FOI Software: The Business Case for Canadian Public Bodies of Any Size
Freedom of information requests across Canada are getting harder to manage. Not because deadlines are getting shorter, in fact Ontario just moved the other way, but because the requests themselves are more complex, the rules for handling them have more moving parts, and regulators expect a clear record of how each one was handled. Yet in most municipalities, police services and provincial bodies, the FOI office still runs on email, spreadsheets and manual redaction. When the question of FOI software reaches council or a board, it usually comes down to one thing: what does the current process actually cost, and what does it put at risk? This article sets out how to answer that question, whether your institution handles ten requests a year or a thousand.
Regulators have put the problem on the record
In September 2026, Canada’s federal, provincial and territorial information commissioners and ombuds, acting together as the FPT Information Regulators, adopted a joint resolution, Enhancing Access to Information Held by Small Public Bodies. It makes two points that every clerk and FOI coordinator will recognize.
First, access legislation “generally imposes similar obligations on all public bodies regardless of size,” while small public bodies often operate without dedicated access staff, legal counsel or records specialists. Second, many of those bodies face technological limitations: the resolution specifically names the absence of dedicated case management systems, automated redaction tools, electronic disclosure portals and digital records management systems. The regulators call on governments to ensure small public bodies have access to the technological tools needed to administer their obligations, and encourage the bodies themselves to invest in records management and share information on access request tracking systems and other solutions.
Regulators do not endorse products. But a joint statement from every information commissioner in the country that names the missing tools is a useful place to start a business case.
Why the question is being asked now
The resolution lands as every province rewrites its rules, and each rewrite adds steps to track.
- Ontario. Bill 97 moved MFIPPA to business-day timelines and extended the standard response period to 45 business days, but it also introduced staged access plans, a second time extension, new fee estimate and clock-stop rules, and mandatory privacy impact assessments from January 1, 2027. More time, and more to manage inside it.
- British Columbia. Bill 22, which became law in 2021, amended FIPPA to introduce an application fee and new privacy management obligations. Responses are due within 30 business days, and the Office of the Information and Privacy Commissioner actively reviews timeliness.
- Alberta. The Access to Information Act replaced the FOIP Act, with new procedures, timelines and reporting expectations for public bodies.
- Nova Scotia. A new Freedom of Information and Protection of Privacy Act comes into effect April 1, 2027. It consolidates the current FOIPOP Act, Part XX of the Municipal Government Act and the Privacy Review Officer Act, makes the Commissioner an officer of the legislature, extends privacy oversight to municipalities and villages, and increases fines.
The common thread is accountability. Each regime expects a public body to show that it tracked every request, applied every rule, treated exemptions consistently and reported accurately. That is hard to demonstrate from a shared inbox.
The request that decides the budget
FOI cost is not spread evenly. A public body that handles ten requests a year can go eleven months without a problem and then receive one request that consumes the clerk’s office for six weeks: a multi-year records search, a thousand pages to review, third parties to consult, a fee estimate that gets challenged, and an extension notice that has to be defended. Increasingly that request arrives drafted with an AI tool: longer, broader, multi-part, and quoting the statute back at the institution. The FPT resolution notes the same pattern, pointing to “fluctuations in request volumes” and “the complexity or sensitivity of certain matters” as factors that compound the strain on small bodies.
That single request can cost more in staff and legal time than a year of FOI software, and it is the one most likely to be appealed, because it is the one where a step was missed under pressure. Small and large bodies alike are judged on how they handled the hard files, not the easy ones.
So the question to put to council is not “how many requests do we get?” It is “what happens when we get the difficult one?” If the answer involves overtime, a lawyer and a spreadsheet, the business case is already made.
What does not change with volume
Four things sit at the same level whether a body receives 10 requests or 1,000:
- Legal complexity. The statute is the same length for everyone. Mandatory and discretionary exemptions, exclusions, third-party notice rules, fee provisions, extension grounds and clock stops, and in Ontario staged access plans, all have to be applied correctly on request number one. A coordinator who handles ten files a year has to get it right with a fraction of the practice.
- Case tracking. Every request now carries its own calendar: the business-day due date, clock stops for fee estimates and third-party consultations, one or two extension deadlines, the response window on a staged access plan in Ontario, a return date for each search memo issued to a department, and the appeal period at the end. One file can easily carry five or more dates that matter, each moving the others. A spreadsheet holds them; it does not watch them.
