Written by Mike Pearlstein, CISSP, CEO of Fusion Computing Limited. Helping Canadian businesses build and manage secure IT infrastructure since 2012 across Toronto, Hamilton, and Metro Vancouver.
Two AI tools, one CPA Code, one decision a Canadian firm makes in 2026. Microsoft 365 Copilot and consumer ChatGPT are the products almost every 5-to-50-CPA firm has already tested. Across our 5 Canadian CPA client firms sourced between Q4 2025 and Q2 2026, each tool landed in a different place on the regulator-trust map.
CPA Ontario’s 2024 guidance, Accountabilities for CPAs in the Age of Artificial Intelligence, puts the same Code duties of competence, due care and confidentiality on the licensee no matter which model is running underneath. Picking the wrong tool turns a productivity question into a CPA Code problem. This piece sits inside AI for Canadian accounting firms: the 2026 playbook.
What is Microsoft 365 Copilot for a CPA firm, explained
According to Microsoft (2026), Microsoft 365 Copilot is a paid assistant built into Word, Outlook, Teams, Excel and SharePoint. It answers from files and messages the signed-in user can already open, inside the firm’s own tenant, under the Microsoft 365 service contract. That contract is what separates it from a consumer chatbot for a CPA firm.
The firm-agnostic sequence, from SharePoint cleanup through the day-90 go/no-go, is in our Microsoft 365 Copilot rollout plan; this page covers what changes for CPA firms specifically.
Two products carry the Copilot name and they are not interchangeable. Microsoft 365 Copilot Business is the paid add-on that reads tenant content. Microsoft 365 Copilot Chat is the free signed-in chat that does not. A firm that budgets for one and deploys the other ends up with a licence nobody wanted.
Key Takeaways
- Microsoft 365 Copilot Business is the only option here with a published Canadian list price, CA$28.50 per user per month on annual commitment, read 2026-08-05.
- Business Basic, Business Standard, Business Premium and Apps for Business are all eligible prerequisites, so most firms add Copilot without changing plans.
- Consumer ChatGPT is consumer-grade for a CPA firm. Rule 208 confidentiality duties make pasting client tax data into a personal account hard to defend.
- None of the four is a turnkey CPA compliance answer. CPA Ontario leaves competence, due care and confidentiality with the licensee.
Snapshot: how the four options compare
The practical AI choice for a Canadian CPA firm in 2026 is Copilot against consumer ChatGPT, and the CPA Code usually settles it. Copilot keeps engagement material inside the tenant under controls the firm already runs. Pasting client data into a personal ChatGPT account puts confidentiality and independence obligations in play. Source: Fusion Computing, 2026.
| Dimension. | Microsoft 365 Copilot Business. | Microsoft 365 Copilot Chat (free). | ChatGPT Enterprise. | Consumer ChatGPT (free or Plus). |
|---|---|---|---|---|
| Canadian data residency. | Yes, through Microsoft 365 Advanced Data Residency. | Sign-in inherits Entra tenant residency. Chats are not anchored to Canada. | United States tenant by default. No public Canadian region. | No. Routed through OpenAI infrastructure in the United States. |
| CPA Ontario AI accountability fit. | Strong with Purview labels plus a written AI policy. | Acceptable for non-client content only. | Workable with a contracted residency clause. | Weak. Consumer terms, no contractual non-training default on the free tier. |
| EFILE and FINTRAC audit-trail fit. | Strong. Activity lands in the Microsoft Purview audit log. | Limited. Consumer-grade logging. | SOC 2 logging exported through the admin console. | None a regulator response could use. |
| Per-user monthly cost, CAD, read 2026-08-05. | CA$28.50 list on annual commitment. CA$34.20 on monthly commitment. | Free with an Entra work sign-in. | Quote only. No published Canadian list price. | Free tier, or a consumer Plus subscription. |
| Best for. | Firm-wide drafting, Outlook triage, Excel work on client data. | Marketing copy, internal documents, non-client research. | Firms standardized on OpenAI with a negotiated residency posture. | Personal study. Never client engagement data. |
How we scored the four tools: the criteria and the evidence behind them
We scored the control layer before the feature list. According to the Canadian Centre for Cyber Security (2024), the Baseline Cyber Security Controls for Small and Medium Organizations V1.2 set the floor a Canadian firm is expected to hold, and a CRA or CPA Ontario reviewer starts there too.
