Quebec Law 25 and Automated Decisions: When You Must Say an AI Decided

The short answer

Under Quebec Law 25, a business that uses personal information to make a decision based exclusively on automated processing must tell the person, no later than when it tells them the decision. On request, it must also explain what information was used and the main factors behind the decision, and let the person submit observations to a staff member who can review it. This is general information, not legal advice.

Where the rule comes from

"Law 25" is the nickname for Quebec's 2021 privacy reform, which amended the province's private-sector privacy statute, the Act respecting the protection of personal information in the private sector (CQLR c. P-39.1). The automated-decision rule is section 12.1 of that Act. The Commission d'accès à l'information (CAI), Quebec's privacy regulator, lists it among the main changes brought by Law 25, most of which took effect in September 2023.

The statute itself is short. Section 12.1 of the official consolidated text says a business that "uses personal information to render a decision based exclusively on an automated processing of such information must inform the person concerned accordingly not later than at the time it informs the person of the decision."

Three tests that decide whether Quebec Law 25 applies

Work through these in order. If any answer is no, section 12.1 does not bite (though other parts of Law 25 still apply to the data).

1. Is there a decision about a person? Approving or refusing a loan, a rental, a refund, an insurance quote, a job application, an account. Answering a question about opening hours is not a decision about anyone.
2. Does it use personal information? Name, contact details, purchase history, location, credit data, a CV. Most customer-facing decisions do.
3. Is it made exclusively by automated processing? This is the key word. If a person genuinely weighs the output and can change the result, the decision is not exclusively automated. If a staff member just clicks "approve" on whatever the system says, the Quebec government's guidance for public bodies, written for the parallel public-sector rule, treats minor human intervention with no real effect on the outcome as not enough to take a decision outside the rule.

Note that the rule is technology-neutral. It covers a simple rules engine as much as an large language model. "AI" is not the trigger; full automation is.

What you must tell people, and when

Section 12.1 has three layers:

Obligation	When	What it looks like in practice
Notice that the decision was automated	No later than when you communicate the decision	A line in the approval or refusal email: "This decision was made by an automated system."
The personal information used	On request	A list of the data fields the system relied on
Reasons and principal factors and parameters	On request	A plain-language explanation of what weighed most
Right to have the information corrected	On request	How to fix wrong data that fed the decision
Opportunity to submit observations	Must be offered	A named contact or form that reaches a staff member able to review the decision

Two things the rule does not do. It does not ban automated decisions, and nothing in section 12.1 lets a person veto being subject to one. It is a transparency and review rule: notice, explanation, correction and a human to hear objections. As Raymond Chabot Grant Thornton notes, that applies even to a simple CV filter that screens out candidates by years of experience, AI or not.

Related Law 25 rules that catch AI tools

Section 12.1 rarely travels alone. If you are adding AI to a customer process in Quebec, check these too:

• Privacy impact assessment (s. 3.3). Any project to acquire, develop or overhaul an information system or electronic service delivery system involving personal information needs one, proportionate to the sensitivity of the data.
• Identification, location and profiling technology (s. 8.1). If you collect data with technology that can identify, locate or profile someone, you must tell them first and explain how to activate those functions. The CAI reads this as meaning such functions cannot be on by default.
• A published privacy policy (s. 8.2) in clear and simple language if you collect personal information by technological means.

Penalties

Failing to inform someone of an exclusively automated decision, or failing to give them a chance to submit observations, is specifically listed in section 90.1 as grounds for a monetary administrative penalty. Under section 90.12 those penalties can reach $10 million or 2% of worldwide turnover for a business, whichever is greater. Separate penal offences elsewhere in the Act carry higher maximums. Real exposure for a small firm is far lower, but the rule is enforceable.

Setting up an AI process that complies

Most small businesses meet this rule with design choices rather than lawyers:

1. Decide where a human sits. For refusals, a real human review before the decision goes out often takes you outside "exclusively automated" and improves quality. Make sure the reviewer can and sometimes does overturn the result.
2. If you keep it fully automated, template the notice. Add the disclosure line and a review contact to every decision message the system sends.
3. Log inputs and factors. If you cannot reconstruct why the system decided, you cannot answer a request. Ask vendors whether their tool records this.
4. Write it into your internal rules. Our AI acceptable-use policy outline includes a section on decisions about people.

Federal law may soon look similar. Bill C-36 proposes explanations for automated decisions with significant effects; see our explainer on Bill C-36 and AI.

Checklist

• List every automated decision about Quebec customers, applicants or staff.
• Mark which are exclusively automated.
• Add the notice line and a human-review contact to those decision messages.
• Be ready to name the data and main factors for any one decision.
• Run a privacy impact assessment before launching a new AI system.

Frequently asked questions

Does Quebec Law 25 apply to my AI chatbot?

The personal-information rules apply to whatever data the chatbot collects. Section 12.1 applies only if the chatbot, on its own, makes a decision about a person using their personal information, such as approving a refund or rejecting a booking.

Is a decision still "automated" if a staff member approves it?

Not if the review is real. A human who meaningfully considers the output and can change it takes the decision outside "exclusively automated". A rubber stamp with no real effect on the outcome probably does not.

Does this apply to businesses outside Quebec?

Section 1 of the Act frames it around personal information that a person collects, holds, uses or communicates in the course of carrying on an enterprise, read with Quebec's Civil Code. Whether that reaches a business based elsewhere that serves Quebec residents depends on the facts, so get advice on whether the Quebec Act, PIPEDA, or both apply to you.

Sources

1. Act respecting the protection of personal information in the private sector (CQLR c. P-39.1) — LégisQuébec, consolidated text
2. Principaux changements apportés par la Loi 25 — Commission d'accès à l'information du Québec
3. Décision fondée exclusivement sur un traitement automatisé — Gouvernement du Québec
4. Law 25: the Issue of Automated Decisions — Raymond Chabot Grant Thornton

How Flowmatix can help

We put this into practice for businesses in Toronto and around the world through our AI Agents & AI Solutions, business process automation, crm development & integration services. Want to know what it would take for your business? Get a personalised quote in about 3 minutes.