Skip to content
    Adwaizer

    AI Audit and Quebec's Law 25: what it covers and what it does not

    Version française

    This is not legal advice. It summarises public sources from Quebec's government and its privacy regulator, the Commission d'accès à l'information (CAI), and says what our AI Audit does and does not do. It does not tell you whether your business complies with Law 25. For that, ask your privacy officer or a lawyer.

    The short answer

    The AI Audit does not make you Law 25 compliant and does not replace a privacy impact assessment. It gives your privacy officer three useful inputs for the department it looks at: which workflows handle sensitive data, which AI ideas would touch that data, and what could go wrong with each idea. The duties below stay yours.

    Law 25 in one paragraph

    "Law 25" is Quebec's Act to modernize legislative provisions as regards the protection of personal information, passed in September 2021. It amended the Act respecting the protection of personal information in the private sector (CQLR c. P-39.1), the act that applies to businesses [1][2]. Most of its provisions took effect on 22 September 2023 [3][4].

    Three duties an AI project meets, and where the AI Audit stands

    Law 25 topicWhat the official sources sayWhat the AI Audit doesWhat it does not do
    Inventory of personal informationThe CAI's compliance guide for businesses tells a business to list the personal information it holds, including information a third party holds for it, to assess how sensitive it is, and to keep that list up to date as new collections start [5]. The CAI's privacy impact assessment guide makes the inventory a step of every assessment [6].Maps 8 to 12 workflows in one department or process area and scores each one on data sensitivity, among other criteria (offer, deliverable 1) [8]. The intake questionnaire asks which systems are used and how sensitive the data is (kit, phase 1) [9].It is not an inventory of your personal information. It covers one area only, and it does not list each kind of personal information, where it is kept, who holds it or when it is destroyed.
    Privacy impact assessment (PIA) for a new or overhauled information systemA business must conduct a PIA for any project to acquire, develop or overhaul an information system or electronic service delivery system that involves personal information (s. 3.3 of P-39.1) [1][4]. Its depth is proportionate to the sensitivity of the information, the purposes, the quantity and distribution of the information and the medium on which it is stored [1][6]. Mandatory since 22 September 2023 [4].Each of the 3 shortlisted opportunities names the tools it would use and what could go wrong; the 90-day plan for the top one gives the owner, the steps and a cost range (offer, deliverables 2 and 4) [8]. Your privacy officer can use these to decide early whether a PIA is needed.It does not conduct a PIA and does not decide whether section 3.3 applies to a project.
    Notice of a decision made by automated processingA business that uses personal information to make a decision based exclusively on automated processing must tell the person concerned, at the latest when it tells them of the decision (s. 12.1 of P-39.1) [1][4]. On request, it must also tell them the personal information used to make the decision, the reasons and the principal factors and parameters that led to it, and their right to have that personal information corrected. The person must be given the chance to submit observations to a staff member who can review the decision [1][7]. In force since 22 September 2023 [4].Scores each workflow's fit for AI and names what could go wrong for each shortlisted opportunity [8].It does not build or configure any system (implementation is quoted separately [8]), does not write the notice, and does not review whether an existing decision is exclusively automated.

    How the audit itself handles your information

    • We ask for process descriptions and templates, with redacted or example data preferred. No customer or employee personal information unless it is needed and you agree to it in writing [8][9].
    • We use AI tools on your materials only with your written yes. With a no, we work only from interview notes with names and client data removed [8][9].

    Sources

    Official sources, found by web search on 30 Oct 2026. We could not open legisquebec.gouv.qc.ca when writing this page, so the section wording above is a summary, not a quote: read the official text before relying on it.

    1. LégisQuébec, Act respecting the protection of personal information in the private sector, CQLR c. P-39.1, ss. 3.3 and 12.1: https://www.legisquebec.gouv.qc.ca/en/document/cs/P-39.1 (accessed 30 Oct 2026).
    2. CAI, Principaux changements apportés par la Loi 25: https://www.cai.gouv.qc.ca/protection-renseignements-personnels/sujets-et-domaines-dinteret/principaux-changements-loi-25 (accessed 30 Oct 2026).
    3. Government of Quebec, news release "Loi 25 -- Entrée en vigueur de dispositions qui rehaussent la protection de la vie privée des Québécois": https://www.quebec.ca/nouvelles/actualites/details/loi-25-entree-en-vigueur-de-dispositions-qui-rehaussent-la-protection-de-la-vie-privee-des-quebecois-50719 (accessed 30 Oct 2026).
    4. CAI, consolidated text of P-39.1 (administrative version, not official): https://www.cai.gouv.qc.ca/uploads/pdfs/CAI_LSP_Version_ADMIN.pdf (accessed 30 Oct 2026).
    5. CAI, Vers la conformité à la Loi sur le privé (guide for businesses): https://www.cai.gouv.qc.ca/uploads/pdfs/CAI_GU_Responsabilites_Entreprises.pdf (accessed 30 Oct 2026).
    6. CAI, Réaliser une évaluation des facteurs relatifs à la vie privée (PIA guide): https://www.cai.gouv.qc.ca/uploads/pdfs/CAI_GU_EFVP.pdf (accessed 30 Oct 2026).
    7. LégisQuébec, Loi sur la protection des renseignements personnels dans le secteur privé, RLRQ c. P-39.1, art. 12.1 (French text): https://www.legisquebec.gouv.qc.ca/fr/document/lc/P-39.1 (accessed 30 Oct 2026).
    8. Adwaizer, AI Audit offer sheet (available on request): "What you get" (deliverables 1, 2 and 4), "What we need from you", "Not included".
    9. Adwaizer, AI Audit delivery kit (available on request): Phases (phase 1 intake form), "Inputs from the client".