No cross-cutting AI standard exists. That's the first fact to know.

Chacun a droit au respect du secret professionnel. […] Le tribunal doit, d'office, assurer le respect du secret professionnel.

What it means

Professional secrecy is a right of the CLIENT, of quasi-constitutional rank, protected by the primacy clause in s. 52 of the Charter. It isn't a contract term you can arrange around: it's a right the court enforces on its own initiative.

What we answer

No vendor can release you from it, and we won't pretend otherwise. What the contract does is bar us from any use of your content for our own purposes, restrict our staff's access to a need-to-know basis, and give you a right of audit. The rest is your professional judgment.

hard law·1975, never amended; text read as up to date to 1 April 2026·Official source

Le professionnel doit respecter le secret de tout renseignement de nature confidentielle qui vient à sa connaissance dans l'exercice de sa profession. Il ne peut être relevé du secret professionnel qu'avec l'autorisation de son client ou lorsque la loi l'ordonne ou l'autorise par une disposition expresse.

What it means

The second paragraph closes the list: the client's authorization, or an express provision of law. The third paragraph adds one further opening, a narrow one — preventing a serious risk of death or serious injury — and only by communicating the necessary information to the persons exposed, to their representative or to those able to come to their aid. There is no “service provider” exception comparable to s. 18.3 of the Act respecting the protection of personal information in the private sector (CQLR, c. P-39.1, the section inserted by Law 25), which relieves ordinary businesses of the consent requirement when they award a mandate or a service contract.

What we answer

That is why a member of an order has to run a different analysis than a business does, and why we never present our Law 25 compliance as an answer to professional secrecy. The two regimes stack; the stricter one wins. Note too: the duty of secrecy that extends to your employees and collaborators does not come from the Code itself but from your order's code of ethics, which s. 87(3) requires every order to adopt.

hard law·In force since 1 July 2024; text read as up to date to 1 April 2026·Official source

Le Conseil d'administration doit, par règlement, déterminer des normes relatives à la tenue, à la détention et au maintien par un professionnel dans l'exercice de sa profession des dossiers, livres, registres […]

What it means

This is why there is no single answer: each order has its own regulation, with its own retention periods. Three years for a chartered human resources counsellor (C-26, r. 90, s. 2.04) or for a certified translator, running this time from the execution of the mandate (C-26, r. 281, s. 4); five years for a psychologist (C-26, r. 221, s. 8), a psychoeducator (C-26, r. 207.3, s. 10), a guidance counsellor (C-26, r. 71.1, s. 10), an occupational therapist (C-26, r. 121.1, s. 17), a physiotherapist (C-26, r. 200.2, s. 11) or an optometrist (O-7, r. 20, s. 2.04); seven for a lawyer (B-1, r. 5, s. 18, third paragraph); ten for an engineer (I-9, r. 7.3, s. 6) or for a notary (N-3, r. 17, s. 20); and unlimited for a land surveyor's greffe (A-23, r. 9, s. 18). Your order's regulation, not ours, sets your floor. Paragraphs 2 and 4 reach further than retention periods: every order must also regulate the transfer, assignment, provisional custody and destruction of records on striking off, cessation of practice or death, and the board of directors may then take possession of the records or require that they be handed over to an assignee.

What we answer

The platform applies no configurable purge, so nothing on our side is aligned with those periods. But it also has no retention that can be configured per professional order: that's a gap we name, and it weighs more heavily on an engineer with ten years than on a counsellor with three. Three of the product's hard-coded clocks do reach a record, however, and cannot be turned off: transcriptions are deleted after 30 days, tool-produced files after 7 days, and attachments staged but never sent after 48 hours. On the death or striking-off scenario, the answer is blunt: we cannot be the assignee or the provisional custodian of your records — several regulations reserve that role for a member of the order. What we do guarantee is a full export, to you or to the person the order designates. So keep the master copy of any record you must retain in your archiving system. A practical consequence if you carry a long retention obligation: if one of those timers carries off a piece of the record, it destroys it without regard to your period — export it before the deadline. Those are the timers that reach a record; other clocks exist elsewhere in the product, and the Confidentiality and compliance page publishes the full inventory.

hard law·Text read as up to date to 1 April 2026·Official source

Le professionnel doit respecter le droit de son client de prendre connaissance des documents qui le concernent dans tout dossier constitué à son sujet et d'obtenir copie de ces documents. Toutefois, le professionnel peut refuser l'accès aux renseignements qui y sont contenus lorsque la loi l'autorise.

What it means

The client may consult their record, obtain a copy of it, have inaccurate information corrected and have outdated or unjustified information deleted — subject to the refusals the law allows, in particular where disclosure would risk causing serious harm. On the order's side, s. 192 lets the syndic and the inspection committee demand the record; since 2 April 2026, the professional may raise against them neither litigation privilege nor professional secrecy. And s. 114 makes refusing to provide a document, or to let a copy be taken of it, an act of hindering — a disciplinary offence in its own right. A note for anyone verifying us: the consolidated version we link is “up to date to 1 April 2026”, the day before the coming into force — so the added words are not in it yet. The amending text is S.Q. 2026, c. 8, s. 32, brought into force by its s. 120.

