Law 25 and Artificial Intelligence

What Quebec businesses need to know to use AI in compliance.

Law 25 in brief

Quebec's Act to modernize legislative provisions as regards the protection of personal information (Law 25) has been in effect since September 2023. It strengthens obligations for businesses regarding personal data protection.

In practice, for a business that wants to use AI, this means:

You need to know what personal data passes through your AI tools.
You need a designated person in charge of personal information protection.
If you send data outside Quebec (which most AI tools do), you need to assess the risks and inform the individuals concerned.
You need an accessible, up-to-date privacy policy.
In case of an incident, you must report it to the Commission d'accès à l'information (CAI).

The real problem

Most Quebec businesses want to use AI but hesitate. The question I hear most often: "What can I share with AI without breaking the law?"

It's a good question. The answer depends on the type of data, the AI provider used, and the context. That's exactly where I come in.

What I do

I built my tools specifically to deal with Law 25 on a daily basis:

My AI agent classifies the sensitivity of your documents and explains best practices in plain language. It links to official sources (CAI, Éducaloi). This is not legal advice — it's practical education integrated into your workflow.
My anonymization solutions scrub personal information on my Montreal server before any AI processing. For these services, no personal data leaves Quebec.
My AI workshop addresses Law 25 questions as they come up during demos, with your real cases. Your people leave knowing what they can and can't do.

Official resources

Note: The information on this page is educational in nature and does not constitute legal advice. Consult a qualified legal professional for questions specific to your situation.

Ask me a question

← Back to home