- Consistency on appeal. A decision is defended on the record. If two analysts applied the same exemption differently, or nobody can show which section was applied to which page, the institution is exposed on appeal regardless of how few files it handles.
- Key-person risk. In a small body the FOI process often lives in one person’s head. When that person is away or leaves, there is no backlog to speak of, just a deadline nobody is tracking.
FOI software addresses all four at a fixed cost. The software replaces a process, not a headcount, which is why the business case does not depend on volume.
What FOI software actually changes
FOI software does not replace judgment. It takes the administrative load off the people who exercise it, and it builds the statute into the workflow so the right rule is applied every time. A capable platform handles:
- Online request forms with built-in identity verification and integrated payment, so a request arrives complete, paid and verified, and the business-day clock starts automatically without front-line staff keying anything in
- Triage and routing to the right departments
- Search memos sent from the file, with a secure link for each department to upload its responsive records directly and recurring reminders until it does
- Automatic due-date calculation in business days, with clock stops for fee estimates and third-party consultations, and tracking for extensions and, in Ontario, staged access plans
- Redaction built for exemption-based review, with each redaction tagged to the specific exemption or exclusion relied on and the tags aggregated across the file and across the year
- An audit trail that shows on appeal exactly which section was applied to which page, and by whom
- Fee estimates and invoicing under the current fee rules
- Templated correspondence that is updated when the legislation changes, so a small body is not maintaining its own letters
- Consultation workflows with third parties
- Automated annual reporting, assembled from the tagged exemptions, timelines and fees already in the system rather than rebuilt from spreadsheets
The first and last points matter most for small bodies. Intake that verifies, collects the fee and starts the clock on its own removes the most repetitive work from the counter. And when the law changes, as it has in Ontario this year, in Alberta recently and in Nova Scotia next April, the templates and timelines change with it.
How to build your own FOI software business case
Answer five questions and the case largely writes itself:
- What did our most complex request last year cost in staff and legal time, and how long did it take?
- How many responses were late, and how many appeals, reviews or complaints followed?
- How are deadlines, clock stops and extensions tracked today, and who tracks them when the coordinator is away?
- How are pages redacted, and could we show on appeal which exemption was applied to each one?
- How much front-line time goes into receiving requests, verifying identity, taking payment and chasing departments for records?
Put the answers beside the annual cost of the software, add any appeal cost you can quantify, and present the result as risk retired for a known price rather than hours saved. The FPT resolution is worth attaching: it shows council that Canada’s information regulators, collectively, see the absence of these tools as a limitation and expect governments to help close the gap.
Frequently asked questions
The case does not depend on volume. New legislation adds steps to every file, such as Ontario’s staged access plans, second extensions and clock stops, and a small body has to track all of them with fewer people. Canada’s information regulators have jointly identified the lack of case management systems and automated redaction tools as a limitation facing small public bodies, and have called on governments to ensure those bodies have the technological tools to meet their obligations.
When a request is logged, the coordinator selects the departments to search and the software issues the search memo from the file. Each department receives a secure link to upload its responsive records directly, and the system sends recurring reminders until the records arrive, so nothing is chased by email and the record of who was asked, when, and what came back is kept with the request.
An online request form collects the request, verifies the requester’s identity and takes payment in one step. The file is created and the business-day clock starts automatically, so front-line staff are not transcribing paper forms, checking ID at the counter or processing payments by hand.
Each redaction is tagged to the exemption or exclusion applied. The tags are aggregated across the file, so the decision letter and index of records are built from them, and across the year, so the annual report to the commissioner is generated rather than compiled.
Yes. Vayle provides a business case calculator for Canadian public bodies that works from your request volume, the cost of your most complex request, late responses and appeals, and front-line intake time, and sets the result against the annual cost of the software.
Build the case with real numbers
Vayle FOI is used by municipalities, police services and other public sector institutions across Canada. If you want help putting your own figures into a business case, book a demo at Vayle and ask for the business case worksheet.
About Vayle
Based in Toronto, Canada, Vayle delivers modern Freedom of Information (FOI), Privacy Impact Assessment (PIA), online forms ( FormLink), and secure ID verification workflow solutions (Vayle ID) purpose-built for government and public sector organizations. By modernizing and automating information access and privacy programs, Vayle helps organizations strengthen compliance, improve operational efficiency, and enhance public trust.