What we answer

Conversations, documents and attachments export, and everything is deletable. A message can be corrected in place, and the change leaves an entry in the audit log — enough to answer an access or correction request and keep a record of it. So the right question to put to us is not “can I export?” for convenience, but “can I, on request and within a reasonable time, produce everything and let an inspector take a copy?” — because not being able to is hindering.

hard law·Text read as up to date to 1 April 2026; s. 192 amended by SQ 2026, c. 8, s. 32, in force 2 April 2026·Official source

Avant de communiquer à l'extérieur du Québec un renseignement personnel, la personne qui exploite une entreprise doit procéder à une évaluation des facteurs relatifs à la vie privée. […] Il en est de même lorsque la personne qui exploite une entreprise confie à une personne ou à un organisme à l'extérieur du Québec la tâche de recueillir, d'utiliser, de communiquer ou de conserver pour son compte un tel renseignement.

What it means

No law requires a professional to host in Quebec — sectoral exceptions aside — but do not conclude from that that no constraint applies. A private practice “carries on an enterprise” within the meaning of s. 1525 of the Civil Code: entrusting storage to a provider outside Quebec triggers a privacy impact assessment, and then a WRITTEN agreement that takes into account, among other things, the results of that assessment and, where applicable, the mitigation measures agreed on. It is the agreement the law requires in writing, not the assessment itself — documenting it remains good practice, and one the CAI recommends. Section 3.3 triggers a second, separate one for any plan to acquire or overhaul an information system that processes personal information — the purchase itself — and its scope must be proportionate to the sensitivity and the quantity of the information. The two are cumulative.

What we answer

We supply the raw material for those assessments rather than an attestation: hosting region and paired region, the list of model providers and their countries, what is sent to them and what is not, retention periods, security measures, and the contract clauses that frame all of it. The assessment itself stays yours — the law places it on the enterprise, not on the provider.

hard law·2021, c. 25, s. 111, in force since 22 September 2023; up to date to 1 April 2026·Official source

Quiconque confie un document technologique à un prestataire de services pour qu'il en assure la garde est, au préalable, tenu d'informer le prestataire quant à la protection que requiert le document en ce qui a trait à la confidentialité de l'information et quant aux personnes qui sont habilitées à en prendre connaissance.

What it means

This is the provision that governs exactly the act this page describes, and it imposes a PRIOR obligation on the professional: tell the service provider what protection the document requires as regards confidentiality, and who is authorized to read it. The second paragraph turns the obligation back on us, but it has to be read word for word — throughout the period of custody the service provider must see to it that the AGREED technological means are put in place to secure the document, preserve its integrity and, where applicable, protect its confidentiality and bar access to it by anyone not authorized, and must ensure compliance with any other legal retention obligation. The obligation is therefore indexed on what was agreed, and that is precisely why the prior notice in the first paragraph matters: it sets the level we will be held to.

What we answer

That obligation is ours, and it is in the contract: security, confidentiality, need-to-know access, notice if we are compelled to disclose. On your side, the prior step required by s. 26 happens at configuration time: who belongs to which group, which knowledge bases are accessible to whom, and which categories of document must not enter the platform at all.

hard law·2001, c. 32, s. 26; up to date to 1 April 2026·Official source

Le Prestataire de services s'engage à ce que toutes les données qui lui sont transmises par le Client, notamment les renseignements personnels concernant ses membres, soient hébergées sur des serveurs situés au Québec.

What it means

This isn't law: it's a model clause the Conseil makes available to the orders for their own procurement. But if your order uses it in a call for tenders, it becomes contractual — and it requires Quebec, not Canada.

What we answer

Our default region is Canada Central (Toronto), so outside the province of Quebec. Microsoft's residency commitment is to Canada, not to the province of Quebec: it expressly reserves the right to copy customer data between Canadian regions, and provides that personnel located outside Canada may access it remotely. Hosting in a Quebec region, available only under private hosting (the shared cloud has only one Canadian region), therefore moves processing closer to Quebec without contractually guaranteeing it. And even then, the clause as drafted covers “all data transmitted”: the model's computation at a foreign provider would have to be addressed explicitly.

commentary·January 2022; published 1 June 2022·Official source

À l'instar de l'Ordre des ingénieurs, le Conseil propose de préserver l'imputabilité du professionnel dans l'exercice de sa profession.

What it means

The cross-cutting position, as it stands today, fits in one sentence: the professional remains accountable for their professional act, not the machine. The Conseil examines two approaches — holding the creators of the AI system responsible, or holding responsible the person who applies its decision — and settles on the second, naming the “many hands problem”. So it takes no position on the vendor's contractual liability: that one belongs to contract and civil law, not to professional law. The document presents itself as avenues for reflection and asks what amendments to the Professional Code would be needed; the 2022 report confirms that the framework is missing and ranks data confidentiality among its fourteen challenges. In other words: the framework doesn't exist yet.

What we answer

We will not invent compliance with a standard that doesn't exist. What we can provide, order by order, are the facts your professional inspection will ask for: where the data sits, who has access to it, what leaves, what trains no model, and what the contract commits to.

commentary·December 2021; supplemented by the research report « Les enjeux transversaux au déploiement et à l'utilisation de l'IA au sein du système professionnel québécois », published by the CIQ on 2 June 2022·Official source

Entente de sécurité établie par écrit avec un fournisseur du Québec ou du Canada préalablement à l'utilisation d'un fournisseur infonuagique pour héberger des renseignements confidentiels;

What it means

This is not one order's position: nine of them wrote it together — physiotherapy, veterinary medicine, pharmacy, dietetics, psychoeducation, respiratory therapy, dentistry, nursing and occupational therapy. Three conditions fit in a single sentence: the agreement must be IN WRITING, the provider must be established in Quebec or in Canada, and the agreement must come before the service goes live. The order of operations counts: you do not regularize the contract after you have started loading records into it.

