What we look at
- Which AI tools touch client files, and on which plan: personal or business
- For each plan: a data processing agreement, training on your prompts, retention, and where the data is stored
- What each agent or connector can read, change or send
- What your engagement letters say about AI
Plans and their terms change often, so we check yours as of the day we look.
Two facts, with their sources
The AMF’s draft regulation of April 9, 2026 would require registered firms and representatives to evaluate the risks of these technologies, generative AI included (draft section 11.30). It is not in force. AMF Bulletin, vol. 23, no. 14
Before personal information is entrusted to someone outside Québec, Québec’s private-sector privacy act, as amended by Law 25, requires a privacy impact assessment and a written agreement (section 17). LégisQuébec, P-39.1
As read in October 2026.
What it is not
Not legal advice: we map and document what you use; your counsel gives the legal reading.
How it starts
Usually inside an assessment: it is its third question, what your AI tools and agents can read, change or send. See the assessment