Keep confidential client information out of AI, and prove it.
Mandate checks what goes to AI tools against your rules before it leaves, and keeps a signed record.
What someone typed into an AI tool
Draft a reply to Marie Tremblay about her tax return. Her SIN is 130 692 544.
Mandate’s decision
RefusedNot sent. It names someone on your client list and contains a social insurance number.
Other messages that day
HeldPayment instructions for a supplier, waiting for an approver
AllowedRewrite a job posting, nothing confidential
What the surveys found
of employees at large US companies who use AI at work say they have entered sensitive information into public AI assistants.
of Canadian office workers familiar with AI tools use personal AI apps at work: 33% alongside their employer’s tools and 21% with personal apps only.
of Canadian organizations say they have systems to govern AI across everyday operations.
What’s at stake
Confidential information put into an AI tool can be a privacy breach you have to report, or grounds for a complaint to a law society, bar or accounting body.
In May 2026 a US bank told the SEC that customer names, Social Security numbers and dates of birth had been put into an AI app it had not approved.
Guidance from the Law Society of Ontario and the American Bar Association; the bank’s SEC filing and American Banker. Reading note
What you get
Rules in plain words
Choose what to look for and what happens to it, in messages and files. Ready-made checks find ID, card, bank account and passport numbers. You add client names and your own words and numbers, such as tax document names or file numbers.
Approval before a message is sent
When a rule holds a message, someone you name gets an email, signs in and approves or denies it with a reason. Once it is approved, the person sends it again.
A record you can hand over
Export any period, report included, with your client names left out, and hand it to whoever asks for proof, such as a client, your insurer or a regulator. They confirm on their own computer, without a Mandate account, that nothing in it changed after it was signed.
Where it works
AI websites, checked before each message leaves
- ChatGPT
- Claude
- Gemini
- copilot.microsoft.com
- Perplexity
- Grok
- DeepSeek
- Mistral’s Le Chat
Checked the same way
- Your own software
- AI agents
Other AI websites, refused or recorded as you choose
- Meta AI
- Poe
- and 23 more
Business AI accounts, recorded afterwards from their own logs
- ChatGPT Enterprise
- Claude Enterprise
- Gemini in Google Workspace
- Microsoft 365 Copilot in Outlook, Word, Teams and Copilot Chat
A free AI acceptable use policy template
Tool approval, data rules, AI agents and incident reporting, written for Canadian privacy law and ready for your lawyer to adapt wherever you operate. Mandate then applies the policy’s data rules to each message and keeps the record.
Get the template