What we answer

Hilo Tech is established in Quebec and the master agreement is signed before the service goes live: two of the three elements in the CIQ's sentence are met, the writing and the precedence. Section 14 covers, in writing, confidentiality, security measures, staff access on a need-to-know basis only, incidents and an annual right of audit. The third element is not fully met, and we will not talk our way around it: the sentence asks for a Quebec or Canadian provider to host the confidential information, and while hosting defaults to Canada — Toronto, a Quebec region existing only under private hosting — the model's computation happens at foreign providers, several of them in the United States, to whom the content of your prompts is sent. For the nine orders that wrote it, that is the gap to assess, and it is a gap of location, not of contractual form.

regulator expectation·22 June 2017; copy distributed by the Ordre des diététistes-nutritionnistes du Québec·Official source

L'ingénieur doit apposer sa signature sur l'original et les copies de chaque consultation et avis écrits, mesurage, tracé, rapport, calcul, étude, dessin et cahier de charges qu'il a préparés lui-même ou qui ont été préparés sous sa direction et surveillance immédiates par des personnes qui ne sont pas membres de l'Ordre.

What it means

Two sections, not one: seal and signature for plans and specifications (s. 3.04.01), signature alone for reports, calculations, studies, drawings and written opinions (s. 3.04.02) — which is to say exactly the deliverables a generative AI touches first. An AI is not a “person” within the meaning of those sections: it is a tool. A deliverable produced with its help therefore remains one the engineer “prepared himself”, and authentication is mandatory, not optional. There is no category of deliverable that escapes the seal or the signature because an AI contributed to it.

What we answer

The platform signs nothing, seals nothing and claims to produce no engineering deliverable: the act of authentication stays entirely yours, and that is what the Ordre's guide requires — you cannot shed responsibility by claiming it was the AI that decided. The contract says so expressly: no generated output is to be treated as a final decision without human validation.

hard law·Up to date to 1 April 2026 (O.C. 2566-84, s. 4)·Official source

L'ingénieur ne peut être relevé du secret professionnel qu'avec l'autorisation de son client ou lorsque la loi l'ordonne.

What it means

These are the provisions the Ordre itself attaches to its work on AI. Section 3.06.04 adds a compartmentalization requirement, and it has to be quoted in full: an engineer must not ACCEPT A MANDATE that involves or may involve the disclosure or use of confidential information or documents obtained from ANOTHER client, without that other client's consent. So it is not a free-standing ban on use, and the other client's consent lifts it. For a platform, that goes straight to shared knowledge bases and memories shared across mandates.

What we answer

Every knowledge base, every assistant and every conversation carries its own access lists — by user and by group — and a folder created inside a project is shared with the project's members from the outset, and its creator keeps no particular authority over it; a personal folder cannot be converted into a shared folder. Content can feed an answer only if it has been explicitly attached to the conversation or to a base the user is entitled to. Compartmentalization by mandate is therefore possible, but it has to be configured: the platform allows it, it does not guess it.

hard law·Up to date to 1 April 2026·Official source

L'ingénieur prend les mesures raisonnables pour préserver la confidentialité et l'intégrité de ses dossiers en tout temps.

What it means

This is the regulatory anchor for every hosting decision an engineer makes — far more than the seal provision. It bears on confidentiality AND on integrity, at all times. Section 4 spells out what “traceability” means here: a retrieval system “allowing the various elements of a single record to be grouped together and traced”. A conversation history is not that.

What we answer

On confidentiality: dedicated instance, encryption in transit and at rest, access by user and by group, audit log. On integrity: edits to a message leave a trace in the log. On grouping by record, let's be exact — the platform organizes by conversation, by knowledge base and by workspace, not by engineering record number. If your retrieval has to be by record, it happens in your document management system, not here.

hard law·OPQ decision 2023-681, in force 23 March 2023; up to date to 1 April 2026·Official source

L'ingénieur tient ses dossiers de façon à permettre la compréhension de la démarche suivie dans le cadre de sa prestation de services professionnels et des motifs soutenant ses décisions.

What it means

The obligation is not to be able to find an exchange again: it is to record IN THE FILE the approach taken and the reasons behind the decisions, with the list the regulation enumerates — contract, correspondence, assumptions, calculations, opinions even where given verbally. Section 1, second paragraph, adds a point that is decisive for an enterprise platform, but it is conditional: records kept by the employer or by the firm are deemed to be the engineer's own IF THE ENGINEER CAN RECORD IN THEM documents or information relating to their professional services. A company instance where the engineer writes under their own identity can therefore qualify as the member's professional record; an instance where they can record nothing does not, and they must then keep their own record.

What we answer

We will not claim that your conversation history stands in for an engineering record: it does not. What it supplies is the raw material — what was asked, what the model answered, which model, when and by whom. Recording the approach and the reasons in the file remains your professional act. And since your employer's instance can qualify as a record under s. 1, export and file what belongs there.

hard law·In force 23 March 2023; up to date to 1 April 2026·Official source

L'ingénieur conserve chaque dossier pendant au moins 10 ans après la date de sa fermeture. L'ingénieur doit prendre les mesures raisonnables afin de s'assurer de la pérennité de tout système ou procédé d'archivage permettant d'avoir accès aux documents et aux renseignements contenus au dossier.

