If you run a Quebec company, you are probably its person in charge of the protection of personal information. Law 25 gives that role to the person with the highest authority by default, whether or not anyone told you (section 3.1).
Now read the list of failures that can draw an administrative monetary penalty (section 90.1). Two of the five that apply to most companies are not legal paperwork. They are engineering: failing to take reasonable security measures, and failing to handle decisions made by automated processing. Generative AI touches both.
Law 25 was not written with large language models in mind. It applies to them anyway, and the regulator has already said so in writing. Here is where Law 25 and generative AI meet, what each obligation asks of an AI system, and what the Commission d'accès à l'information has actually decided.
What Law 25 is
Law 25 is the common name for An Act to modernize legislative provisions as regards the protection of personal information (S.Q. 2021, c. 25). It amended Quebec's private sector privacy act and its public sector equivalent. It was phased in mainly between September 2022 and September 2024. Everything below is in force today.
The regulator is the Commission d'accès à l'information (CAI). Administrative monetary penalties reach $10 million or 2% of worldwide turnover, whichever is greater (section 90.12). Penal fines reach $25 million or 4%, doubled for a subsequent offence (sections 91 and 92.1). Individuals can also sue: where an unlawful infringement is intentional or results from gross fault, the court must award punitive damages of at least $1,000 (section 93.1).
Section references below are to the private sector act. We are security practitioners, not lawyers. This post explains how the obligations translate into AI architecture and controls; your counsel decides how they apply to you.
What the record shows so far
We reviewed the CAI's published decisions, its annual and five-year reports, and the joint investigations it conducts with the federal Privacy Commissioner. As of October 2026:
- No published administrative monetary penalty. The CAI has had the power since September 2023. Its decisions page and annual reports show orders, not fines. Be wary of blog posts listing "real" Law 25 fines: the ones we traced were composites.
- No decision interpreting section 12.1, the automated decision rule. The CAI has issued guidance and law reform recommendations, not rulings.
- Plenty of orders on AI and biometrics. The CAI has ordered organizations to stop systems, destroy data, notify people, and report on algorithmic bias. Several of those decisions are cited below.
- Volume is real. The CAI received 514 confidentiality incident notices in 2024–2025, 80% from the private sector (annual report 2024–2025).
The absence of fines is not a reason to wait. Orders to shut down a system after it is built are expensive, and class actions do not need a CAI decision to proceed.
Read the penalty provisions as a scope
Section 90.1 lists what can draw an administrative monetary penalty for most companies: failing to inform people about collection, collecting, using, communicating, keeping, or destroying personal information unlawfully, failing to report a confidentiality incident, failing to take the security measures required by section 10, and failing to inform a person of an automated decision or let them submit observations under section 12.1. A sixth ground applies only to personal information agents.
The act also tells you how penalties and fines are weighed. The CAI must first send a notice of non-compliance and let you respond (sections 90.3 and 90.4). At any time after a failure, you can offer an undertaking to remedy it; if the CAI accepts it and you comply, no penalty can be imposed for those acts (section 90.1). Its criteria include the measures you took to remedy the failure and your cooperation (section 90.2). For penal fines, a judge weighs whether the offence was foreseeable, whether you failed to follow recommendations or warnings to prevent it, and whether you failed to take reasonable preventive measures (section 92.3).
Two consequences follow. A security assessment whose findings sit in a drawer is worse than none: it proves the risk was foreseeable. And when a notice arrives, a credible, sequenced remediation plan is what an undertaking is built on.
Not sure which of your AI systems this reaches? Book a 30-minute call. Bring one system; you leave knowing which obligations below apply to it and your top three gaps.
1. A privacy impact assessment before you build
What the law says. Any project to acquire, develop, or overhaul an information system or electronic service delivery system involving personal information requires a privacy impact assessment (section 3.3). The person in charge of the protection of personal information must be consulted from the outset of the project.
What it means for AI. A RAG assistant, a copilot connected to your CRM, or an agent with access to a mailbox is exactly that kind of project. The assessment has to cover what the model can read, not just what users type. A retrieval index built over a shared drive inherits every piece of personal information on that drive.
On the record. In Centre de services scolaire du Val-des-Cerfs (November 2022), a school service centre built a machine learning tool to predict grade 6 dropout risk. The CAI held that the predictions were new personal information, so producing them was a collection, and that a privacy impact assessment should have been done before deployment. In its 2026 five-year report, the CAI recommends that assessments of AI systems making decisions about people include an algorithmic impact analysis. The CAI's PIA guide is the starting template.
Warning sign. The PIA is drafted after the pilot, describes the vendor's product page, and never mentions embeddings, logs, model outputs, or tool access.
