For AI agents and the humans who supervise them
Consequential-action index
Twelve moments where an AI agent touching personal information can cause real legal harm. Each row names the statutory trigger, the enforcement or guidance record behind it, what an agent may prepare, and what it must never do without a human signature. Corpusv2026.12.0, verified against primary sources on November 4, 2026.
This is general information for governance and operations, not legal advice. The person signs every consequential step. Bill C-36 citations refer to first-reading text; the bill is not law.
Reading guide
How to read a row
Every statutory citation carries a status. "In force" means the provision is law today. "PPCDA first reading" means the Bill C-36 section number was checked against the June 15, 2026 first-reading text; the bill sits at second reading, so the number can still move in committee. "Pending verification" means the citation comes from the build plan and the primary-source check is still open; treat it as unverified until confirmed.
One citation did not survive verification and was corrected before shipping: the plan listed C-36 s. 41 for breach notification, but s. 41 of the first-reading text covers money-laundering disclosures. The row now cites ss. 58-61, the actual breach-notification provisions. Cited or it does not ship.
Citation IDs such as OPC-2023-001 are corpus record identifiers. Hosts calling the MCP tool should transmit record IDs and statutory parameters only, never client names, customer identifiers, incident narratives, or personal information.
The French version of this index is a first-pass translation: all twelve rows are translated, and statutory French terminology is still under review. This one notice covers every row; a row carries its own flag only when it is genuinely incomplete.
CA-01
Onboarding a new vendor or sub-processor that receives personal information
Statutory triggers
PIPEDA Sch. 1, Pr. 4.1.3 In force
Accountability extends to personal information transferred to a third party for processing.
Law 25, s. 18.3 In force
The written mandate with a service provider must describe the safeguards it will apply.
PPCDA, s. 11 PPCDA first reading
An organization transferring personal information to a service provider must ensure equivalent protection, by contract or otherwise.
OSFI B-10, Principle 8 (s. 2.3.3) In force
Third-party arrangements must give the FRFI timely access to accurate information and the right to conduct or commission an independent audit of the third party (B-10 Principle 8, s. 2.3.3).
Enforcement and guidance records
OPC-2023-001, OPC-2019-004
An agent may prepare
Parse the data processing agreement, map missing Law 25 s. 18.3 or B-10 audit-right clauses, and draft the approval stamp for a human to sign.
An agent must never
- Execute the contract or accept its terms
- Provision an API key or credential
- Transmit production personal information to an unapproved endpoint
Jurisdictions: CA-FED, CA-QC, CA-ON, CA-BC, CA-AB, OSFI-FRFI.
CA-02
Cross-border transfer of personal information outside Quebec or Canada
Statutory triggers
Law 25, s. 17 In force
A privacy impact assessment (EFVP) is required before communicating personal information outside Quebec.
PPCDA, s. 57 PPCDA first reading
Mandatory privacy impact assessment before disclosing or transferring personal information outside Canada, with mitigation measures.
Enforcement and guidance records
CAI-EFVP-GUIDE-2023, BILL-C36-S57
An agent may prepare
Identify the receiving jurisdiction, compile equivalence data, and draft the s. 17 EFVP or s. 57 PIA factors for review.
An agent must never
- Route data to a new foreign region, bucket, or cross-border model endpoint without a human-signed stamp
Jurisdictions: CA-FED, CA-QC, CA-ON, CA-BC, CA-AB.
CA-03
Breach and confidentiality incident notification decision
Statutory triggers
PIPEDA, s. 10.1 In force
Report to the OPC and notify affected individuals where a breach creates a real risk of significant harm (RROSH).
Law 25, ss. 3.5-3.8 In force
Keep an incident register; notify the CAI and the individuals where a serious risk of injury exists.
PPCDA, ss. 58-61 PPCDA first reading
Report to the Commission and notify the individual where there is a real risk of significant harm; keep breach records; service providers must notify the controlling organization.
Enforcement and guidance records
CAI-INCIDENT-REG, OPC-BREACH-2018
An agent may prepare
Compute the breach-clock timeline, log the facts locally, and assemble the RROSH and serious-injury factors for a human decision.
An agent must never
- Decide whether the notification threshold is met
- Transmit external notices to regulators or individuals on its own
Jurisdictions: CA-FED, CA-QC, CA-ON, CA-BC, CA-AB.
CA-04
Automated decision-making and profiling about an individual
Statutory triggers
Law 25, s. 12.1 In force
On request, inform the individual of an automated decision, the personal information used, and the reasons behind it.
