On June 11, 2026, Quebec’s Commission d’accès à l’information tabled its seventh five-year report, Transparence et vie privée : protéger la démocratie à l’ère numérique. Seventy-four recommendations, several of which target AI systems and the decisions they produce.

One clarification first: a five-year report does not change the law. It is the Commission’s advice to the legislator on what should change. Those reports have nonetheless shaped the reforms that followed, Law 25 included. Reading them means seeing what is coming instead of absorbing it later.

The three recommendations that touch AI in business

1. An algorithmic impact assessment attached to the PIA. Recommendation 45 proposes that a privacy impact assessment be accompanied by an algorithmic impact assessment whenever it concerns an AI system used for automated decision-making about people. In other words: the privacy impact assessment you already know would no longer be enough the moment a model decides something about a person. The system itself would have to be analysed, not just the data it consumes.

2. A redefined, broader PIA. Recommendation 44 proposes writing into the law that a PIA covers first the right to privacy, but also the other rights and freedoms affected, and that it always has three parts: legal compliance of the project, risk assessment, mitigation measures. Many assessments done today stop at the first part.

3. Inferences become personal information. Recommendations 33 and 34 propose explicitly folding profiling-based inferences into the definition of personal information, and broadening that notion beyond the sole criterion of identification. Direct consequence: a risk score, an attrition probability or a category generated by a model about a client or an employee would become personal information in its own right, with the obligations that follow.

The workplace side was already on the table

The Commission had set out its position on AI at work in a brief filed with the Ministère du Travail on January 27, 2025, L’IA au travail : pour un meilleur encadrement. Six recommendations, summarised here:

#What the Commission proposes
1Disclose in the privacy policy any use of AI or monitoring technology: system names, vendors, purposes, data in and data out, impact on rights, audits performed
2Disclose to employees any intent to use partially or fully automated decisions, as soon as it is confirmed
3Provide a mechanism for employees to collectively obtain data used or generated by AI systems
4Require an algorithmic impact assessment for any AI system making partially or fully automated decisions
5Make employee involvement in that assessment mandatory
6Ban certain uses: emotion recognition, most forms of biometric categorisation, fully automated decisions with significant effects on employees

Look at the first row: it describes an inventory. Not a principle, an inventory. System name, vendor, data in, data out. It is the document almost no SMB holds today, and it is the one everything else starts from.

Four moves that cost nothing to make now

Take inventory. One table, six columns: tool, vendor, who uses it, what for, what data goes in, what data comes out. Nothing else. That table will serve you whatever final shape the law takes.

Separate assistance from decision. A model that drafts a reply is not a model that screens applications. The first category raises confidentiality questions; the second adds automated-decision questions, and it is the one every recommendation above targets. Sort your uses into one or the other.

Write down what you actually do. Does your privacy policy mention the AI tools your teams really use? If the answer is no, the gap between your practice and your documentation already exists, independent of any reform.

Keep your assessments. If you ran a privacy impact assessment on an AI project, keep the record and note what you did not assess. The day the algorithmic impact assessment becomes mandatory, you will start from a document rather than a blank page.

What is already mandatory

None of the above is in force. What is: Law 25 obligations on personal information, the privacy impact assessment in the cases it covers, the confidentiality incident register, and the duty to inform a person when a decision concerning them is based exclusively on automated processing. Our post Law 25 when your employees use AI covers that baseline.

Note the word “exclusively”. That is the word the Commission proposes to remove, by targeting decisions that are “partially or fully automated”. For an SMB, it is the most concrete shift in the entire report: AI-assisted application screening, out of scope today because a human decides, would come into scope.

The five-year report creates no new urgency. It indicates a direction, and that direction has been consistent for three years: more transparency about systems, more accountability for the decisions they produce. Organisations that already keep an inventory will have nothing to catch up on.

To place your organisation in a few minutes: our Law 25 and AI assessment asks the questions in order, collecting nothing. And if the inventory is the step that stalls, we build it with you.