Law 25 and AI: what Quebec businesses actually have to do
If your business operates in Quebec and uses AI to talk to customers, screen leads, or make decisions, Law 25 already applies to you. In practice that means four things: get meaningful consent and be transparent about the AI, respect the automated-decision rule in section 12.1 when a decision is made exclusively by a machine, handle call recording and cross-border processing honestly, and understand that penalty exposure runs into the tens of millions. Here is what that looks like at the operator level — not the legal-textbook level.
General information, not legal advice. Law 25, PIPEDA, and the Charter of the French Language are complex and fact-specific. For your own compliance position, consult a qualified Quebec privacy lawyer or your Commission d'accès à l'information (CAI) resources.
Quebec's Law 25 (the Act to modernize legislative provisions respecting the protection of personal information) is now fully in force, and AI adoption in Canadian business is climbing fast — Statistics Canada reported that 19.2% of Canadian businesses used AI in Q2 2026, up from 6.1% in Q2 2024. If you run an AI phone line, chatbot, or lead-screening tool that touches Quebec residents, the law reaches you regardless of where your company is based. Below is the operator's version of what actually applies.
Consent and transparency come first
Law 25 requires that you collect and use personal information for a clear, identified purpose, and that consent be manifest, free, and enlightened — in plain terms, people should understand what you're doing and agree to it. When an AI system is doing the talking, transparency does extra work: callers and website visitors should be able to tell they are interacting with an automated agent, not misled into thinking it's a human.
Practically, that means:
- A short, honest disclosure at the start of an AI-handled call or chat ("You're speaking with an automated assistant").
- A privacy policy that names the categories of information collected, the purposes, and whether the information may be processed by service providers — including outside Quebec or Canada.
- A designated person responsible for the protection of personal information (Law 25 requires this role; by default it's the person with the highest authority in the organization unless delegated in writing).
The CAI has published guidance on consent and on privacy-impact assessments; if you're deploying a new AI system that processes personal information, a privacy assessment is the disciplined starting point.
The automated-decision rule: section 12.1
This is the provision people most often get wrong. Section 12.1 applies when a business makes a decision based exclusively on the automated processing of personal information. When it applies, you must inform the person that the decision was made that way and, on request, give them a chance to submit observations to someone able to review the decision — plus tell them what personal information was used and the reasons behind the decision.
The key word is exclusively. Where a human is genuinely in the loop, or the "decision" has no legal or similarly significant effect, s.12.1 is generally not triggered.
Where it usually does not bite
Routine appointment scheduling and booking — an AI receptionist taking a reservation, checking availability, and confirming a time — is generally not an "exclusively automated decision" with a legal or significant effect on the person. It's an administrative task, not a judgment about someone.
Where it can bite
The moment your AI starts screening, scoring, ranking, or qualifying people — deciding who gets a callback, who is offered credit or a rate, who is flagged as low-priority — you're closer to an exclusively automated decision with real effects. If that's your use case, build the s.12.1 mechanics in from the start: disclosure, a record of the information used, and a human who can review on request.
Recording and consent for AI phone calls
If your AI answers or places calls and records or transcribes them, the recording itself is a collection of personal information (and often sensitive, since callers may volunteer health, financial, or identifying details). Treat it accordingly: disclose that the call may be recorded or transcribed and why, limit retention to what the purpose needs, and secure the stored audio and transcripts. Consent to talk to an automated agent is not the same as consent to be recorded — say both plainly at the top of the call.
Cross-border processing, done honestly
A lot of AI infrastructure — models, telephony, transcription — runs on servers outside Canada. Here's the accurate position, not the myth. PIPEDA does not prohibit processing personal information outside Canada. The Office of the Privacy Commissioner of Canada (OPC, priv.gc.ca) treats a transfer to a service provider for processing as a use of the information, governed by the accountability principle: your organization stays responsible for that information, must ensure a comparable level of protection through contractual and other means, and must be transparent that the information may be processed outside Canada — and therefore may be accessible to foreign courts and authorities.
