The first time a 60-person Canadian professional services firm called me about “an AI knowledge management project,” the operations lead opened with a sentence I have heard four other ways since.
Our best knowledge is locked in three people’s heads and a SharePoint nobody curates, and we are about to lose one of those three people to retirement.
That is the actual problem. Not whether to buy Copilot. Not whether to fine-tune anything. Whether the firm can answer its own questions when the senior staff are not in the room.
Fusion Computing has scoped, deployed, or remediated AI knowledge platforms for Canadian companies between 30 and 200 employees in professional services, construction, light manufacturing, and healthcare-adjacent work. In our practice the pattern repeats closely enough that I can hand you the playbook in the order it actually runs. Read it as a 90-day plan.
Key takeaways
Permissions before knowledge architecture. Microsoft 365 Copilot inherits SharePoint permissions before it inherits anything you build in the knowledge layer, so the pre-Copilot SharePoint audit is the prerequisite cleanup. Residency is the second gate, and it is the one most vendors describe wrongly.
- The 30 to 200 employee Canadian SMB has 3 to 4 high-value knowledge sources. Indexing all of SharePoint on day one is the classic failure.
- A 90-day pilot proves value if you scope it to one workflow, one user group, and one source set.
- Neither PIPEDA nor Quebec Law 25 bans processing outside Canada. Both impose an accountability step instead, and Law 25 section 17 makes that step a written assessment.
- Microsoft documents that Copilot customers outside the European Union may have queries processed in the United States, the EU, or other regions. Checked August 5, 2026.
- Adoption is an operations problem. The post-pilot owner matters more than the model choice.
What “AI knowledge management” actually means for a 30 to 200 person company (a working definition).
According to Microsoft and LinkedIn’s Work Trend Index (2024), 75 percent of knowledge workers already use AI at work and the heaviest users save over 30 minutes a day. That edition is two years old, and the number has moved one way since. The live question for a Canadian firm is whether that AI is grounded in your business or the public web.
The operations lead at that 60-person firm never said “retrieval-augmented generation” on our first call, and she was right not to. Vendors describe this category as a stack: connectors, an embedding step, a vector index, a language model, a question box. Accurate, and useless, because nobody runs a project that way.
My working definition is shorter, and I use it on every engagement between 30 and 200 seats. It is a system that lets a new hire ask a question and get the answer one of your 3 senior staff would give, with the source cited, and without interrupting that person. Anything else is a search box with an architecture diagram attached.
Where the knowledge actually lives (and the trap of indexing everything).
According to Lewis et al., the paper that named retrieval-augmented generation (2020), grounding an LLM in a focused, curated index beats unbounded retrieval on knowledge-intensive tasks. We unpacked the mechanics in our explainer on RAG for business. For an SMB the practical reading is blunt: smaller and curated beats larger and noisy.
The week-one question I always ask.
In week one I ask the operations team one question. Where does someone go today, in priority order, when they cannot find an answer? In our practice the list never comes out as “SharePoint.” It comes out as a person, a Microsoft Teams channel, one folder a single owner maintains, and a spreadsheet on somebody’s desktop.
The three or four sources that matter.
Useful institutional knowledge in a Canadian SMB concentrates in 3 to 4 places. The operations playbook, usually a SharePoint folder one person maintains. The ticket, matter, or job history inside your line-of-business system. The policy and HR repository. The proposals and scopes archive. Everything else is noise you pay to embed.
I watched a 110-person engineering firm spend six weeks indexing every byte of its SharePoint estate. The assistant then quoted policies rescinded in 2019, with citations. The fix was deleting two thirds of the index and pointing it at the four folders the partners actually maintain. Adoption tripled in ten days.
The 90-day playbook (Days 0 to 90).
