What AI actually does for a small business, according to the data rather than the pitch

The short version

• 19.2% of Canadian businesses used AI in 2026, tripled from two years earlier. In construction it is 9.2%.
• Statistics Canada found no statistically significant direct link between AI adoption and productivity once complementary investments were accounted for.
• In Microsoft’s own trial of its own product, only about 40% of people given a licence used it regularly.
• The clearest measured wins are narrow: clinical documentation, and support work done by less experienced staff.
• AI has already changed one thing decisively, and it is not on the productivity side. It made phishing far more effective.

The adoption number depends entirely on the question

Four credible Canadian sources give four different AI adoption rates, and it is worth knowing why before you quote one at a board meeting.

These are not contradictory. The 45% counts somebody in the office using ChatGPT to draft an email. The 19.2% counts AI embedded in how the product or service actually gets made. Anyone quoting a single number without saying which question was asked is being careless.

The sector split in the Statistics Canada figures is the part worth knowing locally. Information and cultural industries sit at 42.3%. Professional, scientific and technical services at 32.4%. Construction at 9.2%. Wholesale trade at 7.9%.

If you run a trades business in Durham and feel behind, you are not. You are in the sector where almost nobody has adopted anything.

One caution: Statistics Canada’s published analysis does not break out health care, transportation and warehousing, retail, or manufacturing, and does not separate the 5 to 19 and 20 to 99 employee bands. If you see a confident adoption figure for Canadian clinics or warehouses, ask where it came from.

The productivity finding that nobody quotes

Statistics Canada’s April 2026 study is the most useful thing published on this subject in Canada, and the least circulated.

The raw comparison showed AI adopters with 16.8% higher productivity. Controlling for how productive those firms already were before adopting brought it to 10.2%. Adding controls for the other things adopters tend to have, meaning research spending, cloud systems, data analytics, robotics and ICT training, brought it to 5.1% and made it statistically insignificant.

The authors’ conclusion: no statistically significant direct association between AI adoption and productivity.

Their explanation is reasonable, and worth taking seriously rather than dismissing. Gains take time and depend on organisational change and complementary investment. AI is not doing nothing. It is doing very little on its own, in a company that has not already sorted out its data, its processes and its training.

Independent research points the same direction. A Danish study of roughly 25,000 workers across 11 occupations found AI chatbots saved 2.8% of total work hours on average, with “no significant impact on earnings or recorded hours in any occupation.” Time saved did not become money.

And the finding I think about most: METR ran a randomised trial with experienced developers on real work in July 2025. They were 19% slower with AI tools. Afterwards, they believed AI had made them 20% faster.

That gap between felt and measured is the reason to be careful with anyone’s testimonial, including your own team’s.

Where it demonstrably works

Two areas have real evidence behind them.

Clinical documentation. This is the strongest Canadian evidence in the whole subject and it is directly relevant to a Durham clinic. Canada Health Infoway’s AI Scribe Program, launched June 2025, enrolled over 12,000 primary care clinicians and describes itself as the largest national implementation and evaluation of AI scribes in primary care conducted globally. Reported results: more than an hour saved per week, around 70% reduced administrative burden.

An earlier Ontario pilot of 150 clinicians reported 3 to 4 hours a week. The national number is lower, from a much larger sample. Use the conservative one. In Ontario this is PHIPA territory and the program uses scribes only with patient consent during the visit.

Support work, for less experienced staff. A peer-reviewed study of 5,172 support agents and 3 million chats, published in the Quarterly Journal of Economics in April 2025, found 15% more issues resolved per hour overall. The distribution matters more than the average. Novices gained around 30%. The most experienced workers saw small speed gains and small quality declines.

The practical reading: AI raises the floor, not the ceiling. It is most useful where you have junior or high-turnover staff. Applied to your best person, it may do nothing or slightly worse than nothing.

Copilot: what is included and what is not

Microsoft restructured small business licensing on 1 July 2026, bundling Copilot into the main Business SKUs rather than selling it as a separate add-on. This has produced a lot of confusion about what you now have.

The distinction that matters:

Copilot Chat is included with any Microsoft 365 Business subscription. It is grounded in the web only. It cannot see your files, your email or your Teams chats. You can paste content into it. It has enterprise data protection.

Microsoft 365 Copilot Business is the paid tier. That is what puts Copilot inside Word, Excel, PowerPoint and Outlook and grounds it in your actual work data. It is capped at 300 seats, annual commitment only, no month to month.

So “Copilot is now free with Microsoft 365” is misleading. The free part is a web chatbot with your company’s name on the login.

On price, Microsoft’s two Canadian pages disagree. One lists Business Standard with Copilot at CAD $31.90 per user per month annually, the other at $29.88. Premium shows $43.40 and $43.39. Probably promotional versus list pricing. Treat it as roughly $30 and confirm the actual number with your reseller rather than either page.

One thing to budget for that is easy to miss: autonomous agents and multi-step agentic workloads consume Copilot Credits, billed separately at around US$0.01 per credit. They are not included in the subscription.

