Regulator map

Which deliverable meets which rule

This page maps each GaganAI deliverable to the rule or expectation it helps a practice meet. It is not legal advice and not a compliance certification. Bring it to your compliance officer, your dealer, or your counsel — they decide what applies to your practice, and this page is written to make that conversation short.

Regulator / framework	Who it applies to	What it expects around AI and client data	Which deliverable addresses it
PIPEDA (federal privacy law)	Every practice that collects client personal information in the course of business (provinces with their own substantially similar laws — Quebec, Alberta, BC — apply those instead for provincial matters).	Meaningful consent; collecting and using only what the purpose needs; safeguards proportionate to sensitivity; accountability for personal information handed to third parties such as AI vendors; reporting breaches that pose a real risk of significant harm to the Privacy Commissioner and affected people.	AI Use Policy (the data line), vendor due-diligence file, business-tier workspace with training controls verified, client-facing statement, and the same-day incident-reporting rule.
Quebec Law 25	Any practice with clients in Quebec, wherever the practice itself sits.	A named person responsible for personal information; assessing privacy impact before personal information is transferred outside Quebec (which most AI vendors involve); transparency about automated processing; a register of confidentiality incidents.	The policy names the privacy owner; the vendor due-diligence file records where each tool stores data and whether it trains on content; the client statement covers disclosure. Legal review of the impact assessment is a question for counsel.
CIRO (investment and mutual fund dealers)	Registered representatives and their dealer firms — advisors whose dealer supervises their client communications, records, and technology.	Dealer supervision of client communications and advice; books and records kept for the required periods; the dealer's approval of the tools and channels a representative uses; client information kept confidential.	The human-review rule and CRM wiring produce reviewable records; the approved-tool list is written to be handed to the dealer's compliance department for sign-off. Dealer-attached advisors: start with the compliance kit below rather than buying a build.
FSRA (Ontario mortgage brokering, life & health insurance)	Ontario mortgage brokerages, brokers and agents; life and health insurance agents and MGAs. (Ontario property & casualty brokers are regulated by RIBO, below.)	Fair treatment of customers; safeguarding client information; accurate records; licensees remaining accountable for work done through third parties and tools; suitability of what is recommended.	AI Use Policy, vendor due-diligence file, staff training with signed acknowledgements, and the human-review rule so AI-drafted client communications are never sent unread.
OSFI Guidelines B-13 and B-10	Federally regulated financial institutions — banks, federally incorporated insurers and trust companies. Relevant to the Organizations assessment, not to a small practice.	B-13: governance and management of technology and cyber risk, including incident management. B-10: managing third-party risk across the relationship lifecycle — which now includes AI vendors and models.	The AI Opportunity & Readiness Assessment's governance, security, and vendor-control dimensions, its risk gates, and the vendor-risk sections of the report. It informs an institution's own program; it does not replace it.
CPA provincial bodies	Accounting and bookkeeping practices led by CPAs (each province's body — CPA Ontario linked as the example).	Confidentiality of client information under the code of professional conduct; competence in the technology used to deliver services; safeguarding client records.	AI Use Policy, vendor due-diligence file, team training, and the review rule — with the practice's own CPA body consulted on any professional-standards question.
Provincial insurance councils and RIBO	Licensed insurance brokers and agents regulated provincially — RIBO for Ontario P&C brokers (linked), the Insurance Councils of BC, Alberta, Saskatchewan, Manitoba, and their counterparts elsewhere.	Licensee conduct standards; confidentiality of client information; supervision of staff; accurate client records.	AI Use Policy, client-facing statement, staff training, and the vendor file — the same Safe Start pack, with the council's own conduct rules taking precedence where they are stricter.

Descriptions are general summaries of published expectations, current to the date this page was last reviewed; each regulator's own site is the authority. Where a practice is subject to several of these at once, the strictest applies.

Bring this to your compliance officer

Questions to ask your compliance officer about AI

If you're attached to a dealer, an MGA, or a firm whose compliance department owns the technology decision, you can't adopt tools on your own — but you can walk in with the right questions. Print this page, or save it as a PDF, and get answers in writing.

Questions to ask your compliance officer about AI

For advisors and agents attached to a dealer, MGA, or firm · prepared by GaganAI · https://gaganai.com

1Which AI tools, if any, are already approved for client work — and is there a written list I can see?
2May I use a paid business-tier AI account (training on our content disabled) for drafting, if no client identifiers are entered?
3Exactly what client information may never be entered into an AI tool, by our rules — names, account numbers, documents, all of it?
4Are AI meeting note-takers permitted on client calls? If so, which vendors, and what consent wording do you want used?
5How should AI-generated notes, summaries, and emails be kept as records, and for how long?
6Who must review an AI-drafted client communication before it is sent, and does that review need to be logged?
7What vendor due diligence do you require before a tool touches client data — attestations, storage location, deletion terms?
8If client information ends up in the wrong tool, what is the reporting path and timeline?
9Do any of my clients trigger extra obligations — for example, Quebec residents under Law 25?
10Would the firm consider a single AI use policy and approved-tool list for every advisor, rather than case-by-case answers?

Free. No email needed — the print button is right there.

Get this as a one-page PDF, plus updates when the rules change

Optional. The page above prints as-is; this just sends you the tidy version and the revision whenever a regulator updates its guidance.

If your dealer or MGA wants this done for every advisor

One AI use policy, one approved-tool list, one training program across the whole advisor base — that's the Organizations assessment, scoped for the firm rather than the practice.

Point them to the organizations page

Fair questions

Is this page legal or compliance advice?

No. It maps GaganAI deliverables to the expectations regulators publish, in plain words, so a practice knows what each document is for. Your compliance officer, dealer, or counsel decides what applies to you.

Does GaganAI certify that a practice is compliant?

No. GaganAI provides advisory work — policies, vendor checks, configuration, and training. It does not perform audits, attestations, or certifications, and no deliverable should be presented as one.

I'm attached to a dealer or MGA. Can I still use this?

Yes — start with the compliance kit on this page. It is a one-page list of questions to bring to your compliance officer, so the answers come from the people who own the technology decision. If the firm wants it done for every advisor, the Organizations assessment is the route.