AI for Ontario Insurance Brokerages: A Pre-FSRA-Rules Compliance Roadmap for 2026

Written by Mike Pearlstein, CISSP, CEO of Fusion Computing Limited. Helping Canadian businesses build and manage secure IT infrastructure since 2012 across Toronto, Hamilton, and Metro Vancouver.

AI use inside Ontario insurance brokerages is already governed, by instruments that pre-date the tools. The Registered Insurance Brokers of Ontario published Responsible AI Use Among RIBO Licensees on May 29 2025. The Code of Conduct is section 14 of R.R.O. 1990, Reg. 991. FSRA guidance GR0016INT took effect April 1 2024. None prescribes a stack. All leave the obligation with the brokerage.

This roadmap sits underneath our FSRA-aligned cybersecurity playbook for Ontario financial brokerages and turns those expectations into a vendor matrix, a six-step rollout, and an evidence set that survives an examination. The policy artifact lives in the RIBO Responsible AI Use policy template.

Book a Consultation

The five AI use cases a brokerage actually runs.

AI inside a 12-broker Ontario brokerage clusters into five repeatable workflows. Lumping them under one clause is the drafting mistake that fails first.

The first is intake. A submission lands by email. The AI extracts the named insured, the policy number, the line of business and the broker of record, then writes it into Applied Epic, Power Broker or whichever system the brokerage licenses.

Second is quote preparation. The AI populates a market submission package and pre-fills underwriting answers from the client file, where most Ontario brokerages see the first real time saving. Third is claims triage: a first notice of loss arrives, the AI scores severity and routes the file to an adjuster queue.

Fourth is renewal automation. 60 days out, the AI surfaces the worklist, flags premium changes and drafts the client-facing summary. Fifth is marketing: newsletter copy, website drafts, lead-form follow-ups.

Each workflow reaches different fields of personal information, and each lands on a different paragraph of the Code. Our general AI acceptable-use policy framework is the parent the brokerage clauses build on.

RIBO governance: what does the four-part standard require?

---

The May 29 2025 guidance is principles-based. It creates no new rule and mandates no written AI policy. It restates that existing duties survive automation, so the regulator measures evidence rather than paperwork.

Expectation one is competency and accountability for third-party tools. Section 14 paragraph 2 already requires a member to be competent in the services undertaken on the client’s behalf. Buying an AI feature does not move that duty to the vendor.

Expectation two is acting in the client’s interest by proposing suitable coverage. Expectation three is a human in the loop, with transparent use: a client dealing with a chatbot should know it. Expectation four is privacy and confidentiality, which maps to paragraph 5.

“A member owes a duty to the member’s client to be competent to perform the services which the member undertakes on the client’s behalf.” And: “A member shall be both candid and honest when advising the member’s client.”

R.R.O. 1990, Reg. 991, s. 14, paragraphs 2 and 4, quoted verbatim from Ontario e-Laws.

Those two paragraphs are the whole AI disclosure argument. Candour about how advice was produced is already a Code duty in Ontario, so no new rule is needed before telling clients where AI reached the file.

The vendor landscape in 2026.

---

Across our four Ontario brokerage engagements in 2025 and 2026, the realistic vendor field has three tiers, and the boundary between them sets the compliance ceiling.

Tier one is the broker management system already in place, plus its native AI: Applied Intelligence, Vertafore AI Studio, EZLynx or Power Broker.

Tier two is the horizontal Microsoft 365 layer. Microsoft 365 Copilot inside the brokerage tenant handles email drafting, Word documents, Excel quote comparisons and Teams summaries. The data boundary holds content in Canada Central or Canada East when the tenant is configured that way.

The oversharing trap that hits law firms hits brokerages identically. The Copilot oversharing guide walks the SharePoint permission cleanup needed before Copilot turns on.

Tier three is dedicated insurance AI. Indico Data, Roots Automation and Quandri target submissions and renewals. CCC Intelligent Solutions handles claims triage carrier-side. These layer on the broker management system and add a third-party processor the policy must name.