And the security point that matters more than the price. Copilot inherits your existing Microsoft 365 permissions. If SharePoint sharing has drifted over the years, and it usually has, Copilot will cheerfully surface documents to staff who were never meant to reach them. It does not create the exposure. It makes an existing one searchable in plain English. Fixing permissions before switching it on is not optional.

Then there is the adoption number from Microsoft’s own randomised trial of 6,000 workers across 56 firms: about 30 minutes less per week reading email, documents completed 12% faster, and only around 40% of people given a licence using it regularly. Six in ten licences went largely unused in the vendor’s own best case.

The one place AI has clearly changed the game

Everything above is a story of modest, uncertain gains. This part is not.

Microsoft’s Digital Defense Report, published October 2025, measured AI-automated phishing achieving a 54% click-through rate against 12% for standard phishing. That is 4.5 times more effective. The same report estimates AI automation could raise phishing profitability by up to 50 times.

IBM and Ponemon’s 2026 breach study, published 29 July 2026, found one in four malicious breaches were AI-enabled, up 56% year over year, and that AI-enabled breaches cost around $6 million on average against a $4.99 million global average.

The Canadian Centre for Cyber Security issued a standalone statement on frontier AI models on 24 June 2026 warning that attackers can now find and exploit vulnerabilities much faster than before, compressing response windows from days to hours, and naming convincing phishing, voice scams and deepfakes at scale as a specific vector.

Canadians reported losing at least $704 million to fraud in 2025, a record, and the Competition Bureau notes fewer than one in ten frauds get reported at all.

The best-documented business deepfake case remains Arup’s Hong Kong office in February 2024, where a finance employee was deceived by a video call in which the CFO and colleagues were all synthetic. US$25 million. I could not find a single publicly documented Canadian business that has lost money this way, which is worth stating plainly rather than implying otherwise.

The defence has not changed. It is the same boring set: MFA everywhere, a verification step for payment changes that does not rely on email, and a culture where someone can question a request from the boss without it being awkward. The grammar mistakes that used to give phishing away are gone. Process is what is left.

Putting company data into consumer AI tools

The Canadian Centre for Cyber Security’s guidance on generative AI, ITSAP.00.041, updated December 2025, is one sentence long where it counts:

Two facts give that weight. IBM found shadow AI added roughly US$670,000 to the average cost of a breach, and 63% of organisations have no AI governance policy at all.

And a concrete illustration that “delete” is not a guarantee. During litigation between the New York Times and OpenAI, a May 2025 court order required OpenAI to preserve output log data that would otherwise have been deleted. That obligation was terminated in October 2025, but logs saved during it remain. Somebody else’s lawsuit froze a lot of people’s chat history.

The practical answer is not to ban the tools. Staff will use them anyway. Put people on a business workspace where the default is that your data is not used for training, write one page saying what must never be pasted in, and move on.

On regulation, one correction worth making because it circulates constantly: AIDA is not law. Bill C-27, which contained it, died when Parliament prorogued in January 2025 and has not been reintroduced. What actually governs an Ontario business using AI is PIPEDA for customer data, PHIPA if you are a health information custodian, and human rights law, which does not care whether a discriminatory decision came from a person or an algorithm.

Canada launched a national AI strategy called AI for All on 4 June 2026, targeting an increase in adoption from 12% to 60% by 2034 and including a commitment to help small and medium businesses adopt AI. Legislation was promised without deadlines.

What this means for your building

For a clinic in Whitby, the scribe evidence is real and the pathway exists. Start there, with consent handling sorted first.

For a warehouse in Courtice, the honest answer is that AI video analytics is the one AI system you are likely to buy, and what it reliably detects is narrower than the brochure suggests. Everything else is a nice-to-have.

For a contractor in Port Perry with eight people in the field, the highest-value AI in your business right now is probably a scheduling and job management system that has nothing to do with AI at all. Getting off paper beats adding a chatbot to paper.

For everyone, the phishing change already happened and does not care whether you adopt anything.

What to do about it

1. Write one page on what staff may and may not put into AI tools. Client names, health information, financial records, anything under NDA. Ten minutes, and it puts you ahead of the 63% with nothing.
2. Move anyone using AI regularly onto a business account rather than a personal one. The data handling defaults are different.
3. Fix your Microsoft 365 sharing permissions before turning on Copilot, not after. Copilot makes existing over-sharing findable.
4. Add a verification step for payment and banking changes that does not run over email or a single phone call. This is the control that stops the expensive version of AI fraud.
5. If you buy Copilot, license a small group first and measure something real. Not how it feels. Microsoft’s own trial saw 60% non-adoption.
6. If you are in a sector with real evidence, such as clinical documentation, follow the evidence. If you are not, it is reasonable to wait. Construction is at 9.2% adoption and is not visibly suffering for it.

The security side of this is what our cybersecurity work covers. The permissions and tenant side sits with Microsoft 365.