Most mid-sized employers adopting AI hit the same wall within a year. Someone asks where the data goes, who can see it and what happens if the vendor changes terms. The answer is rarely in a contract. It is in whether you have the right people in the building.
Control over AI is often framed as a cloud or legal issue. In practice it is a staffing issue. Policies do not enforce themselves, and a vendor cannot hold your accountability for you.
What control actually covers
Keeping your data in one country is only one piece. An employer in Canada or the US should be able to answer four questions:
- Which laws apply to the data we feed these tools, and in which provinces or states?
- Who inside the company can approve, change or switch off a model?
- Could we move to another provider in a reasonable time if we had to?
- Who owns what the system learns from our records, customers and processes?
If nobody can answer these in a sentence, the gap is a role, not a document.
Why it differs by market
Canadian employers deal with PIPEDA and provincial privacy law, with Quebec's rules being the strictest. Public bodies and some health and education employers also face rules on where data may be stored. US employers face a patchwork of state privacy laws plus sector rules in health and finance. A company operating on both sides of the border has to meet both sets, and often cannot use one template.
The US National Institute of Standards and Technology publishes an AI Risk Management Framework that many US and Canadian firms use as a common reference. It is a sensible starting point for defining roles, because it describes the work that has to be done, not just the principles.
The roles that make control real
You do not need a large AI team. You do need clear ownership. Typical hires and assignments for a company of 100 to 1,000 people:
- Data engineer or analytics engineer. Knows where data sits, how it moves and what can be restricted. Without this person, nobody can prove where information went.
- AI or machine learning engineer. Evaluates models, tests outputs and can swap one provider for another without rebuilding everything.
- Security and access lead. Sets who sees what, and reviews the vendors' access as well as your own staff's.
- Compliance or privacy specialist. Often part-time or contract. Translates provincial, state and sector rules into working practice.
- Operations owner. A process leader who decides where AI is allowed to touch real work and signs off on the controls around it.
In finance, add someone who can explain automated decisions to an auditor. In manufacturing, add someone who understands what happens when a model touches quality records or scheduling data.
Where employers go wrong
Three patterns come up again and again.
Handing it all to IT. IT can configure tools, but it cannot decide what the business is willing to risk. The operations or finance leader who owns the process has to be in the room.
Buying a platform and skipping the people. A good vendor reduces the workload. It does not remove the need for someone on your side who understands what the vendor is doing with your data.
Hiring one hero. A single AI hire who holds all the knowledge is a retention risk and a control risk. If that person leaves, so does your oversight. Document decisions and keep a second person close to the work.
Build, borrow or contract
Not every control role has to be a permanent hire. A practical split:
- Permanent: the data engineer and the operations owner. These are ongoing responsibilities.
- Contract: privacy review, a security assessment or a model evaluation before launch. These are bounded projects with a clear end.
- Upskill: existing analysts and process leads who already know your business. Teaching them the controls is often faster than hiring someone who has to learn your operations.
Contract specialists are also useful when rules change. A short engagement to review your setup after a new law takes effect costs far less than a full-time role you do not yet need.
Questions to ask in interviews
When you hire for any of these roles, test for judgment, not tool names:
- Describe a time you stopped or changed an AI or data project because of a risk. What did you do?
- If we had to change providers in 90 days, what would break first?
- How would you explain to an auditor or a customer how this system reached a decision?
Candidates who have actually carried this responsibility answer with specifics. Candidates who have only read about it answer with vocabulary.
What to do next
Write down the four questions above and put a name beside each. Every blank is a role to assign, a contractor to bring in or a hire to plan. Do that before the next AI tool is approved, not after.
If you need a data, AI, security or compliance person and want help finding the right level for your size, a Traverse recruiter can help.