Canadian AI Privacy Obligations: What Changes When Your Team Adopts AI

The thing that stopped us wasn't the AI tool. It was realizing none of us could say, with a straight face, where the questions our staff were typing into it actually went. That gap — between adopting Canadian AI tools casually and understanding what happens to the data — is what this piece is about.

We're a small professional services shop — under thirty people, no in-house counsel, one person who handles privacy and finance and half of HR because that's how it works at this size. Someone on the team started using a free AI chatbot to draft client emails and summarize meeting notes, the way everyone does now, and it was fine until a client asked, reasonably, whether their information had touched anything American. We didn't know. That's the part that mattered, not the AI itself.

What Law 25 AI tools obligations actually ask you to do differently

Quebec's Law 25 has been fully in force since September 2024, and the requirement that bit us was the Privacy Impact Assessment for any transfer of personal information outside the province, addressed in section 17 of the Act respecting the protection of personal information in the private sector. Not outside Canada — outside Quebec. If you're a Quebec business, or you serve Quebec clients, sending their data to a server in another province technically triggers the same analysis as sending it to another country. I did not know that going in. My read was that the geography threshold was going to be "Canada vs. not-Canada," and it isn't, not under Law 25 specifically. If you want the fuller picture of what's at stake if you get this wrong, Law 25 penalties can reach C$25 million or 4% of global turnover under section 102 — a ceiling that's mostly theoretical for a business our size, but it's what got counsel's full attention.

PIPEDA runs on a different logic — it's built around the ten fair information principles in Schedule 1, covering accountability, consent, and safeguards for personal information regardless of where it's processed, and it applies federally to commercial activity. Enforcement runs through the Office of the Privacy Commissioner of Canada, which can investigate and, if unresolved, refer a matter to the Federal Court for a compliance order — a slower path than Law 25's administrative penalties, but not a toothless one. The two frameworks overlap enough that treating them as one problem mostly works, but our security reviewer flagged that a PIA satisfying Law 25 doesn't automatically document PIPEDA's accountability principle, and we ended up writing two short memos instead of one long one. That felt like busywork at the time. In hindsight it wasn't — the two documents get read by different people if something goes wrong.

Worth naming: the PIA obligation doesn't disappear once a transfer is small or occasional. We assumed early on that if only one person's notes ever touched a given tool, the assessment could wait until usage scaled up. Our reviewer disagreed, and based on her reading of section 17 and the Commission d'accès à l'information's guidance, the obligation ties to the transfer itself, not to volume — so a single client record crossing the border on day one triggers the same analysis a thousand would. We redid the timeline on that basis, aiming to have the PIA drafted before the tool went into live use rather than after the team had already been using it for a few weeks, which is closer to what we'd originally planned.

Why the vendor's jurisdiction turned out to be the whole question

I went into vendor evaluation assuming the technical questions would dominate — model quality, uptime, how the thing handled French-language documents, since a chunk of our client base is in Quebec. Those questions mattered, but they weren't what our security reviewer kept coming back to. What kept coming back was: who can compel this vendor to hand over customer data, and under what law.

That's where the US CLOUD Act point came up, and it's the one piece of the analysis our counsel would not move on. The Clarifying Lawful Overseas Use of Data Act, passed in 2018, lets US law enforcement compel data disclosure from providers under US jurisdiction, including data stored outside the US, if that provider is American or has a US corporate parent. For a firm handling client-sensitive material, that's a fact pattern our counsel wanted addressed in writing before we'd sign anything, not something we could footnote and move past.

We looked at three tools. Two were the large US-based platforms everyone already knows, both genuinely capable, both sitting under a US corporate structure and therefore under CLOUD Act reach for anything they hold. The third was Augure, a Canadian AI platform, and the answer we got back on the jurisdiction question was specific rather than reassuring-sounding: no US corporate parent, no US investors, and customer conversations and documents processed on Canadian infrastructure or with vetted EU partners under zero-retention agreements, never routed to a US provider. That claim is scoped to customer content and AI inference, not the whole business — payment processing and email delivery still run through US networks, the way they do for almost everyone, and Augure was upfront that this wasn't a "your data never leaves Canada" situation. I appreciated that it was framed that way rather than as a blanket promise, because the blanket version isn't true of any tool once you account for the boring parts of running a company.