What it means

Ten years after CLOSING, and the obligation bears on the durability of the system: the documents must stay legible and accessible for that whole period. The Ordre's guide adds the “subcontractor” rule the code of ethics does not have — a backup copy in a separate and secure location, and “where archiving is entrusted to an intermediary, the extent of its responsibility is well understood”. Section 11, finally, reserves the role of assignee or provisional custodian to an engineer.

What we answer

Let's be plain on all three points. Durability: we offer no ten-year archiving guarantee, and a conversation platform is not an archiving system — a record you must retain has to be exported into yours. Backup in a separate location: two things have to be told apart. The database is replicated to a second Canadian region. The files you upload are not — they are backed up by daily snapshots kept 14 days, in your instance's region only, and they are block-level snapshots: the same guarantee as pulling the plug, not an application-consistent backup. The extent of our responsibility: it is written into the contract, with an annual right of audit. And we can never be your provisional custodian — which is why a full export is guaranteed.

hard law·In force 23 March 2023; up to date to 1 April 2026; guide revised in May 2024·Official source

L'ingénieur.e est en effet responsable de la protection des informations confidentielles qu'il ou elle transmet à des outils tiers.

What it means

This is the axis of the guide that bears directly on choosing a tool, and it is specific: be wary of free plans with lax policies, check whether the prompt is reused for training, read the terms of use, minimize and anonymize, encrypt, and “keep a record of processing activities and file it in your records”. Axis 5 adds informing the client that an AI system is being used. The guide declares itself to carry no weight as legal advice, but it is the standard professional inspection will apply. It ties these expectations to ss. 3.06.02 and 3.06.04 of the Code of ethics.

What we answer

Several points in that axis have a verifiable answer on our side: this is not a free plan, the console displays each provider's published training and retention policy, the contract bars training a public model on your content without your written authorization, exchanges are encrypted in transit and at rest, and access is controlled by user and by group. Other points in the axis are not ours, and we will not pretend otherwise: anonymizing and de-identifying data before it is sent — hashing, masking, generalization, differential privacy —, data minimization, federated learning, intrusion detection, informing the client and obtaining their consent, and the record of processing activities. We supply the raw material for those — audit log, per-user attribution, a model catalogue restricted by the administrator, Law 25 detection message by message — it being understood that this detection is a paid option, off by default, and that it is itself an outbound call that sends the text of the message to a model, so a way of measuring minimization, not of applying it — not the professional act.

regulator expectation·Published in September 2025; last amended in August 2026·Official source

Il est donc essentiel de ne jamais saisir des renseignements personnels, des données confidentielles ou des informations stratégiques dans un outil d'IA sans avoir la certitude que les données sont protégées, par exemple que l'outil fonctionne en circuit fermé interne à l'organisation.

What it means

The Ordre declares these guidelines “mandatory in scope”. It isn't a regulation, but it is the standard of practice professional inspection will apply. The only ranking the Ordre makes (Principle 06) sets the public tool against “a solution customized to the organization and hosted on its internal servers” — on-premises, not an instance operated by a provider; and it forbids confidential information in a public tool “with or without a paid subscription”. We will not make it say a comparison it did not make. On top of that come s. 12.1 of Law 25 for any candidate screening made without human intervention, and s. 18.1 of the Charter for protected grounds.

What we answer

No — and it has to be said here rather than a hundred lines further down. The box on page 8, to which Principle 03 expressly refers, describes three configurations, and an instance operated by a supplier is none of them: for the paid subscription, the Ordre writes that it “remains strongly recommended not to enter confidential information”, and it recognizes control over the data only in the local private model installed on the organization's own servers. That is not what we are. A dedicated instance brings you closer to what the Ordre describes — a separate database, named user accounts, an audit log — without matching it, and the guidelines are declared “mandatory in scope”. Anonymize what you put in, or do not put confidential information in at all. The point that remains yours in any event: if you wire up an automation that screens candidates with no human involved, you fall under s. 12.1 and must inform the person, give them the factors, and open a human review.

regulator expectation·12 June 2026; replaces the notice of 16 December 2025·Official source

Le membre doit protéger l'emploi et l'administration des techniques et des outils qu'il utilise ainsi que l'interprétation des informations qui en découlent contre une utilisation inadéquate de la part d'autrui.

What it means

The Ordre's guidelines expressly tie AI to this section, and draw three expectations from it: govern the use of AI within the HR | IR function, train the people who use it in safe use, and keep up a continuous watch so internal practices track the technology as it evolves. The obligation itself is hard law and drafted in open terms: protect the use of the tools against improper use by others. The means — named accounts, roles, a usage policy, prevention of shadow AI — are our reading of what it implies for a platform, not the text of the section, and “shadow AI” comes from another part of the guidelines. Section 51(2) doubles it on the people side: take the steps necessary so that collaborators and persons under supervision neither disclose nor use the information they come to know.

What we answer

That is exactly what the tooling is for: named accounts, groups, roles, a model catalogue restricted by the administrator, an audit log of who did what. A dedicated instance declared to the organization is also the most direct answer to shadow AI. The Ordre's two other expectations stay outside the product: the usage policy has to exist and be taught, and a continuous watch on how the tools evolve is work, not a setting.

hard law·Consolidated text up to date to 1 April 2026·Official source

Un conseiller doit conserver ses dossiers dans un local ou un meuble auquel le public n'a pas librement accès et pouvant être fermé à clef ou autrement. Lorsque suivant l'article 1.03, le conseiller utilise l'informatique ou toute autre technique pour la constitution et la tenue de ses dossiers, il doit s'assurer que leur confidentialité soit respectée.

