Bill C-36, AI and client data: what advisory firms can prepare for now

November 2026 · Compliance

Request demo

Summary: The proposed Protecting Privacy and Consumer Data Act would raise the stakes on how firms handle client data and automated tools, and securities regulators are already asking similar questions.

Wealth firms hold some of the most sensitive personal information in the economy: income, net worth, family relationships, health details that bear on planning, and Social Insurance Numbers. Over the past year, three developments have pointed in the same direction. A new federal privacy bill was tabled. Securities regulators confirmed they will look at how firms control their use of AI. And a breach at the industry's own self-regulatory organization showed how far client data can travel. None of these changes the law today on its own. Together, they describe what regulators and clients will expect.

What Bill C-36 would do

On June 15, 2026, the federal government introduced Bill C-36, which would enact the Protecting Privacy and Consumer Data Act. It is the third attempt in six years to replace the private-sector part of PIPEDA, following Bill C-11 in 2020 and Bill C-27 in 2022, both of which died on the order paper.

Based on law-firm summaries of the bill, several features stand out for advisory firms:

  • A regulator with order-making power. Oversight would move to a Privacy and Consumer Data Commissioner within a new Digital Safety and Data Protection Commission, which could issue binding orders, conduct audits and impose penalties. Unlike Bill C-27, there would be no separate tribunal between the Commissioner and a penalty.
  • Larger penalties. Administrative monetary penalties of up to the greater of $10 million and 3% of global revenue, with higher maximums for criminal offences.
  • Disclosure of automated decision systems. Organizations would need to disclose their use of automated decision systems that could have a legal or similarly significant effect on individuals. This is a narrower test than the one in Bill C-27.
  • Cross-border transfers. Organizations would need to assess and mitigate privacy risks before sending personal information outside Canada.
  • Continuity on core duties. The privacy management program requirement, breach reporting, and the rule that de-identified information is still personal information all carry forward from Bill C-27.
  • No standalone AI law. The Artificial Intelligence and Data Act, which formed part of Bill C-27, has been dropped.

Where it stands

As of the latest Parliament of Canada record we reviewed, Bill C-36 had completed first reading and was awaiting second reading in the House of Commons. It would still need committee study, a Senate vote and Royal Assent. Commentators also note that its coming into force is tied to a companion bill, Bill C-34, which would establish the Commission. Until then, PIPEDA continues to apply, as do provincial private-sector laws such as Quebec's.

The bill may change before it passes, or it may not pass at all, as its two predecessors did not. That is a reason not to build a compliance program around its exact wording. It is not a reason to ignore the direction of travel, which has been consistent across three bills.

Securities regulators are asking similar questions

Advisory firms registered with securities regulators do not need to wait for privacy reform to hear about AI. In December 2024, the Canadian Securities Administrators published Staff Notice and Consultation 11-348 on the use of AI systems in capital markets. It did not create new rules. It explained how existing obligations, including governance, supervision, conflicts and client disclosure, apply when a registrant uses AI. Commentators have summarized its themes as human oversight, explainability, testing, and accurate disclosure where AI materially affects how clients are served.

In its 2026 compliance report, released in February, the Canadian Investment Regulatory Organization (CIRO) said it would review dealers' operational controls over AI use during its financial and operations examinations. The same report described cybersecurity as a key business risk for all dealers and stressed staff training and multi-factor authentication.

The common thread across privacy law and securities guidance is accountability. A firm should be able to say which tools touch client data, what they do with it, who reviews their output, and what the client has been told.

A reminder from inside the industry

In January 2026, CIRO confirmed that a phishing attack first disclosed in August 2025 had affected about 750,000 Canadian investors, with exposed data that included items such as dates of birth, income details and Social Insurance Numbers. CIRO said it had found no evidence the data had been misused.

The lesson for advisory firms is not about CIRO. It is that client information is held in more places than the firm's own systems: regulators, custodians, software vendors, outsourced back offices and AI services. Each copy is a risk the firm is accountable for explaining to clients, and under Bill C-36 the cross-border question would become an explicit assessment rather than a matter of contract terms.

What firms can sensibly do now

None of the following depends on Bill C-36 passing in its current form. Each would also stand up well against CSA and CIRO expectations.

  1. Map where client data goes. List every system and vendor that holds or processes client personal information, where it is hosted, and whether data leaves Canada.
  2. Inventory AI use. Record which tools use AI, what client data they receive, and whether any output affects decisions about a client. Note where a person reviews the output before it is used.
  3. Keep a human in the loop for anything client-facing. Drafts, summaries and suggestions produced with AI should be reviewed and approved by a named person before they reach a client or change a record.
  4. Keep an audit trail. For AI-assisted work, record what was produced, who approved it and what changed. This supports both supervision and any future disclosure obligation.
  5. Review client disclosures. If AI meaningfully shapes how clients are served, say so plainly in client-facing materials.
  6. Revisit vendor agreements. Confirm breach notification terms, data residency and subprocessors, particularly for AI and cloud providers.

Closing thoughts

Privacy reform in Canada has moved slowly, but the expectations behind it have not changed much from one bill to the next: know where personal information is, limit what automated systems do with it, keep a person accountable, and be able to show your work. Advisory firms that hold complex family data will be asked these questions by regulators and by clients, whichever version of the law arrives. At Mozaiik, Canadian-built and designed around a single record of each family's people, entities and documents, these are the questions we expect our clients to ask of us as well.

This article is general information, not legal advice. Bill C-36 is a proposal and may change before enactment.

Sources

Keep reading

Family offices are adopting AI, but their reporting is still done by hand

November 2026 · Technology

Wealthy clients now work with several firms. Who sees the whole picture?

November 2026 · Industry

The great wealth transfer is slower than expected, and the family is getting bigger

November 2026 · Planning

Wealth

Consolidated net worthOne number for the family, with every asset class behind it.The whole structureEvery person, holdco and trust on one map, with ownership in view.

Work

Every deadline, coveredEvery deadline for every family, generated for you.Your whole bookEvery family you serve on one screen.

Data

Data that keeps itself currentRaymond James and Microsoft Outlook, live today.Every document accounted forRequired documents for every person and company.IntegrationsWhat connects to Mozaiik today.

Trust

SecurityHosted in Canada. SOC 2 Type I audit underway.Trust CenterOur controls and policies, live.