Law 25 and AI Tools: Compliance Obligations in Quebec

Deploying ChatGPT, Copilot or a chatbot connected to a CRM without a compliance framework exposes any organization operating in Quebec to heavy administrative penalties. This article is addressed to IT, security and compliance teams piloting the integration of generative AI tools into an information system subject to Law 25. It does not constitute legal advice: for any binding decisions, consult a lawyer specializing in personal information protection or the Commission d'accès à l'information du Québec (CAI).

The scope of application of Law 25 for AI projects

The Act to modernize legislative provisions respecting the protection of personal information, known as Law 25, was adopted in Quebec in 2021. Its implementation occurred in successive waves — 2022, 2023, 2024. Transparency obligations regarding automated decisions have been applicable since September 2023, and the entire framework, including the right to civil action, has been fully in effect since September 2024.

The law applies whenever an organization processes personal information of Quebec residents, regardless of its headquarters location. A SaaS publisher based in France, the United States or elsewhere in Canada that offers a support chatbot or scoring tool to Quebec customers falls within its scope, just like an SME established in Montreal.

The CAI published a reflection document specifically dedicated to AI, which sets out the expected framework for organizations: CAI reflection document on AI and privacy. The Responsible AI Integration Guide in the Workplace from the Quebec government formalizes the same principle: data protection must be integrated from the design of the project, not added at the end.

Five operational obligations before any AI deployment

Any team that connects an AI tool to data from Quebec residents inherits five concrete obligations:

• Designate a personal information protection officer. By default, this is the person with the highest authority in the organization. Their contact information must appear publicly on the website.
• Collect explicit and granular consent. No pre-checked boxes, no implicit consent. Each purpose — analysis, marketing, generative AI, model training — requires separate consent.
• Ensure transparency on automated decisions. If an algorithm makes a decision that affects a person (credit denial, dynamic pricing, application screening), they must be informed and able to request human intervention.
• Conduct a PIA before any project. The Privacy Impact Assessment is mandatory for any project involving acquisition, development or overhaul of a system processing personal data — an AI tool is included.
• Destroy or anonymize data once the purpose is achieved. This obligation explicitly covers prompts sent to an LLM (large language model) and conversation logs.

Supplier due diligence before activating a generative AI tool

Integrating a chatbot, a scoring module in a CRM or an AI plugin in a marketing tool amounts to entrusting personal information to a third party, potentially hosted outside Quebec. Five points must be documented in black and white in the contract with the publisher.

Data location: not all jurisdictions are equal

Law 25 requires a formal assessment before any data transfer outside Quebec. If data leaves the province, the organization must document that the destination jurisdiction offers equivalent protection.

Model training: the question blocking most projects

Entrusting personal information to a public generative AI version — without a business account or API with non-training commitment — constitutes a direct violation of Law 25. The principle applies to ChatGPT, Claude, Gemini, Copilot and most SaaS tools integrating a generative AI layer.

Before activating a tool, require in writing:

• An explicit commitment not to use prompts and data for model training.
• A signed and versioned DPA.
• A SOC 2 audit report or ISO 27001 certification.
• Encryption of data in transit and at rest.
• The default retention period for prompts and conversation history.
• The ability to obtain a purge on request, with proof of destruction.

The NETendances 2025 survey by the Digital Transformation Academy at Laval University shows that the use of generative AI by Quebec internet users doubled in one year (NETendances 2025 survey). This progression mechanically increases the exposure surface of personal data to public LLMs, particularly through uncontrolled uses by commercial or support teams.

Law 25 versus GDPR: what changes for multi-jurisdictional organizations

Being GDPR compliant is not enough to operate legally in Quebec. Law 25 imposes specific requirements, particularly on PIA and on the penalty ceiling expressed as a percentage.

An organization certified GDPR cannot simply recycle its privacy policy by changing the target country name. Documentation of equivalence, written commitment specific to Law 25 and mention of a named officer remain required.

Conducting the PIA before AI deployment

The PIA (Privacy Impact Assessment) is the Quebec equivalent of the European DPIA. The CAI provides an official PIA implementation guide.

Consent and cookie banners: what has changed

In Quebec, there is no longer implicit consent for non-essential cookies. The visitor must be able to refuse as easily as accept.

Detailed operational practices on consent management are documented in this guide on cookie consent and Law 25, notably on dark patterns that the CAI now monitors.

Implementation: identifying AI applications connected to Microsoft Entra ID

Before drafting a registry of AI suppliers, you still need to know which ones are already connected to the tenant. The following script queries Microsoft Entra ID via Microsoft Graph PowerShell to identify enterprise applications whose name matches a known generative AI tool, and exports the delegated permissions granted.

• Required module: Microsoft.Graph.Applications (Install-Module Microsoft.Graph -Scope CurrentUser)
• Minimum permission: Application.Read.All and Directory.Read.All, read-only
• Output: a CSV file listing detected AI applications and their permissions, usable for populating the Law 25 processing registry

1# Connection with minimal required scope in read-only
2Connect-MgGraph -Scopes "Application.Read.All","Directory.Read.All"
3 
4# List of keywords associated with commonly used generative AI tools in enterprise
5$aiKeywords = @("openai","chatgpt","gpt","anthropic","claude","gemini","bard","jasper","copy.ai","perplexity","midjourney")
6 
7# Retrieve all enterprise applications (service principals) in the tenant
8$applications = Get-MgServicePrincipal -All
9 
10# Filter applications whose name matches a known AI tool
11$aiApps = $applications | Where-Object {
12    $name = $_.DisplayName.ToLower()
13    ($aiKeywords | ForEach-Object { $name -like "*$_*" }) -contains $true
14}
15 
16# For each detected application, retrieve delegated permissions granted
17$results = foreach ($app in $aiApps) {
18    $permissions = Get-MgServicePrincipalOauth2PermissionGrant -ServicePrincipalId $app.Id -ErrorAction SilentlyContinue
19    [PSCustomObject]@{
20        Application       = $app.DisplayName
21        AppId             = $app.AppId
22        NumberOfPermissions = ($permissions | Measure-Object).Count
23        Scopes            = ($permissions.Scope -join ", ")
24    }
25}
26 
27# Export to CSV to populate the Law 25 processing registry
28$results | Export-Csv -Path ".\audit-apps-ia-tenant.csv" -NoTypeInformation -Encoding UTF8
29 
30Write-Output "Audit complete: $($results.Count) AI application(s) detected in the tenant."

What needs to be done concretely

Law 25 compliance is not a one-time project: it is a process that must be integrated into the life cycle of any AI project, from supplier selection onwards.

• Verify that a personal information protection officer is designated and published on the organization's website.
• Run an audit of AI applications already connected to the Microsoft Entra ID tenant before adding new ones.
• Systematically require a signed DPA and a written non-training commitment from any AI supplier.
• Document a PIA before each new AI deployment affecting personal data — not after.
• Update the consent banner to offer a truly symmetrical choice between accepting and refusing.

If your organization already processes data from Quebec residents via a public AI offering, the starting point is not the PIA but the audit: know precisely which tools are in use, by whom, and with what data, before documenting anything.

For any concrete implementation, the Commission d'accès à l'information du Québec remains the official reference, with its publicly accessible guides and reflection documents.