AI and Quebec's Law 25: how to stay compliant
Québec's Law 25 modernizes the protection of personal information, including in private-sector businesses that use AI. A business must designate a person in charge of the protection of personal information, carry out a privacy impact assessment (EFVP) in the cases provided, including before communicating personal information outside Québec, and inform people when a decision is based exclusively on automated processing.
Key points
- Law 25 amends Québec's private-sector act on the protection of personal information, enforced by the Commission d'accès à l'information (CAI).
- A privacy impact assessment (EFVP) is required, including before communicating personal information outside Québec.
- A decision based exclusively on automated processing must be disclosed to the person concerned.
- Penal fines can reach CA$25 million or 4% of worldwide turnover, whichever is greater.
- This page is general information, not legal advice.
What does Law 25 change for using AI?
Law 25 amends the Act respecting the protection of personal information in the private sector, Québec's law that governs how businesses collect, use and communicate personal information. It is enforced by the Commission d'accès à l'information (CAI). Its provisions came into force in stages between 2022 and 2024.
Who must be in charge of protecting personal information?
Law 25 requires a business to designate a person in charge of the protection of personal information and to publish that person's title and contact details. This person oversees compliance, handles requests from the people concerned and answers questions about the business's practices.
When is a privacy impact assessment required?
An EFVP is a written analysis of the privacy risks of a project that involves personal information. Law 25 requires one in particular for a project to acquire, develop or overhaul an information system or electronic service that involves such information, and before communicating that information outside Québec.
What do the rules say about automated decisions and transfers outside Québec?
When a decision about a person is based exclusively on automated processing, the business must inform that person. On request, it must also tell them which information was used, the reasons and the main factors that led to the decision. A decision actually made by a person after review does not fall in this category; the distinction should be checked case by case.
Transfers outside Québec are the other sensitive point. A cloud AI model may process messages in another country. The business therefore needs to know where its data is processed, carry out the EFVP before the transfer, and choose providers able to meet its obligations.
What checklist should you follow to use AI in compliance?
This checklist is not legal advice. It summarizes the steps that legal, security and compliance teams most often review before approving an AI tool.
- Inventory the AI tools in use, including those adopted without approval by the business.
- Identify the personal and sensitive information that goes into each tool.
- Designate the person in charge of the protection of personal information and publish their contact details.
- Check where the data is hosted and where each model processes it.
- Carry out an EFVP before deployment, and before any transfer outside Québec.
- Limit the models allowed and define who may use which tool.
- Set retention periods for conversations and files, and plan their deletion.
- Check that conversations are not used to train models, under the provider's terms.
- Document automated decisions and plan how people will be informed.
- Keep a register of confidentiality incidents and a notification procedure.
- Train employees on what can, and cannot, be submitted to AI.
How iYan helps, and what iYan does not do for you
iYan is an AI platform published by PontSys Inc., in Montréal. For several points on the checklist above, iYan offers concrete options: workspaces hosted in Canada, choice of model by the organization, an allowlist of approved models, personal information masked before it reaches the model, single sign-on and 2-step verification, access rights per workspace and per file, and an exportable audit journal.
iYan does not make a business compliant on its own. Compliance depends on your practices, your contracts and your decisions. iYan does not yet hold a SOC 2 or ISO 27001 certification; its controls are mapped to those frameworks. Organizations that require a local installation can run iYan on their own servers, with local models only.
Frequently asked questions
Does Law 25 forbid using AI?
No. Law 25 does not prohibit AI. It governs how personal information is used: a business must know which data it processes, why, where it is processed, who can access it and how long it is kept. An AI tool can therefore be used in compliance, provided it is governed like any other system that handles personal information.
Is hosting AI in Canada enough to meet Law 25?
No. Hosting in Canada is an important criterion, but it does not cover everything. A cloud model may process data elsewhere. You also need to check access rights, logging, retention periods and contracts with providers. An EFVP remains necessary for the projects concerned.
Does every AI tool need an EFVP?
Not necessarily for every tool, but for every project that involves personal information within the meaning of the law, and before any communication outside Québec. An assessment is still useful for everyday AI use, because it documents the choices made. Consult the person in charge of the protection of personal information in your business.
What should you do after a confidentiality incident involving AI?
The business must keep a register of confidentiality incidents. If an incident presents a risk of serious injury, it must notify the CAI and the people concerned, as the law requires. The iYan audit journal helps reconstruct what happened, who accessed what and when. Notification remains your responsibility, however.