Consent and privacy for HVAC companies using AI: a Canadian checklist

Rule set 1: CASL and AI-sent texts and emails

Canada's anti-spam law covers commercial electronic messages, and ISED's consent guidance is clear that texts count alongside email. AI does not change the rules; it just sends more messages, faster, which makes mistakes bigger.

According to that guidance:

• You need consent, either express or implied.
• Implied consent from an inquiry or application generally lasts six months; from a purchase, up to two years.
• Each message must identify your business (and anyone you send on behalf of) and give contact details that stay valid for at least 60 days.
• Each message needs an unsubscribe mechanism, and unsubscribes must be honoured within 10 business days, at no cost to the recipient.

What this means for HVAC AI

A customer who requested a replacement quote on 1 March gives you, generally, until about 1 September to follow up on implied consent. Your follow-up system should hold that date on the record and stop automatically. A customer who bought a furnace in 2025 can hear about maintenance reminders for up to two years from that purchase, unless they opt out.

Express consent is cleaner. If your technicians or CSRs ask "can we text you reminders about maintenance and offers?" and the answer is recorded with a date, your later AI sequences stand on firmer ground.

CASL checklist

• Every contact record shows consent type (express, inquiry, purchase) and date.
• Follow-up sequences check consent before each send, not only at the start.
• Every AI-drafted template names your company and includes a working opt-out.
• Opt-outs flow back to every system that can send messages, not just the one where they arrived.
• Someone owns the opt-out list and checks it monthly.

Rule set 2: privacy law and AI vendors

The Privacy Commissioner's summary of privacy laws explains that PIPEDA applies to private-sector commercial activity across most of Canada, while Alberta, British Columbia and Quebec have their own substantially similar laws for activity inside those provinces. The principles are similar: collect what you need, say why, protect it, and be accountable.

That last point matters most for AI. The accountability principle says your organisation must protect personal information, including information you send to a third party for processing. When processing happens outside Canada, it recommends assessing the risks, using contracts to require comparable protection, limiting the vendor's use of the data, and telling customers their information may go to another jurisdiction.

Privacy checklist

• List every AI tool and what customer data it receives: names, addresses, call audio, notes.
• Read each vendor's terms for storage location, retention and whether your data trains their models.
• Turn off data sharing or model training where the setting exists and you don't need it.
• Never feed payment card numbers or unnecessary health details into AI tools.
• Update your website privacy notice to mention AI processing and possible storage outside Canada.
• Name one person accountable for AI privacy questions.

Rule set 3: recording calls for AI

Most AI answering and summary tools work from call audio. The OPC's guidance on recording customer telephone calls sets out the expectations:

• Tell the customer the call is recorded, whether they called you or you called them.
• State the purpose as narrowly as possible and list every use. Don't say "quality assurance" if recordings also feed marketing, profiling or authentication.
• Continuing the call after being informed generally counts as implied consent; sensitive uses such as voiceprints may need express consent.
• Offer an alternative for customers who don't want to be recorded, such as an unrecorded call or another way to reach you.

Recording checklist

• Greeting mentions recording and its purposes before any personal details are collected.
• If recordings or transcripts help train or tune your AI, the notice says so.
• Callers who decline can press a key or ask to continue unrecorded, or get a callback.
• Retention period is set, and old recordings are deleted on schedule.

Rule set 4: Quebec's automated-decision notice

Quebec's privacy regulator, the Commission d'accès à l'information, describes two changes under Law 25 that touch AI directly:

1. When a decision about a person is based exclusively on automated processing of their personal information, the business must tell them, at the latest when it informs them of the decision, and give them a chance to present observations to a staff member who can review it.
2. Before collecting personal information with technology that can identify, locate or profile a person, the business must say so and explain how to turn those functions on; they can't be on by default.

What this means for HVAC AI

Most HVAC AI uses we recommend avoid fully automated decisions: a person approves bookings beyond simple slots, prices, refusals and priority. That design choice is deliberate. If your AI ever declines service, ranks customers, or decides who gets a callback without human involvement, and you serve people in Quebec, that is the point to involve a lawyer and add the notice.

Quebec checklist

• Map every point where the AI decides something about a customer without a person.
• Remove the fully automated ones where possible.
• For any that remain, draft the notice in French and name the staff role who reviews observations.
• Check that profiling or location features in your tools are off unless the customer turns them on.

Putting it together in one afternoon

Here is the order we follow with clients:

1. Inventory tools and data (one hour).
2. Fix the call greeting and recording notice (30 minutes).
3. Add consent type and date fields to your CRM, or confirm they exist (one hour).
4. Review templates for identification and opt-out (30 minutes).
5. Note any automated decisions and Quebec exposure (30 minutes).
6. Write the one-page "what the AI may and may not do" list (30 minutes).

As of October 2026 these summaries match the official pages linked above; check them again before relying on them. Our AI privacy and review rules service does this work with you, and our phone failure guide covers the operational side. For questions, see the FAQ or contact us.