“A tool that does not guarantee confidentiality” — your order's test, word for word

Le comptable professionnel agréé est tenu au secret professionnel et il ne peut divulguer les renseignements de nature confidentielle qui viennent à sa connaissance dans l'exercice de sa profession, à moins qu'il n'y soit autorisé par son client ou par une disposition expresse de la loi.

What it means

Watch the version: this Code replaced the previous one on 9 May 2024, and the renumbering is not the one people assume — former section 48 became 39, former 49 became 42, and section 40 is a NEW obligation with no equivalent before 2024. The second paragraph adds a duty distinct from secrecy: to be discreet about any information concerning a client, whether or not it is protected by professional secrecy.

What we answer

The contract protects your “confidential information”, a broader term than “personal information”, with a mutual obligation and advance notice before any legally compelled disclosure. We do not claim to relieve you of professional secrecy: we commit not to undermine it and to let you verify that.

hard law·In force 9 May 2024 (O.C. 716-2024); version read as updated to 1 April 2026·Official source

À toute étape du processus de préparation, de conservation et de transmission de renseignements, le comptable professionnel agréé prend les mesures raisonnables, notamment à l'égard des personnes qui collaborent avec lui, pour assurer la protection des renseignements de nature confidentielle obtenus ou portés à sa connaissance dans l'exercice de sa profession.

What it means

The three stages named — preparation, retention, transmission — map exactly onto the path data takes through an AI platform, and the section expressly reaches “the persons who collaborate” with you, which includes a vendor. A version point to check at your end: this section did not exist before 9 May 2024, so a firm IT policy written earlier never took it into account.

What we answer

Preparation and retention: a dedicated instance in Canada, encryption at rest, per-object permissions, an audit log. Transmission: TLS 1.2 or higher on every segment, and, at the model provider, a preamble identifying the author by name, email and whichever directory fields are filled in. It is a record of measures you can file as is.

hard law·In force 9 May 2024; version read as updated to 1 April 2026·Official source

Le comptable professionnel agréé doit conserver à son dossier le raisonnement au soutien du document produit ou des recommandations faites au client.

What it means

The obligation an AI tool triggers most directly, and the easiest to miss. It is not the output that has to end up in the file, it is the REASONING that supports it. An analysis produced with a model's help does not become documented reasoning because it happens to read well.

What we answer

The platform keeps the full history of every exchange — prompts, sources consulted, successive versions — which gives you what you need to reconstruct the reasoning and put it in the file. It does not file it for you, and it does not tell apart what counts as reasoning from what is only a draft. That is an export to make, and a judgment to exercise.

hard law·In force 9 May 2024 (O.C. 716-2024); text read as updated to 1 April 2026·Official source

Lorsqu'il prévoit que certains services liés à l'exécution du contrat seront exécutés, sous des aspects essentiels, par une personne n'exerçant pas au sein du même cabinet, le comptable professionnel agréé en informe son client et obtient son consentement.

What it means

Heavier than the obligation of means in section 40: the client must be informed AND must consent, in advance. Whether a platform is “a person” is arguable, but the Ordre's IT guide lands the same way, asking you to tell clients that data belonging to them is entrusted to a third party.

What we answer

We cannot inform your client for you, and we cannot decide for you whether your use touches “essential aspects” of the engagement. What we give you for that conversation: the path a request takes, the hosting regions, the subprocessors by role and each provider's retention policies.

hard law·In force 9 May 2024; text read as updated to 1 April 2026·Official source

Il doit, lorsque le client le demande, fournir une copie de ces documents sur un support répondant au mieux des intérêts du client. Des frais raisonnables peuvent être exigés pour la reproduction ou la transmission des documents.

What it means

Section 57 sets the scope first: this division only bites where you provide services to third parties. That aside, it is the client's request that triggers the obligation, and it is the client's interest that governs the choice of medium, not the firm's convenience — reasonable reproduction or transmission fees remain permitted. The second paragraph reserves two things: the techniques, methods or processes you have developed and treat as confidential, and the assurance programme or procedures, except to let the CPA who succeeds you on an assurance engagement consult your working file to a reasonable extent. Those are the only reservations: exporting the rest is not a commercial favour, it is an ethical duty.

What we answer

Answering on retention alone — “the file exports in full” — leaves out the duty that makes that export non-optional. The export exists and it is complete: conversations, documents and attachments, in open formats you can hand over as is or reformat. The choice of a medium “best serving the client's interests” nonetheless stays yours, and the export does not make it for you: it produces what the platform holds, not what best serves your client. Two gaps to know about before a request arrives. Three of the product's hard-coded timers that cannot be switched off — transcripts at 30 days, tool-produced files at 7 days, attachments never sent at 48 hours — may have removed an item before the request lands; and retention is not configurable, so you cannot lengthen them to cover the period during which a client may ask for a copy. Those are the timers that reach a record; other clocks exist elsewhere in the product, and the Confidentiality and compliance page publishes the full inventory.

hard law·In force 9 May 2024 (O.C. 716-2024); text read as updated to 1 April 2026·Official source

Ne jamais saisir de renseignements confidentiels, personnels ou sensibles dans un outil qui ne garantit pas la confidentialité des renseignements.