5 criteria decided the ranking, weighted in this order. First, where engagement data physically sits. Second, fit with CPA Ontario AI accountability guidance. Third, the audit trail a CRA EFILE or FINTRAC reviewer could read. Fourth, the published Canadian per-seat price. Fifth, the work each tool is built for.
Residency and audit trail carry the heaviest weighting. In our practice a CPA Code complaint or an EFILE security review begins at one of those two. Where this guide draws on our own engagements it is anonymized client data and first-person field observation, labelled where it appears. Working through a shortlist now? Ask us to run these 5 criteria against it →
What the four tools cost in Canadian dollars.
1. Microsoft 365 Copilot for Microsoft 365
According to Microsoft Canada (2026), Microsoft 365 Copilot Business lists at CA$28.50 per user per month on annual commitment and CA$34.20 on monthly commitment. A promotional rate of CA$24.43 is footnoted as running between July 1 and September 30, 2026. It is the only tool here with a Canadian list price a partner can budget against.
Copilot is the assistant embedded in Word, Outlook, Teams, Excel and SharePoint. For an analyst-focused Excel deep dive, see Best AI for Excel 2026: Copilot vs Claude vs ChatGPT.
The upgrade you probably do not need. Microsoft’s own licensing page lists Business Basic, Business Standard, Business Premium and Apps for Business as prerequisites for the Copilot Business add-on, so a firm on Business Basic can buy Copilot without moving plans. We measured this on 3 of our 5 CPA engagements, where the quoted upgrade would have added cost per seat for no Copilot benefit.
Tenant data stays inside Microsoft 365 Advanced Data Residency boundaries once the firm turns that feature on, and Microsoft commits in writing that customer prompts are not used to train foundation models. Activity lands in the Microsoft Purview audit log, the same surface CRA EFILE access reviews rest on.
The real CPA Code story sits at the configuration layer. Copilot reads whatever a signed-in user can read, so a SharePoint site with broken permissions becomes a one-prompt breach of Rule 208, confidentiality of information. Pairing Copilot with Purview sensitivity labels on client tax files closes that loop. Our Microsoft 365 Copilot oversharing playbook for Canadian SMBs covers the lockdown sequence.
Pros: deepest integration with Outlook and Excel, a published Canadian residency option, and a single add-on your provider can already manage.
Cons: not accounting-specific, so the firm builds its own prompt library. Purview labels and a written AI policy are the 2 prerequisites for safe use at scale in an Ontario practice.
Not sure where your Copilot oversharing risk sits? Book a 30-minute call →
2. Microsoft Copilot Chat (free with Entra sign-in)
According to Microsoft (2026), Copilot Chat is the free signed-in chat included with an eligible Microsoft 365 work subscription. It runs the same model family as the paid add-on, sign-in routes through Entra, and prompts sit under enterprise data protection commitments. The trade-off is that it cannot read tenant files at all.
For a CPA firm, Copilot Chat is a useful drafting and research tool for material that is not client engagement data: marketing copy, internal memos, training content, partner blog posts.
It is unsafe for tax-season client work because it has no tenant-scoped data path and no Purview audit trail. CPA Ontario’s AI guidance puts supervision on the licensee, and a free tier with no engagement metadata is hard to evidence under that test.
3. ChatGPT Enterprise (OpenAI)
According to OpenAI (2026), ChatGPT Enterprise is SOC 2 Type II certified, contractually non-training on customer prompts and outputs, and ships admin console controls with SAML single sign-on. Pricing is quote-only. There is no published Canadian regional endpoint, so a Canadian CPA firm routes through United States infrastructure by default.
