AI Risk Is Business Risk: Bridging Legal, Cybersecurity and the Boardroom

Atoussa Mahmoudpour, founder of AMR Law, walks a hypothetical Canadian company through the legal questions raised when a customer-service AI assistant scope-creeps from product manuals to old emails to an entire shared drive. She frames three overlapping but distinct questions: may we use this information this way (a privacy question about lawful basis), can we protect it while we use it (a security question about access and vendor controls), and when should we stop keeping it (a retention question). She walks through Canada's layered privacy regime (PIPEDA federally, distinct provincial laws in Quebec, Alberta and British Columbia), Quebec's privacy-impact-assessment requirement and its safeguard for decisions based exclusively on automated processing, and the still-unenacted Bill C-36 and Bill C-8. On vendors, she lists six negotiation questions (purpose, data flow, deletion, incident notice, exit, evidence) and warns that contract terms and actual configuration must match. On retention, she gives a three-question test (must we preserve it, do we still need it, has both ended) and distinguishes closing an account, deleting data and true anonymization, citing the Loblaw/PC Optimum finding. She closes on a four-step incident-response sequence and a take-home exercise, then takes two audience questions on fourth-party AI risk and data-labeling maturity.