Insurance brokers · Alberta PIPA

Alberta insurance brokers: using ChatGPT without exposing client information under PIPA

PIPA was written long before ChatGPT, but three of its duties apply directly when staff paste client files into AI.

Updated October 18, 2026 · About a 7-minute read · Written by the Hushtag team in St. Albert, Alberta. General information, not legal advice.

The short answer

An Alberta insurance brokerage is a private-sector organization, so the Personal Information Protection Act (PIPA) applies to client information (PIPA overview). PIPA doesn't mention AI. It does require reasonable security, written policies, and specific steps when personal information goes to a service provider outside Canada. A consumer AI chat touches all three.

Three PIPA duties that matter for AI

Reasonable security. Organizations must take reasonable security measures against unauthorized access, use or disclosure, appropriate to the sensitivity of the information. Alberta.ca adds that limiting how much personal information you collect makes security easier (Alberta.ca).
Written policies. Section 6 of PIPA says an organization must develop and follow reasonable policies and practices. A designated person is responsible for compliance under section 5 (the Act, PDF).
Service providers outside Canada. If you use a service provider outside Canada to collect, use, disclose or store personal information, your policies must say which countries and for what purposes, and individuals must be told how to get that information (Alberta.ca). Most AI chat services are run from the United States.

If a breach poses a real risk of significant harm, the organization must notify the OIPC without unreasonable delay (OIPC breach notification). A producer pasting a client's driver's licence number, policy number and claim history into a free AI chat is the kind of incident you don't want to assess after the fact.

What brokers use AI for

Task	Personal information involved	Safer way
Explaining a coverage change to a client	Name, policy number	Mask both; keep the coverage details
Claim summary for an adjuster	Name, address, DL, claim #, accident facts	Mask identifiers; check the facts don't identify the person on their own
Renewal email templates	None needed	Write generic templates
Comparing two quotes	Often none	Remove the client's name and VIN first

Insured: #PERSON_1, DL #GOV_ID_1 Policy #: #ACCOUNT_1 Claim #: #CASE_NUMBER_1 Address: #ADDRESS_1, St. Albert, AB #POSTAL_CODE_1 Rear-ended at a red light, other driver admitted fault. Summarize for the adjuster and draft an update for the client.

A practical setup for a brokerage

Write it down. Add AI to your privacy policies: which tools are approved, what may never be pasted, and the outside-Canada note if you allow a US service to see personal information. Our one-page staff AI-use policy is a starting point.
Collect less. De-identify before pasting so client names, licence, policy and claim numbers never reach the AI. Hushtag does this in the browser and restores the details in the answer.
Train once, lock it on. Fifteen minutes with a real example, and a manager PIN so staff can't turn it off.
Keep a record. Hushtag's AI-use record logs the date, AI site and number of details hidden on each computer, never the text.
Know your breach steps. Name who assesses incidents and bookmark the OIPC page.

Your privacy officer, insurer partners or the Alberta Insurance Council may have more specific expectations; check with them. This guide is general information, not legal advice.

Sources

Links checked October 18, 2026. Laws and guidance change; rely on the official versions.

Want this set up for your office? The AI-safe office package covers Hushtag on every computer, the one-page staff AI-use policy, an AI-use record, and a 10-minute setup call. It helps you put a rule and a safeguard in place; it doesn't make an office compliant with any law on its own.