The AI rules for Canadian advisors in one place: what’s off limits, what your compliance team decides, and where you can start this week. Every rule is sourced.
By Chase Bernier, Sidekick OrchestrationChecked against 28 official sourcesVersion 1.0 · September 28, 2026Not legal advice
Rules from CIRO and NI 31-103, and BC’s Personal Information Protection Act. No Canadian law is written for how advisors use AI, so the limits come from rules you already follow. You stay responsible for everything AI produces.
Each line names its authority, so you can see what is binding and what is advice.
AI can research, compare and draft. The decision stays with you. Securities regulators say a suitability determination can’t be outsourced, and that at AI’s current stage it can’t stand in for an advising representative making investment decisions.
You stay accountable for client information you give to any outside service, and that needs contract protection. A personal account has no data agreement with your firm, and your firm can’t see, supervise or keep what happens in it.
A SIN collected for tax slips may only be used or shared as the Income Tax Act allows, unless the client consents in writing. Putting a SIN into an AI prompt is not a purpose the Act authorizes. ID and account numbers are exactly what fraud needs. Useful AI work never needs any of them.
Client communications must be supervised and must not mislead. Your firm’s rules set whether that is approval before sending or review after. Either way, AI can write a polished email with a wrong number in it. A person reads it and sends it.
Your records must show what you told clients, and you must keep them for 7 years (NI 31-103 s.11.6). An AI app that messages clients outside your firm’s email or CRM leaves a gap in those records. CIRO lists messages through unapproved channels as a common problem.
Anti-spam law applies to AI-drafted email like any other: consent, who it’s from, and a working unsubscribe. Every claim must be true, including claims about how you use AI. Securities regulators warn that overstating AI use can be a misrepresentation.
BC’s private-sector privacy law has no breach-reporting duty yet, but your regulator, your contracts or federal law may still require a report. Tell compliance the same day so the firm can decide. Investment dealers must also report cybersecurity incidents to CIRO.
Your dealer or firm must approve and supervise these, and may be stricter than the law. Where it is, the firm’s rule wins.
At a dealer, the dealer picks the tools. It must vet outside services and supervise how they’re used. Take this page to your branch manager or compliance team and ask which tool is approved. Expect a business plan with training off and a data agreement.
Privacy law permits it for the purposes the client gave you the information, with safeguards and a contract with the provider. Many firms are stricter, for example names only, with no account numbers or balances. Follow your firm’s version.
Recording a call you are part of is legal. Privacy law still means telling clients you’re recording and why, at the start. The transcript and summary become client records, so your firm decides the tool, the words you use to tell the client, and where the records are kept.
Your firm’s communications policy says what needs approval before it goes out and what gets reviewed after. AI drafts follow the same policy.
Securities regulators expect firms to disclose AI use that directly affects the service a client gets, usually in the relationship disclosure. Your firm sets the wording.
Ask your insurer, or whoever arranges your E&O cover, whether errors in AI-assisted work are covered, and whether they expect anything from you, such as a written policy.
An AI tool can lean toward in-house or higher-fee products without anyone noticing. Conflict rules still apply, and regulators flag this risk for AI. Your firm decides how tools are tested and watched.
CIRO says it will ask about AI use in dealer exams. A significant change in how you serve clients may mean updating the firm’s registration filings. Compliance decides.
No general Canadian privacy law requires client data to stay in Canada. Your firm, a client contract or a carrier may require it. If so, check where the AI tool stores data before you connect it. Clients should be told their data may be processed outside Canada.
“Firm-approved tool” means a business AI plan your firm has approved, with training off and a data agreement in place. Never a personal or free account.
| Information | Answer | Why |
|---|---|---|
| Public informationMarket commentary, product documents, rules, your own templates | Yes | Nothing about a client. Use it freely. |
| Client names and contact detailsName, email, phone, employer | Firm-approved tool | Allowed with an approved tool. Much of it is already public. Your firm may limit it. |
| Meeting notes and goalsLife events, family, plans, preferences | Firm-approved tool | This is where AI saves the most time. Read every summary before it goes into the file. |
| Know-your-client profileIncome, net worth, risk tolerance, time horizon | Written sign-off | Sensitive financial information. Needs your firm’s written approval and the security basics. |
| Holdings, statements and policiesAccount values, positions, plan documents, policy details | Written sign-off | Worth the most for analysis. Check every figure before you rely on it. |
| Health informationHealth notes from planning conversations | Ask compliance | Sensitive, and needs express consent. Keep it out of general AI tools unless your firm approves a specific use. |
| SINs and government ID numbersSIN, driver’s licence, passport numbers | Never | The law limits how a SIN can be used. AI never needs them. |
| Bank and card numbersAccount, transit and card numbers | Never | Exactly what fraud needs. AI never needs them. |
| Passwords and sign-in codesAny login, key or one-time code | Never | Anyone who sees one can act as you. |
Pick a task. Each one has a prompt you can try today in a firm-approved tool.
AI drafts. You send from your firm’s email, so the message is captured.
Once the hard lines and your firm’s rules are met, this is a choice. No law picks it for you. More information makes AI more useful, and means reading its work more closely. Pick a level. The policy below follows it.
Want a partner to set up your chosen level with your compliance team and IT provider?
Before you connect client systems, read AI and sensitive information and how IT approval works.
The biggest risk usually isn’t the AI. It’s a reused password on the email account the AI is connected to.
These protect you whether you use AI or not. For settings, connections and working with your IT provider, read AI and sensitive information.
“I built an interactive dashboard with my company’s branding in two minutes. Commission structures, stages, all of it. Then I built an accounting folder that basically works like a bookkeeper.”
Training sessions and client calls feed into Solo, which updates Salesforce, compares carrier PDFs to the client’s situation, and drafts follow-up emails in his voice.
“It remembers. Twenty-five years of relationships, and it holds the ledger: who introduced whom, what I promised, what they said in their own words.”
Pre-call briefs are built from his files, calendar and recent emails. By Nathan’s estimate, preparing properly for a call went from about 45 minutes to about five minutes of reading.
About 45 minutesabout 5to prepare properly for a call
“It feels like you suddenly have an admin, an analyst, and a small team working behind the scenes.”
An AI workspace helps plan the day, prepare meetings, and draft presentations, investment memos, and financial models.
Client-reported results, not independently measured. Solo is our 30-day setup for one person: see Sidekick Solo · More client work
Answer in order. This is how to decide the next case this page doesn’t cover.
Answer in order. You’ll see the result as you go.
Fill in your details. The text follows your role, province and level. Copy it into your own document, or print it, and have compliance approve it.
Policy owner: ________ · Approved AI tool: ________ · Client information level: Names, no numbers · Effective: ________ · Next review: ________
I have read this policy and will follow it.
Name ____________Signature ____________Date ________
General information, not legal advice. Adapted from the Sidekick Orchestration Advisor AI use map, Version 1.0, September 28, 2026.
Want this policy fitted to your firm’s tools and client work, ready for your compliance lead to review and approve?
Prepared by Chase Bernier, Founder of Sidekick Orchestration. Each rule was checked against its primary source on September 28, 2026. General information, not legal or compliance advice. Your dealer’s, firm’s or carrier’s compliance team has the final say.
We coach your leaders on AI, then help you roll it out. Your compliance team approves the policy, your IT provider approves the connections, and then we train your advisors.
Have a question first? Text Chase at 778-999-0985 or email chase@sidekickorchestration.ai.
30 minutes with Chase. You leave knowing where AI fits your firm and what to do next, whether that’s with us or not. See how we work with advisory and insurance firms, or try the free AI assessment.