2. Sending personal information outside Quebec
What the law says. Before communicating personal information outside Quebec, an organization must conduct a privacy impact assessment covering the information's sensitivity, the purposes, the protection measures including contractual ones, and the legal framework of the destination (section 17). The information may go only if it would receive adequate protection, and the transfer needs a written agreement that reflects the assessment. The same applies when you entrust a provider outside Quebec with collecting, using, communicating, or keeping the information on your behalf. Wherever the provider is, section 18.3 requires a written contract that specifies its protection measures and bars it from keeping the information after the contract ends. The provider must notify your person in charge without delay of any violation or attempted violation of confidentiality, and let them verify compliance. Few standard AI vendor terms say that.
What it means for AI. Most hosted model APIs process prompts outside Quebec, often outside Canada. Every prompt carrying personal information is a communication outside Quebec. So is a cloud vector database in another region, a managed logging service, or an evaluation tool that stores conversation samples.
On the record. The reach runs both ways. In the joint investigation of OpenAI (May 2026), the CAI found that Quebec's act applied to OpenAI even though it had no establishment or employees in Quebec. In Clearview AI (December 2021), it ordered a US company to stop collecting Quebecers' facial images. Your foreign provider is within the CAI's reach. So are you, for choosing it. We found no decision yet that turns on section 17 itself.
Warning sign. Nobody can say which region processes inference, or whether the "data residency" option covers prompts, completions, logs, and abuse monitoring, or only data at rest.
3. Decisions made by automated processing
What the law says. An organization that uses personal information to render a decision based exclusively on automated processing must inform the person no later than when it informs them of the decision (section 12.1). On request, it must disclose the personal information used, the reasons and the principal factors and parameters that led to the decision, and the right to have the information corrected. The person must be able to submit observations to a staff member in a position to review the decision.
What it means for AI. Screening job applicants, triaging insurance claims, scoring credit, or flagging accounts for closure with a model all qualify when no human meaningfully reviews the outcome. The CAI's guidance gives credit decisions, financial aid assessments, and prioritizing a request as examples. "Principal factors and parameters" is hard to produce from an LLM after the fact. It has to be designed in: logged inputs, retrieved sources, and a decision record a reviewer can read. Section 11 adds a floor: information used to make a decision about a person must be accurate when used and kept for at least one year after the decision. A model that decides today needs a decision record that still exists next October.
On the record. No decision interprets section 12.1 yet, but the CAI has shown what algorithmic accountability looks like to it. In its April 2026 Metro decision on facial recognition in grocery and pharmacy stores, it ordered the company to report every six months for two years on the systems' effectiveness, false positives, and algorithmic bias. Expect the same questions about any model that decides things about people.
Warning sign. The human in the loop approves 99% of model recommendations in under ten seconds. That is automated processing with a signature.
4. Profiling and privacy by default
What the law says. An organization that collects personal information using technology with functions to identify, locate, or profile a person must inform them beforehand and explain how to activate those functions (section 8.1). Technological products and services offered to the public must apply the highest level of confidentiality by default, without any action by the user (section 9.1). Browser cookies are excluded.
What it means for AI. Personalization, sentiment analysis, and behavioural inference built into a customer-facing assistant are profiling. Training on user conversations, and conversation memory across sessions, are privacy settings. The feature ships off, and the user turns it on.
On the record. This is where the CAI has been most direct about AI. In the OpenAI investigation, it found that training models on ChatGPT conversations by default breached section 9.1, despite the information OpenAI gave users. In the joint TikTok investigation (September 2025), it found that profiling functions were not off by default, in breach of sections 8.1 and 9.1. It rejected TikTok's argument that settings designed for the European GDPR satisfied section 9.1: the Quebec rule is worded differently.
Biometrics carry their own lead time. Law 25 amended the IT framework act so that a biometric database, such as facial or voice templates, must be disclosed to the CAI at least 60 days before it goes into service (section 45). That disclosure is what put the Metro project in front of the CAI.
Warning sign. The product team describes long-term memory or "help improve the model" as an opt-out, and nobody has asked whether it is on by default.
5. Secondary use and training data
What the law says. Personal information may be used only for the purposes for which it was collected, unless the person consents or a specific exception applies (section 12). Sensitive information requires express consent. One exception covers study, research, or statistics using de-identified information.
What it means for AI. Using support transcripts to fine-tune a model, or loading customer files into a general-purpose knowledge assistant, is a new use. That analysis belongs before the training run, not after.
On the record. In the OpenAI investigation, the CAI accepted that training a language model can be a legitimate purpose, but found the collection overbroad. It also held that information published on the web is not "public" under the act just because it can be scraped. In Val-des-Cerfs, student records collected for schooling were reused to train a prediction tool without consent or notice, and the CAI ordered the school service centre to inform parents. Inferences stay in play afterwards: a person's right of access covers all the information you hold on them (section 27). Only portability, the export in a structured format, excludes information "created or inferred" from their data. The courts are asking the same question: in Badji, below, the Superior Court left for trial whether algorithmic profiles are themselves new personal information (para. 43).
Warning sign. The training dataset was assembled by an engineer with production read access and a deadline.
