Law 25 and AI: What Small Firms Need to Assess

Quebec's privacy reform applies to enterprises of every size within the private-sector Act's scope. Adding an AI tool can change how a firm collects, uses, communicates and retains personal information. The useful question is which obligations the proposed use triggers and whether the firm can demonstrate that it meets them.

Where Law 25 stands in May 2026

Law 25's principal private-sector changes took effect in stages from September 2022 to September 2024. Under the amended private-sector Act, the person with the highest authority is responsible for privacy compliance unless the function is delegated in writing. All confidentiality incidents must be recorded, but notification to the CAI and affected individuals depends on a risk of serious injury. That distinction matters when a firm investigates an accidental disclosure.

The sanction regimes are distinct. For a person other than a natural person, the administrative ceiling is the greater of $10 million or 2% of the preceding financial year's worldwide turnover. The penal maximum is the greater of $25 million or 4%. Natural persons have different limits: $50,000 for an administrative sanction and $100,000 for a first penal offence. These are statutory limits, not automatic amounts for an AI incident.

In its January 2025 submission on AI at work, the CAI advocated stronger safeguards for workers' privacy. Such recommendations help identify regulatory concerns; they do not independently amend the statute or establish that every recommended measure is already mandatory.

Where AI tools meet Law 25

Three provisions of the private-sector Act are particularly relevant to an AI service handling personal information. They operate alongside other duties, including the project assessment required by section 3.3 where its conditions are met. First check the Act's scope: section 1 excludes information that is public by law and specified information about a person's business function from sections II and III. An online copy of a document does not alone establish that legal status.

Section 17. Before communicating personal information outside Quebec, the enterprise must assess privacy factors, including sensitivity, purpose, safeguards and the destination's applicable legal framework. The assessment must establish adequate protection, and the communication must be governed by a written agreement reflecting its results and any risk mitigation. The provision also covers entrusting an outside-Quebec person with collecting, using, communicating or keeping information on the enterprise's behalf. Ontario hosting can therefore matter just as US hosting can. A prompt raises this issue if it actually carries personal information outside Quebec; the number of prompts alone establishes neither a violation nor a requirement for a separate assessment of every prompt. Section 17.

Section 12.1. If personal information is used to make a decision exclusively through automated processing, the person must be told by the time the decision is communicated. On request, the enterprise must provide the information used, the reasons and principal factors and parameters, and information about the right to correct that information. The person must also have an opportunity to submit observations to a staff member able to review the decision. An advisory draft that a professional actually evaluates is not automatically such a decision; an automated refusal of a retainer may require this analysis. Section 12.1.

Section 18.3. Necessary disclosure to perform an entrusted mandate or service contract can occur without consent under this provision. For an ordinary technology supplier, the written arrangement must specify confidentiality, restricted use and end-of-contract retention safeguards. The supplier must report confidentiality breaches or attempted breaches without delay and permit verification. The statute contains a qualification for public bodies and members of professional orders. A free or paid subscription label does not settle compliance: examine the actual agreement, permitted uses, retention and access. Professional secrecy remains a separate question. Section 18.3.

The small-firm reality

Consider a hypothetical firm whose employees start using external AI services without an approved data-handling process. One uploads a contract containing personal information; another pastes a discovery transcript after an incomplete redaction. The firm must establish what was sent, where it was processed, who could access it and what the governing agreement permitted. Those facts determine the transfer, security and incident questions. The product name or the presence of an AI feature cannot answer them.

A workable process assigns responsibility, assesses the proposed service before use and gives staff clear rules about permitted information. It also records changes in processors, access or use that could undermine an earlier assessment.

Supacorp and compliance by design

Supacorp is the entity-management product I am building for Canadian solo and small firms. The design aim is to make information flows, access controls and records easier to inspect. Those controls support a firm's legal assessment; they do not replace it.

Tenant separation and database access controls need to be tested, including privileged and service access. They cannot by themselves demonstrate compliance with a processor contract or professional secrecy. Canadian hosting is another useful design choice, but a Quebec firm must still consider processing elsewhere in Canada, external support access and subprocessors.

Data minimization starts with the purpose and actual requirements of each filing. A director's address should not be collected merely because another jurisdiction or another form requests it. An audit trail can support access, correction and accountability work, but a generated report is not automatically a completed privacy impact assessment.

What to watch

Follow published CAI decisions for how the statutory tests are applied to concrete AI uses, and distinguish a recommendation from an enforceable obligation. Procurement should test the actual data flows and contractual safeguards of each service. Canadian branding, a no-training setting or an audit dashboard is useful evidence about particular controls; none supplies a general exemption from privacy law.