Quebec Law 25 and AI: What Businesses Must Do
Last updated: July 24, 2026 · Informational, not legal advice
Quick answer
Law 25 is Quebec's modernized privacy law, and it is the strictest rulebook that applies to business AI use in Canada today. If AI touches the personal information of people in Quebec, you must: disclose fully automated decisions and offer human review, run a Privacy Impact Assessment before deploying tools that process personal data (including sending it to US-hosted AI), keep tracking/profiling off by default, and declare biometric systems to the CAI. Penalties reach $25M or 4% of worldwide turnover.
Why Does a Privacy Law Govern AI in Quebec?
Canada has no dedicated AI statute — the federal attempt (AIDA, inside Bill C-27) died in January 2025. That leaves privacy law doing the work, and Law 25 goes further than PIPEDA: it is the only Canadian law with explicit duties around automated decision-making, technology that profiles or tracks people, and biometrics. If you serve Quebec customers, Law 25 — not AIDA — is the AI rule you can actually be fined under today.
What Counts as an "Automated Decision" Under Law 25?
Any decision about a person based exclusively on automated processing of their personal information. Common business examples:
- An AI screening job applications before a human sees them — and rejecting some outright
- Automated credit, financing, or insurance eligibility decisions
- Dynamic pricing or account limits set per-customer by an algorithm
- An AI agent approving or denying a refund, claim, or application end-to-end
For these, you must tell the person the decision was automated (at or before the time of the decision), explain on request what information and main factors drove it, and provide a route to human review. The cheapest compliance design is often to keep a human meaningfully in the loop — then the decision is no longer exclusively automated. AI that drafts, recommends, or triages for a human decision-maker sits outside this provision.
When Do You Need a Privacy Impact Assessment?
- Any project that collects, uses, or discloses personal information — an AI chatbot capturing leads, an AI tool summarizing customer emails, CRM enrichment.
- Before sending personal information outside Quebec — which includes most US-hosted AI tools. The PIA must conclude the data gets adequate protection, supported by contract terms.
- Proportionately — a small deployment needs a short, documented assessment, not a 50-page report. What matters is that you did it before launch and can show it.
The Practical Law 25 + AI Checklist
- Appoint a privacy officer and publish their contact (default is your CEO until delegated)
- Inventory where AI tools touch personal information — inputs, outputs, and vendor storage
- Run a proportionate PIA per AI deployment; re-run when the tool or data changes
- Use enterprise AI tiers with no-training commitments and defined retention; minimize personal data in prompts
- Disclose automated decisions and build the human-review path before launch
- Keep profiling/tracking features off by default; disclose them clearly
- Declare any biometric identity system to the CAI before it goes live
- Publish a clear confidentiality policy in French and English
Two of our tools do the heavy lifting: the AI Compliance Checker flags which obligations apply to your use case, and the AI Policy Generator drafts the internal AI-use policy your PIA will reference. For the full Canadian picture, see the Canadian AI compliance hub.
Frequently Asked Questions
Does Law 25 apply to my business if I'm not in Quebec?
Yes, if you handle the personal information of people in Quebec. Law 25 applies based on whose data you process, not where your office is. An Ontario company with Quebec customers, a SaaS product with Quebec users, or a clinic serving Quebec patients all fall in scope for that data.
What does Law 25 say about AI making decisions?
When a decision about a person is based exclusively on automated processing — an AI approving a loan application, screening a résumé, or setting a price — you must inform the person of that at the time of the decision or before, tell them on request what personal information was used and the main factors behind the decision, and give them a way to have it reviewed by a human and to submit observations.
Do I need a Privacy Impact Assessment before deploying an AI tool?
Often, yes. Law 25 requires a Privacy Impact Assessment (PIA) for any project involving the collection, use, or disclosure of personal information — which most AI deployments are — and specifically before communicating personal information outside Quebec, which covers most US-hosted AI tools. The PIA must weigh sensitivity, purpose, and protections, and be proportionate to the project.
Can I use a US-hosted AI tool like ChatGPT with customer data under Law 25?
You can, but only after assessing the transfer: a PIA covering the cross-border communication, contractual protections with the vendor, and a conclusion that the information would receive adequate protection. In practice this means enterprise-tier agreements (no training on your data, defined retention), minimizing what personal information reaches the tool, and documenting the assessment. For sensitive data, many Quebec businesses choose Canadian-resident or self-hosted options instead.
What are the penalties for getting Law 25 wrong?
Administrative monetary penalties reach $10 million or 2% of worldwide turnover, and penal fines reach $25 million or 4% of worldwide turnover — the highest privacy penalties in Canada. Law 25 also created a private right of action for damages. Enforcement is handled by the Commission d'accès à l'information (CAI).
Does a chatbot on my website trigger Law 25 requirements?
If it collects personal information from Quebec visitors (names, emails, account details), yes: you need transparency about what is collected and why, appropriate consent, and your confidentiality policy published in clear terms. If the chatbot uses tracking or profiling technology, Law 25 requires those functions to be off by default until the person activates them.
Related Guides
Get AI insights for Canadian businesses
Weekly tips on ChatGPT, automation, and cost-saving strategies. No spam, unsubscribe anytime.
Related Articles
Canada’s New Privacy Law (Bill C-36) and Your AI
When the US Can Switch Off Your AI: What Export Controls Mean for Canadian Businesses
AIDA Compliance Guide for Canadian Businesses
AI consultants with 100+ custom GPT builds and automation projects for 50+ Canadian businesses across 20+ industries. Based in Markham, Ontario. PIPEDA-compliant solutions.