What it means

This is the regulation made under s. 91 of the Professional Code, and one of the few hard-law texts that authorize computerizing the record while attaching a personal obligation to it: it is the member, not the vendor, who must ensure confidentiality is respected (s. 2.05, second paragraph, referring back to s. 1.03). Section 2.07 adds a condition rarely quoted in full: records kept by the firm or the employer count as the counsellor's own only IF THE COUNSELLOR CAN ENTER IN THEM the elements listed in s. 2.02 — date opened, the client's name, address and telephone number, the reasons for the consultation, a description and the date of the services rendered, recommendations, correspondence; failing that, they must keep a record for each of those persons. They must also sign or initial every entry they make in it.

What we answer

On confidentiality, we supply the means — dedicated instance, encryption, access by user and by group, named accounts, logging of entries — and you supply the verification: the s. 2.05 obligation is yours, and no vendor attestation transfers it. On s. 2.07, let's be exact: it is not our platform that spares you double record-keeping. The exemption presupposes being able to enter the elements listed in s. 2.02 — contact details, reasons, services rendered and their dates, recommendations, correspondence — in the firm's or the employer's record, and our product keeps no client file: it is organized by conversation and by knowledge base. It is a working tool upstream of your record; the record contemplated by s. 2.07 is your management system, not ours.

hard law·Consolidated text up to date to 1 April 2026·Official source

Lorsqu'une décision ou une recommandation s'appuie, en totalité ou en partie, sur des résultats générés par l'IA, inscrire au dossier les informations pertinentes pour la compréhension de la démarche, par exemple le nom de l'outil d'IA utilisé, la nature de l'intervention de l'IA, les données fournies à l'IA, les moyens pris pour limiter les risques, les résultats générés par l'IA et l'usage qui a été fait de ces résultats.

What it means

The expectation is open-ended, and that is what makes it demanding: record in the file “the information relevant to understanding the approach taken”, of which the Ordre gives six examples — the name of the AI tool used, the nature of the AI's intervention, the data supplied to the AI, the steps taken to limit risk, the outputs the AI generated, and the use made of those outputs. The list is illustrative, not exhaustive. It is the most concrete expectation in the document because it can be verified on the documents themselves. The same document, at p. 8, also ranks the architectures: from the moment data leaves the organization, it “remains strongly recommended not to enter confidential information and to anonymize data containing personal information”, and only a local private model installed on the organization's own servers is, in the Ordre's words, “the only way to keep control over the data and its uses”.

What we answer

The platform supplies, with no effort on your part, part of what the Ordre gives as examples: the tool and the exact model used, the data you supplied (the prompt, the attachments, the bases attached), the outputs generated — all timestamped, attributed to your account and exportable. The steps taken to limit risk and the use you made of the output are professional judgment: they get written down, they don't get logged — and since the Ordre's list is illustrative, your inspection may ask for more. One point we will not keep quiet about: the same document ranks the architectures by risk and takes the view that from the moment data leaves the organization it is better not to enter confidential information into it without anonymization, full control being achieved, according to the Ordre, only through a model installed on your own servers. Our dedicated private hosting narrows that gap, it does not close it: the model's computation still happens at third-party providers.

regulator expectation·Published 12 June 2026 (colophon: May 2026)·Official source

Les serveurs des outils grand public sont situés dans d'autres pays que le Canada. Les utiliser pour traiter des données confidentielles ou des renseignements personnels contrevient aux lois québécoises et canadiennes sur la protection de ces données.

What it means

The notice does not say “imprudent”, it says “contravenes” — and it ties the illegality to where the servers are. A member therefore has to know where the data of the tool they use is hosted, before assessing its linguistic quality. The Ordre also directs its members to fold these tools into a process that must, in every case, include at least one quality-control step carried out by a professional, whatever the machine puts out.

What we answer

What we deliver is not a consumer tool: an instance dedicated to your organization, hosting in Canada by default, and none of your content trains a public model without your written authorization. The distinction the notice does not draw and we have to: hosting is one thing, the model's COMPUTATION is another, and that computation happens at foreign providers, mostly in the United States. We show you what is sent to them, what is not, and what their published policies commit to — that is the material for your assessment, not its conclusion.

regulator expectation·Published 13 March 2025·Official source

La psychoéducatrice ou le psychoéducateur souhaitant utiliser l'IA dans sa pratique doit demeurer prudent quant au partage d'informations de ses clientes et clients, en anonymisant rigoureusement les renseignements pour éviter les possibles risques d'identification.

What it means

It is the only Quebec guide that asks the question by name — “Can I use AI for my record-keeping?” — but it files it among its members' open questions and answers it nowhere: the answer “yes, on condition” is a reading, not the Ordre's written position. What it does state is clear-cut: the test is not the removal of the name, it is the elimination of the “possible risks of identification”, and therefore of the details that would let an identity be reconstructed; and for record-keeping specifically, you must “transmit to the AI no information that would allow them to be identified”. In other words: neither a ban nor a permission, but a strict anonymization condition. The guide is silent on hosting, location, encryption and retention — so it cannot be invoked on those grounds.

What we answer

The platform helps, it does not decide for you. Law 25 detection flags personal information, secrets and passwords message by message, and a review queue escalates them to the administrator; confidentiality mode lets you handle an exchange without it feeding anything. Two things to know before counting on it: this detection is a paid option, off by default, and it is itself an outbound call to a model. And it does not anonymize on your behalf, and “rigorously” is a professional judgment, not a setting. We will not pretend otherwise: you are the one who decides what goes in.

regulator expectation·Adopted at the sitting of 24 May 2025; publication dated June 2025·Official source

La présente section permet l'utilisation des technologies de l'information pour la tenue, […] des dossiers des clients d'un conseiller d'orientation pourvu que la confidentialité des renseignements qui y sont contenus ainsi que l'exercice des droits d'accès et de rectification soient assurés.

