With AI tools, one person can take on consulting work, produce designs, write code, even launch a SaaS product. There is no legal department and no partner, so when something goes wrong, the contracts you signed are most of what protects you. These four are the gaps we see most often in Ontario one-person companies.
1. The Client Agreement: MSA Plus SOW
A common structure is a master services agreement (MSA) that sets the general terms on payment, intellectual property, confidentiality and liability, plus a statement of work (SOW) for each project describing the deliverables, timing and price. New projects then only need a new SOW.
One-person companies usually get hurt in the same few places. Payment terms should cover the deposit, milestones, interest on late payment, and whether you can suspend work when invoices go unpaid. Acceptance needs criteria and a deadline, with silence past the deadline treated as acceptance. Requests outside the SOW need a pricing mechanism, or you end up doing them for free. And liability should be capped, typically at fees paid, with lost profits and other indirect losses excluded.
A liability cap only helps if it holds up. In Tercon Contractors v. British Columbia, 2010 SCC 4, the Supreme Court set out the framework for reviewing exclusion clauses: does the clause, properly interpreted, apply to the situation; was it unconscionable when the contract was made; and is there an overriding public policy reason not to enforce it. Vague wording can fail at the first step.
2. Who Owns AI-Generated Work?
This is the least settled area. Under s. 13(1) of the Copyright Act, the author of a work is the first owner of its copyright, and CCH Canadian v. Law Society of Upper Canada, 2004 SCC 13 requires an exercise of skill and judgment for originality. No Canadian court has yet decided whether purely AI-generated content has an author or attracts copyright.
In 2021 the Canadian Intellectual Property Office registered a work (SURYAST) listing an AI system as co-author. CIPPIC, a public-interest clinic, has applied to the Federal Court to expunge it (T-1717-24); no hearing or decision yet. The federal government's February 2025 consultation report found that most stakeholders think only AI content with sufficient human contribution should be protected, but the legislation has not changed.
What this means for your contracts:
- Don't warrant that the deliverables carry full copyright. A safer approach is to assign whatever rights you hold in them and disclose which parts involved AI tools;
- If the client wants originality or non-infringement warranties, narrow them and tie them to your liability cap;
- Read the current terms of the AI tools you use: who owns output, whether inputs are used for training, and whether client confidential information may be processed. These vary by product and plan, and they change.
3. Contractor and Freelancer Agreements
Many one-person companies subcontract part of the work and assume that paying for it means owning it. Under s. 13(3) of the Copyright Act, an employer owns work an employee creates in the course of employment, but an independent contractor is not an employee, and copyright stays with the contractor unless it is assigned in writing and signed by the owner (s. 13(4)). Moral rights cannot be assigned, only waived (s. 14.1(2)), so the agreement should include a waiver too.
If your contractor also uses AI tools, the agreement should say whether your clients' information may be entered into them.
4. SaaS and AI Tools: Terms of Service and Privacy
Terms of service
In Rudder v. Microsoft, 1999 CanLII 14923 (ON SC), an Ontario court enforced click-through online terms. But terms can go too far: in Uber Technologies v. Heller, 2020 SCC 16, the Supreme Court held the arbitration clause in Uber's standard-form contract unconscionable and invalid. Make the terms visible, require an active click to accept, and keep them reasonable.
Privacy
A business in Ontario that collects personal information in commercial activity is generally governed by the federal PIPEDA. Clause 4.1.3 of its Schedule 1 says you remain responsible for personal information transferred to a third party for processing, and must use contractual or other means to ensure comparable protection. Sending customer data to an AI provider's API falls squarely within it. You should:
- Disclose in your privacy policy which third-party services process data and why;
- Check the AI provider's data processing terms, including where data is stored and whether it is used for training;
- Keep identifiable personal information out of prompts where you can.
That last point tracks the generative AI principles Canada's privacy regulators issued in December 2023: use anonymized or de-identified information in prompts where possible, and enter personal or confidential information only where authorized. The principles also stress that accountability for decisions stays with the organization, not the automated system.
The federal government introduced Bill C-36 on June 15, 2026 to replace PIPEDA's privacy provisions. It has not passed, so PIPEDA still applies.
A Short Checklist
- An MSA with every client and an SOW for every project;
- Payment, acceptance, change requests and a liability cap spelled out;
- Honest disclosure of AI use in deliverables, with no copyright warranty you can't back up;
- A signed written copyright assignment and moral rights waiver from every contractor;
- Click-through terms of service and a privacy policy for any SaaS product;
- The current terms of every AI tool you use, read and saved.
Bottom Line
Running a business alone means nobody else absorbs the hit when something goes wrong. Your contracts don't need to be long, but payment, IP, liability and data need to be right. Templates are a starting point; have a lawyer adapt them to how your business actually works, especially the AI ownership terms, since that area of law is still moving.
Frequently Asked Questions
Can I promise my client they own the copyright in AI-assisted work?
It is unwise to. Canadian courts have not decided whether purely AI-generated content is protected by copyright, and the federal consultation found most stakeholders think sufficient human contribution is needed. The safer approach is to assign whatever rights you hold and disclose which parts involved AI tools.
If I pay a freelancer for design or code, do I own the copyright?
Not automatically. Under the Copyright Act, copyright in work by an independent contractor stays with the contractor unless assigned in writing and signed by them. Moral rights cannot be assigned, only waived, so the agreement also needs a waiver.
What should I watch for when entering client data into AI tools?
Under PIPEDA, you remain responsible for personal information you pass to a third party for processing and must use contractual means to ensure comparable protection. Disclose it in your privacy policy, check the AI provider's data processing terms, and use anonymized or de-identified information where possible.
Sources
- Copyright Act, ss. 13, 14.1
- PIPEDA, Schedule 1, clause 4.1.3
- Office of the Privacy Commissioner of Canada: Principles for generative AI (December 2023)
- ISED: Consultation on Copyright in the Age of Generative AI, What We Heard Report (February 2025)
- CIPPIC v. Sahni (Federal Court T-1717-24) case page
- Bill C-36 (LEGISinfo)
- Tercon Contractors v. British Columbia, 2010 SCC 4; CCH Canadian v. LSUC, 2004 SCC 13; Uber v. Heller, 2020 SCC 16; Rudder v. Microsoft, 1999 CanLII 14923
This article provides general information about the law as of the date of publication and is not legal advice. It does not create a solicitor-client relationship. For tax or IP registration questions, please consult the appropriate professional.