The vendor decision matrix.

---

Each row maps a vendor option to the dimensions Ontario brokerages test before procurement. Bands are published 2025 and 2026 figures, so treat them as a quote starting point.

How much does brokerage AI cost, and which tier should you choose?

Budgeting for AI in a 10-to-20-broker Ontario shop turns on two numbers: the seat cost above, and the governance cost underneath. The seat cost is visible and small. The governance cost is the inventory, the agreement review, the impact assessment and the supervision record, and most brokerages leave it out of the case.

Our engineers found the same sequencing rule on every rollout. If the broker management system covers a workflow, buy the native add-on. If the gap falls outside it, in drafting or correspondence, Microsoft 365 Copilot at $45 CAD per user closes it.

Tier three earns a seat only where a workflow carries volume and native features fall short. Buying it first is how a 14-broker shop pays for three overlapping intake engines. To map the matrix to your stack, book a consultation →.

Privilege and disclosure: when the broker has to tell the client.

---

Three situations move AI from an internal tooling decision to a client-facing one under section 14. First, where AI materially shapes the recommendation. Second, where AI is used in claims advocacy. Third, where AI ingests policyholder data the client did not anticipate at binding.

The compliant posture is narrow and cheap. Disclose in writing wherever AI shapes a recommendation or claims advocacy. Cover intake parsing, renewal worklists and marketing in the general technology clause of the Ontario brokerage service agreement.

A privacy notice alone does not carry it. The Office of the Privacy Commissioner expects consent to be specific, and “we may use AI tools” is not specific about anything.

The Quebec wrinkle is Law 25 section 17. It requires a privacy impact assessment before personal information moves outside Quebec, and requires that assessment to conclude the information will get adequate protection. A US-hosted AI processor without an enforceable safeguard fails that test, so Quebec business makes Canadian residency a hard floor. Ask us to review your residency position →.

The six-step AI adoption rollout.

This is the sequence Ontario brokerages run when AI goes in cleanly, and the order carries most of the value. Reach pilot before governance and you come back to fix governance under examination pressure, which costs more than doing it once. Across our four brokerage engagements the inventory step has never come back clean first time.

1. Governance. Name the principal broker accountable for AI. Draft the policy against the four RIBO expectations. Inventory every AI feature already live in the broker management system, the Microsoft 365 tenant and the marketing stack. Embedded AI runs by default, so that line is the one most brokerages miss.
2. Vendor select. Run the matrix above against real workflows. Negotiate the data processing agreement before procurement. Confirm Canadian residency in writing, and what the vendor does with brokerage inputs. Training opt-out is the clause to watch.
3. Impact assessment. One per tool that touches policyholder data, naming the lawful basis, data flows, retention, sub-processors and the breach path. PIPEDA does not mandate the artifact. FSRA examiners and RIBO investigators ask for it anyway.
4. Pilot. One workflow, one team, 90 days. Measure quote turnaround, intake throughput, error rate and client-facing surprises. Document the supervisor cadence. The pilot finds policy gaps before they become incidents.
5. Train. Every licensed broker, CSR and clerk gets a documented session on the approved-tools list, the prohibited-tools list, the disclosure rule and the supervision standard. New hires inside 30 days. Acknowledgement filed.
6. Audit. Quarterly review of the inventory, supervision records, disclosure log and incident register. Annual review with principal-broker sign-off. This is the step examinations read for.

“We were spending 40 minutes per submission cleaning up intake forms and re-keying applicant data into Applied Epic. After we wired submission processing into the workflow and tied it to the governance log, that came down to 12 minutes, and the producer signs off on every AI-drafted summary before it leaves the file. The compliance side ended up being easier than the productivity side.”

Compliance Officer, 14-broker independent brokerage, Halton Region. Fusion Computing client, 2025 AI rollout.

Which AI adoption mistakes cost Ontario brokerages the most?