What it means

The instrument is a checklist, but the text it reproduces is hard law: the Ordre's record-keeping regulation. It expressly permits information technology — and sets two cumulative conditions. Confidentiality, as expected. And, just as much, the effective exercise of the rights of access and rectification: a tool that protected the data well without allowing it to be consulted or corrected would not meet the permission.

What we answer

Both conditions can be demonstrated. Confidentiality: dedicated instance, encryption in transit and at rest, access by user and by group, audit log. Access and rectification: conversations, documents and attachments export, a message is corrected in place and the change leaves an entry in the log. What the platform is not is a record-keeping system: it is organized by conversation and by knowledge base, not by client file. For record-keeping itself, it is a working tool upstream of your record, not the record.

regulator expectation·16 July 2026 — the most recent text in the corpus of the orders·Official source

Processing by a processor shall be governed by a contract or other legal act under Union or Member State law, that is binding on the processor with regard to the controller...

What it means

If a European client entrusts you with the role of processor (or if you yourself subcontract to a vendor), a separate data processing agreement is required, with the article 28 safeguards — independently of professional secrecy, which remains your strictest obligation.

What we answer

We do not yet offer a GDPR-compliant DPA (article 28) in our standard catalogue. If your mandate touches data belonging to people in the EU or the EEA, tell us before you sign: it's a gap we would rather name than have you discover mid-mandate. They are negotiated at the order form, case by case; productising them is not scheduled.

hard law·In force since 25 May 2018·Official source

Any transfer of personal data which are undergoing processing or are intended for processing after transfer to a third country... shall take place only if... the controller and processor comply with the conditions laid down in this Chapter.

What it means

Canada holds a PARTIAL European Commission adequacy decision (Decision 2002/2/EC, maintained at the 2024 review): it covers only private organizations subject to PIPEDA. A transfer to an instance hosted in Canada with such an organization therefore rests on adequacy. Two caveats: an instance hosted outside an adequate country, and the onward hop to a model provider outside the EU, each need their own basis — in practice, standard contractual clauses.

What we answer

We do not yet offer signed standard contractual clauses in our standard catalogue. For a mandate involving data belonging to people in the EU or the EEA, talk to us about your specific need before contracting.

hard law·In force since 25 May 2018; standard clauses of 4 June 2021·Official source

In the case of a personal data breach, the controller shall... notify the personal data breach to the supervisory authority competent... without undue delay and, where feasible, not later than 72 hours after having become aware of it...

What it means

Seventy-two hours, a fixed deadline. If you act as processor for a European principal, you must notify them without undue delay so their 72-hour clock can start on time — well ahead of your own professional retention deadline.

What we answer

The contract obliges us to notify you without delay, with the nature of the incident, the people affected, the period and the measures taken — but with no stated number of hours. For a mandate subject to the GDPR, this is a clause to negotiate explicitly in the order form.

hard law·In force since 25 May 2018·Official source

La présente section permet l'utilisation des technologies de l'information pour la tenue, la détention ainsi que le maintien des dossiers des clients d'un psychoéducateur pourvu que la confidentialité des renseignements qui y sont contenus ainsi que l'exercice des droits d'accès et de rectification soient assurés. […] Le psychoéducateur doit conserver les dossiers dans un local ou un meuble auquel le public n'a pas librement accès et pouvant être fermé à clé ou autrement. […] Le psychoéducateur doit conserver chaque dossier pendant au moins 5 ans à compter de la date du dernier service professionnel rendu.

What it means

Section 1 is a conditional permission, and the condition is part of the permission: the record may be kept by information technology provided that confidentiality and the exercise of the rights of access and correction are ensured. The safekeeping rule in section 9 is written for paper — “premises or a piece of furniture” kept locked, to which the public does not have free access — and it transposes to digital as an obligation to restrict access to the same degree. The period is 5 years from the last professional service rendered, and the second paragraph of section 10 adds that the destruction that follows must itself preserve confidentiality. Division III closes the loop: on definitive cessation of practice, permanent striking off or death, the records pass to an assignee who is a psychoeducator or to the secretary of the order, who must still keep them for at least 5 years (ss. 28, 29 and 34) — section 27 allowing that retention to be carried out by technological means on the same conditions as in section 1.

What we answer

The instance is dedicated and hosted at Microsoft Azure, Canada Central region (Toronto) by default; access is set per user and per group, the audit log keeps a trace of accesses and changes, and the model catalogue can be restricted all the way to the global kill switch, which binds administrators too. That supports the confidentiality condition in section 1; it does not on its own guarantee it, because inference leaves Canada — the model providers are established in the United States and in France. And the kill switch binds only the models a user picks: the extraction of the text of a document added to a knowledge base, the generation of conversation titles, and the Law 25 detector if you enable it are calls the server makes on its own. On section 10, the answer is blunt: retention is not configurable, so nothing on our side is aligned with your 5 years. Three of the product's timers that cannot be turned off run the other way — transcriptions at 30 days, tool-produced files at 7 days, attachments staged but never sent at 48 hours — and other clocks exist elsewhere in the product; if one of them carries off a piece of the record, it destroys it without regard to your period. Keep the master record in your archiving system; the full export of conversations, documents and attachments in open formats is there to feed it. We issue no certificate of destruction. And we cannot be your assignee: section 28 reserves that role for a psychoeducator or for the secretary of the order.

