AI for Accountants in Canada: Privacy Rules and First Uses

Before a Canadian accounting firm uses AI on client work, it should confirm three things: privacy law covers the data (PIPEDA federally, or the substantially similar Alberta, British Columbia or Quebec statute), the provincial CPA rules on competence, confidentiality and review are met, and the tool has been vetted so client data stays protected. Start with tasks that use no client data.

Most firms get stuck because the sources are scattered across federal and provincial regulators, a professional body in each province, and a pile of vendor pages that all say "secure". The order that works is: settle which privacy law governs your files, read your own provincial body's conduct rules, vet each vendor in writing, then start with uses that keep client data out of the prompt. Tool comparisons come last, and the tools tutorial for chartered accountants covers them.

Follow me on Instagram@sagnikteaches

Which privacy law governs your client files

The Office of the Privacy Commissioner says PIPEDA applies to private-sector organisations across Canada that collect, use or disclose personal information in the course of commercial activity. Alberta, British Columbia and Quebec have their own private-sector privacy laws, deemed substantially similar to PIPEDA. Personal information that crosses provincial or national borders in the course of commercial activity is subject to PIPEDA whatever the province of the business.

Connect on LinkedInSagnik Bhattacharya

That last point matters for AI. A tool that routes a prompt to servers in another province or country can pull in the federal law even for a firm in a province with its own statute. Do not try to settle this by memory. Ask your professional liability insurer or a privacy lawyer once, write down the answer for your firm's footprint and revisit it when you add a tool.

Subscribe on YouTube@sagnikteaches

Personal information under PIPEDA is any factual or subjective information about an identifiable individual. A client file is full of it: names, income, ID numbers, health expenses for a medical tax credit, dependants' details. A summary an AI generates from those facts is still personal information.

The PIPEDA principles that bite when AI arrives

PIPEDA rests on ten fair information principles. Five matter most for AI.

• Accountability. You remain responsible for personal information you hand to a third party for processing. The commissioner's guidance says to use contractual or other means to get comparable protection when information goes to a processor, to limit the processor's use to the purposes in the contract, and to protect everything you hold. An AI vendor is a processor in this sense.
• Identifying purposes and consent. Clients gave you data to prepare returns or keep books. Using it to train someone's model, or for a purpose they would not expect, needs a fresh look at consent.
• Limiting use, disclosure and retention. Prompts and uploaded files are retained somewhere. Know how long, and be able to delete them.
• Accuracy. Personal information should be accurate for the purpose it is used. An AI summary that wrongly states a client's income breaches the spirit of this principle if you rely on it.
• Safeguards. Access controls, encryption and staff rules must match the sensitivity of the data. Financial records are at the sensitive end.

On 7 December 2023 the federal, provincial and territorial privacy commissioners published joint Principles for responsible, trustworthy and privacy-protective generative AI technologies. There are nine: legal authority and consent, appropriate purposes, necessity and proportionality, openness, accountability (which includes making AI tools explainable), individual access, limiting collection, use and disclosure, accuracy, and safeguards. The document is written in "should" language, but it says many of its points will in practice be required to comply with privacy law, so treat it as a preview of what a regulator will ask after a complaint. One line in it converts straight into a firm rule: where personal information, and in particular sensitive or confidential information, must be entered into a prompt, only do so where authorised.

Quebec's Law 25 adds duties the other provinces do not have

If you hold information about people in Quebec, the Act respecting the protection of personal information in the private sector matters on top of everything above. Four of its provisions bear on AI.

1. A named person in charge. The person with the highest authority in the enterprise acts as person in charge of protecting personal information unless they delegate in writing, and their title and contact details must be published on the website. In a three-partner firm, that is a decision to make explicitly.
2. Governance policies. Section 3.2 requires policies and practices on keeping and destroying information, roles and responsibilities and a complaints process. Your AI rules belong inside them.
3. A privacy impact assessment for new systems. Section 3.3 requires one for any project to acquire, develop or overhaul an information system involving personal information, proportionate to sensitivity and volume. Adopting an AI service that processes client data can fall within it.
4. Assessment before data leaves Quebec. Section 17 requires a privacy impact assessment before communicating personal information outside Quebec, weighing sensitivity, purposes, contractual protections and the legal framework where the data would go, plus a written agreement. It applies equally when you entrust a person or body outside Quebec with using or keeping the information for you. Most AI services run outside the province, so this will often apply.