6. Confidentiality incidents
What the law says. When an organization has reason to believe a confidentiality incident has occurred, it must take reasonable measures to reduce the risk of injury and prevent new incidents. If the incident presents a risk of serious injury, it must promptly notify the CAI and the affected individuals (section 3.5). Section 3.6 defines an incident, section 3.7 sets how to assess the risk, and section 3.8 requires a register of every incident, reported or not.
What it means for AI. Generative AI creates new incident paths. A prompt injection that makes an assistant reveal another customer's file is unauthorized communication of personal information. So is a retrieval system that returns documents the user was never authorized to see, or a leaked API key that exposes conversation logs. Your incident response plan needs to recognize them, and your logs need to show what the model actually returned.
On the record. 514 incident notices reached the CAI in a single year. The regulator is used to them. What it will ask about an AI incident is what you can reconstruct: which documents were retrieved, what was returned, and to whom.
Warning sign. The AI system is out of scope for the incident response plan, or its logs record the prompt but not the retrieved documents and the output.
7. Retention and destruction
What the law says. When the purposes are achieved, personal information must be destroyed or anonymized according to the anonymization regulation in force since May 2024 (section 23). The organization's governance policies must frame retention and destruction (section 3.2).
What it means for AI. Personal information persists in more places in an AI stack than in a classic application: prompt logs, vendor abuse monitoring stores, embeddings, caches, evaluation sets, and fine-tuned weights. You cannot destroy what you have not inventoried, and you cannot easily remove one person from a fine-tuned model.
On the record. Destruction is the CAI's standard remedy. It ordered Clearview AI to destroy the images and biometric vectors it held on Quebecers within 90 days, and ordered Transcontinental (September 2024) to shut down an employee facial recognition system and destroy the templates. An order to destroy is cheap to comply with only if you know where every copy lives.
Warning sign. A deletion request is honoured in the CRM while the same customer's emails remain in the vector index.
The courts are moving too
Class actions do not wait for the CAI. In Badji c. Zenleads inc. (2026 QCCS 5), the Superior Court authorized a class action on January 5, 2026 against the company behind the Apollo.io sales-prospecting platform. The court wrote that loss of control over the use of data and algorithmic profiling "can, in themselves, cause harm" (para. 72), and found the conditions for punitive damages under section 93.1 met at this stage (paras. 81–82). Whether the defendant profiled class members in breach of the act is one of the questions set for trial (para. 103). The Court of Appeal has since granted leave to appeal, with a hearing scheduled for November 2026 (Osler). The judgment also cites Doan c. Clearview AI inc. (2024 QCCS 3968), a Quebec class action over scraped facial images. Neither case has been decided on the merits.
Accountability sits at the top
As noted at the top, the person with the highest authority, usually the CEO, holds the role of person in charge of the protection of personal information by default (section 3.1). That role can be delegated in writing, but the accountability does not disappear. The title and contact information must be published on the organization's website.
That is why Law 25 is a board topic, not only a compliance one. Directors should expect to see where AI systems process personal information, which ones have a completed PIA, and what incidents were recorded. Our post on questions a board should ask before an AI coding tool rollout applies the same discipline to a different decision.
How we help
We work alongside your privacy officer and legal counsel. They interpret the law; we make sure the system does what the PIA says it does.
- GenAI Security Readiness Assessment. A four-week, fixed-scope review of your AI architecture, data flows, identity model, and providers, including whether your AI vendor terms meet section 18.3. Findings are mapped to Law 25 alongside NIST, ISO, and OWASP references, with an owner and a remediation for each. It produces the technical evidence a section 3.3 PIA and a section 17 assessment need.
- Secure architecture and AI-driven SDLC. Threat modeling at design time, so data residency, retention, access control on retrieval, privacy-protective defaults, and decision logging are built in rather than retrofitted. See our services.
- Remediation plans. When a finding, an incident, or a notice of non-compliance lands, we turn it into a sequenced, owned, and dated plan your counsel can put in front of the CAI.
- Incident response. Playbooks and tabletop exercises for AI-specific incidents such as prompt injection, retrieval leakage, and exposed keys, with a clear path to the "risk of serious injury" assessment and CAI notification.
- Board advisory. Briefings for CEOs and directors who carry Law 25 accountability, and a reporting format that shows AI privacy exposure in one page.
Five questions to test yourself
- Which of your AI systems make a decision about a person with no meaningful human review?
- For a decision a model made eleven months ago, can you produce the inputs it used and the sources it retrieved?
- Do your AI vendor contracts require the vendor to tell you about attempted breaches, and let you verify?
- Is training on user data, or memory across sessions, off by default in every AI product you offer the public?
- If a prompt injection exposed one customer's file to another today, would your incident plan recognize it, and could you tell the CAI what was returned?
If you hesitated on two of them, that is the conversation to have before production, not after a notice. Book a 30-minute call: bring one AI system, and leave with the obligations that apply to it and your top three gaps.
