Based here. Same time zone.
This is home. Central Time, same-day availability, and no travel line on the invoice for a first conversation. For a governance question that usually starts with someone quietly asking whether a system should have been deployed at all, being in the room is worth more than a calendar invite.
FIPPA, PHIA, and the federal Directive.
Manitoba public bodies answer to the Freedom of Information and Protection of Privacy Act, in force since 4 May 1998, which gives a right of access to records held by public bodies and regulates how those bodies manage personal information. The definition of a public body is broad: departments, Crown corporations, regional health authorities, municipalities and northern community councils all sit inside it, with the Manitoba Ombudsman receiving complaints.
Health information is separate. The Personal Health Information Act gives individuals a right of access to their own personal health information held by trustees, which is the instrument that actually binds a hospital or a regional health authority deploying a clinical or administrative model.
Federal institutions operating here are governed by a different and more AI-specific instrument. The Treasury Board Directive on Automated Decision-Making applies to any automated decision system in production used to make an administrative decision about a client, and it requires an Algorithmic Impact Assessment completed, approved and published on the Open Government Portal before the system goes into production. Recent amendments moved publication ahead of launch, made peer review findings public, and strengthened the requirements on bias testing, data governance and explanation.
Where the gap usually is.
What I bring to it.
A mapping from these instruments to the MESA Framework and to ISO/IEC 42001 and the NIST AI Risk Management Framework, so a department or a health organisation can put AI behind an administrative decision without losing the ability to account for it. The free Readiness Self-Assessment is a reasonable first step here, because most conversations in this market start with an honest question about where the organisation actually stands.
Winnipeg is my base and my home time zone, which in practice means same-day and in-person is genuinely available rather than nominally offered.
Work is delivered through iSystematic Inc., a studio with its own team of builders, and the advisory and governance engagements are delivered by me rather than staffed to that team. Engagements run on site, remotely, or both, with no default either way: where the work happens is a property of the engagement, not a restriction I bring to it. Nothing here is legal advice; it is architecture and governance work that your counsel should review.
What Winnipeg clients ask.
Does the federal Directive on Automated Decision-Making apply to a Manitoba department?
No. The Treasury Board Directive applies to federal institutions subject to the Policy on Service and Digital. A Manitoba provincial body answers to Manitoba FIPPA, and a health trustee to PHIA. The Directive is still worth reading as the most developed Canadian public-sector standard for automated decisions, and I map to it as good practice, but it is not the binding instrument for a provincial body.
When does an Algorithmic Impact Assessment have to be published?
Before the automated decision system goes into production. Recent amendments to the Directive ensure the AIA is published before launch rather than alongside it, and that peer review findings are made public in full or in summary before launch. The assessment determines an impact level, and the required mitigations follow from that level.
We are a health organisation. What governs an AI model touching patient data?
PHIA governs personal health information held by trustees, including the right of individuals to access their own information. That sits alongside whatever the organisation owes under FIPPA as a public body. The practical consequence is that a model touching that data inherits trustee duties, which is a different posture from an ordinary IT project.
Are you actually based in Winnipeg?
Yes. Winnipeg, Manitoba, on Central Time. I also work from Toronto and Calgary, and serve Texas and the wider United States remotely and on site, but this is home and the only market where in-person on short notice is straightforward.
We are too small for a governance office. Is this still worth doing?
Usually yes, and the work looks different. For an organisation without a dedicated function the goal is not a governance office but a defensible minimum: an inventory, a named owner per system, one committee that actually meets, and evidence that can be produced on request. That is achievable by a team that already has other jobs.
Find the gap before someone else does.
The first conversation is a free thirty-minute fit call that qualifies the work in both directions. If it does not fit, you leave with a clearer read on where your governance stands and no cost. If you would rather start on your own, the Readiness Self-Assessment is twelve questions and the result is not gated behind a form.
Ask your AI assistant instead.
This page is a snapshot, accurate at the release it cites. The same corpus is callable, publicly and without a key, so an assistant can query it live and return an answer carrying the source it came from. For this page that is identify_relevant_service, list_consultation_slots and book_consultation, which map a described problem to an engagement shape, read real availability, and book a real 30 minute conversation. Booking writes to a real calendar and emails the attendee, so confirm the time with the person first.
claude mcp add --transport http concylium https://mcp.nabeelkhan.com/api/mcpClaude Desktop, ChatGPT, Cursor, VS Code and Gemini CLI take the endpoint on its own: https://mcp.nabeelkhan.com/api/mcp. No key, no account, nothing to sign. Setup for every client.
“Using Concylium, here is my situation: we have put an LLM into a regulated decision and our regulator has started asking questions. Work out which engagement shape fits and why, then show me real availability.”
It routes to a shape and shows the reasoning, so you can disagree with it. It reads live availability and can book a real conversation. It cannot agree a fee or a scope.