The CPA Code analysis here is workable rather than automatic. 3 things have to happen first. The firm negotiates a residency clause in the master agreement, ships a written AI policy naming the tool, and documents the human-review checkpoint on every engagement deliverable.
Without all three, default routing puts client tax data inside CLOUD Act jurisdiction, which sits badly against how the OPC and CPA Ontario read the duty of confidentiality.
Best for: firms over 50 CPAs with procurement teams that can negotiate residency terms and prefer the OpenAI ecosystem.
4. Generic ChatGPT (free or Plus)
A personal chatbot account cannot evidence any of this. According to the Office of the Privacy Commissioner of Canada (2023), its 9 principles for generative AI require legal authority for the collection, a proportionate purpose, openness about the use, and safeguards on the personal information involved.
Consumer ChatGPT is sold under consumer terms. The firm gets no contractual non-training default, no admin audit trail and no enterprise residency option. That is the failure mode CPA Ontario’s 2024 AI guidance flags.
Pasting a T2 schedule, an engagement letter or a client trust-account ledger into a personal account is the most common AI risk we see when onboarding a CPA firm in Ontario. It turned up in 4 of our 5 engagements, and it is also the cheapest to fix.
Cancel the personal subscriptions, route non-client work through Copilot Chat and engagement work through the paid add-on, then ship a one-page AI policy. The Canadian Public Accountability Board, in its work on technology in the audit, inspects how a firm approves, implements and maintains the automated tools it uses. Uncontrolled consumer AI is the version of that risk nobody approved.
Editorial pick: what FC would do for a 25-CPA Ontario firm today
We would buy the add-on, not a new plan. That means Copilot Business on top of whatever Microsoft 365 plan the firm already holds, Purview sensitivity labels on every engagement folder, and Advanced Data Residency switched on before the first prompt. Copilot Chat sits beside it for non-client work at no extra licence cost.
FC EDITORIAL PICK
Across our 5 Ontario accounting engagements in the last 3 quarters (3 Toronto, 1 Hamilton, 1 Niagara, ranging 12 to 35 CPAs), 4 picked Microsoft 365 Copilot. The reasons repeated: the firm already pays for Microsoft 365, the residency commitment is in writing, and the Purview audit log gives partners something to hand a CPA Ontario or CRA reviewer.
The fifth ran a small ChatGPT Enterprise pilot for its advisory practice, where partners preferred the OpenAI model behaviour. Even there the firm spent 14 weeks negotiating the residency clause. None of our clients chose the consumer route once the CPA Code analysis was on the table.
Mike Pearlstein, CISSP, Fusion Computing. FC internal benchmark from Q2 2026, drawn from anonymized client data.
“We piloted Copilot beside a free ChatGPT account two of our partners had been using on the side. Copilot won inside a week. The deciding question was never which model was sharper. It was which tool I could point a CRA reviewer at if EFILE security came up.”
What the CPA Code requires before you switch any AI tool on
Rule 208 of the CPA Ontario Code is confidentiality of information. Rule 208.3(b) requires the firm to obtain the written agreement of anyone it gives access to confidential client information, and an outsourced IT provider sits squarely inside that wording. So does any AI vendor whose contract lets it read engagement material.
That is the clause most firms miss. A written AI policy names the approved tool, the permitted data flows and the human-review checkpoint. The Rule 208.3(b) agreement is a separate artifact covering everyone with access, including the provider running the tenant. Ask us which of the two you already hold →
The editorial pick above only holds if both artifacts exist. Without them, Copilot is a faster way to move client data into the wrong SharePoint folder, and CPA Ontario still treats the partner as the accountable licensee.
Frequently asked questions
Is Microsoft 365 Copilot allowed under the CPA Code for a Canadian CPA firm?
