Does Quebec’s Law 25 apply to AI tools?

The short answer

Yes, wherever the tool touches personal information about people in Quebec, and it applies through the ordinary rules rather than through anything AI-specific. The Commission d’accès à l’information — Quebec’s regulator, and the authority for everything on this page — describes the private-sector Act as covering personal information a business collects, holds, uses or communicates to third parties, expressly including information whose safekeeping is handled by a third party rather than the business itself, and regardless of whether it is written, graphic, audio, visual or computerised. A hosted AI service is a third party holding your information in computerised form. There is no gap to fall into.

The Office of the Privacy Commissioner of Canada notes separately that Quebec is one of three provinces with a general private-sector law deemed substantially similar to PIPEDA, and that PIPEDA still applies where information crosses provincial or national borders. So a firm outside Quebec with Quebec clients is usually looking at both.

Five obligations that bite on an AI rollout

The Commission’s published summary of the main changes brought by Law 25 is the source for each of the following.

• • A privacy impact assessment before information leaves Quebec. The Commission states that since September 2023, before communicating personal information outside Quebec an organisation must carry out an assessment of privacy-related factors; the communication may proceed if the assessment shows the information would benefit from adequate protection, and it must be the subject of a written agreement meeting certain conditions. It also states that an assessment is required for any project to acquire, develop or overhaul an information system or electronic service delivery involving personal information — which is what deploying an AI tool is.
• • Notice and a human review path for exclusively automated decisions. The Commission states that organisations must inform a person when they are the subject of a decision based exclusively on automated processing of their personal information, no later than when they inform them of the decision, and must give the person the opportunity to submit observations to a member of staff able to review that decision. The practical answer for a professional firm is usually to make sure no decision is exclusively automated — a person reviews and signs — but that has to be true, not asserted.
• • Governance policies with retention and destruction rules in them. The Commission states that businesses must establish and implement policies and practices governing their handling of personal information, which must provide for rules on retention and destruction, roles and responsibilities across the information lifecycle, and a complaints process, and must publish detailed information about them on their website.
• • A named, published person responsible. The Commission states that the person with the highest authority in the business is responsible for protection of personal information and exercises the function of person in charge, though it may be delegated in writing in whole or in part, and that the title and contact details must be published on the website or otherwise made accessible.
• • Confidentiality incidents: notify and keep a register. The Commission states that organisations must notify it and the individuals concerned of any confidentiality incident involving personal information they hold that presents a risk of serious injury, and must keep a register of incidents and provide it to the Commission on request.

Two more that catch AI deployments sideways

Anonymisation is not currently a free alternative. The Commission states that since September 2023 the applicable laws allow personal information to be anonymised as an alternative to destruction, but only in accordance with generally accepted best practices and the criteria and terms determined by government regulation — and that in the absence of such a regulation, public bodies and businesses cannot anonymise personal information. If a vendor is telling you the problem disappears because the data is anonymised, that is a claim to check against the current position rather than accept.

Identification, location and profiling functions must not be on by default. The Commission states that organisations collecting personal information from a person using technology that includes functions allowing them to be identified, located or profiled must first inform them of the use of such technology and of the means available to activate those functions — in other words, the functions cannot be enabled by default. It defines profiling as collecting and using personal information to evaluate certain characteristics of a natural person, including work performance, economic situation, health, personal preferences, interests or behaviour. It also states that technological products and services offered to the public must, by default, provide the highest level of confidentiality without any intervention by the person concerned.

If your firm is outside Quebec

The obligations follow the information, not the letterhead. A firm in Ontario or Alberta acting for Quebec clients should assume the Quebec rules are in play for those files, and should also remember the surrounding obligations that have nothing to do with privacy — Treadstone Law’s answer on what an Ontario corporation must do to carry on business in Quebec covers registration with the Registraire des entreprises and the French-language requirements, which apply to client-facing material regardless of where you are incorporated.

Worked example (illustrative)

A Montreal professional services firm wants to use a hosted drafting assistant. Before the pilot, four things happen. A privacy impact assessment is prepared because the tool is a new information system involving personal information and because processing occurs outside Quebec. A written agreement is negotiated with the vendor rather than accepted as clickwrap. The firm’s governance policy is amended so the retention and destruction rules cover prompts and outputs, not just matter files. And the workflow is designed so that every output is reviewed and signed by a professional, which keeps the firm out of the exclusively-automated-decision regime rather than obliging it to build a review-on-request channel.

What is countable: assessments completed before deployment rather than after, vendor agreements signed versus clickwrap accepted, and incidents recorded in the register. Not hours saved.

Where this sits in the firm

This page is written for a firm that delivers work to a book of clients. If the question is really about the front desk — intake, scheduling, recall, reminders — that lives on the professional practice owners page. If it is about your own month-end, reconciliation and payables rather than client deliverables, that is accounting automation. The two overlap on tooling and almost never on risk.

Questions we get asked

Does Law 25 ban AI?
Nothing in the Commission’s published summary of the changes does that. It regulates what happens to personal information, which constrains how a tool may be used rather than whether it may be used.

Is a privacy impact assessment a big document?
The Commission states that in every case the assessment must be proportionate to the sensitivity of the information, the purpose of its use, its quantity, distribution and medium. A narrow tool over low-sensitivity information does not need the treatment a biometric system would get.

We only use the tool on anonymised text.
Then confirm that what you are doing meets the Commission’s description of anonymisation rather than being de-identification by another name, and note its statement about the regulation-dependency above. If in doubt, treat the information as personal and comply.

Does this replace PIPEDA for us?
Only if you operate entirely within Quebec. The federal Commissioner’s summary of privacy laws states that PIPEDA applies to information crossing provincial or national borders regardless of where the business is based.