Professional secrecy in the age of AI: the questions your Chambre will ask
The Chambre des notaires will ask questions about the AI you use. Data residency, confidentiality, traceability. Here is how to prepare.
The team
Mentor AI Notaire
The question that is coming
AI has entered notarial practices. Sometimes officially, sometimes through the side door: a technician using ChatGPT to rephrase a clause, a notary asking Gemini to summarize a document.
The Chambre des notaires du Québec knows it. And the questions are coming.
Not “do you use AI?”. That much is already a given. The questions will be more precise:
- Where is the data stored that you send to this AI?
- Who has access to your clients’ information in this system?
- Does the model train on the data you submit to it?
- How do you ensure traceability of the generated answers?
- Are you compliant with Law 25 in your use of AI?
If you cannot answer these questions clearly, you have a problem.
What Law 25 says
The Act to modernize legislative provisions as regards the protection of personal information (Law 25) came fully into force in September 2024. For notaries, it adds a layer of obligations on top of the professional secrecy that already existed.
The key points for the use of AI:
- Consent. Your clients must know whether their data is processed by an AI. Not necessarily explicit consent for every use, but transparency about your practices.
- Data residency. Where is the data physically stored? If it crosses the border, to the United States for example, additional obligations apply.
- Purpose. Data collected for a notarial file may only be used for that file. An AI model that trains on your data is reusing it, and that is a diversion of purpose.
- Security. Protection measures proportionate to the sensitivity of the data must be in place. Notarial data is by definition highly sensitive.
The problem with general-purpose AI
When a notary or a technician uses ChatGPT or Copilot for work, here is what happens technically:
The information typed in (potentially a client’s name, the details of a transaction, financial information) is sent to servers that may be located in the United States. Depending on the terms of use and the plan chosen, that data may be used to improve the model. Traceability is limited: it is difficult to prove where an answer came from.
This is not a criticism of ChatGPT. It is a simple observation: a tool designed for the general public is not designed for the obligations of notarial professional secrecy. The distinction between generic AI and profession-specific AI is fundamental.
The evaluation criteria
When you evaluate an AI solution for your practice, here are the questions to ask. They are the same ones the Chambre will ask:
Data residency
- Does the data stay in Canada?
- Which cloud provider is used? (Google Cloud, AWS, Azure, and which region?)
- Is there any cross-border transfer, even temporary?
Confidentiality
- Does the AI model train on your data?
- Is one practice’s data isolated from everyone else’s?
- Who, at the provider, has access to the data?
Traceability
- Is every AI answer traceable to its source?
- Is there an audit log of interactions?
- Can you demonstrate how a conclusion was reached?
Compliance
- Does the provider have a privacy policy compliant with Law 25?
- Is there an identified person responsible for the protection of personal information?
- Which security certifications are in place?
Prepare now
Compliance is not an obstacle to adopting AI. It is a filter that separates serious solutions from gadgets.
A practice that adopts a compliant AI from the start will not have to backtrack when the rules tighten. It will be ahead, and able to show its clients, the Chambre and its insurers that it takes the technology seriously. The goal is to have a true virtual colleague that follows the same rules as your team.
The questions are coming. Better to have the answers before you are asked.