Québec framework
Law 25 and AI
Law 25 doesn't mention artificial intelligence, but it fully applies to how you use AI. Here's what it requires, and how Aptia makes your due diligence measurable and demonstrable.
A law that doesn't say « AI »,
but that applies to it
Law 25, which modernizes the protection of personal information in Québec, rolled out in stages from 2022 to 2024. It applies to nearly every organization that holds personal information. It never mentions artificial intelligence, but as the Québec government reminds us, AI as a tool is fully subject to it. In other words: the moment your teams use AI with personal data, Law 25 applies.
Obligations
What it requires, where AI is at stake
The Law 25 obligations that most directly touch your AI usage.
Valid consent
Express, free, informed and for specific purposes. Feeding personal information into an AI tool without an appropriate basis is a risk.
Automated decisions
Inform the person when a decision is based exclusively on automated processing, and let them submit their observations.
Assessments (PIA)
A privacy impact assessment for certain projects, and for transfers of information outside Québec.
Security & minimization
Limit collection and secure information. « Shadow AI », tools used outside any framework, is a major blind spot.
Staff awareness
Clear internal policies and employees who know what to do, and what not to do, with AI.
Governance & accountability
A person responsible for the protection of personal information, and documented governance.
Real powers, heavy penalties
The Commission d'accès à l'information (CAI) can inspect, even without a complaint, investigate, demand documents and order measures. Administrative penalties can reach $10M or 2% of worldwide turnover, and penal fines more still. Which is why it pays to arrive on audit day with an evidence file already prepared, rather than having to reconstruct everything under pressure.
Support
Where Aptia helps you
On the « awareness and proof » part of Law 25, Aptia acts directly.
Measure mastery
Your teams' level on confidentiality, data and the applicable rules (competencies C2 and C7).
Train & document
Targeted capsules, then a time-stamped record, exactly what you present if the CAI asks what was done.
Usage policies
Draft, share and verify understanding of your internal AI usage rules.
Let's be clear about Aptia's role
Aptia makes your teams' awareness measurable and demonstrable, and builds your evidence file.
It does not « make » you compliant with Law 25 and replaces neither your privacy officer, nor your assessments (PIA), nor legal advice. Compliance remains your overall effort, validate it with a legal advisor.
Make your due diligence demonstrable
Start by measuring how well your teams master Law 25 and build your due-diligence file.
No credit card · No commitment · Confidential data