Updated September 25, 2026: every legal and factual statement in this article was re-checked against the primary source and corrected where needed.
There is a race in legal tech to automate everything: 'one-click compliance,' 'AI-generated legal advice,' 'robot DPOs.'
At Mosaic, we are clear-eyed about technology. Used well, it can take the drudgery out of the legwork. But it does not change a fundamental truth: privacy is not a maths problem. It is a values problem. And values need human judgment.
The limits of large language models
Generative AI is good at summarizing documents and spotting patterns. It struggles with context and nuance.
- Hallucinations: a model can confidently cite a regulation that does not exist.
- Subjectivity: laws such as the GDPR turn on terms like 'disproportionate effort,' 'high risk,' and 'reasonable expectations.' These are legal arguments, not binary switches.
If you rely entirely on a model for compliance, you are building your defence on probability rather than reasoned judgment.
What the law actually asks for
Human oversight is not only good practice; several regimes now write it down.
- GDPR, Article 22: people have the right not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects, subject to limited exceptions.
- Quebec's Law 25: an organization that makes a decision based exclusively on automated processing of personal information must tell the person, explain on request the principal factors behind it, and give them the opportunity to submit observations to someone in a position to review the decision.
- EU AI Act: deployers of high-risk AI systems must assign human oversight to people with the necessary competence, training and authority. That obligation applies from December 2, 2027 for the high-risk uses listed in Annex III, and from August 2, 2028 for AI in regulated products.
- Federal institutions: under the Treasury Board Directive on Automated Decision-Making, the final decision must be made by a human for systems at the two highest impact levels.
The Mosaic methodology: precision with accountability
We think the privacy function works best as a partnership between people and tools — with the people firmly in charge.
- Let technology carry the legwork: collating records, surfacing patterns, and organizing evidence are well suited to software.
- Keep judgment with the expert: when a risk is surfaced, a named senior practitioner weighs the business context — is the risk acceptable, and is the mitigation sufficient?
That is why every Mosaic engagement is expert-led and senior-reviewed. We do not hand over a generic, unread report; every finding is reviewed and put in context, and every engagement is led and signed by a named senior practitioner.
Trust is human. Your customers are not asked to trust an algorithm; they are asked to trust your organization. A human-in-the-loop approach tells them: 'We value your privacy enough to have a real person look at it.'