Your retention obligations are unchanged. What is new is a class of record nobody scheduled: the prompt, the output, and the evidence that a person reviewed it.
Key takeaways
Keep what you already had to keep, on the same schedule, and then make one deliberate decision about the new material. The tool has not changed a single retention rule. It has created prompts, outputs, transcripts and activity logs that nobody has assigned an owner or an expiry to, and by default those either pile up indefinitely or vanish on a vendor’s timetable. Both defaults are bad, and choosing between them takes an afternoon.
Subsection 230(1) of the Income Tax Act requires every person carrying on business, and every person required to pay or collect taxes, to keep records and books of account at their place of business or residence in Canada, or at such other place as the Minister may designate, in such form and containing such information as will enable the taxes payable to be determined. Subsection 230(2.1) states for greater certainty that the records required of a person carrying on business as a lawyer include all accounting records, supporting vouchers and cheques. Subsection 230(4)(b) sets the general period at six years from the end of the last taxation year to which the records relate, and subsection 230(4.1) requires records kept electronically to be retained in an electronically readable format for the retention period.
Section 286 of the Excise Tax Act is the GST/HST counterpart. Subsection 286(1) requires records necessary to determine liabilities and obligations. Subsection 286(1.2) requires records to be kept in Canada in English or in French unless the Minister authorises otherwise. Subsection 286(3) sets six years after the end of the year to which the records relate, and subsection 286(3.1) again requires an electronically readable format.
That location requirement is worth a second look in an AI context. If a workflow produces the only copy of a required record inside a service that stores it outside Canada, the obligation has been engaged by a tooling choice. That is dealt with at more length in keeping client data in Canada.
By-Law 9 of the Law Society of Ontario sets its own schedule for financial records. Subsection 23(1) requires a licensee to keep the financial records required under sections 18, 19 and 19.1 for at least the six-year period immediately preceding the licensee’s most recent fiscal year end. Subsection 23(2) requires ten years for the records specified in paragraphs 1, 2, 3, 8, 9, 10 and 11 of section 18. Subsection 23(3) requires ten years for section 20 mortgage records, running from discharge or from the day the licensee ceases to be trustee.
Two related provisions matter for anyone digitising. Section 21 provides that where a financial record is entered and posted by mechanical or electronic means, the licensee must ensure a paper copy of the record can be produced promptly on the Society’s request. Section 22(2) allows certain records to be created within twenty-five days after the last day of the month concerned. And Part I provides that a requirement for information, a document or a record to be in writing or printed is satisfied by an electronic form if it is accessible so as to be useable for subsequent reference, with electronic signatures similarly accepted. Licensees in other provinces should check their own law society’s equivalent rather than assuming Ontario’s numbers apply.
Most retention thinking is about keeping things long enough. In Quebec the duty runs the other way as well. The Commission d’accès à l’information states that as soon as you no longer need to use personal information for the purposes previously determined, you must destroy it securely, and that the only restriction on that obligation to destroy is a retention period provided by a statute. It also states that the business must inventory the types of documents containing personal information, define confidentiality levels, distinguish media types so that appropriate retention and destruction methods can be applied to each, and determine a retention schedule that meets legal requirements. Separately, the Commission states that the governance policies businesses must establish have to provide for rules on the retention and destruction of personal information.
So “we keep everything, just in case” is not a neutral position in Quebec. It is a position that has to be justified by a statutory retention period.
Four artefacts appear once a tool is in the workflow, and each needs a decision.
An Ontario firm adds one column to its existing retention schedule rather than writing a new policy. Client deliverables keep their existing period. Financial records keep the periods in By-Law 9. Prompts are not retained. Generated drafts are kept only for matter types where provenance could be argued. The review line — reviewer, date, document — is written into the matter record and follows the matter’s retention period. Meeting transcripts get an explicit period set in the platform rather than being left at the default.
The whole exercise is one column and a short conversation. The countable outcome is the proportion of AI-touched records with an assigned retention period, which starts near zero at almost every firm and can be brought to complete in a single afternoon.
Corporate records sit alongside all of this and are frequently forgotten. Treadstone Law covers what belongs in an Ontario minute book and what a corporation must keep after dissolution — a reminder that retention obligations imposed elsewhere continue on their own timelines regardless of what happens to the entity.
This page is written for a firm that delivers work to a book of clients. If the question is really about the front desk — intake, scheduling, recall, reminders — that lives on the professional practice owners page. If it is about your own month-end, reconciliation and payables rather than client deliverables, that is accounting automation. The two overlap on tooling and almost never on risk.
Do we have to keep the prompt that produced a document?
No general rule requires it, and the OPC guidance points the other way. Keep the review record instead — it answers the question people actually ask, which is whether a person read the output.
Is a generated draft a business record?
If it informed the work, treat it as one. The test is whether it did something, not what produced it.
Does an electronic copy satisfy a paper requirement?
Under Ontario By-Law 9, an electronic form satisfies a writing requirement where it is accessible so as to be useable for subsequent reference — but section 21 still requires that a paper copy of a mechanically or electronically posted financial record can be produced promptly on the Society’s request. Test that you can actually do it.
Who owns the schedule?
Name a person. In Quebec the Commission states that the person with the highest authority in the business is responsible for the protection of personal information and exercises the function of person in charge, though it may be delegated in writing, and that the title and contact details must be published. Elsewhere the appointment is yours to make, and unowned schedules do not get followed.
A 30-minute call is enough to tell you whether AI pays for itself here.
