AI for client onboarding at a Canadian firm

What onboarding actually means inside a firm

When a business talks about onboarding, it usually means welcoming a customer. When a firm says it, it means something narrower and riskier: deciding whether you can act, confirming who the client is, agreeing what you will and will not do, setting the fee basis, and opening a file that can be defended years later.

That is the engagement lifecycle, and it is the part of practice management that most often goes wrong quietly. A missing conflict clearance or an engagement letter that never came back signed does not cause a problem this week. It causes one when the relationship sours.

So the useful question is not "can AI onboard clients". It is: which of those steps are clerical, and which are professional judgment that a named person has to sign?

The steps where AI genuinely earns its place

Intake summarising. A prospective client sends three emails, a spreadsheet and last year’s statements. AI can produce a structured summary — entity type, year end, services requested, who the contacts are — so the partner reads one page instead of an inbox thread.Document extraction. Incorporation records, prior-year filings, identification documents and bank letters can be read and their fields written into your practice-management system, turning manual keying into review-and-correct.First-draft engagement terms. AI can assemble a draft engagement letter from your own approved clause library and the answers captured at intake. A draft is not a signed letter; see the clauses that carry the weight in a service agreement before you let a template harden into a habit.The client request list. The list of records you need from the client is generated from the engagement type and the entity’s facts, then reviewed rather than rebuilt every time.

The steps a licensed person has to keep

The acceptance decision is yours. Whether the work is within your competence, whether there is a conflict, whether independence is threatened, whether the client is one you want — these are professional judgments, and your provincial CPA body or law society holds you to them, not your software vendor.

The engagement letter is signed by a person, not generated by one. And the standard of care that applies if the engagement later goes wrong is a legal question with a settled test — the duty of care analysis does not soften because a tool produced the first draft. Professional negligence claims against accountants turn on what the firm did, not on what the firm’s software did.

Note also that the type of engagement changes the letter. the Auditing and Assurance Standards Board distinguishes audit, review, compilation and other assurance engagements, and each carries different responsibilities that the letter has to state accurately.

Where client identification obligations come in

Accounting firms are not automatically caught by Canada’s anti-money-laundering regime. FINTRAC’s guidance is specific: the obligations apply when you engage in — or give instructions on behalf of a client in respect of — receiving or paying funds, purchasing or selling securities, real estate, business assets or entities, or transferring funds or securities. FINTRAC also states plainly that audit, review and compilation engagements are not subject to the Act or its regulations.

FINTRAC further distinguishes giving instructions from providing advice: directing the movement of funds is an instruction, while recommending a course of action is advice, and advice does not trigger the requirements.

If your practice does perform those activities, identification is not a formality — it has prescribed methods and prescribed records, and AI can prepare the record but cannot be the verifier. That is covered separately in our article on AI for KYC at a professional firm.

Privacy applies from the first intake form

Everything collected at onboarding about an individual is personal information. The Office of the Privacy Commissioner sets out the ten fair information principles in Schedule 1 of PIPEDA — accountability, identifying purposes, consent, limiting collection, limiting use, disclosure and retention, accuracy, safeguards, openness, individual access and challenging compliance.

Alberta, British Columbia and Quebec have their own private-sector privacy laws deemed substantially similar to PIPEDA, and information crossing a provincial or national border in the course of commercial activity brings PIPEDA back into play regardless of where the firm sits. If you are unsure which applies, start with whether PIPEDA applies to your business and what it means for the data you collect.

"Limiting collection" is the principle most often broken by an automated intake form, because a form that asks for everything is easier to build than one that asks for what the engagement needs.

A sensible first scope

Pick one engagement type — personal tax, or compilations for owner-managed companies — and automate only intake summarising and document extraction for it. Leave acceptance, conflicts and the letter itself exactly as they are for a full cycle.

Measure two things against your current baseline: elapsed days from first contact to signed engagement letter, and how many files reach the work stage with a complete record. If neither improves, the bottleneck was never the typing.

If your interest is the firm’s own books rather than the client-facing engagement, that is a different problem — see AI in accounting operations instead.

Questions we get asked

Can AI decide whether to accept a client?
No. Acceptance involves competence, independence, conflicts and risk appetite, and your provincial regulator holds a named individual accountable for that decision. AI can assemble the information the decision rests on.

Does using AI change our professional liability?
It does not reduce it. The firm remains responsible for the work product, and disclaimer clauses have limits that a tool does not change.

Where should a small practice start?
With document extraction on one engagement type. It is the least judgment-loaded step and the easiest to check, because a human is reviewing the extracted fields against the source document anyway.