Straight answers to the AI questions your practice is actually facing

Rules · Ontario lawyers, paralegals, and law firm leaders

The Law Society of Ontario has not adopted AI-specific rules. Its April 2024 white paper and companion practice resources explain how existing duties apply to generative AI: technological competence under rule 3.1-2, confidentiality under rule 3.3-1, supervision under rule 6.1-1, candour with clients, fair billing, and not misleading a tribunal. The guidance tells licensees not to put confidential or privileged client information into a generative AI tool unless adequate safeguards are in place.

Rules · Lawyers, law firms, and legal departments in Quebec

Yes: the Barreau du Québec encourages supervised use of generative AI, but professional secrecy leaves no room for approximation. Its practical guide states that simply entering information protected by professional secrecy into an open system, such as a public AI tool, is a breach, even without any actual reproduction or disclosure. In practice, that means anonymizing, keeping data to the strict minimum, not using the tool when anonymizing is impossible, and supervising how the whole team uses it.

Rules · BC lawyers and law firm leaders

The Law Society of British Columbia has not created AI-specific rules. Its practice resource, Guidance on Professional Responsibility and Generative AI, applies existing BC Code duties: competence (rule 3.1-2), confidentiality (rule 3.3-1), candour, supervision (rule 6.1-1), fair fees, and the records security obligations in Law Society Rules 10-3 and 10-4. Its core advice on confidentiality is to leave client confidential and identifying information out of generative AI tools, and to consider informed client consent where redaction is not possible.

Rules · Litigation boutiques and civil litigators

Canadian law has not settled this, so treat discovery material as restricted. Documents and answers obtained on discovery may be used only for the proceeding in which they were produced, and in Ontario rule 30.1.01 expressly binds parties and their lawyers. Building a chronology for the same case may be a permitted use, but sending the material to an AI provider whose terms allow retention or training raises a real question about disclosure to a stranger to the litigation, so use a vetted tool and get advice first.

Specific work · M&A boutiques, corporate law firms and deal advisors

Only into a tool the firm has vetted, and only if the NDA, the client and the law allow it. Evaluation material is usually shared under an NDA that limits who may receive it and what it may be used for, personal information in the data room is often shared under a privacy law exception tied to the transaction, and a public company deal may involve undisclosed material facts. Pasting that material into a personal AI account can fall outside all three.

Specific work · University technology transfer offices and academic researchers

Not with the unfiled technical details, unless the tool is one the institution has approved for confidential research information. A prompt is not automatically a public disclosure, but it hands the invention to a third party under that party's terms, creates novelty questions nobody can fully answer, and Europe offers no general grace period to fall back on.

Specific work · SR&ED consultants and R&D tax credit advisors

Yes, if the client's technical data stays out of tools your engagement does not cover. CRA has not published guidance on AI use by claim preparers that we could find, so the limits come from your client contracts and NDAs, privacy law for the personal information in a claim, and any professional code you belong to. Draft with abstracted facts in a vetted tool, and keep source code, experimental results and unreleased product details out of public AI accounts.

Governance · MSSPs, MSPs, and vCISOs

Package it as four parts clients already understand: a fixed-scope AI use assessment, a policy and sanctioned-tool decision, managed data-level controls in the browser, and a monthly report with a regular review. Measure outcomes the client can see, such as AI tools discovered, sensitive-data events caught before submission, and repeat events by department, and map the program to the NIST AI RMF or ISO/IEC 42001 so it speaks the language auditors recognize.

Governance · MSSPs, MSPs, and vCISOs

Answer with a program, not a yes or a no. Find out which AI tools staff already use, agree on a short policy, sanction the tools the client will pay for, put data-level controls in the browser where prompts are typed, and report on it every month. Each step maps to frameworks the client may already track, such as the NIST AI RMF and ISO/IEC 42001.

Governance · MSSPs, MSPs, and vCISOs

Force-install the extension through each client's own browser management: the ExtensionSettings or ExtensionInstallForcelist policies for Chrome and Microsoft Edge (by Group Policy, Intune or Chrome Enterprise Core), and the ExtensionSettings policy for Firefox. Keep one template per client in that client's own tenant, roll out in rings, and be clear that the control covers managed browsers, not personal devices.

