Quebec Law 25 and Generative AI: What to Settle Before Production

Posted on Oct 21 • Originally published at codacon.ai

If you run a Quebec company, you are probably its person in charge of the protection of personal information. Law 25 gives that role to the person with the highest authority by default, whether or not anyone told you (section 3.1).

Now read the list of failures that can draw an administrative monetary penalty (section 90.1). Two of the five that apply to most companies are not legal paperwork. They are engineering: failing to take reasonable security measures, and failing to handle decisions made by automated processing. Generative AI touches both.

Law 25 was not written with large language models in mind. It applies to them anyway, and the regulator has already said so in writing. Here is where Law 25 and generative AI meet, what each obligation asks of an AI system, and what the Commission d'accès à l'information has actually decided.

Law 25 is the common name for An Act to modernize legislative provisions as regards the protection of personal information (S.Q. 2021, c. 25). It amended Quebec's private sector privacy act and its public sector equivalent. It was phased in mainly between September 2022 and September 2024. Everything below is in force today.

The regulator is the Commission d'accès à l'information (CAI). Administrative monetary penalties reach $10 million or 2% of worldwide turnover, whichever is greater (section 90.12). Penal fines reach $25 million or 4%, doubled for a subsequent offence (sections 91 and 92.1). Individuals can also sue: where an unlawful infringement is intentional or results from gross fault, the court must award punitive damages of at least $1,000 (section 93.1).

Section references below are to the private sector act. We are security practitioners, not lawyers. This post explains how the obligations translate into AI architecture and controls; your counsel decides how they apply to you.

We reviewed the CAI's published decisions, its annual and five-year reports, and the joint investigations it conducts with the federal Privacy Commissioner. As of October 2026:

The absence of fines is not a reason to wait. Orders to shut down a system after it is built are expensive, and class actions do not need a CAI decision to proceed.

Section 90.1 lists what can draw an administrative monetary penalty for most companies: failing to inform people about collection, collecting, using, communicating, keeping, or destroying personal information unlawfully, failing to report a confidentiality incident, failing to take the security measures required by section 10, and failing to inform a person of an automated decision or let them submit observations under section 12.1. A sixth ground applies only to personal information agents.

The act also tells you how penalties and fines are weighed. The CAI must first send a notice of non-compliance and let you respond (sections 90.3 and 90.4). At any time after a failure, you can offer an undertaking to remedy it; if the CAI accepts it and you comply, no penalty can be imposed for those acts (section 90.1). Its criteria include the measures you took to remedy the failure and your cooperation (section 90.2). For penal fines, a judge weighs whether the offence was foreseeable, whether you failed to follow recommendations or warnings to prevent it, and whether you failed to take reasonable preventive measures (section 92.3).

Two consequences follow. A security assessment whose findings sit in a drawer is worse than none: it proves the risk was foreseeable. And when a notice arrives, a credible, sequenced remediation plan is what an undertaking is built on.

Not sure which of your AI systems this reaches? Book a 30-minute call. Bring one system; you leave knowing which obligations below apply to it and your top three gaps.

What the law says. Any project to acquire, develop, or overhaul an information system or electronic service delivery system involving personal information requires a privacy impact assessment (section 3.3). The person in charge of the protection of personal information must be consulted from the outset of the project.

What it means for AI. A RAG assistant, a copilot connected to your CRM, or an agent with access to a mailbox is exactly that kind of project. The assessment has to cover what the model can read, not just what users type. A retrieval index built over a shared drive inherits every piece of personal information on that drive.

On the record. In Centre de services scolaire du Val-des-Cerfs (November 2022), a school service centre built a machine learning tool to predict grade 6 dropout risk. The CAI held that the predictions were new personal information, so producing them was a collection, and that a privacy impact assessment should have been done before deployment. In its 2026 five-year report, the CAI recommends that assessments of AI systems making decisions about people include an algorithmic impact analysis. The CAI's PIA guide is the starting template.

Warning sign. The PIA is drafted after the pilot, describes the vendor's product page, and never mentions embeddings, logs, model outputs, or tool access.

What the law says. Before communicating personal information outside Quebec, an organization must conduct a privacy impact assessment covering the information's sensitivity, the purposes, the protection measures including contractual ones, and the legal framework of the destination (section 17). The information may go only if it would receive adequate protection, and the transfer needs a written agreement that reflects the assessment.

The same applies when you entrust a provider outside Quebec with collecting, using, communicating, or keeping the information on your behalf. Wherever the provider is, section 18.3 requires a written contract that specifies its protection measures and bars it from keeping the information after the contract ends. The provider must notify your person in charge without delay of any violation or attempted violation of confidentiality, and let them verify compliance.

Few standard AI vendor terms say that.

What it means for AI. Most hosted model APIs process prompts outside Quebec, often outside Canada. Every prompt carrying personal information is a communication outside Quebec. So is a cloud vector database in another region, a managed logging service, or an evaluation tool that stores conversation samples.

On the record. The reach runs both ways. In the joint investigation of OpenAI (May 2026), the CAI found that Quebec's act applied to OpenAI even though it had no establishment or employees in Quebec. In Clearview AI (December 2021), it ordered a US company to stop collecting Quebecers' facial images. Your foreign provider is within the CAI's reach. So are you, for choosing it. We found no decision yet that turns on section 17 itself.

Warning sign. Nobody can say which region processes inference, or whether the "data residency" option covers prompts, completions, logs, and abuse monitoring, or only data at rest.

What the law says. An organization that uses personal information to render a decision based exclusively on automated processing must inform the person no later than when it informs them of the decision (section 12.1). On request, it must disclose the personal information used, the reasons and the principal factors and parameters that led to the decision, and the right to have the information corrected. The person must be able to submit observations to a staff member in a position to review the decision.

