AI agents for business finance: what they can and can't do
What AI agents can do in bookkeeping, close, collections and compliance today, where a person must stay in charge, and how to judge a product.
The short answer
Under PIPEDA, a business must report to the Office of the Privacy Commissioner of Canada any breach of security safeguards involving personal information under its control that creates a real risk of significant harm, and notify the people affected as soon as feasible. It must also keep a record of every breach, reported or not, for 24 months. An AI agent can keep that record and assemble the facts, but the harm assessment should be made by a person.
When PIPEDA applies
PIPEDA covers private-sector organisations that collect, use or disclose personal information in the course of commercial activity, except where a province has substantially similar law, as Alberta, British Columbia and Quebec do for activity within those provinces. Cross-border and interprovincial activity generally stays under PIPEDA. Check which law applies to your business before you rely on these rules.
Real risk of significant harm
The test has two parts. Significant harm is broad: bodily harm, humiliation, damage to reputation or relationships, financial loss, identity theft, negative effects on a credit record and damage to property. Whether there is a real risk depends on how sensitive the information is and how likely it is to be misused.
| Factor | Questions to ask |
|---|---|
| Sensitivity | Was it financial, health, identity document or login data? |
| Probability of misuse | Was it stolen deliberately, or sent by mistake to a known recipient? |
| Recovery | Has the data been returned or deleted with confirmation? |
| Scale and duration | How many people, and how long was it exposed? |
| Protection | Was it encrypted with the key kept safe? |
What you must do
- Report to the OPC as soon as feasible after determining that a breach creates a real risk of significant harm.
- Notify affected individuals as soon as feasible, directly in most cases, with enough information to understand the harm and protect themselves.
- Notify other organisations, such as a bank or a police service, if doing so may reduce the risk of harm.
- Keep a record of every breach of security safeguards for 24 months after you determine it occurred, whether or not you reported it.
- Provide those records to the OPC on request.
The 24-month record is the duty small businesses miss most, because the breaches that are not reported feel finished. The OPC can ask for the record at any time, and an empty one is hard to defend.
What an AI agent can do
- Open a breach record when something is reported, with the date of discovery.
- Record what information was involved, how many people and the circumstances.
- Lay out the harm factors from the facts, leaving the conclusion to a person.
- Draft the OPC report and the notice to individuals once a person decides they are needed.
- Keep each record with a retention date 24 months on, and produce the full log on request.
- Remind the owner of the follow-up actions agreed.
What stays with a person
The real risk of significant harm assessment is a judgement, and the OPC expects you to be able to explain it. A person should make it, using the record the agent kept. If the breach was caused by an AI agent, such as an invoice sent to the wrong customer, the same duties apply, and the mandate that allowed it should be reviewed.
Worked example
Example only. A physiotherapy clinic in Ottawa emails one patient's appointment summary to another patient with the same surname. The agent opens a breach record that afternoon. It notes that health information was involved, one person was affected and the recipient was a member of the public. The owner calls the recipient, who agrees to delete it, but cannot confirm deletion in writing. Given the sensitivity, the owner decides there is a real risk of significant harm, reports to the OPC and tells the patient. The agent drafts both and records the reasoning. Note that clinics may also be covered by provincial health privacy law, which the owner checks with an adviser.
What the breach record should contain
The OPC's guidance says the record must contain enough information for the Commissioner to verify compliance with the reporting and notification rules. A practical record holds:
- The date or estimated date of the breach and the date it was discovered.
- A description of the circumstances and the personal information involved.
- The number of people affected, or an estimate.
- The harm assessment and the reasoning for reporting or not reporting.
- Whether the OPC, individuals and other organisations were notified, and when.
- The steps taken to contain the breach and prevent it happening again.
Keeping these fields consistent across every breach makes the 24-month log easy to produce and easy to read. It also shows patterns. Three misdirected emails in a year point to a process fix, such as a recipient check before attachments are sent, that is cheaper than the next breach. An agent can show that pattern in a quarterly summary for the owner.
Where Pryme fits
The Pryme Compliance agent keeps breach records with their clocks next to the rest of its obligations register, and every action is recorded with its source. Above its mandate a person decides. See audit trails for AI agents and the UK version of this guide, the first 72 hours of a UK breach.
Questions people ask
Is there a fixed deadline to report to the OPC?
PIPEDA requires reporting as soon as feasible after you determine a breach creates a real risk of significant harm, rather than a fixed number of hours.
Do I record breaches I do not report?
Yes. You must keep a record of every breach of security safeguards for 24 months, and give it to the OPC on request.
Does PIPEDA apply in Quebec, Alberta and BC?
Those provinces have their own private-sector privacy laws for activity within them. PIPEDA generally still applies to interprovincial and international activity.
Can an AI agent decide a breach is not reportable?
It should not. It can lay out the facts and the harm factors, but a person should make and record the decision.
Sources
- OPC: Mandatory reporting of breaches of security safeguards · accessed Oct 2026
- OPC: Privacy breaches at your business · accessed Oct 2026
- OPC: PIPEDA requirements in brief · accessed Oct 2026
This article is general information, not financial, legal or tax advice. Products described are provided under the terms on this site and are subject to regulation and eligibility.