A scoped 90-day rollout should deliver one thing: a permission-aware assistant grounded in 3 to 4 sources, used by one defined group, with audit logging, a documented processing location, and a measured baseline. According to Microsoft Purview documentation (2026), prompts and responses from supported AI apps are captured in the tenant audit log, which is where that evidence comes from.
| Phase. | Deliverable. | Who is involved. | Success metric. |
|---|---|---|---|
| Days 0 to 14. Audit and scope. |
Source inventory, permission map, use-case shortlist, residency and compliance scope, success criteria. | Ops lead, IT lead, one senior subject expert, MSP architect. | Signed scope: 1 user group, 3 to 4 sources, 5 priority questions. |
| Days 15 to 30. Connect high-value sources. |
Permission-aware connectors live, index built, audit logging on, processing location documented. | MSP, IT lead, source owners (one per source). | 5 priority questions answered correctly with sources cited. 0 permission leaks in the red-team test. |
| Days 31 to 60. First workflows live. |
Pilot group of 5 to 15 users onboarded, 2 named workflows in daily use, weekly tuning loop. | Pilot user group, MSP, internal champion. | At least 60% weekly active users in the pilot group. At least 65% of repeat questions answered without escalation. |
| Days 61 to 90. Tune and expand. |
Retrieval tuning, prompt library v1, second user group onboarded, governance cadence written. | Internal champion, MSP, HR or compliance lead. | Time-saved baseline measured. Documented owner. 12-month roadmap signed. |
In my experience the phases that get cut are Days 0 to 14 and Days 61 to 90. Skip the audit and you index everything, including the salary spreadsheet a manager left in the wrong folder. Skip the tuning and you ship something that works for two weeks and then drifts.
What Law 25 and PIPEDA actually require: the residency checklist.
According to the Office of the Privacy Commissioner of Canada’s cross-border processing guidelines, PIPEDA Principle 4.1.3 permits transferring personal information to a third party for processing, including one outside Canada. The organization must use contractual or other means to give that information a comparable level of protection. Accountability travels with the data, and it does not stop at the border.
The claim most vendors get wrong
Canadian data residency is not a legal requirement under PIPEDA. It is a control you choose because it makes the accountability obligation cheap to satisfy and easy to evidence. Selling it as a statutory mandate is how buyers end up paying for the wrong architecture.
Quebec is where the obligation gets teeth. Section 17 of the province’s Act respecting the protection of personal information in the private sector, as amended by Law 25, requires a privacy impact assessment before the information leaves Quebec. It may go only if that assessment finds adequate protection, and the transfer needs a written agreement.
Section 17 also covers entrusting an outside party with collecting, using or keeping that information on your behalf. Sending prompts and source documents to a model hosted elsewhere is exactly that. The Commission d’accès à l’information supervises it, and a client’s counsel will ask for the assessment by name.
Now the vendor half, checked August 5, 2026. Microsoft’s data residency documentation lists Canada as a Local Region Geography, so tenant data at rest can be committed here. Copilot query processing is a separate question, and the answer is different.
The four-item residency checklist.
- Distinguish data at rest from query processing. Committing SharePoint and Exchange data to Canada says nothing about where a prompt gets evaluated.
- Write the processing location into the scope document. Day 14, not month six. Retrofitting it is a rebuild.
- Run the Law 25 assessment if any Quebec personal information is in the index. Keep it with the written agreement, filed where compliance can produce it.
- Turn on audit logging before the first pilot user. Prompts and responses in the tenant log are the only evidence you will have when a regulator or insurer asks.
The OPC’s generative AI principles (2023) put the same point plainly: accountability for a decision rests with the organization, not with the system supporting it. If you want this scoped against your own tenant, talk to a CISSP-led engineer → before you sign anything.
Free consumer tiers fail that residency and retention test before the assessment even starts. The vendor terms are broken down in why free AI tools cost more than you think.
Copilot versus a custom knowledge layer: how to choose.