Section 12.1 also requires telling a person when a decision about them is based exclusively on automated processing. A firm using AI to draft a report that a partner reviews is not making automated decisions. A firm using a tool to accept or reject a client application with no human step is. Ask your adviser how the Act applies to your set-up, as this tutorial is not legal advice.

What the CPA rules of conduct add

CPA Canada is the national body, but conduct is set and enforced by the provincial and regional CPA bodies, so the rule numbers below come from one of them. CPA Ontario published The Responsible Use of AI in Professional Practice in June 2026. It says new technology does not replace professional judgement, accountability rests with the CPA, and the Code of Professional Conduct is the lens for evaluating AI tools. It ties AI use to four rules:

Members of other provincial bodies should read their own body's materials, because numbering and wording differ and new guidance keeps arriving. CPA Canada also publishes general AI material, such as Navigating the AI Revolution: Key Updates for Today's CPA, issued with the AICPA as the first paper in a series, which is useful background on how the technology works and how to govern it. I found no CPA Canada document that sets out privacy rules for generative AI specifically, so the binding detail sits with your provincial body and the privacy statutes.

Rule 208's wording gives you a usable test: verified secure and compliant. A vendor's marketing line is not verification. A signed agreement, a documented settings review and a dated assessment on file are.

A vendor check you can run in an afternoon

The privacy laws and CPA rules converge on the same questions. Ask each vendor, in writing where you can, and keep the replies.

1. Training. Is our content used to train models? ChatGPT Business and Claude Team both state they do not train on business content by default. Consumer plans give a settings switch instead: on ChatGPT's personal plans it is called Improve the model for everyone, and it is on until you turn it off. Check the plan you will actually buy.
2. Location. Where is data stored and processed? For Quebec data this feeds the section 17 assessment. For PIPEDA, it feeds your accountability duty on transfers.
3. Contract. Is there a data processing agreement committing to protection comparable to PIPEDA, use limited to your instructions and notification of incidents?
4. Retention and deletion. How long are chats and files kept, and can an admin delete them or set retention?
5. Access. Single sign-on or enforced multi-factor authentication, per-user seats, an admin who can remove a leaver at once.
6. Sub-processors. Who else touches the data? Is there a list?
7. Human review. Does the vendor allow staff to read your conversations for safety review, and can you opt out?

A short note per vendor with a date, the plan tier and the answers is your evidence of due diligence. What to check in an AI tool's privacy terms shows how to read the policy pages behind each answer, and the ChatGPT client-data tutorial compares plan types in more detail.

A worked example: a five-partner firm in Ontario and Quebec

Take a firm with five partners and nine staff, offices in both provinces, and about 900 individual and small-business clients. Staff have started using a free chatbot on their own phones. The managing partner wants a decision within a month.

1. Inventory (day 1 to 3). A short, no-blame survey finds four tools in use. Two are free consumer apps, one is an AI feature inside the tax software and one is a transcription app on a partner's phone.
2. Classify the data (day 4). The firm splits its material into three bands: public or generic (templates, marketing), internal (procedures, pricing) and client personal or confidential (everything on a file). Only the first two may go into a general chat tool.
3. Vendor check (day 5 to 12). Two vendors get the seven questions. One, the tax software's AI assistant, already sits inside a contract the firm holds and processes data in a region the vendor documents. The other, a business-plan chat tool, offers a data processing agreement and no-training terms on the paid tier. Cost is roughly $20 to $25 per user a month on the plans a team of this size would use, so the firm budgets for four seats at first. It checks current vendor pricing before buying.
4. Quebec steps (week 2). The Quebec office's managing partner is named person in charge, the title goes on the website, and the firm writes a short privacy impact assessment for the cloud AI service including the written agreement. The assessment records sensitivity (financial and ID data), purposes (draft summaries for partner review), contractual protections and the location of processing.
5. Rule and record (week 3). One page: approved tools, banned inputs, who reviews, and a review note on each file where AI was used. The partners sample one file per partner each quarter.
6. Clients (week 4). The engagement letter and website privacy notice get a plain paragraph on AI use.