PPCDA, s. 62(2)(c) PPCDA first reading
Policies must give a general account of any automated decision system used to make predictions, recommendations, or decisions with legal or similarly significant effects.
PPCDA, s. 63(4)-(6) PPCDA first reading
On request, explain the prediction, recommendation, or decision; the individual may make written representations to an employee able to review it.
OSFI E-23, Pr. 3.4 In force
Model risk management expectations for federally regulated financial institutions, including independent validation of conceptual soundness and performance (E-23 Principle 3.4). Final guideline published September 11, 2025; in effect May 1, 2027.
AMF AI Guideline 2026-PDG-0016 In force
Quebec financial-sector AI guideline: AMF decision 2026-PDG-0016 dated March 30, 2026, published April 2, 2026, in force May 1, 2027. Identifier and dates verified against the AMF bulletin.
Enforcement and guidance records
CAI-LOI25-S12.1, BILL-C36-ADS, OSFI-E23-2027, AMF-2026-PDG-0016
An agent may prepare
Write the plain-language explanation of the parameters and data used, and route contestations to a human reviewer.
An agent must never
- Issue a final, uncontestable adverse decision
- Dismiss a contestation without human review
Jurisdictions: CA-FED, CA-QC, CA-ON, CA-BC, CA-AB, OSFI-FRFI, AMF-QC.
CA-05
Activating a new tracker, pixel, or server-side conversion feed
Statutory triggers
Law 25, s. 8.1 In force
Privacy by default: technology with identification, location, or profiling functions must be deactivated unless the individual activates it.
CAI guidance on deceptive interfaces In force
Consent interfaces must not use deceptive design that steers the individual toward acceptance.
PPCDA, s. 18(1)(b), (3)(b) PPCDA first reading
The business-activity and legitimate-interest consent exceptions are never available where personal information is collected, used, or disclosed to influence the individual's behaviour or decisions.
Enforcement and guidance records
OPC-2023-001, CAI-INTERFACES-TRUQUEES, OPC-2019-002
An agent may prepare
Diff DOM scripts and tag-manager manifests against the tracker register, classify the receiving host, and draft the stamp.
An agent must never
- Publish a tag container
- Alter banner interface weights or defaults
- Activate a server-side feed on its own
Jurisdictions: CA-FED, CA-QC, CA-ON, CA-BC, CA-AB.
CA-06
Disposal, deletion, anonymization, or de-indexing on a rights request
Statutory triggers
Law 25, s. 23 In force
Retention and disposal rules under the Quebec private-sector act.
Law 25, s. 28.1 In force
Right to have personal information cease to be disseminated and hyperlinks de-indexed or re-listed.
PPCDA, ss. 52-54 PPCDA first reading
Retention limited to what is necessary; disposal on the individual's written request where statutory grounds are met.
PPCDA, s. 74 PPCDA first reading
Measures an organization must apply when it de-identifies personal information.
Enforcement and guidance records
CAI-AVIS-ANONYMISATION, OPC-2024-001
An agent may prepare
Track the response clock, draft bilingual response letters, and compile the disposal checklist.
An agent must never
- Execute irreversible deletion
- Declare data anonymized without verifying the anonymization criteria
- Correspond with a data subject unsupervised
Jurisdictions: CA-FED, CA-QC, CA-ON, CA-BC, CA-AB.
CA-07
Data portability and mobility export request
Statutory triggers
Law 25, s. 27 In force
Right to portability of computerized personal information, in force since September 22, 2024.
PPCDA, s. 72 PPCDA first reading
Data mobility framework: on the individual's request, disclose collected personal information to a designated organization where both are subject to a framework.
Enforcement and guidance records
CAI-PORTABILITE-2024, BILL-C36-MOBILITY
An agent may prepare
Format verified records as structured JSON or CSV and exclude third-party personal information.
An agent must never
- Verify identity documents on its own
- Release an archive externally without sign-off
Jurisdictions: CA-FED, CA-QC, CA-ON, CA-BC, CA-AB.
CA-08
Secondary purpose use, AI model training, or inferred profiling
Statutory triggers
Law 25, s. 12 In force
Purposes for collecting personal information must be determined before or at collection.
PPCDA, s. 2(1) PPCDA first reading
Personal information includes information inferred about the individual.
PPCDA, s. 12 PPCDA first reading
Collection, use, or disclosure only for purposes a reasonable person would consider appropriate.
PPCDA, s. 14(1) PPCDA first reading
No use or disclosure for a purpose other than the purposes determined and recorded, unless a statutory exception applies.
