Putting a client’s numbers into an AI tool doesn’t hand the AI vendor your accountability along with the data.
Short answer
Yes, there is no Canadian rule against it. But the accountant’s privacy and confidentiality obligations travel with the client file wherever it goes — including into an AI tool — and PIPEDA is explicit that accountability for personal information does not transfer to whoever processes it next.
PIPEDA Schedule 1, clause 4.1.3 is the operative text, and it reads plainly: “an organization is responsible for personal information in its possession or custody, including information that has been transferred to a third party for processing”. For this purpose, an AI service that ingests a client’s file is a third-party processor like any other. The accountant remains on the hook for what happens to that information at the vendor — the mechanism for enforcing that is the contract you sign with the tool, not a hope that the vendor behaves.
Before that contract is even signed, the joint federal-provincial-territorial privacy principles for generative AI ask an organisation using the tool to “consider whether the use of a generative AI system is necessary and proportionate… evidence-based”. That is a due-diligence step, not a formality — it is the difference between choosing a tool because it is convenient and choosing one because it is fit for handling client data.
The confidentiality duty an accountant owes a client existed long before generative AI and doesn’t move because a new tool is involved — a breach of that duty is enforced the same way a confidentiality-clause breach always has been, through damages and, where the harm is ongoing, an injunction.
One thing worth checking before the file goes anywhere: whether the vendor’s terms let your inputs be used to improve the model going forward. That is a separate question from whether you can use the tool at all — see can I stop a tool training on my data.
No Canadian accounting-specific AI disclosure rule was found in the sources checked for this page. In its absence, the closest reasoned framework in the Canadian record belongs to lawyers, not accountants — the Law Society of Ontario’s four-factor disclosure test discussed here — and it generalises by analogy rather than by rule.
Keeping a vendor accountable for client data once a tool is live is an operations discipline, not a one-time decision at sign-up.