The effort is perhaps two partner days and a few staff hours. The usual surprise is how much of the work is paperwork that was already due under the privacy laws, now done once and kept current.

Four first uses that need no client data

You can start learning the tools while the paperwork goes through. These four uses keep personal information out of the prompt entirely.

1. Drafting your own templates and letters

Draft a one-page document-request checklist for a self-employed client
preparing a personal tax return. Use plain language, group items under
"Income", "Expenses" and "Other slips", and leave [first name] and [year]
as placeholders. Under 300 words.

Sample output, illustrative: a tidy list under three headings. You fix the slips the tool misses, such as foreign-income reporting, and the wording about your own deadlines. Nothing about any client went in.

2. Explaining a concept before you explain it to a client

Ask for a 120-word plain explanation of how instalment payments work for a new freelancer, then check every statement against the revenue agency's own page before sending. The risk is a confident wrong threshold. The check takes five minutes and catches it.

3. Spreadsheet formulas on dummy data

Build a sample sheet with invented transactions and ask for a formula that flags duplicates or splits a combined name column. Test it on the dummy data, then use it on the real file in your normal environment. The seven Excel tasks tutorial has more ideas with checks.

4. Turning your own procedures into checklists

Paste the bullets describing how your firm does year-end close, with no client names, and ask for a numbered checklist with a reviewer column. You edit it into your quality-management documents.

Second-wave uses, once the vendor check is filed

With an approved tool and client permission where needed, move to uses where client data is involved and a reviewer can easily verify the output.

• First-pass transaction coding inside bookkeeping software, with the reviewer checking exceptions and a sample. A realistic rule is to read every line the tool flags uncertain and every line over a threshold you set, such as $1,000, and sample 10 per cent of the rest.
• Summaries of long client emails and notices for the file note. The reviewer checks dates and dollar amounts against the original, because that is where summaries slip.
• Drafting client letters from your own bullet points, so the advice is yours and the tool supplies tone.
• Meeting notes. Recording a client meeting raises consent and retention questions of its own; see the AI note taker comparison before choosing.

Leave tax positions, filings and anything you will sign to a person. Rule 205's concern with false or misleading documents is about exactly this: an AI error that reaches a filing is your error.

Review notes that prove you checked

Rules 203 and 208 and the accountability principle all point to evidence. A short note on each file does the job.

AI use note
Job:            Year-end workpapers, client code 0417
Tool / plan:    [tool], business plan, on approved list dated [date]
Task:           Draft summary of 38 bank-statement exceptions
Input held back: SIN, account numbers, dependants' names
Reviewer:       [name], CPA
Checks:         All 38 items traced to statements; 4 amounts corrected;
                1 invented explanation deleted
Result:         Summary used after edits

Illustrative, but note the "input held back" line. Writing down what you excluded forces the habit and shows regulators you apply data minimisation. The SOP tutorial turns this into a firm procedure.

Telling clients, in words they will read

Openness is a PIPEDA principle and a theme of the regulators' generative AI principles, so say something plain in the engagement letter and on your privacy notice. Something like this works as a starting point for your adviser to adjust.

We use software with AI features to help prepare and review your work. We
only use providers we have assessed for security and privacy, we do not put
your information into public AI chat tools, and a CPA reviews every
AI-assisted result before it is used. If you would prefer we do not use AI
on your file, tell us and we will work without it.

The opt-out has a cost: you need a flag on the client record and a staff habit of checking it. A firm with 900 clients might expect a handful of requests, usually from clients in sensitive situations, and honouring them is cheap compared with losing the relationship. Pair the wording with a staff rule that nobody pastes a client's SIN or bank account number into any prompt, whatever the tool, and that rule alone removes a large share of the risk. Review the rule after the first quarter: ask staff which tasks they still reach for a free app to do, because that list shows which approved tool you are missing.

If client data goes where it should not

Have the steps ready before the day it happens. Stop the use and note what went in, which tool, when and whose data. Delete the conversation and any uploaded files through the tool's controls and switch off training where the plan allows it. Then assess whether the incident creates a real risk of significant harm, the test under the federal law for reporting a breach to the commissioner and notifying the people affected, and whether Quebec's incident rules apply. In Quebec, section 3.5 of the Act requires reasonable measures to reduce the risk of injury and, where there is a risk of serious injury, prompt notice to the Commission d'accès à l'information and to the people concerned. Take advice quickly. The federal guidance also requires a record of every breach, including those that do not meet the reporting test, so log the incident either way. Then fix the cause, which is usually a missing rule or a missing approved tool.