According to Microsoft’s Copilot data, privacy and security documentation (2026), customers outside the European Union may have their queries processed in the US, the EU, or other regions. Calls can route elsewhere again when capacity is tight. Prompts and Microsoft Graph data are not used to train the foundation models behind Copilot.
How I choose, in two lines.
I put those two sentences together and the buying rule falls out. Copilot is the right instrument when the work is in-app drafting and every source already sits inside Microsoft 365. It answers only from content the signed-in user could already open, which is why the permission audit comes first.
A custom knowledge layer earns its cost when answers must cross systems Copilot cannot see together, when a buyer needs provable processing geography, or when audit retention has to exceed the defaults. Both can run side by side, and above roughly 75 seats most Canadian SMBs end up doing exactly that.
A third option sits between them: a scheduled agent that assembles the answer on a cadence instead of on demand. I cover the governance that requires in agents in ChatGPT for work.
I score the two against the actual workload rather than the org chart. The full matrix sits in custom AI platform vs Microsoft 365 Copilot. Want yours scored? Get yours reviewed →.
What this actually looks like when Fusion delivers it.
The architecture under the playbook is what we publish as our custom business AI platform. A private workspace ingests your approved sources, indexes them with permission awareness, runs retrieval through an inference layer whose location is documented, and surfaces answers inside Microsoft 365. One vendor, 1 contract, one security questionnaire.
“The 90-day playbook was the most disciplined IT engagement we have done. Day 1 we scoped 4 question types from real staff. Day 90 the platform was answering them with citations our compliance team accepted. Our average new-hire ramp time on policy questions dropped from 6 weeks to 2.”
VP Operations, 130-person Greater Toronto Area healthcare-services firm. Engagement scoped through the Fusion Computing 90-day playbook, Q1 2026.
The practitioner version, said plainly. Most platforms sold here were built for the United States enterprise and treat processing geography as a toggle. For a Canadian SMB selling into regulated buyers it is the clause a client’s lawyer redlines first.
The before and after, illustrated.
The 60-person firm I opened with is an anonymized illustration, and the figures show the kind of outcome a properly scoped 90 days can produce. Treat them as a target. Before the engagement, 3 senior staff fielded roughly 200 internal questions a week, each costing about 15 minutes of partner time.
By Day 90 the assistant handled an estimated 65% of repeat questions directly, with citations a partner could verify in two clicks. The partners reclaimed an estimated 8 hours a week. The retiring senior’s knowledge went into the index before her last day.
What 30 to 200 person Canadian companies get wrong.
The same operational anti-patterns show up regardless of vertical, and they are operations failures rather than technology failures. I have seen these six often enough to name them. Avoiding any one protects the rollout. Avoiding all six is the difference between a pilot that ships and an 18-month evaluation that does not.
The six anti-patterns, in order.
- Indexing the entire SharePoint estate on day one. The model returns confident answers from documents nobody has maintained since 2019. Scope to 3 to 4 curated sources and earn the right to expand.
- No permission-aware retrieval. If the assistant sees everything a user can open, it will quote a salary memo to the wrong person on a Tuesday. This is week-one work.
- No audit logging. When the first user asks the assistant something embarrassing, you need to know it happened. When a regulator or insurer asks, you need the log.
- Treating it like a chatbot project. Chatbot builds ship an interface and stop. Knowledge work ships an owner. Without an internal champion running a weekly review, retrieval quality drifts inside a quarter.
- No residency or compliance scoping. A Canadian SMB selling into legal, finance, healthcare, or public sector buyers will get a questionnaire asking where the data sits and where prompts are evaluated. Answer both on day one.
- Skipping the readiness review. The most expensive deployments I have seen skipped the 90-minute conversation and started with a tool. That step catches the five issues above before they cost a quarter.
Where to start: the 90-minute readiness review.
The right first step is a structured 90-minute conversation producing a one-page scope: which user group, which sources, which compliance constraints, which metrics. We run it as our AI readiness assessment. Without that artifact the 90 days become guesswork with a deadline attached.
