Your employees already use generative AI. Not because you deployed it: because it is free, accessible and useful. And every time personal information enters a prompt, your organization carries a responsibility that Law 25 frames precisely.

This guide covers the most neglected side of compliance: everyday AI usage. Not servers, not firewalls; what your teams type into the tools.

What Law 25 changed, in short

Adopted in 2021, Law 25 came into force in stages: since September 22, 2023, the bulk of its obligations apply, and the data-portability requirement has been in force since September 22, 2024. It imposes concrete obligations on Québec businesses regarding personal information: designating a person responsible for the protection of personal information, keeping a confidentiality incident log, conducting privacy impact assessments (PIA) before certain projects, and informing individuals when a decision about them is based exclusively on automated processing. Non-compliance carries penalties of up to $25M or 4% of worldwide turnover, overseen by the Commission d’accès à l’information du Québec.

None of this mentions AI by name. All of it applies as soon as an AI tool touches personal information.

The four risk situations

1. Personal information in prompts. An employee pastes a client’s email into ChatGPT to draft a reply. The client’s name, address and context just left your perimeter, toward a vendor whose terms you probably have not verified.

2. Tools nobody has inventoried. Try it: ask your teams which AI tools they actually use. The list almost always exceeds what leadership imagines, and rarely has a single one of those tools gone through any approval process. You cannot govern what you cannot see.

3. Undeclared automated decisions. Automatic rejection of applications below a threshold, prioritization of client files applied without review: if a decision affecting a person is based exclusively on automated processing, the law requires that the person be informed. As soon as a human genuinely decides, the obligation does not apply. The word that matters is “genuinely”: document who decides, and on what basis.

4. Unverified vendors. Where is the data hosted? Is it used to train models? Does the contract say? If you cannot answer for every tool, the exposure is real.

The five actions that bring you into compliance

  1. Take inventory. List the AI tools actually in use, including personal accounts used for work. It is the foundation for everything else.
  2. Write a prompt policy. One page is enough: what may enter an AI tool, what never may, and what to do when in doubt. Communicate it; do not let it sleep on an intranet.
  3. Run a PIA before deploying. For any AI tool that will process personal information, the privacy impact assessment is not optional. It documents the risks and the measures taken.
  4. Designate a responsible person and equip them. The law requires someone formally responsible. In an SMB, it is often a role added to an existing position: give them time and a clear mandate.
  5. Train. The best policy is worthless if the team does not know it. A short, concrete training session, using the actual tools your teams work with, changes behaviour more than any directive.

Where to start

If you do not know where you stand, ten minutes give you a first picture: our Law 25 + AI assessment covers the ten points above, free of charge and without collecting any data. Your answers never leave your browser.

And if the picture reveals gaps, let’s talk: the first one-hour meeting is free.

This article raises awareness; it does not constitute legal advice. For a formal analysis of your situation, consult a lawyer specialized in personal information protection.