Copilot can be deployed in a way that aligns with the CPA Code, because the Code applies to the CPA’s conduct rather than to the software. The firm needs a written AI policy, Purview sensitivity labels on client engagement folders, Canadian tenancy through Advanced Data Residency, and a documented human-review checkpoint.
Microsoft commits contractually that customer prompts are not used to train foundation models. Read AI for Canadian accounting firms: the 2026 playbook for the policy and rollout sequence.
Can a Canadian CPA firm use generic ChatGPT for tax-season work?
The honest answer is no. Consumer ChatGPT runs on consumer terms with no contractual non-training default, no Canadian residency and no admin audit trail.
Pasting a T2 schedule or an engagement letter into a personal account is the failure mode CPA Ontario’s 2024 AI guidance flags. For engagement data, Microsoft 365 Copilot or ChatGPT Enterprise with a negotiated residency clause are the 2 defensible options.
What does Microsoft 365 Copilot cost for a 20-CPA Canadian firm?
At the Microsoft Canada list price we read on 2026-08-05, CA$28.50 per user per month on annual commitment, 20 Copilot Business seats land at CA$6,840 per year. A promotional CA$24.43 rate is footnoted through September 30, 2026, which would price the same 20 seats at CA$5,863.
Add Purview label rollout, which runs 40 to 60 IT-hours in our practice, and a written AI policy. Budget CA$8,000 to CA$12,000 of year-one effort beyond the seat licences.
Do we need to upgrade to Business Premium to get Copilot?
Usually not. Microsoft lists Business Basic, Business Standard, Business Premium and Apps for Business as eligible prerequisites for the Microsoft 365 Copilot Business add-on, so most firms can add Copilot to the plan they already hold.
Business Premium is still worth buying for its security stack, including Intune and Defender. Buy it for those controls on their own merits rather than as a Copilot prerequisite, and confirm your exact plan in the admin centre first.
How does Copilot handle FINTRAC and CRA EFILE audit-trail requirements?
Microsoft 365 Copilot writes prompts, grounded retrievals and outputs into the Microsoft Purview audit log, which is exportable and retainable for the periods FINTRAC and CRA EFILE reviews care about. The firm has to turn on advanced auditing and set the retention window.
Consumer ChatGPT has no audit surface a regulator request could use. For the FINTRAC control set see FINTRAC IT controls for Canadian accountants.
Do we need a written AI policy before turning Copilot on?
Yes. CPA Ontario’s 2024 AI accountability paper places competence, due care and confidentiality on the licensee whatever tool is in the loop. Without a policy naming the approved tool, the permitted data flows and the human-review checkpoint, the firm cannot evidence the supervision CPA Ontario expects.
The policy is also the first artifact a CRA EFILE reviewer asks for, and it is 1 page. Start from our CPA AI policy template and align it to tax-season cybersecurity controls.
Related resources
These 7 pages carry the rollout detail this comparison leaves out: the firm-wide AI playbook, the oversharing lockdown sequence, the EFILE and FINTRAC control sets, and the deployment service itself. Read them in that order if you are starting from a blank AI policy.
- AI for Canadian accounting firms: the 2026 playbook.
- Copilot vs ChatGPT vs Claude: the general 2026 comparison.
- Microsoft 365 Copilot deployment services.
- Microsoft 365 Copilot oversharing playbook for Canadian SMBs.
- CRA EFILE security for Canadian accounting firms.
- FINTRAC IT controls for Canadian accountants.
- Accounting IT services.
About the author. Written by Mike Pearlstein, CISSP, founder and CEO of Fusion Computing, a Canadian managed IT and cybersecurity provider serving regulated SMBs from Toronto since 2012. He has run AI tooling selection for 5 Ontario accounting firms in the last 3 quarters.
Bottom line
The realistic shortlist is 2 tools. Microsoft 365 Copilot wins on residency, audit trail and price transparency. ChatGPT Enterprise works for firms that prefer the OpenAI ecosystem and can negotiate a residency clause. Consumer ChatGPT does not belong near client engagement data.