What it means

The Ordre's test is about the guarantee, not the intention: it adds that data must be kept to the strict minimum and treats any loss of control as an ethical risk. We also have to say what we are not quoting. The page sets out five blocks — Objectivity, Integrity, Competence, Professional conduct and Confidentiality — and we reproduce only the last, the one our product answers well; the golden rule sits elsewhere, under Professional conduct: “the use of AI must always be governed, supervised and documented: you are responsible for the decisions taken and the results used.” The blocks also call for “clear governance […] appropriate controls and ongoing supervision”. So the operational question has two halves, and the second is not settled by a contract: what establishes the confidentiality guarantee, and what documents your supervision — responsibility for the result staying yours, which no platform setting shifts.

What we answer

Through a contract, not a promise: no training of a public model on your confidential information without written authorization, an enumerated list of purposes, a default configuration with providers whose terms do not permit training, and each provider's published policies displayed in your console so that verification does not rest on our word.

regulator expectation·No date shown; HTTP header of 15 June 2026; accessed 6 August 2026·Official source

Le membre doit conserver chaque dossier pendant au moins 5 ans à compter de la date à laquelle le mandat a été exécuté. Il peut utiliser tout système ou procédé d'archivage qui lui donne accès à l'information que contenait le dossier à la date de sa fermeture.

What it means

Five years is a floor, not a target: tax legislation, professional standards and your insurers often require more. Destruction must preserve confidentiality. And the second paragraph offers a disjunction people forget: an original belonging to the client cannot be destroyed without their authorization OR, once the period has run, without having given them the chance to take it back.

What we answer

No purge you can configure breaks your five years, and the file exports in full. Three automatic deletions apply all the same. Three timers are hard-coded and reach a record directly — transcripts at 30 days, tool-produced files at 7 days, attachments never sent at 48 hours. If one of them holds a piece of your file, it destroys it without regard to your five years: export it before the deadline — we issue no certificate of destruction, so that is the only remedy. As with any working tool, keep the master copy in your archive: that is what carries the regulatory period, here as anywhere else. Those are the timers that reach a record; other clocks exist elsewhere in the product, and the Confidentiality and compliance page publishes the full inventory.

hard law·Decision 2001-06-20; version read as updated to 1 April 2026·Official source

Le membre doit consigner pour chaque dossier les éléments et renseignements suivants et les conserver sur support papier ou support électronique: […] 6° le rapport ou le document remis et les recommandations faites au client; 7° la correspondance et les notes

What it means

It is section 4 that authorizes an electronic medium, not section 35: section 35 is a non-exclusion clause — “nothing shall be interpreted as excluding” — and a non-exclusion clause is not a permission. Section 6 adds that the record is kept in a place or on a medium the public cannot access, and section 2 that it is kept where you practise.

What we answer

So an electronic medium is lawful, and it is section 4 that says so. What we will not say: that the CPA corpus is silent on the border and that this silence amounts to permission. It is not — section 2 ties you to your place of practice, and section 17 of Law 25 requires an assessment and a written agreement before anything leaves Quebec. Our model computation does leave Quebec; the assessment is yours to make and we give you the material for it.

hard law·Decision 2001-06-20; version read as updated to 1 April 2026·Official source

Avant de communiquer à l'extérieur du Québec un renseignement personnel, la personne qui exploite une entreprise doit procéder à une évaluation des facteurs relatifs à la vie privée. […] Elle doit faire l'objet d'une entente écrite

What it means

An accounting firm is an “enterprise” within the meaning of this Act, and nothing in the Ordre's corpus exempts it. The assessment and the written agreement are required BEFORE anything first leaves Quebec — and “leaving” does not only mean “sending”: the third paragraph reaches entrusting someone outside Quebec with keeping information on your behalf, so hosting itself. Our default region is Canada Central, in Toronto: it is outside Quebec, so it triggers section 17 on its own, before a single request has gone out to a model, and section 3.3 triggers a second assessment for the acquisition of the system itself.

What we answer

The master agreement already carries the security and confidentiality clauses (section 14), but let us be precise about what the Act asks: the written agreement under section 17 must take into account, in particular, the RESULTS of your assessment and, where applicable, the mitigation measures agreed on. A standard clause signed before any assessment cannot, by construction, take account of results that do not yet exist: on its own it therefore does not satisfy the requirement, and we add an amendment restating your conclusions where needed. The assessment is yours, and we supply the inputs for it. We put it here because it is true that no CPA text imposes a location — and easy to conclude from that that the question is settled. It is not: it is settled by Law 25, not by your order's corpus.

hard law·S.Q. 2021, c. 25, s. 111; in force 22 September 2023; text read as updated to 1 April 2026·Official source

Recourir à des fournisseurs québécois ou canadiens, surtout pour les actifs informationnels critiques ou confidentiels.

What it means

This is a good practice, not an obligation: nothing in the CPA corpus imposes a location. The guide does nonetheless ask you to verify the physical location of the servers, the separation between tenants, ownership of the data, any use of it to train an algorithm and the terms of destruction — and to provide for all of it in the contract.

What we answer

Hilo Tech is a Quebec company, hosting sits in Canada, and the contract is governed by Quebec law with the courts of Montreal having jurisdiction. Where we do not tick the box: the model's computation runs at the chosen provider, several of which operate in the United States. We will not present that as fully local hosting.

regulator expectation·PDF created 26 September 2023; still featured on the Ordre's site as at 6 August 2026·Official source