What it means for AI. Screening job applicants, triaging insurance claims, scoring credit, or flagging accounts for closure with a model all qualify when no human meaningfully reviews the outcome. The CAI's guidance gives credit decisions, financial aid assessments, and prioritizing a request as examples. "Principal factors and parameters" is hard to produce from an LLM after the fact. It has to be designed in: logged inputs, retrieved sources, and a decision record a reviewer can read. Section 11 adds a floor: information used to make a decision about a person must be accurate when used and kept for at least one year after the decision. A model that decides today needs a decision record that still exists next October.

On the record. No decision interprets section 12.1 yet, but the CAI has shown what algorithmic accountability looks like to it. In its April 2026 Metro decision on facial recognition in grocery and pharmacy stores, it ordered the company to report every six months for two years on the systems' effectiveness, false positives, and algorithmic bias. Expect the same questions about any model that decides things about people.

Warning sign. The human in the loop approves 99% of model recommendations in under ten seconds. That is automated processing with a signature.

What it means for AI. Personalization, sentiment analysis, and behavioural inference built into a customer-facing assistant are profiling. Training on user conversations, and conversation memory across sessions, are privacy settings. The feature ships off, and the user turns it on.

On the record. This is where the CAI has been most direct about AI. In the OpenAI investigation, it found that training models on ChatGPT conversations by default breached section 9.1, despite the information OpenAI gave users. In the joint TikTok investigation (September 2025), it found that profiling functions were not off by default, in breach of sections 8.1 and 9.1. It rejected TikTok's argument that settings designed for the European GDPR satisfied section 9.1: the Quebec rule is worded differently.

Biometrics carry their own lead time. Law 25 amended the IT framework act so that a biometric database, such as facial or voice templates, must be disclosed to the CAI at least 60 days before it goes into service (section 45). That disclosure is what put the Metro project in front of the CAI.

Warning sign. The product team describes long-term memory or "help improve the model" as an opt-out, and nobody has asked whether it is on by default.

What it means for AI. Using support transcripts to fine-tune a model, or loading customer files into a general-purpose knowledge assistant, is a new use. That analysis belongs before the training run, not after.

Warning sign. The training dataset was assembled by an engineer with production read access and a deadline.

What the law says. When an organization has reason to believe a confidentiality incident has occurred, it must take reasonable measures to reduce the risk of injury and prevent new incidents. If the incident presents a risk of serious injury, it must promptly notify the CAI and the affected individuals (section 3.5). Section 3.6 defines an incident, section 3.7 sets how to assess the risk, and section 3.8 requires a register of every incident, reported or not.

What it means for AI. Generative AI creates new incident paths. A prompt injection that makes an assistant reveal another customer's file is unauthorized communication of personal information. So is a retrieval system that returns documents the user was never authorized to see, or a leaked API key that exposes conversation logs. Your incident response plan needs to recognize them, and your logs need to show what the model actually returned.

On the record. 514 incident notices reached the CAI in a single year. The regulator is used to them. What it will ask about an AI incident is what you can reconstruct: which documents were retrieved, what was returned, and to whom.

Warning sign. The AI system is out of scope for the incident response plan, or its logs record the prompt but not the retrieved documents and the output.

What the law says. When the purposes are achieved, personal information must be destroyed or anonymized according to the anonymization regulation in force since May 2024 (section 23). The organization's governance policies must frame retention and destruction (section 3.2).

What it means for AI. Personal information persists in more places in an AI stack than in a classic application: prompt logs, vendor abuse monitoring stores, embeddings, caches, evaluation sets, and fine-tuned weights. You cannot destroy what you have not inventoried, and you cannot easily remove one person from a fine-tuned model.

On the record. Destruction is the CAI's standard remedy. It ordered Clearview AI to destroy the images and biometric vectors it held on Quebecers within 90 days, and ordered Transcontinental (September 2024) to shut down an employee facial recognition system and destroy the templates. An order to destroy is cheap to comply with only if you know where every copy lives.

Warning sign. A deletion request is honoured in the CRM while the same customer's emails remain in the vector index.

Class actions do not wait for the CAI. In Badji c. Zenleads inc. (2026 QCCS 5), the Superior Court authorized a class action on January 5, 2026 against the company behind the Apollo.io sales-prospecting platform.

The court wrote that loss of control over the use of data and algorithmic profiling "can, in themselves, cause harm" (para. 72), and found the conditions for punitive damages under section 93.1 met at this stage (paras. 81–82).

Whether the defendant profiled class members in breach of the act is one of the questions set for trial (para. 103). The Court of Appeal has since granted leave to appeal, with a hearing scheduled for November 2026 ( Osler ).

The judgment also cites Doan c. Clearview AI inc. (2024 QCCS 3968), a Quebec class action over scraped facial images. Neither case has been decided on the merits.

As noted at the top, the person with the highest authority, usually the CEO, holds the role of person in charge of the protection of personal information by default (section 3.1). That role can be delegated in writing, but the accountability does not disappear. The title and contact information must be published on the organization's website.

That is why Law 25 is a board topic, not only a compliance one. Directors should expect to see where AI systems process personal information, which ones have a completed PIA, and what incidents were recorded. Our post on questions a board should ask before an AI coding tool rollout applies the same discipline to a different decision.

We work alongside your privacy officer and legal counsel. They interpret the law; we make sure the system does what the PIA says it does.

If you hesitated on two of them, that is the conversation to have before production, not after a notice. Book a 30-minute call: bring one AI system, and leave with the obligations that apply to it and your top three gaps.