Québec Law 25 — Automated Decisions & Privacy (Act 25 / Bill 64): AI Compliance Requirements
Québec's Act to modernize legislative provisions respecting the protection of personal information (Law 25 / Bill 64) is Canada's strictest provincial privacy law, fully in force since September 22, 2024. Section 12.1 requires organizations to disclose when decisions significantly affecting individuals are made exclusively by automated means (AI), explain the factors involved on request, and allow individuals to present observations to a human reviewer. Also requires: Privacy Impact Assessments for AI systems, a designated Privacy Officer with published contact info, and 72-hour breach notification. Applies to all enterprises handling Québec residents' personal information — including foreign companies with Québec users.
Summary of publicly-available regulatory text as of 2026-08-22. Verify against current official sources before relying on this for compliance decisions. Not legal advice.
Key Facts
September 22, 2023
September 22, 2024
Two-tier: (1) CAI-imposed Administrative Monetary Penalties, up to the greater of C$10,000,000 or 2% of worldwide turnover; (2) court-imposed penal fines (Section 91 offences, CAI-initiated prosecution), C$15,000 to the greater of C$25,000,000 or 4% of worldwide turnover, doubled for repeat offences.
What Your Business Must Do
4 compliance requirements identified. Critical requirements carry the highest risk of enforcement action.
Automated Decision Disclosure (Section 12.1)
CriticalInform individuals whenever a decision that significantly affects them is made exclusively by automated means (AI). Upon request, you must: (1) Explain the factors that led to the decision. (2) Identify the personal information used. (3) Inform them how to request corrections. (4) Provide the right to present observations to a human reviewer who can actually change the decision.
Deadline: September 22, 2023
Law 25 (Act 25) s. 12.1Privacy Impact Assessment (PIA) for AI
High PriorityBefore implementing any AI system that collects, uses, or discloses personal information about Québec residents, conduct a Privacy Impact Assessment. Document purposes, legal bases, safeguards, and risks. Keep on file for potential inspection by the Commission d'accès à l'information (CAI).
Deadline: September 22, 2023
Law 25 (Act 25) s. 3.3Designated Privacy Officer (Published)
High PriorityAppoint a Privacy Officer responsible for overseeing AI data practices and handling personal information. Publish the officer's name and contact information on your website. This person handles access requests, correction requests, and breach notifications.
Deadline: September 22, 2022
Law 25 (Act 25) s. 3.1-3.272-Hour Breach Notification to CAI and Individuals
High PriorityWhen a confidentiality incident (breach, unauthorized access, loss) presents a risk of serious injury to individuals, notify the Commission d'accès à l'information (CAI) within 72 hours of becoming aware of the incident, and notify affected individuals without unreasonable delay. Maintain a breach register documenting all incidents. AI systems processing personal data are a leading breach vector — include them in your incident response procedures.
Deadline: September 22, 2022
Law 25 (Act 25) s. 3.5-3.8Who Does This Apply To?
Applies to any enterprise (including non-profits and foreign entities) that collects, holds, uses, or communicates personal information about Québec residents in the course of carrying on an enterprise. No size or employee threshold: a one-person company with a Québec user base is in scope. Key AI trigger: Section 12.1 activates whenever an automated (AI-based) decision "significantly affects" an individual — including credit scoring, hiring shortlisting, insurance pricing, loan approvals, content moderation bans, and personalized service terms. The "significantly affects" standard mirrors GDPR Art.22 but is interpreted broadly by the Commission d'accès à l'information (CAI): any decision that changes access to a service, opportunity, price, or benefit qualifies. Personal employees of Québec businesses are protected; purely B2B commercial decisions not affecting individuals are out of scope.
Recent Enforcement Actions
Against:
Recent Regulatory Guidance
CAI Guidance: Automated Decision-Making Under Section 12.1
The Commission d'accès à l'information's published guidance on s. 12.1 confirms that "exclusively automated" means no meaningful human review of the specific decision before it is made — a rubber-stamp approval does not satisfy the human-reviewer requirement. The right to present observations must be meaningful: the reviewer must have actual authority to change the decision. Applies to HR screening, credit decisions, and content moderation bans.
