Regulators And Compliance.

Canada

• PIPEDA. The federal Personal Information Protection and Electronic Documents Act governs the collection, use and disclosure of personal information in the course of commercial activity, and applies in provinces that have not enacted substantially similar legislation.
• Quebec. The province's modernised private-sector privacy regime, commonly called Law 25, introduced phased obligations between 2022 and 2024 covering governance, breach reporting, consent, privacy impact assessments, data portability and rights in respect of automated decision-making. Quebec is the most demanding privacy jurisdiction in the country and should be designed for first rather than accommodated later.
• Alberta and British Columbia. Each has its own Personal Information Protection Act, recognised as substantially similar to PIPEDA for provincially regulated organisations.

United States

• State insurance data security requirements, widely modelled on the NAIC Insurance Data Security Model Law, impose information security programme, incident response and notification obligations that flow through to third-party service providers by contract.
• State comprehensive privacy statutes apply in parallel, with varying definitions, thresholds and rights.
• The Gramm-Leach-Bliley Act framework continues to apply to financial institutions including insurers, with its own safeguards expectations.

Kempron's Posture On Personal Information

• Minimisation over accumulation. Collect what the process requires, for a defined purpose, for a defined period. A vendor that wants more data than the task needs is describing a business model, not a design.
• Locatability. We expect to be able to state precisely where a given category of data sits, who can reach it and for how long it will be retained. If that question cannot be answered quickly it cannot be answered honestly.
• Residency as a contractual term. Commitments about holding Canadian personal information in Canada are made in writing in the agreement, not offered as a preference.
• Deletion with a deadline. Return or destruction on exit is an obligation with a date attached, agreed before go-live rather than negotiated afterwards.
• Privacy impact assessment support. Where a customer is required to conduct a PIA, we expect to supply what it needs rather than treat it as the customer's problem.

Canada

• Ontario. Regulated by the Financial Services Regulatory Authority of Ontario, operating a statutory accident benefits schedule and the focus of successive reform packages.
• Quebec. Bodily injury is handled by the public Société de l'assurance automobile du Québec; property damage sits with private insurers supervised by the Autorité des marchés financiers.
• Alberta. Supervised for rating purposes by the Automobile Insurance Rate Board, and undergoing structural reform following the passage of Bill 47, the Automobile Insurance Act, which received Royal Assent in May 2025. (Insurance Bureau of Canada, 15 May 2025.)
• British Columbia, Saskatchewan and Manitoba. Public insurers — ICBC, SGI and MPI respectively — with entirely different procurement routes.

United States

Insurance is regulated state by state. Unfair claims settlement practices statutes, adopted in varying forms from NAIC models, set standards for the timeliness and fairness of claims handling. State departments of insurance conduct market conduct examinations. A technology that changes how a claim is handled changes what is examined.

Other Markets, For Context Only

The Global Markets page describes conduct supervision in the United Kingdom, continental Europe and Australia. Kempron does not operate in those markets and does not hold itself out as serving them. They are included because the regulatory direction of travel is consistent across all of them and that consistency is informative.

A claims process is subject to after-the-fact examination by parties who were not present when it ran: an internal auditor, a market conduct examiner, an ombudsman, opposing counsel, a court. Auditability is the property that makes those examinations possible. We treat it as a requirement rather than a feature, and we regard a system whose output cannot be accounted for as unfit for this market regardless of how well it performs.

Four propositions follow, and all four are testable by a reviewer without access to any implementation detail:

1. Every material step leaves a record. What happened, when, on what input, and under whose authority. A step that leaves no trace cannot be defended later, and the absence will be discovered at the worst possible moment.
2. Records are retained for as long as the claim can be examined. That period is set by limitation periods, regulatory retention requirements and the customer's own policy, not by what is convenient to store.
3. The reasoning is reconstructable, not merely the outcome. Knowing what a process concluded is of little use to an examiner who needs to know on what basis. An answer that cannot be explained is an answer that cannot be relied on.
4. Decision rights stay with the accountable party. The insurer carries the regulatory accountability for how a claim is handled. Automation that quietly relocates a decision away from the accountable party has created a governance problem and disguised it as an efficiency.

These propositions are also the reason we decline to describe our technical approach publicly while being willing to describe our governance commitments in detail. A regulator or compliance officer needs to know what must be true of the system and how it will be evidenced. Neither requires us to publish how it is built. The same logic governs our position on artificial intelligence.