02. Risks

This section describes the most important risks and how we will mitigate them. These are risks related to our Project idea (Orbit - AI assistant tool for financial advisors), NOT general software engineering risks.

Main Risk

There are high concerns raised regarding data privacy, security and regulatory compliance since Orbit is dealing with sensitive financial data in an AMF-regulated environment. Inadequate privacy and security controls could expose client information and result in non compliance with Quebec’s Law 25.

Mitigation:

• Development: To avoid dealing with actual client financial data, we will mock up fake synthetic client profiles using a fake-data library (e.g. Faker.js) with realistic- matching data structures agreed upon Nayiri, but have no actual client data.

• Real-world design: The production architecture will be designed to minimize clients personal and sensitive information to AI components. Automated PII masking will be applied at runtime to all AI interactions, where client-identifiable data is masked before reaching the AI model.

• Data residency: Under Quebec’s Law 25 (to avoid foreign legal exposure and extra privacy compliance steps), all data storage and processing will be hosted solely within Canadian data centers (e.g.AWS/Azure Canada Central),therefore, client data will never leave the country. Although, Orbit will be using synthetic data. Security: security will be implemented to production standards such as password hashing using bcrypt, sent & received over HTTPS/TLS and stored in AES-256 encrypted data, and role- based access control; all deployed on SOC2-and ISO-certified cloud infrastructure, to ensure that an advisor can only access their own clients.

• Accountability: a full record of all correspondence will be maintained including the timestamp, client, original AI-generated draft, and the advisor’s approval of the content and status for extracting data and compliance purposes.

• Governance: Preserve central all AI systems catalog at AMF level, with a description of its use case, risk classification, data source for each model. Also, limiting financial calculations to deterministic and auditable rather than free AI.

Other Risks

1. The summaries or emails written by Orbit could be misleading if sent without a review

Mitigation:

• Before taking any action or sending anything, all AI output will be reviewed and granted by the advisor so Orbit will never send a message or take any action without the advisor's authorization.

2. Clients may be uncomfortable if they know that their advisor is using an AI tool to send email drafts or messages.

Mitigation:

• Clients will be informed that the Orbit will be used as an assistant tool to raise productivity and make the advisor’s work easier, rather than replacing the advisor. The advisor will remain the decision maker and the client relation will not be affected; it will stay fully human.

3. The advisor may not have the full confidence of AI-generated summaries if they are not able to confirm their source.

Mitigation:

• let the AI indicate which meeting notes or client history it used for each follow up recommendation or generated summary, so the advisor can verify the source information before taking an action.