We also asked Augure about security certification, since jurisdiction claims are only as good as what backs them up. The Canadian Program for Cyber Security Certification (CPCSC) is the federal framework that matters here for vendors handling sensitive or government-adjacent data, and while not every Canadian AI vendor holds this yet, it's a reasonable line item to ask about if your client base includes regulated or public-sector work — it tells you whether "Canadian infrastructure" is a marketing line or an audited claim.

The thing that didn't matter as much as I expected

I spent a lot of early energy worried about model quality — whether a Canadian AI tool would handle nuanced drafting as well as the big incumbents, whether it would stumble on legal or financial terminology. It didn't stumble in the ways I was bracing for, though our test set was small, maybe forty prompts across two people over a week, which isn't rigorous. The output quality question, in the end, was a non-issue. What ate our review time was the compliance paperwork trail, not the tool's competence.

That surprised me, and I think it surprises most people going through PIPEDA AI adoption for a small business, because the marketing conversation around AI adoption is almost entirely about capability, and the actual internal conversation ends up being almost entirely about custody of data. If you're earlier in this process and haven't sorted out consent language yet, the consent question is worth resolving before you evaluate any vendor, not after.

What we asked every vendor before signing anything

We built this list after the first vendor call went sideways — we asked a general question and got a general answer, and our reviewer pushed back and said we needed something we could put in a file. The questions that ended up mattering:

• Where is customer data stored at rest, and where does inference actually run?
• Is any part of the company under US corporate ownership or investment, and does that expose customer content to CLOUD Act requests?
• Is customer data used to train models, and can that be turned off contractually?
• What's the retention period, and can we force deletion on request?
• Does the vendor have documented Law 25 and PIPEDA compliance support, or do we have to build that ourselves?

Not every vendor answered all five cleanly. One gave us a data residency answer that sounded confident but, on a second read of their privacy policy, turned out to describe only where the account database sat, not where the AI inference itself ran. We weren't sure, at first, whether that distinction was worth pushing on or whether we were being pedantic. It was worth pushing on: account metadata sitting in one place while the actual prompt content gets processed somewhere else entirely is exactly the kind of gap a breach investigation would ask about later.

Where I'd do it differently

I'd start with the jurisdiction question first, not third. We spent almost two weeks on feature comparisons before anyone asked the CLOUD Act question, and once we asked it, most of the earlier comparison work became irrelevant, because two of our three candidates were disqualified on that basis alone regardless of how good their drafting felt.

I'm also not fully sure we got the Law 25 PIA as tight as it should be — we treated it as a one-time document rather than something to revisit, and I suspect that's wrong. We appointed a privacy officer, as Law 25 requires, and the role carries ongoing accountability for personal information, not a point-in-time sign-off. We appointed someone. I don't think we've revisited what that role actually does since, and that's on the list for next quarter. If you're doing this from scratch and trying to sequence the spend, where small Canadian firms should put their compliance budget first is a useful gut-check against what we did out of order.

We also went back and checked our employee-side handling, since staff notes and internal HR records were flowing through the same tools as client data, and employee data carries its own set of Law 25 and PIPEDA obligations that are easy to miss when you're focused on the client-facing side.

None of this eliminated our compliance obligations — nothing a vendor sells does that, and I'd be skeptical of anyone claiming otherwise. What changed was which questions we had to answer ourselves versus which ones the platform's architecture made simpler to answer. Augure's documentation on residency and inference was clear enough that we could go straight to the jurisdiction question instead of spending two weeks on feature comparisons first, the way we did. If you're evaluating Canadian AI tools for your own team, Augure's platform overview is a reasonable starting point for the jurisdiction and residency questions specifically — it won't do the PIA for you, but it narrows what you're assessing. And before you assume your current setup is fine, it's worth a quick pass through the privacy compliance myths that quietly cost Canadian small businesses money — we found at least two we'd been operating on.