What makes an AI project risky under Law 25 is almost never the tool. It is what you give it to read, where that goes, and what you do with its answer. Here are the checks we run systematically before plugging anything in, explained for someone who is not a lawyer.
The tool is not the trigger
One question always comes up: is ChatGPT, Copilot or some other tool “compliant with Law 25”? The question is poorly framed. The law does not care about the name of the tool. It cares about the personal information you handle, what you do with it, who has access to it and where it goes.
The same tool can therefore be perfectly acceptable for summarizing a document with no personal information, and very problematic the moment you paste in a full client file. The sorting happens at the level of the use, not the logo.
First check: what personal information goes into the system?
First of all, we map it out. What will be sent to the model? Names, emails, file numbers, health information, employee evaluations? Often, we find that a large share of what we planned to send is unnecessary for the task. You can remove, mask or summarize before sending, and the risk drops at once without the result getting worse.
This is the data minimization principle, and it is the most profitable lever in the whole file. The less you send, the less you have to protect.
Second check: where does the data go?
An AI model hosted outside Québec means personal information leaves the province. The law governs this case: before communicating information outside Québec, the business must assess, among other things, the level of protection that the legal regime of the destination offers, in particular with regard to generally recognized principles of protection.
In practice, that translates into very concrete questions to put to a vendor. Where are the servers? Is the data used to train the models? How long is it kept? Who at the vendor can access it? If the vendor can’t answer clearly, you already have your answer.
Third check: the privacy impact assessment
The law provides for a privacy impact assessment (PIA) for any project to acquire, develop or overhaul an information system that involves personal information. It also applies before communicating information outside Québec.
Put simply: an AI project that touches personal information very often triggers this exercise. It is not an administrative monster. It is a document that describes what the system processes, why, with what safeguards, and which risks remain. Done well at the start of the project, it takes a few days and it also guides the technical choices. Done at the end, it reveals problems that have become expensive to fix.
Fourth check: is there an automated decision?
The law contains a specific rule for decisions made exclusively through automated processing of personal information. The business must inform the person concerned no later than when it informs them of the decision. On request, it must tell them what information was used and the main reasons and factors that led to the decision, and let them have the decision reviewed by a member of staff.
This is where a principle we apply in all our engagements comes into its own: human validation. When AI prepares and a person decides, you are not in the case of a decision made exclusively through automated processing. This is not a legal detour, it is also the best way to deliver a reliable system. At a public health client, for example, the agents support file processing with several points of human validation, and no existing system is touched.
Fifth check: who is responsible at your company?
Every business must designate a person responsible for the protection of personal information. In an SME, it is often the owner or CEO by default, and that is fine. The important point is that someone explicitly holds this role, knows about the AI project before it starts, and knows what to do in the event of a privacy incident.
What changes in a contract with an AI vendor
- Permitted uses. Does the contract say your data is not used to train the vendor’s models?
- Retention. How long are requests and responses kept, and can they be deleted?
- Location. In which region is the data processed and stored?
- Incidents. How, and how quickly, does the vendor notify you of an incident?
- Subcontractors. Who else sees your data, and under what conditions?
What shouldn’t be delayed because of the law
There is an opposite reflex, just as costly: doing nothing for fear of doing it wrong. Many high-return use cases involve no personal information, or very little: reading technical reports, part sheets, drawings, quote templates, internal procedures. Those can start fast. A good diagnostic is precisely what separates the simple cases from those that call for more precautions, and we start with the former.
The penalties, to put things in perspective
The law provides for administrative monetary penalties of up to $10M or 2% of worldwide turnover, and penal fines of up to $25M or 4% of worldwide turnover, whichever is greater. These amounts mainly target serious or repeated situations. Above all they show that the law is taken seriously, and that a project built without thinking about it can become a problem.
The sequence we follow
In short, before plugging an AI tool into personal information: map what goes in, reduce it to what is strictly necessary, check where the data goes, do the PIA at the start, keep a person who validates decisions, and read the vendor’s contract with the right questions. A project that asks these questions up front ships in weeks. A project that discovers them at the end waits months.
To see how these principles apply in a real public health project, read the Santé Québec Capitale-Nationale case study →
What this article argues, we put into production for a client. The case walks through what was built, how, and what changed.
