Castlemain
AI Policy

Our commitment

At Castlemain we deliver noticing and claimant support programs that directly affect class members, First Nations, Metis, and Inuit communities, so we hold our use of AI to a very high standard of care. This policy provides an overview of how we use AI responsibly.

It applies to everyone who works on Castlemain programs or with Castlemain program data. Court orders, settlement agreements, client contracts, and client-approved program protocols always come first. Where any of them sets a stricter rule, we follow it.

We never use personal or confidential class member or community information in our AI and where we do choose to use it, people remain responsible for every outcome.

Our guiding principle

Deciding what to include, leave out, and emphasize takes human judgement, and no tool replaces that. Our commitments include:

  • Privacy first. Personal and claimant information never goes into AI tools.
  • Human accountability. A named person is responsible for anything we produce with AI, and outputs that influence decisions or have a higher level of risk have extra reviews built in. AI is never used to deceive, exploit, or harm.
  • Respect for Indigenous data sovereignty. Indigenous data belongs to the Nation or community it comes from. We follow OCAP® and the CARE Principles, consistent with UNDRIP and the First Nations Data Governance Strategy. Communities decide how their data is collected, used, and shared.
  • Accuracy you can trust. AI output is logged and verified before anyone relies on it.
  • Transparency. We disclose our use of AI generally and tell people when AI has made a meaningful contribution to work they rely on.

Accuracy, cultural safety, and trauma-informed plain-language communication are vital elements of our work and carry the highest standard for review, verification, and accountability.

How we use AI

We use AI as an assistant, not a decisionmaker. Typical uses include:

  • Drafting and refining general content, outlines, and plans
  • Researching and summarizing public information
  • Testing ideas and supporting analysis
  • Answering questions from approved, controlled data sources, through tools we have assessed and approved

What we do not do with AI:

  • Send anything to a client, claimant, or the public that has not gone through our full verification process.
  • Use AI output as a translation to Indigenous languages. Qualified, program-approved translators produce or validate that content.
  • Create misleading or deceptive content, such as deepfakes or false endorsements.
  • Use AI on client or program work where the contract, program protocols, or the client’s wishes do not allow it.
  • Get around our safeguards, including using unapproved tools, personal accounts, or workarounds to process restricted information.
  • Deceive, pressure, or manipulate claimants, communities, clients, or colleagues.
  • Impersonate a real person or organization, or create false records, documents, evidence, or claims.
  • Monitor, profile, or target individuals or communities.
  • Produce content that is discriminatory, harassing or harmful, or that misrepresents Indigenous peoples, cultures, or communities.

Deliberate misuse is a serious breach of this policy. It may lead to disciplinary action up to and including termination and referral to authorities where the law requires it.

Protecting privacy and data

Claimant and personal information never enter an AI tool. We sort information into categories that set what may be used with AI.

Our other safeguards include:

  • Approved, managed tools only – We use enterprise platforms that do not train public models on our data and that encrypt data in transit and at rest. We do not use free or consumer AI tools for work.
  • Training – Staff are trained on responsible use of AI, internal policy and guidelines, client and program requirements, and verification and disclosure requirements.
  • Data residency – Where a program requires data to stay in Canada, we use only platforms and configurations confirmed to meet that requirement.
  • Secure access – Work accounts use company credentials and multi-factor authentication, and access is never shared.
  • Secure storage – AI outputs are saved only in approved program repositories and follow program auditing, retention, and disposal schedules.

Indigenous data sovereignty

Indigenous data is a matter of collective governance, not only individual privacy. It belongs to the Nation or community it comes from. We apply the OCAP® principles (ownership, control, access, and possession) and the CARE principles for Indigenous data governance in our program delivery.

Governance and approval

Every AI tool and application is assessed before use. Our team reviews each new tool or uses for privacy, security, data residency and risk. Program use also requires confirmation that the client contract and program protocols allow it, and client approval where required.

If something goes wrong

We regularly audit AI use for alignment with policy, guidelines, and protocols. If restricted information may have entered an AI tool, even by accident, the tool is stopped and the incident is reported right away. We contain it with our IT and cybersecurity teams and follow the client-approved incident protocol for the program. Where a privacy breach creates a real risk of significant harm, we notify affected individuals and the Office of the Privacy Commissioner of Canada and meet any provincial obligations.

Keeping this policy current

AI tools and obligations change quickly, so we review this policy and our supporting guidance regularly. Feedback from colleagues, clients, and communities shapes each update. Staff receive training and guidance on approved tools, and tool use is monitored to confirm these rules are followed.

Contact us

Questions about how we use AI can be sent to privacy@castlemain.com.