droit dur·Décision 2011-06-10, 2011 G.O. 2, 2284 ; modifié par la Décision OPQ 2025-947, 2025 G.O. 2, 7238 ; texte lu à jour au 1er avril 2026·Official source

Le conseiller d'orientation doit conserver les dossiers dans un local ou un meuble auquel le public n'a pas librement accès et pouvant être fermé à clef ou autrement. […] Le conseiller d'orientation doit conserver chaque dossier pendant au moins 5 ans à compter de la date du dernier service professionnel rendu. […] À l'expiration de ce délai, il peut procéder à la destruction du dossier en s'assurant de préserver la confidentialité des renseignements qui y sont contenus.

What it means

This is the enacted law behind the order's checklist: the sentence the checklist reproduces is section 1 of this regulation, which allows the record to be kept by information technology provided that confidentiality and the exercise of the rights of access and correction are ensured. The rest, the checklist does not say: section 9 requires safekeeping to which the public does not have free access, section 10 sets 5 years from the last professional service rendered, and the destruction that follows that period must preserve confidentiality. Sections 24 to 32 add the cessation of practice: the records — including the software and the psychometric material — pass to an assignee who is a guidance counsellor or to the secretary of the order within 15 days, section 25 again allowing the technological route on the same conditions.

What we answer

The conditions in section 1 are the ones on which we can produce evidence: a dedicated instance, Microsoft Azure hosting in the Canada Central region (Toronto) by default, per-user and per-group access, an audit log of changes, shares, administrator access and knowledge-base retrieval, full export and the correction of a message with a trace in the log — enough to document access and correction. What the same list does not cover: inference leaves Canada, to providers established in the United States and in France, and the model-catalogue kill switch binds only the models a user picks, not the calls the server makes on its own — the extraction of the text of a document that has been added, conversation titles, the Law 25 detector if you enable it. On section 10, we do not hold your period: retention is not configurable, there is no certificate of destruction, and three of the product's timers that cannot be turned off delete transcriptions at 30 days, tool-produced files at 7 days and attachments never sent at 48 hours. The psychometric material referred to in section 24 deserves a mention of its own: it has no business in a shared knowledge base. And we cannot be the assignee — section 26 reserves that role for a member of the order or for the secretary.

droit dur·Décision 2012-02-09, 2012 G.O. 2, 920 ; modifié par la Décision OPQ 2025-927, 2025 G.O. 2, 6270 ; texte lu à jour au 1er avril 2026·Official source

Pour chacun de ces mandats, le membre doit conserver en outre sur support papier ou support électronique: 1° dans le cas d'une traduction, le texte à traduire et la traduction réalisée; […] Le membre doit conserver les dossiers visés à l'article 3 pendant au moins 3 ans à compter de la date à laquelle le mandat a été exécuté. […] Les dossiers visés aux articles 2 et 3 sont conservés dans un local ou un meuble auquel le public n'a pas librement accès et pouvant être fermé à clef ou autrement, ou sur des supports électroniques auxquels le public n'a pas accès.

What it means

This 1996 regulation is the most explicit of the set on the medium and the most silent on security. Section 5 offers two equivalent branches: premises or a piece of furniture kept under lock and key, OR electronic media to which the public does not have access — so digital does not have to be justified, but no condition of confidentiality, of integrity or of rights of access is attached to it, unlike the more recent regulations of the other orders. The period is 3 years from the execution of the mandate, the shortest of the six orders examined here. And section 3 is the one that bears directly on the translation tool: what must be kept is the text to be translated AND the translation produced — in other words the client's content itself, not merely mandate metadata.

What we answer

Section 5 is satisfiable, and it is rare to be able to write that: “electronic media to which the public does not have access” describes a dedicated instance with per-user and per-group access and an audit log. The hard point is elsewhere. Section 3 obliges you to keep the source text and the translation for 3 years; yet our retention is not configurable and runs the other way — tool-produced files disappear at 7 days, attachments staged but never sent at 48 hours, transcriptions at 30 days, and other clocks exist elsewhere. A translation conversation is therefore not a record within the meaning of section 3: export the text and its translation into your own archive, in open formats, before the deadline. Second point, the one the order's opinion already raises: the client's text goes off for inference outside Canada, to providers established in the United States and in France, and the model-catalogue kill switch does not bind the calls the server makes on its own. The contract bars any training on your content without written authorization (ss. 14.2 and 14.7); it does not repatriate the processing. Finally, we cannot be the assignee of your records: section 8 reserves that role for a member of the order or for the secretary.

droit dur·Décision 96-12-19, 1997 G.O. 2, 418 ; modifié par L.Q. 2008, c. 11, a. 212 ; texte lu à jour au 1er avril 2026·Official source

L'arpenteur-géomètre doit garder au Québec son greffe, tout greffe dont il est dépositaire, cessionnaire ou gardien, ainsi que tout greffe commun dont il est gardien. […] La conservation du greffe ou du greffe commun est d'une durée illimitée.