Governance · MSSPs, MSPs, and vCISOs

A useful monthly client AI risk report covers which AI tools are in use, which of them are sanctioned, flagged events by data type and policy, trends against last month, coaching outcomes, and recommended actions. It is built from event metadata (which tool, what type of data, which policy, when), not from what staff typed, so leadership gets evidence without anyone reading prompt content.

Rules · Quebec clinic owners, medical directors, and privacy leads

Not with identifiable patient information unless the Act's conditions are met. Since July 1, 2024, the Act treats everything a covered clinic holds as confidential, and handing it to an outside provider generally requires a written agreement with prescribed clauses and, if the data leaves Quebec, a prior privacy impact assessment. A personal ChatGPT account meets neither condition, so clinics should provide approved tools and stop identifiable data at the prompt.

Rules · Principal investigators, research coordinators, and research ethics and privacy offices

Only if your REB-approved protocol and the participants' consent allow it. TCPS 2 requires researchers to describe their data safeguards to the REB and to obtain approval before substantive changes, including changes to privacy and confidentiality measures, so running identifiable participant data through an unapproved AI tool may fall outside what was approved. Ask your REB before using the tool, not after.

Governance · Clinic owners, medical directors, and privacy officers in Ontario

Approval attaches to a tool, not to the patient data. An AI scribe chosen through Ontario's AI Scribe Program comes with vetting, contract terms and a privacy assessment; a personal ChatGPT account comes with none of those, so pasting identifiable patient notes into it can be an unauthorized disclosure under PHIPA. Close the gap by giving clinicians a sanctioned way to draft letters and summaries, and by catching identifiable data before it reaches unapproved tools.

Rules · Credit unions, wealth managers, and managing general agents

OSFI Guidelines B-10 and B-13 bind federally regulated financial institutions, so most provincially regulated credit unions, wealth managers, and MGAs are not directly subject to them. They still tend to reach you through the federally regulated insurers, banks, and trust companies you work with, and through provincial guidance built on the same expectations. Either way, the practical test is the same: can you show that client and member data does not leave in an employee's AI prompt?

Specific work · Fractional CFOs, outsourced controllers and part-time finance leads

Not without deliberate separation. Features such as memory, chat history, projects and custom GPTs are built to carry context forward, so one client's figures can shape the answers you get for another. If you are a CPA in Ontario, Rule 208 of the CPA Code prohibits using one client's confidential information for the advantage of a third party and requires measures that limit access to it, and CPA Ontario's 2026 AI guidance says confidential data should go only into environments verified as secure.

Specific work · Payroll service bureaus, HR outsourcing providers and in-house payroll teams

Not into a public AI tool. Service Canada treats employee SINs as confidential and limited to income-related purposes, and privacy law requires safeguards matched to the sensitivity of the data, so pasting a SIN, pay stub or benefits file into a personal AI account is very hard to justify. Payroll and HR teams can still use AI for formulas, policy drafts and reconciliation logic, as long as identifying employee data is removed before anything is submitted.

Rules · Companies holding federal contracts with Protected B security requirements

Not into a public AI tool. Suppliers are bound by the security requirements in their contract and by the Contract Security Program, which only allow protected information to be processed on IT systems the program has approved and only by people with the right screening and a need to know. The Treasury Board guide on generative AI speaks to public servants rather than suppliers, but it points the same way and is a sensible floor for what a department will expect of its contractors.

Governance · Operations, finance, and IT leads responsible for cyber insurance renewals

Answer only what you can support with evidence. Renewal applications increasingly ask whether you know which AI tools staff use, whether a written AI policy exists, whether technical controls stop sensitive data from reaching those tools, and whether staff are trained. Gather the inventory, policy, training records, and control records before you fill in the form, and ask your broker how the insurer treats answers you cannot fully support.

Governance · Small and mid-sized organizations hosting interns, co-op students and summer students

Assume they will use AI, and plan for it from day one. Privacy law makes the host organization responsible for training the people who handle personal information and for safeguarding it, whether that person is a permanent employee or a four-month co-op student. Give interns a clear rule on what never goes into AI, an approved tool for ordinary tasks, and a safety net that catches sensitive data before it leaves.