Who is liable if my AI-built app is breached?
You are. The organization that collects personal information is accountable for protecting it under PIPEDA and Law 25, whoever or whatever wrote the code. AI coding tools' terms generally place responsibility for your application on you. Customers' contracts will hold you to your security commitments, and a breach triggers reporting duties regardless of cause. This is general information, not legal advice.
What follows a breach
- Assessing whether there is a real risk of significant harm (PIPEDA) or risk of serious injury (Law 25).
- Reporting to the regulator and notifying affected people where required.
- Keeping records of every breach, for 24 months under PIPEDA.
- Contract notices to business customers, often within tight deadlines.
More on what happens if your app leaks data.
Reducing the exposure
Test before launch, collect only what you need, keep a written record of the security steps you took, and review your contracts' security clauses. Cyber insurance may help with response costs; insurers increasingly ask how applications were tested.
Contracts and insurance
Business customers' contracts often include security obligations, breach notification deadlines measured in hours or days, and indemnities. Read them before signing: committing to controls you do not have, such as "annual penetration testing", creates liability on its own. Keep evidence that you do what the contract says.
Cyber insurance can cover breach response costs, notification and some liability. Applications now commonly ask about multi-factor authentication, backups, testing and how software is developed. Answer accurately, because a misstatement on the application can affect a claim. A recent security test with fixed findings is useful on both the insurance application and in any later dispute about whether you took reasonable care.
Getting it checked
TrazTech offers vibe-coding QA and security review, listed from $2,000 CAD. Get at least one other quote on the same scope; the questions to ask a testing firm help compare them.
Related questions
Get a scope for your app
Tell us what you built, what it stores and who is about to use it.
Get matchedCommon questions
Can I blame the AI tool vendor?
Not usefully. Their terms typically disclaim responsibility for generated code, and regulators look at the organization holding the data.
Does a pre-launch test reduce liability?
It reduces the chance of a breach and shows reasonable safeguards, which is what the law asks for.