## Evaluating AI Tools Through a Canadian Lens The regulatory landscape is now complete across five layers. This chapter synthesises everything into a practical evaluation framework. ### 6.1 The NC Canadian AI Tool Evaluation Framework No existing resource consolidates the Canadian regulatory landscape into a practical tool evaluation framework for individual advisors. The framework below applies to any AI tool in any financial advisory context.

Northern Catalyst

Area 1: PIPEDA Compliance

Does the tool require express consent for processing financial data?
Can the advisor maintain accountability if the tool processes client data?
What are the breach notification implications?

Area 2: Quebec Law 25 Applicability

Do you serve clients residing in Quebec?
Has a Privacy Impact Assessment been completed for this tool?
Does the tool involve automated decision-making under Section 12.1?

Area 3: CIRO/CSA Alignment

Does the tool preserve KYC, KYP, and suitability integrity? (AI output is an input, not a determination.)
Does the tool support 7-year record-keeping requirements?
Is AI use within the firm's supervisory framework?
Does the tool provide the "highest degree of explainability that is feasible" (CSA 11-348)?

Area 4: Cross-Border Data Assessment

Where is data stored at rest? Where does processing and inference occur?
Are vendor "Canadian data" claims verified for processing, not just storage?
Is the tool's infrastructure subject to the US CLOUD Act?

Area 5: Vendor Due Diligence

Does the vendor hold SOC 2 Type II or ISO 27001 (or build on certified infrastructure)?
Is there a data training opt-out? What is the data retention policy?
Does the tool provide audit trails? Enterprise-grade security?

### 6.2 Vendor Red Flags Eight signals that warrant caution: 1. "AI-powered" as the primary selling point without explainability documentation 2. No data training opt-out (client data may be used to improve the vendor's model) 3. US-only processing with no transparency about data flows 4. No SOC 2 or ISO certification (or building on uncertified infrastructure) 5. No model explainability documentation 6. No audit trail (cannot meet books-and-records requirements) 7. Consumer-tier security (personal subscriptions positioned for professional use) 8. No data deletion policy ### 6.3 The Compliance Conversation Compliance officers frequently default to prohibition rather than permissioned use when advisor AI tool requests arrive without context. The approval process moves faster when advisors demonstrate regulatory awareness rather than just a tool preference. Bring the evaluation framework and your assessment to your compliance officer. Show that you have considered the five regulatory areas. Present the vendor's answers to the cross-border data questions. Frame the conversation around risk management, not technology adoption. Compliance officers are partners in this process. They carry legitimate concerns about liability, data governance, and regulatory scrutiny. Many default to prohibition because the threshold for when CIRO filing is triggered by AI adoption remains ambiguous, and prohibition is the safest response to ambiguity. An advisor who arrives with a completed evaluation framework has a fundamentally different conversation than one who arrives with "I want to use ChatGPT." ### 6.4 What CSA 11-348 Means for Your Decision The CSA's "AI as input" framing repositions the conversation. AI is not replacing the advisor. AI is providing an input that the advisor evaluates, applies professional judgment to, and takes responsibility for. This framing aligns AI use with existing professional obligations rather than creating new ones. The same professional judgment that guides your investment due diligence applies here. The framework gives you specific criteria to assess.