This article summarises publicly available guidance from regulators and official sources. It is general educational information only and does not constitute legal or professional advice. Requirements vary by jurisdiction. Consult your regional authority or a qualified professional for advice specific to your situation.
Quebec's Law 25 applies based on where the person affected by your AI system is, not where your business operates. A business with no physical presence in Quebec at all can still be fully bound by the law's automated-decision rules the moment an AI tool makes a significant decision about a Quebec resident.
In short: Law 25, fully in force since September 2024, gives Quebec residents specific rights when a decision that significantly affects them, credit, insurance, hiring, and similar, is made exclusively by automated processing: the right to be informed the decision was automated, the right to an explanation of the factors and rationale involved, and the right to have a human review and contest the decision. It also requires a Privacy Impact Assessment for AI systems processing personal data. These requirements only apply where a human doesn't meaningfully participate in the decision.
The plain-English answer
If an AI tool makes a decision that significantly affects a Quebec resident, and no person meaningfully reviews that specific outcome before it takes effect, Law 25's automated-decision provisions apply to your business regardless of where you're headquartered. This is genuinely Canada's most specific and binding set of automated-decision rights, going well beyond what PIPEDA requires at the federal level, and it's already in force, not a proposal.
Why this matters for your business
A 15-person Ontario-based insurance broker with clients across Canada is a genuinely common structure, and the assumption that a Quebec law only applies to Quebec-based businesses is one of the most natural mistakes to make. Insurance claims decisions are exactly the kind of significant, consequential decision Law 25's automated-decision provisions target, and an AI claims tool operating with no human review step for Quebec clients specifically is a real, live compliance gap, not a theoretical one.
The penalty structure makes this a genuine business risk, not just a technicality: administrative monetary penalties up to $10 million CAD or 2% of worldwide turnover for less serious violations, and penal penalties up to $25 million CAD or 4% of worldwide turnover for the most serious.
What Law 25 actually requires
Law 25's Section 12.1 targets decisions rendered exclusively by automated processing that significantly affect a person, explicit examples include credit decisions, insurance assessments, hiring screens, and content moderation outcomes. Three specific obligations apply: notification, the person must be told a decision about them was made through automated processing; explainability, the business must be able to explain the factors the system weighed and the reasoning that led to the outcome, not just that an algorithm was involved; and human review, the person has the right to have the decision reviewed by a person and to contest it.
Separately, Law 25 requires a Privacy Impact Assessment for any project involving the acquisition, development, or overhaul of an information system or electronic service delivery system that processes personal data, in practice, this means most new AI tool deployments touching Quebec residents' personal data need a PIA before rollout, not after. Critically, all of these automated-decision requirements only apply where the decision is made exclusively by automated processing, if a person meaningfully participates in reviewing the specific outcome before it takes effect, not just rubber-stamping it, the automated-decision provisions don't apply, though the PIA requirement can still be relevant.
What this looks like in practice
Picture the operations manager at the insurance broker, running every claim through an AI-assisted tool that determines the payout or denial with no distinction for Quebec clients. Working through Law 25's actual scope changes the process: for Quebec-resident clients specifically, the business now sends a clear notification that the decision involved automated processing, keeps a record of the specific factors the tool weighed for that claim so it can genuinely explain the outcome if asked, and routes any contested decision to a real claims handler who reconsiders the case rather than re-running the same tool.
The fix doesn't require abandoning the AI tool for Quebec clients, it requires building the specific rights the law grants around it, the same pattern as similar automated-decision rules in the UK and EU, applied here to Quebec residents specifically regardless of where the business itself operates.
What you can do about it
A practical checklist if your business could ever make an automated decision affecting a Quebec resident:
- Identify any AI-driven decision your business makes that could significantly affect someone, credit, insurance, hiring, and similar categories are explicitly named.
- Check whether a real person meaningfully reviews the specific outcome before it takes effect, if not, Law 25's automated-decision provisions apply for any Quebec-resident individual affected.
- Build a clear notification process telling affected Quebec residents that a decision involved automated processing.
- Make sure your AI tool or process can produce a genuine, specific explanation of the factors behind a given decision, not just a generic description of how the tool works.
- Set up a real human review and contest process, and complete a Privacy Impact Assessment before deploying a new AI tool that processes Quebec residents' personal data.
For the fuller picture on when a Privacy Impact Assessment is required in Canada beyond Law 25's specific trigger, see our guide on Privacy Impact Assessments in Canada.
Methodology (Real-World, Verified)
We test AI tools against real SMB workflows: the tasks a 20-person business actually uses AI for, not enterprise demos. Pricing is verified at the vendor's published rates, with local-currency conversions noted where relevant. Compliance notes reference the legislation and regulatory guidance relevant to each article's region. Every tool is judged on one question: could a business with no dedicated IT department actually pick this up and use it on Monday morning.
Related reading: our AI governance by region.
Try our free AI vs Human Cost Comparison to compare the cost of AI tools against equivalent human time.
Does Law 25 apply if our business has zero physical presence in Quebec?
Yes, if any individual affected by your automated decision resides in Quebec, the law applies regardless of where your business is located. Company location isn't the trigger, the affected person's residence is, the same pattern as NYC's Local Law 144.
Does having a human glance at the AI's recommendation before it's sent count as human review?
Only if that review is genuinely meaningful, actually considering the specific outcome rather than a token approval of whatever the tool decided. A rubber-stamp review doesn't take the decision outside the automated-decision provisions.
Do we need a Privacy Impact Assessment for every AI tool we use?
The requirement is triggered by acquiring, developing, or overhauling an information system that processes personal data, which covers most genuine AI tool deployments touching Quebec residents' data. See our dedicated guide on PIAs in Canada for the specific triggers and what a proportionate assessment looks like.
How does Law 25 compare to PIPEDA, the federal privacy law?
Law 25 goes considerably further than PIPEDA specifically on automated decision-making, PIPEDA's fairness principles are interpreted by the OPC as covering AI transparency generally, but Law 25 grants explicit statutory rights, notification, explanation, and human review, that PIPEDA doesn't currently provide as a formal right.
The information in this article is general in nature. It reflects a summary of publicly available guidance and does not constitute legal, privacy, or professional advice. Your obligations will depend on your specific situation, jurisdiction, and business circumstances. Do not rely on this article as a substitute for qualified legal or professional advice.
Not sure which Canadian privacy law applies to your specific customers?
Check the province-by-province picture