Your team wants to use AI, and much of what they would ask it involves personal information: client files, employee records, invoices with names on them. If your company does business in Quebec, Law 25 sets clear expectations for that information, whatever tool handles it. This checklist walks through what to verify before and after you adopt AI. It is not legal advice; your privacy officer or lawyer has the last word.
Why Law 25 matters for AI
Law 25 modernized Quebec's private-sector privacy act, and most of its rules have been in force since September 2023. It does not mention chatbots by name, but it applies to every tool that collects, uses or communicates personal information. Administrative penalties can reach $10 million or 2% of worldwide turnover, so it is worth getting the basics right.
1. Name who is responsible
- By default, the person with the highest authority in your company is responsible for protecting personal information. That role can be delegated in writing.
- The title and contact details of that person must be published on your website.
- Make sure this person knows which AI tools your team uses and has a say in new ones.
2. Map how AI is used today
- Which AI tools does your team use, and are they on company or personal accounts?
- What goes into them: client, employee, financial or health information?
- Where does that information go, and does the provider keep it or use it to train its models?
3. Assess the privacy impact
- Law 25 requires a privacy impact assessment for any project to acquire, develop or overhaul an information system involving personal information. Adopting an AI tool usually counts.
- Before personal information is communicated outside Quebec, including when an AI provider processes it on servers elsewhere, the assessment must consider how sensitive it is, why it is sent, the protection measures (contractual ones included) and the legal framework where it goes. It may only go there if it will be adequately protected, and the arrangement must be set out in a written agreement.
- De-identified information is still personal information under the law. Only information that is irreversibly anonymized falls outside it.
4. Be open about automated decisions
- If you use personal information to make a decision about a person based only on automated processing, you must tell that person, at the latest when you inform them of the decision.
- On request, you must also tell them what personal information was used, the reasons and main factors behind the decision, and that they can have the information corrected. They can submit their observations to someone on your staff who is able to review the decision.
- The simplest way to stay on the right side of this rule is to keep a person who genuinely reviews and approves what the AI suggests, and to document that review.
5. Control what leaves your company
- Decide by topic what may go to an outside AI service. Payroll, health information and legal strategy are not handled like marketing copy.
- When in doubt, information should stay inside.
- Give your team one approved tool so these rules apply automatically, instead of relying on personal accounts.
6. Keep records and be ready for incidents
- Keep a record of who asked what, and what left your company. It supports your assessment and lets you answer questions from clients or employees.
- Law 25 requires a register of confidentiality incidents. If an incident presents a risk of serious injury, you must notify the Commission d'accès à l'information and the people concerned.
7. Train your team
- Explain in plain words what may and may not be shared with AI, and why.
- Show people the approved tool and who to ask when they are unsure.
Where Hybrid Zero-Trust Private AI fits
Hybrid Zero-Trust Private AI is BADEP's private AI platform. It is designed to support your privacy compliance, including Law 25, and it helps with several points on this list.
- Points 2 and 5: every request is given one of three levels. Sealed work never leaves your environment, which runs in infrastructure you own, in the region you choose. Shielded work goes out only after identifying details are removed. Shared work is limited to information that is not sensitive. Sealed is the default.
- Point 3: you get clear documentation of what data goes where and in which form, which feeds your privacy impact assessment. Because Shielded content is de-identified, not anonymized, it still belongs in that assessment.
- Point 4: agents prepare work, and people approve it.
- Point 6: every request is recorded in your environment: who asked, the level, which model answered and, when something left, the exact version that left. Your privacy officer can review it at any time.
A good first step is a Knowledge Confidentiality Assessment. It maps your knowledge, classifies it into the three levels and identifies the AI uses you can start safely. Compliance itself remains your responsibility.
Talk it through
In a free discovery call, we can go through this checklist with you and tell you what we would do first. More about our AI services and Hybrid Zero-Trust Private AI.