The scope names six things. The pilot group, the 3 to 4 source systems, the permission and processing-location rules, the 5 priority questions, the internal owner, and the metric your operations lead will sign. Book the readiness review → and you will leave with a costed scope rather than a brochure.
From the practitioner.
“In every Canadian SMB deployment between 30 and 200 employees, the knowledge worth capturing lives in three or four sources owned by two or three people. The most common mistake is treating the project as a tooling decision instead of an ownership decision. The firms that succeed pick an internal owner by name before they pick a model. The ones that struggle pick a model and hope an owner emerges.”
Mike Pearlstein, CISSP, MSc AI. CEO, Fusion Computing.
Knowledge management is the long-term program. For the tactical tool that reads across your systems right now, see using ChatGPT agents to distill scattered knowledge across your SMB.
Frequently asked questions
How is this different from a corporate wiki?
A wiki stores knowledge passively and waits for someone to search it. An AI knowledge platform retrieves, synthesizes, and answers in natural language with citations back to the source. The deeper difference is maintenance. Wikis decay because nobody owns curation. A platform with a weekly 30-minute tuning loop gets re-indexed and surfaces stale content instead of hiding it.
Do we have to clean up our SharePoint first?
No, but you do have to scope what gets indexed. None of our clients has arrived with a clean SharePoint estate. Point the platform at the 3 to 4 folders or systems your team actually maintains today, prove value in 90 days, then expand. A wholesale SharePoint cleanup is a 12-month project that blocks every AI deployment waiting on it.
Who maintains it after the 90 days?
A named internal owner runs a weekly 30-minute review of low-confidence answers and source freshness. The MSP runs retrieval tuning and the quarterly governance review. Without that owner the platform drifts inside a quarter. The owner needs to care about answer quality; technical depth is optional.
Does PIPEDA or Quebec Law 25 require our AI data to stay in Canada?
Neither statute bans it. PIPEDA Principle 4.1.3 lets you transfer personal information to a third party for processing, including one outside Canada, provided contractual or other means give it comparable protection. Quebec is stricter. Section 17 of its private-sector privacy Act requires a privacy impact assessment before the information leaves the province, plus a written agreement. Canadian residency is the cheapest way to satisfy both, not a mandate in either.
Can we use this with Microsoft 365 Copilot, or is it a replacement?
Complementary. Copilot answers from tenant content using Microsoft Graph permissions, so it is strong on in-app drafting and weak on anything outside the tenant. A custom layer answers from sources Copilot does not see well: chat threads, structured policy databases, third-party PDFs, and content where oversharing risk has not been audited. Above roughly 75 seats most Canadian SMBs run both.
Where are our prompts actually processed?
Microsoft’s privacy page, read on August 5, 2026, says customers outside the European Union may have queries processed in the US, the EU, or other regions. Tenant data at rest is a separate commitment, and Canada is available as a Local Region Geography. On a custom platform you choose the inference region and write it into the contract.
What does the 90-day rollout cost a 50 to 150 person Canadian SMB?
The structure is predictable even before the number is. I price it in three parts. The readiness assessment is a one-time fee. The 90-day deployment is fixed-fee against a defined user group and source set. Ongoing platform cost is per user per month, covering inference, index storage, Canadian-region hosting, and the change protocol. Complexity and user count move the number, which is why the readiness review comes first.
Does the platform handle French content for our Quebec operations?
Yes. Current multilingual embedding models place French and English content in the same vector space, so a French question retrieves an English document and the reverse. The inference layer answers in the question language. For Quebec operations we default it to French and keep content inside the region recorded in the section 17 assessment.
Ready to scope your 90 days?
If your operations team already says the best knowledge in the company sits in three people’s heads, the next step is the 90-minute review, not a comparison spreadsheet. A CISSP-led engineer produces the one-page scope, and you either deploy it with us or run it yourself.
