AI & Machine Learning Company in Ottawa

On federal AI work in Ottawa the Algorithmic Impact Assessment level does more to a budget than the model architecture does. A scoped AI proof of concept runs at Ottawa federal rates. A custom production ML model (benefits fraud scoring, document classification for ATIP, supply chain forecasting, merchant recommendation) is the common middle. Full production AI systems with RAG over departmental document repositories, multiple models, fine-tuning, and enterprise integration with GC-side identity (GCKey, GCCF, MyGCKey) sit above it. Scope drivers include data audit, a baseline model, a hosted demo, and a draft Algorithmic Impact Assessment. Federal engagements trend higher than private sector because the compliance and procurement overhead is real, security clearances cost time, and AIA and SA&A documentation is non-negotiable. We give fixed-fee proposals against PSPC and SSC standing offer pricing structures rather than open T&M estimates.

The Directive on Automated Decision-Making is mandatory for any federal department using automation to support administrative decisions about Canadians or foreign nationals. It requires an Algorithmic Impact Assessment scoring the system on a four-level impact scale (Level I low through Level IV very high), proportional transparency, human oversight, quality assurance, and recourse mechanisms. Our discovery phase runs the AIA against the Treasury Board's published questionnaire and arrives at a defensible impact level. We then build to that level — Level III and IV systems get peer review of the model by qualified experts, public notice in plain language, employee training, and recourse processes wired into the application. We deliver the completed AIA in the format Treasury Board publishes on the Open Government portal, so departmental publication is a copy-paste rather than a rewrite. We have walked AIAs through the Treasury Board Secretariat review channel and know which questions reviewers actually push back on.

Yes. Our delivery model includes Reliability-status cleared engineers for Protected A and B engagements, and we engage cleared subcontractors through Public Services and Procurement Canada's Industrial Security Program for Secret-level work when an engagement requires it. We are familiar with the Contract Security Manual, the Document Safeguarding Capability requirement, and the controlled goods program where defence work touches export-controlled technical data. For cloud deployments, Protected B systems run inside the Canadian Centre for Cyber Security's accredited medium-cloud configurations on AWS ca-central-1, Azure Canada Central, or GCP montreal-toronto regions, with SSC Cloud Brokering Service involvement where applicable. We deliver ITSG-33 control selection, tailoring rationale, and SA&A package contributions that departmental security officers can submit through their normal authorisation workflow.

The Artificial Intelligence and Data Act (AIDA), drafted in Ottawa as the third component of Bill C-27, will be Canada's first horizontal AI law once enacted. It classifies systems as high-impact (employment decisions, credit and lending, healthcare, law enforcement, content moderation at scale, biometrics, services affecting access to essential services) and imposes obligations around risk assessment, bias mitigation, transparency, human oversight, and incident reporting to the Minister of Innovation, Science and Industry. Federal departments and Crown corporations already procure to AIDA-style expectations because Treasury Board, the Office of the Privacy Commissioner, and the Departmental Audit Committee community have telegraphed convergence. Our builds ship AIDA-aligned governance regardless of enactment status: model cards, bias audits, monitoring plans, human-oversight workflows, and incident response playbooks ready for the AI and Data Commissioner's eventual reporting interface.

Yes, and this is one of our most active engagement types. Shopify's Elgin Street headquarters and its AI-first mandate under Tobi Lütke have raised expectations across the entire Ottawa merchant ecosystem — Shopify Plus brands now expect Sidekick-grade conversational interfaces, semantic search, ML-driven recommendation, abandoned-cart recovery, fraud scoring at checkout, and predictive inventory across multi-location operations. We build custom apps and headless integrations that layer on top of Shopify's native AI surfaces (Shopify Magic, Sidekick, semantic search, automated bulk editing) and add merchant-specific ML where the platform's defaults are not enough. Engagements typically use the Shopify Admin API, Storefront API, and Function API alongside our model layer, with deployment to Heroku, Vercel, or AWS depending on the merchant's existing stack. We do not need clearances for this work, but we apply the same MLOps discipline that federal work has trained into us.

We default to AWS ca-central-1 (Montreal), Azure Canada Central (Toronto), and GCP northamerica-northeast1 (Montreal) or northamerica-northeast2 (Toronto) for storage, training, and inference. Protected A workloads run in any Canadian region with standard cloud security controls. Protected B workloads run inside the CCCS-accredited medium-cloud configurations of those providers, with SSC Cloud Brokering Service involvement for federal customers. Protected C and above stay on premises or inside SSC's secure facilities, full stop — no commercial cloud provider currently meets Protected C in Canada. For LLMs that must stay in Canada we use Cohere's Canadian endpoints or self-host Llama 3 and Mistral on Canadian GPU instances. Cross-border processing is acceptable only when a Privacy Impact Assessment and a Threat and Risk Assessment sign off, typically for non-sensitive internal tooling. Every engagement documents residency in the model card, the data processing agreement, and the ITSG-33 SA&A package.

A typical federal department AI build takes eighteen to twenty-eight weeks from kickoff to authority-to-operate, with the variance driven almost entirely by the AIA impact level and the SA&A track rather than the modelling itself. Week 1 to 4 is data audit, AIA scoring, ITSG-33 control selection, and security categorisation. Week 5 to 14 is modelling, iteration, bias review, and explainability artefact production. Week 15 to 22 is MLOps, monitoring, shadow deployment, peer review for Level III and IV systems, and departmental Security Assessment and Authorization. Week 23 onward is gradual rollout with human-in-the-loop oversight and recourse channels live. Crown corporation and Shopify-ecosystem timelines compress to twelve to eighteen weeks because procurement and SA&A overhead is lighter. We have shipped to both cadences inside Ottawa-headquartered organisations.

Most custom AI work qualifies for the Scientific Research and Experimental Development (SR&ED) program, which returns 35 percent refundable credit on eligible R&D spend for Canadian-controlled private corporations (CCPCs) up to the $3M expenditure limit, and 15 percent non-refundable above that. Eligible activity generally includes novel modelling, architecture experimentation, algorithmic uncertainty, and systematic investigation, not routine integration of off-the-shelf APIs. We deliver time-tracked logs, technical narratives, experiment histories, and failed-hypothesis documentation aligned with the CRA T661 form. Ottawa CCPCs in the Kanata-North cluster commonly stack SR&ED with the National Research Council's IRAP funding for AI commercialisation. Federal departments cannot claim SR&ED, but the Crown corporations and private contractors building alongside them often can on their own R&D contributions. Final eligibility sits with your SR&ED consultant and the CRA.