What it means

This is the hardest residency rule in the Quebec professional system, and it is stricter than section 88 of the Act respecting the distribution of financial products and services: the greffe must be KEPT IN QUEBEC — not in Canada, not “at a provider offering adequate safeguards” — and it must be kept for an UNLIMITED period, with no term and no right of destruction. Section 2 expressly authorizes computer means to constitute and keep the greffe, so the constraint is not technological: it is geographic and perpetual. Section 19 adds satisfactory protection against fire, water and theft, and the Regulation respecting the keeping of an office (A-23, r. 17, s. 3) further requires that “the office must be located in Quebec”. Consolidated version read as up to date to 1 April 2026; section 17 was amended by Decision 2009-03-26.

What we answer

A blunt answer: your greffe must not live in the platform. By default, your instance is hosted on Microsoft Azure in the Canada Central region, in Toronto — in Canada, but outside Quebec, which does not satisfy section 17. A Quebec region is available only under private hosting; the shared cloud has only one Canadian region. And even in a Quebec region, model inference leaves Canada (providers in the United States and in France; a Singapore entity for video only): what is sent to a model leaves Quebec. On top of that comes the unlimited period in section 18, which we cannot promise — retention is not configurable and several timers fire without any way to turn them off (transcriptions at 30 days, tool files at 7 days, attachments never sent at 48 hours, and other clocks elsewhere in the product). What the platform can do for a land surveyor: the work that is not the greffe — research, correspondence, drafting, summarizing — with a restricted model catalogue, an audit log and full export. Minutes, documents in brevet form, evolving documents, the repertory and the cadastral index stay in a system kept in Quebec.

droit dur·2026-04-01·Official source

Rien dans le présent règlement ne doit être interprété comme excluant l'utilisation de l'informatique ou de toute autre technique pour la constitution et la tenue des dossiers d'un architecte.

What it means

Information technology is permitted with no proviso — and that is exactly what sets this regulation apart. Where the évaluateurs agréés and the optométristes attach a condition to the same permission ("provided confidentiality […] is assured"), section 1.03 attaches none. The safekeeping rule, though, was never modernized: section 2.05 requires "a room or a piece of furniture to which the public does not have free access and which can be locked or otherwise secured", without the electronic equivalent that the administrateurs agréés' regulation took the trouble to add. A fully digital practice therefore reads itself into a text that describes a lock. Retention: 5 years from the last service rendered or from completion of the works (s. 2.03), plus 5 years from notice of a construction defect (s. 2.04) — a clock that can restart years after handover.

What we answer

On section 1.03 there is nothing to demonstrate: the permission is unconditional. On section 2.05 we provide the functional equivalent of a locked cabinet — a dedicated instance, per-user and per-group access on every object, an audit log, encryption at rest and in transit — but you are the one who will have to write that this equivalent satisfies a text drafted for a lock, because the regulation does not say so. On section 2.04, be precise with us: retention is not configurable, we issue no destruction certificate, and the construction-defect clock can require you to keep a record well beyond the delays the product applies on its own — the Confidentiality and compliance page publishes the full inventory. The project record stays in your system; the full export feeds it.

droit dur·À jour au 1er avril 2026·Official source

Les dossiers visés aux articles 2 et 3 sont conservés dans un local ou un meuble auquel le public n'a pas librement accès et pouvant être fermé à clef ou autrement, ou sur des supports électroniques auxquels le public n'a pas accès.

What it means

For a cloud buyer this text settles in advance the question the others leave open: section 5 puts electronic media on the same footing as the locked cabinet, in so many words, instead of leaving the equivalence to be inferred. Section 2 points the same way — the record is kept "on paper or electronic media". The criterion is therefore not the place, it is inaccessibility to the public. Retention: 5 years from execution of the mandate (s. 4). Watch section 3, though: a member authorized to issue a sound-management compliance opinion must keep a precise list of analysis materials on file, and those fall under the same safekeeping rule.

What we answer

This is the requirement we meet most cleanly on this whole page, because the regulation names the electronic medium itself. What we put against "to which the public does not have access": a dedicated instance, no anonymous public links by default, per-object and per-group rights, an audit log. One caveat before you rely on it: sharing outside your organization IS on by default — the ceiling and the list of invitable domains are configurable, down to "never", but that is a setting to make, not an initial state. On the 5 years of section 4, retention is not configurable and we issue no destruction certificate.

droit dur·À jour au 1er avril 2026·Official source

Rien dans le présent règlement ne doit être interprété comme excluant l'utilisation des technologies de l'information pour la constitution, la tenue ainsi que la conservation des dossiers, pourvu que la confidentialité des renseignements qui y sont contenus ainsi que l'exercice des droits d'accès et de rectification soient assurés.

What it means

The permission is conditional, and the two conditions are not demonstrated the same way: confidentiality is a matter of measures, the exercise of access and rectification rights is a matter of procedure. Section 2 adds a constraint most records regulations do not have — the record "must be kept at the place where the member practises" — which is worth reading with your Order before concluding that cloud hosting satisfies it. Retention: 5 years from the last service rendered or the last entry (s. 6), then destruction permitted while preserving confidentiality (s. 9).

What we answer

On confidentiality the means exist and can be demonstrated: a dedicated instance, Azure Canada Central (Toronto) hosting by default, per-object and per-group rights, an audit log, encryption in transit and at rest. On access and rectification rights the answer is shorter than it looks: an administrator locates and removes a named person's data, but case by case — there is no self-service portal and no committed deadline in the contract. On section 2 we will not decide for you: "the place where the member practises" was not written for a data centre, and if your Order reads it literally, none of our technical characteristics answers it. On section 9, deletion is possible and immediate, but we issue no certificate of it.

droit dur·À jour au 1er avril 2026·Official source