Four failures account for most of the remediation work we see in Ontario brokerages. None is exotic. Each is an ordering error: a reasonable thing done in the wrong sequence, with the cost surfacing later as rework under supervisory pressure.

Mistake 1: buying the dedicated AI tool before fixing Copilot oversharing.

Buy Indico or Quandri before fixing SharePoint and OneDrive permission inheritance and you get an AI tool that surfaces every policyholder file every employee ever opened. Clean the Microsoft 365 oversharing first, then layer AI on top.

Mistake 2: treating embedded AI as out of scope for the policy.

Applied Intelligence and Vertafore AI Studio are AI tools under the May 2025 guidance, whether or not the brokerage calls them features. The inventory covers every function using machine learning to summarize, classify or recommend on policyholder data.

Mistake 3: skipping the data processing agreement on US-hosted AI.

A US-hosted vendor with no signed agreement covering Canadian personal information is a PIPEDA exposure and a Law 25 exposure at once. The agreement is the cheapest control here. Skipping it is the most expensive mistake.

Mistake 4: disclosing AI use in the privacy notice and stopping there.

A privacy notice saying “we may use AI tools” misses the specificity the Privacy Commissioner expects. Pair the notice update with a recommendation-level disclosure. A two-sentence add-on to renewal letters is the whole lift for most brokerages.

We measured the same gap in every policy review: the text reads fine and the evidence is missing. The policy that survives a RIBO examination carries 4 quarterly review records a year, naming the supervisor, the producer and the workflows reviewed.

The security layer underneath the policy.

Policy without technical enforcement is theatre, because the prohibited-tools clause cannot stop anyone. Microsoft Purview sensitivity labels gate Copilot access by matter. Conditional access blocks personal-account sign-ins to consumer AI. Data loss prevention rules stop policy numbers, SIN and claim numbers reaching unapproved tools. Audit logging retains the record.

Our cybersecurity services for Canadian businesses deploy these controls during the AI rollout, not after. The nearest cross-reference is our AI guide for Canadian law firms, applying the same control stack to LSO-regulated practices. Disclosure mechanics diverge; Purview, conditional access, DLP and logging do not.

What does an FSRA examiner ask for? The AI evidence checklist.

---

An examination is a document request. 6 artifacts decide how it goes, and a brokerage that cannot produce them has no AI governance.

• The AI inventory, including features embedded in the broker management system and Microsoft 365.
• The written policy, dated, with the accountable principal broker named.
• The impact assessment for each tool processing policyholder personal information.
• The supervision record: named supervisor, named producer, review cadence, dates.
• The disclosure log showing where clients were told AI shaped advice.
• The incident register and the last tabletop after-action report.

Fusion Computing builds that evidence set during the rollout, so the artifacts exist before an examiner asks. To test what your brokerage could produce today, book a readiness review →.

Further reading and primary sources.

• RIBO, Responsible AI Use Among RIBO Licensees (May 29 2025).
• R.R.O. 1990, Reg. 991, s. 14.
• FSRA IT Risk Management Guidance GR0016INT.
• FSRA property and casualty insurance hub.
• FSRA mortgage brokering framework (MB0048INF).
• OSFI B-13 Technology and Cyber Risk Management.
• PIPEDA (Justice Canada).
• CCCS Baseline Cyber Security Controls.

Frequently Asked Questions

Does RIBO require Ontario brokerages to have a written AI policy?

The May 29 2025 guidance does not amend the Code of Conduct to mandate a written AI policy by name. It sets four expectations: competency with third-party tools, acting in the client’s interest, human oversight with transparent use, and privacy. A written policy is how a brokerage demonstrates it met them, and the absence of one is a material adverse factor in a RIBO investigation.

Which RIBO Code of Conduct section applies to AI use?

Section 14 of R.R.O. 1990, Reg. 991, which holds the entire Code as fourteen numbered paragraphs. Paragraph 2 covers competence, 3 quality of service, 4 candour when advising, 5 strict confidence, and 7.1 written disclosure of conflicts. Section 13 was revoked in 1998 by O. Reg. 309/98, so an AI policy citing it cites nothing.

