The Sovereign profile of Tonia runs tax preparation and analytical review on-site installed in your firm: names, SIN, identifying amounts and corporate client financial statements stay in Québec, under your KMS key. The Frontier profile routes client communications (with identifiers redacted) to a frontier-model provider. The locally signed audit log is the tool the OCAQ asks for at the annual practice review — and you already have it.
A Quebec CPA firm — whether in sole practice or as a CPA professional partnership — operates under three simultaneous regimes: Bill 25, the CPA Code of professional conduct, and the Act respecting Chartered Professional Accountants (CQLR, c. C-48.1) with its duty-of-means obligations.
The practical consequence is known to every tax-practice CPA: pasting a client employee's T4 or a corporate financial statement into ChatGPT for synthesis communicates the information to a U.S. corporation — without client-corporation consent, without a contractual framework, and without an art. 17 assessment. The syndic has taken note.
(synthesis of T4, T5, NR4, RL-1, financial statements). Maximum Bill 25 friction. Tax slips identify the taxpayer (SIN, employer, salary), the corporate client (NEQ, transactions), and — by cross-reference — third parties (employees, contractors). Pasting a single complete financial statement into ChatGPT simultaneously communicates the corporate client's information (Code art. 50) and that of the in-scope employees (Bill 25 art. 17).
(ratio analysis, anomaly detection, sectoral comparisons). High-leverage automation case: ChatGPT-4 or Claude Opus return in seconds an analysis that took two hours manually. But each request identifies a corporate client by its unique figures — margin, revenue, sector-tax line.
(letters, planning memos, annual presentations). Less sensitive if specific names and numbers are removed before send. Still problematic if the wording contextualizes the letter — "my client, a Saint-Hyacinthe SME manufacturer at CA$12M revenue" identifies the firm to a narrow circle.
The on-site tonia installed in the firm absorbs the full tax synthesis. T4s, RL-1s, financial statements run through the local model; no byte crosses the border. Bill 25 art. 17 does not apply, for lack of transfer. The signed audit log documents every request — you can demonstrate to the OCAQ exactly which slips were synthesized, when, by which roster-listed CPA.
Same posture: identifying figures stay on-site. The locally-executed analytical review produces the same deliverable as the ChatGPT-executed one, without the transfer.
The Frontier profile routes approved requests to a frontier-model provider. tonia redacts identifiers (client name, NEQ, unique figures) before send; the signed audit log documents the redaction (cryptographic fingerprint of post-redaction content, invoked policy rule). The CPA can demonstrate to the OCAQ that the client communication did not expose the firm.
CPA firm specializing in international taxation, 8 CPAs + 12 support, ~150 Canadian and U.S. corporate clients, deployed under Tonia — Sovereign profile in Q1-2026. Anonymization required. OCAQ validation referenced for credibility of the annual practice review.
The firm had been using ChatGPT-4 for tax synthesis and analytical review since 2023. The 2025 update of the CPA Code of professional conduct and the publication of the OCAQ Position on generative AI triggered an internal review. Internal audit in November: 7 categories of requests non-compliant with art. 17 (tax preparation, analytical review, sectoral comparisons), and a potential art. 50 flag on using ChatGPT for the synthesis of identifying financial statements.
Deployment in Q1-2026: on-site tonia in the firm's server room, policy configured by the PRPRP in collaboration with the managing partner, 3-h training of the 20 users. The Sovereign profile absorbs tax preparation and analytical review wholesale — 100% of requests handling slips or financial statements execute on-site. The Frontier profile remains enabled for client-communication translation (category classified as non-sensitive with active PII redaction).
BLOCK events (PII patterns detected on the Frontier profile)Want to see how this applies in your firm? Start with the free Loi 25 audit, then request a 30-min consultation. We will review your three tax use cases, OCAQ obligations, and on-site tonia sizing if your context calls for it.
Disclosure notice: this page is editorial and reflects Tonia's commercial position. Regulatory references are verifiable at the indicated links. Before acting, validate the obligations specific to your organization with your counsel.