Law 25 adds its own layer: before communicating personal information outside Quebec, you must conduct an assessment of the privacy-related factors and ensure the information receives adequate protection. So the honest checklist is: assess, contract for comparable protection, and disclose the cross-border reality to the people whose data it is. Claiming data "never leaves Canada" when it does is worse than saying nothing.
French-language service
Separately from privacy law, Quebec's Charter of the French Language (updated by Bill 96) creates a general right for consumers and the public to be served and informed in French. It does not impose a specific "you must answer the phone in French" rule. The practical takeaway: an AI agent that can operate in French supports your French-language service obligations — it doesn't discharge a single telephone mandate, because there isn't one. Bilingual capability is a way to meet the general obligation, not a compliance checkbox.
The real penalty exposure
Law 25 has real teeth through two separate regimes. There are administrative monetary penalties imposed by the CAI, and there are penal offences prosecuted separately. For the penal offences, the fine range for a business runs from $15,000 to $25,000,000, or — if greater — an amount equal to 4% of worldwide turnover for the preceding fiscal year. In plain language: penalties can reach the tens of millions, or a percentage of global revenue if that number is larger. This is not a rounding-error risk.
What about federal AI law?
You may have read that Canada was getting a dedicated AI statute. That was AIDA (the Artificial Intelligence and Data Act), part of federal Bill C-27 — and it died when Parliament was prorogued in January 2025. AIDA is not law. As of 2026 the federal privacy/AI vehicle in play is Bill C-36, which is a bill, not passed legislation. Meanwhile, PIPEDA remains the operative federal private-sector privacy law. Don't build a compliance program around a statute that never came into force.
The operator's takeaway
Most Quebec businesses using AI to answer calls or handle bookings are not doing "exclusively automated decisions" in the s.12.1 sense — but they still owe consent, transparency, honest cross-border disclosure, and sensible handling of recordings. If your AI starts making judgments about people, the obligations step up sharply.
If you're weighing an AI receptionist and want the consent, disclosure, and recording practices handled thoughtfully from the start, that's the kind of thing we build into ALMATalk. As an implementation partner, ALMA Intelligence's job is to help you deploy AI that's useful and defensible — not one at the expense of the other.
Frequently asked questions
If your AI system collects or uses the personal information of people in Quebec, Law 25 applies regardless of where your business is based. That means meaningful consent, transparency that the caller or visitor is dealing with an automated agent, honest handling of recordings and transcripts, and disclosure if data is processed outside Quebec or Canada.
Generally no. Section 12.1 applies to decisions based exclusively on automated processing that have a legal or similarly significant effect on a person. Routine scheduling or booking is normally an administrative task, not such a decision. However, using AI to screen, score, rank, or qualify people is much more likely to trigger section 12.1 — which requires informing the person and letting them submit observations to a human reviewer on request.
Yes. PIPEDA does not prohibit processing personal information outside Canada. The Office of the Privacy Commissioner treats a transfer for processing as a use governed by the accountability principle: you stay responsible, must ensure comparable protection by contract, and must be transparent that data may be processed abroad and could be accessible to foreign courts and authorities. Law 25 also requires a privacy assessment before transferring information outside Quebec.
Law 25 has two separate regimes: administrative monetary penalties imposed by the CAI, and penal offences prosecuted separately. For penal offences, the fine range for a business is $15,000 to $25,000,000, or, if greater, an amount corresponding to 4% of worldwide turnover for the preceding fiscal year — meaning the greater of the two figures within that range.
There is no specific 'answer the phone in French' rule. The Charter of the French Language (updated by Bill 96) creates a general right for the public to be served and informed in French. A bilingual or French-capable AI agent supports that general obligation but does not satisfy any single telephone mandate, because none exists.
Not currently. AIDA, the Artificial Intelligence and Data Act contained in Bill C-27, died when Parliament was prorogued in January 2025 and is not law. As of 2026 the federal vehicle in play is Bill C-36, which is still a bill, not passed legislation. PIPEDA remains the operative federal private-sector privacy law.