Enforcement and guidance records
OPC-2021-002, OPC-2019-002, BILL-C36-S14
An agent may prepare
Flag prompt-retention and training clauses in scope cards and assess whether the new purpose matches the original one.
An agent must never
- Opt production data into model training without express opt-in
- Repurpose records for behavioural profiling without express opt-in
Jurisdictions: CA-FED, CA-QC, CA-ON, CA-BC, CA-AB.
CA-09
Biometric database creation or identity verification deployment
Statutory triggers
Law 25, ss. 44-45 In force
Declare the biometric database to the CAI at least 60 days before it goes live and obtain express consent.
Enforcement and guidance records
CAI-BIOMETRIE-60J
An agent may prepare
Identify biometrics in specifications, compute the 60-day filing deadline, and prepare the disclosure draft.
An agent must never
- Deploy voiceprint, facial recognition, or behavioural biometrics before the CAI filing and consent gate
Jurisdictions: CA-QC.
CA-10
Collection or processing of minors' personal information (under 14)
Statutory triggers
Law 25, ss. 4.1, 14 In force
Consent of a person under 14 must be given by a parent or tutor; heightened duties apply to children's information.
PPCDA, s. 2(1) PPCDA first reading
A child means an individual under 18; a child's personal information is sensitive information with a heightened expectation of privacy.
Enforcement and guidance records
CAI-MINEURS-14, OPC-BA-CHILDREN-2011
An agent may prepare
Detect age-gating gaps and flag ad-tech or chatbot contact with under-14 users.
An agent must never
- Profile minors
- Target behavioural advertising at children
- Accept self-consent from a Quebec under-14
Jurisdictions: CA-FED, CA-QC, CA-ON, CA-BC, CA-AB.
CA-11
Production deployment or material modification of a regulated AI/ML model
Statutory triggers
OSFI E-23, Pr. 2.2, 3.4, 3.5 In force
Model risk management expectations for federally regulated financial institutions: model risk rating (Pr. 2.2), independent validation (Pr. 3.4), and pre-deployment risk assessment (Pr. 3.5). Principle numbering verified against the final E-23 text (published September 11, 2025; in effect May 1, 2027).
OSFI B-13, s. 3.1.2 In force
Technology and cyber risk management: FRFIs should adopt a risk-based approach to intelligence-led threat assessment and testing, including penetration testing and red teaming at institution-set triggers and frequencies (B-13 s. 3.1.2). Applying this to live LLM application configuration, APIs, retrieval pipelines, and role/tool permissions is applied interpretation, not a B-13 requirement.
AMF AI Guideline 2026-PDG-0016 In force
Quebec financial-sector AI guideline: AMF decision 2026-PDG-0016 dated March 30, 2026, published April 2, 2026, in force May 1, 2027. Identifier and dates verified against the AMF bulletin.
Enforcement and guidance records
OSFI-E23-2027, OSFI-B13-S3.1.2, AMF-2026-PDG-0016
An agent may prepare
Open a living evidence-file stub, map the risk tier, and watch prompt-template hash changes.
An agent must never
- Self-validate conceptual soundness (E-23 Pr. 3.4 requires independent validation)
- Promote a model to production without human sign-off
Jurisdictions: CA-FED, OSFI-FRFI, AMF-QC.
CA-12
Public privacy policy modification or governance practice notice
Statutory triggers
Law 25, ss. 8, 8.2 In force
Inform individuals of the purposes of collection and keep default settings at the highest level of confidentiality.
PPCDA, s. 62 PPCDA first reading
Make policies and practices readily available in plain language, covering data types, uses, automated decision systems, transfers, retention, and how to exercise rights.
Enforcement and guidance records
CAI-POLITIQUE-CONFIDENTIALITE, OPC-2023-001
An agent may prepare
Diff live behaviour, scope cards, and the cookie register against the published policy text, and draft the EN/FR notice.
An agent must never
- Publish unilateral amendments
- Silently expand sharing disclosures retroactively
Jurisdictions: CA-FED, CA-QC, CA-ON, CA-BC, CA-AB.
Machine-readable
Use this index in code
The same twelve rows ship as a versioned static JSON file and as an MCP tool. The tool is read-only, stateless, and idempotent; breaking changes ship as a new versioned name, never as an in-place edit.
MCP tool: canadian_privacy_consequential_action_lookup_v1 at POST https://movahedi.ca/mcp. Resource: movahedi://corpus/v2026.12.0/consequential-actions.
Bill C-36 (Protecting Privacy and Consumer Data Act): first-reading text, June 15, 2026, 45th Parliament, 1st session. At second reading; not law. Section numbers may move in committee.