OPC/CAI Joint Guidance: AI and Privacy in Canada (February 2023)
Joint guidance from the Office of the Privacy Commissioner of Canada and the CAI on AI-based decision-making. Confirms that PIPEDA (federal) and Québec Law 25 create parallel obligations for AI: organizations subject to both laws must meet the stricter Law 25 standard. Provides a compliance checklist for automated decisions: identify all AI touchpoints, document data flows, implement human review, publish privacy notice.
Key Case Law & Precedent
CAI decision — Transcontinental Printing Inc. (facial recognition, Québec, 2024)
Commission d'accès à l'information du Québec (CAI) · 2024Outcome: Cease facial-recognition use; destroy collected biometric information (CAI, 4 Sept 2024).
Case referenceQuarterly Enforcement Digest
Law 25 has been in full force since September 2024 (all three implementation phases now active). The CAI enforces via its two-tier penalty structure: Administrative Monetary Penalties (up to the greater of C$10M or 2% of worldwide turnover, imposed directly by the CAI) and separate court-imposed penal fines (up to the greater of C$25M or 4% of worldwide turnover). A verified CAI decision (Transcontinental Printing, 4 September 2024) ordered a company to cease facial-recognition access control and destroy collected biometric data — confirming the CAI will enforce against biometric/AI-driven identification under the private-sector Act. The real, verified joint Clearview AI action (OPC/CAI/BC/Alberta findings 2021-02-03, binding provincial orders 2021-12-14) remains the clearest documented example of AI-training-data scraping being treated as regulated automated processing, though it predates Law 25's current AMP regime. For SaaS companies serving Québec businesses: if your product makes decisions affecting end-users (loan scoring APIs, hiring screeners, fraud detection outputs fed to human reviewers), you must provide your customers with sufficient information to satisfy their Section 12.1 disclosure obligations — this is now a B2B contract requirement, not just a direct-to-consumer one.
Digest covers enforcement actions, guidance, and regulatory developments. Last verified: 2026-08-22.
Industry Playbooks covering Québec Law 25 — Automated Decisions & Privacy (Act 25 / Bill 64)
These industry playbooks include jurisdiction-specific checklist items and guidance for Québec Law 25 — Automated Decisions & Privacy (Act 25 / Bill 64).
Frequently Asked Questions
Does Québec Law 25 — Automated Decisions & Privacy (Act 25 / Bill 64) apply to my business?
Québec's Act to modernize legislative provisions respecting the protection of personal information (Law 25 / Bill 64) is Canada's strictest provincial privacy law, fully in force since September 22, 2024. Section 12.1 requires organizations to… Use Aegis Firma's free scanner to get a personalized assessment in under 5 minutes.
What is the penalty for non-compliance?
The maximum penalty under Québec Law 25 — Automated Decisions & Privacy (Act 25 / Bill 64) is: Two-tier: (1) CAI-imposed Administrative Monetary Penalties, up to the greater of C$10,000,000 or 2% of worldwide turnover; (2) court-imposed penal fines (Section 91 offences, CAI-initiated prosecution), C$15,000 to the greater of C$25,000,000 or 4% of worldwide turnover, doubled for repeat offences.. Fines are typically scaled by company size, severity of violation, and whether violations were willful or accidental.
How do I comply with Québec Law 25 — Automated Decisions & Privacy (Act 25 / Bill 64)?
The 4 requirements above cover the core obligations. The fastest path to compliance is: (1) conduct an AI risk assessment, (2) document your AI systems, (3) implement transparency disclosures where required. Aegis Firma generates all required documents automatically.
Official Source
https://www.rcgt.com/en/insights/expert-advice/law-25-issue-automated-decisions/Last updated: 2026-08-22 — verify at source before relying on this information.
Don't leave compliance to chance
Aegis Firma scans your AI tools, tells you exactly which regulations apply, and generates all required documents — in 30 minutes.
Start your free compliance scan