A thirty-day plan

• Week 1: inventory the tools, classify data bands and decide which privacy law governs your files.
• Week 2: run the vendor check on one tool and file the answers. In Quebec, complete the assessment and written agreement.
• Week 3: write the one-page rule, the review note and the incident steps, then brief the team.
• Week 4: update the engagement letter and privacy notice, and run one real job through the process.

If you would rather map this with someone, that is what my AI implementation consultation covers. Either way, recheck the guidance from your provincial CPA body and the privacy commissioners every few months, because both are moving quickly.

Privacy questions accounting firms ask before using AI

Does PIPEDA apply to a small accounting firm?

PIPEDA covers private-sector organisations that collect, use or disclose personal information in the course of commercial activity, and a fee-charging firm does exactly that. Alberta, British Columbia and Quebec have their own private-sector laws deemed substantially similar. Which one governs depends on where the data moves, so confirm with the commissioner's guidance or your adviser.

Is a free AI chatbot acceptable for client work?

It is a poor fit. CPA Ontario's June 2026 standard says no confidential or personally identifiable information goes into AI tools unless the environment is verified as secure and compliant. A free consumer plan rarely gives you the contract, retention control or admin settings to verify that, so keep it for generic questions.

Do I need a privacy impact assessment for an AI tool in Quebec?

Quebec's private-sector Act requires one for projects to acquire or overhaul an information system involving personal information, and before communicating personal information outside Quebec. Using an AI service whose servers sit elsewhere can trigger both. Keep the written assessment and agreement on file.

Do I have to tell clients that I use AI?

Federal and provincial privacy regulators stress openness about how personal information is used. Quebec adds a specific duty to tell a person when a decision about them is made exclusively by automated processing. Beyond that, a short plain-language line in your engagement letter and privacy notice is the sensible minimum.

What should I do if client data went into the wrong AI tool?

Record what was entered, where and when, delete it using the tool's controls, and assess whether it creates a real risk of significant harm, which is the federal test for reporting a breach. Take advice quickly on notification duties, and note the incident and fix in your breach record.

Further reads

• AI Readiness Checklist for Accountants, Solicitors, Consultants — Check how ready the firm is before any rollout.
• Accountants AI Risk Checklist: Error Points, Each With a Named Check — Named checks for every error point in AI-assisted work.
• AI for Chartered Accountants: What to Tell Clients About Your AI Use — Plain wording for telling clients about AI use.
• Best AI for Lawyers in Canada: Privacy, Tools and a Safe First Task — How a neighbouring profession handles the same privacy rules.
• AI Acceptable Use Policy for a Small Professional Firm — A firm-wide acceptable-use policy to adapt.
• Free AI Tools for Accounting: Which Jobs Free Plans Handle — What free plans do and do not protect.
• 7 AI Mistakes That Put an Accounting Firm's Client Trust at Risk — Mistakes that cost an accounting firm client trust.
• AI Bookkeeping in Canada: GST/HST Coding and Remittance Checks — A bookkeeper's review routine for GST/HST coding and payroll remittances: formulas for the maths, AI for the judgement calls, CRA pages for the dates.
• AI for Canadian Appraisers: CUSPAP, Privacy and Practical Uses — CUSPAP confidentiality, competence and work-file rules read against AI, plus privacy points and practical appraisal uses that keep client data out.
• AI Tools and AI Development: The Complete 2026 Guide — the AI hub, including every tutorial in the AI-for-business series.

Sources: Office of the Privacy Commissioner of Canada, PIPEDA requirements in brief, the accountability principle, breach reporting guidance and Principles for responsible, trustworthy and privacy-protective generative AI technologies (7 December 2023); Quebec Act respecting the protection of personal information in the private sector (sections 3.1, 3.2, 3.3, 3.5, 12.1, 17); CPA Ontario, The Responsible Use of AI in Professional Practice (June 2026); CPA Canada, Navigating the AI Revolution: Key Updates for Today's CPA; OpenAI ChatGPT Business and Claude pricing pages.