Can an Ontario brokerage use ChatGPT to write renewal letters?

Not the consumer version. It may train on input and stores data in unknown jurisdictions, a PIPEDA exposure the moment a policyholder name or claim detail is pasted in. An enterprise tier, or Microsoft 365 Copilot in-tenant with Canadian residency configured, handles renewal drafting safely. Name the product and the configuration on the approved-tools list, not the category.

When does AI use trigger a disclosure duty to the client?

Where AI materially shapes the recommendation, where AI is used in claims advocacy, or where the engagement letter requires it. Section 14 paragraph 4 of Reg. 991 requires candour when advising; paragraph 7.1 requires written disclosure of conflicts. Intake parsing and renewal worklists need no client-by-client disclosure, but belong in the general technology clause.

Does Applied Epic AI count as an AI tool under the RIBO guidance?

Yes. Any feature using machine learning to summarize, classify, recommend or generate text on policyholder data is in scope, whether the vendor markets it as AI or as automation. Applied Intelligence, Vertafore AI Studio, EZLynx automation and Power Broker AI add-ons all belong on the inventory.

How does FSRA examine AI use during an examination?

FSRA guidance GR0016INT treats AI as an extension of operational and third-party risk, both already in examination scope. Examiners ask for the AI inventory, the policy, supervision records, the impact assessment per tool, and the disclosure log. Produce none of these and the brokerage is treated as having no AI governance.

Do brokerages need a privacy impact assessment for each AI tool?

PIPEDA does not mandate the artifact by name. The OPC 2023 generative AI principles and FSRA IT risk expectations both read as requiring a documented assessment of lawful basis, data flows, retention, sub-processors and the breach path per tool. Quebec is stricter: Law 25 section 17 requires one before any transfer outside the province.

What is the supervision standard for AI use under the Code?

The May 2025 guidance puts accountability on the principal broker and expects a human in the loop. Documented supervision means a named supervisor per producer using AI on client files, a written review cadence, and a filed record. Quarterly is the cadence Ontario brokerages have adopted, and that artifact is what investigators ask for first.

How does Microsoft 365 Copilot interact with the brokerage AI policy?

Copilot in-tenant is a horizontal layer touching email, Word, Excel and Teams. The policy should require Microsoft Purview sensitivity labels on every policyholder folder before enabling it, conditional access blocking personal-account sign-ins to consumer AI, and DLP rules covering policy numbers and SIN. That configuration belongs in the approved-tools list.

What happens if a US-hosted AI tool processes Quebec policyholder data?

Section 17 of Quebec’s Law 25 requires a privacy impact assessment before personal information moves outside Quebec, and it must conclude the information will get adequate protection. A US-hosted vendor with no agreement meeting that standard leaves the brokerage unable to show it was satisfied. Canadian residency is the cleanest path.

Do brokerages have to tell clients which AI tool was used?

Not the product name. Compliant disclosure names the category of involvement, such as intake summarization, quote preparation, claims triage or renewal automation, plus the verification controls applied. Naming the vendor is not required, though the brokerage should produce it on request. A confidentiality clause does not override paragraph 4.

Does this roadmap apply to life and health brokerages?

The four-part frame translates but the citations change. Life and health licensing in Ontario runs through FSRA and the Canadian Council of Insurance Regulators rather than RIBO. Competency, client interest, human oversight and privacy still apply in substance. Cross-check the CCIR position on AI use by insurers and intermediaries first.

Bottom line

Reviewed by Mike Pearlstein, CISSP. Run the inventory before the policy. Map the four RIBO expectations to documented controls. Keep policyholder data inside Canadian residency wherever the workflow allows. Disclose at the recommendation level, in writing, under section 14 paragraph 4. Review the supervision records quarterly. Everything else is sequencing.

Contact Us