Canada Has No AI Act. Quebec Regulated Your Model Three Years Ago.

Notice at the time of the decision

What the law asks

When a decision is based exclusively on automated processing of personal information, the person must be informed of that fact no later than at the time the decision is made. Not in the privacy policy, not on request — at the decision.

What you have to build

The decision surface itself has to carry the disclosure, which means your product needs to know which of its outputs are decisions. Most do not. The engineering work is an inventory and a flag on the response, and the inventory is the part that takes weeks.

The information the person can ask for

What the law asks

On request, the person must be informed of the personal information used to make the decision, the reasons and the principal factors and parameters that led to it, and of their right to have that information corrected.

What you have to build

A per-decision explanation record retained long enough to answer a later request: input snapshot, model version, the factors that drove the outcome, and a correction path back into the source data. Reconstructing this from a trained model after the fact is not possible, so it has to be written at inference time.

The right to submit observations

What the law asks

The person must be given the opportunity to submit observations to a member of the personnel of the enterprise who is in a position to review the decision.

What you have to build

A named human with actual authority to overturn, a queue, a response window and a log. The statutory phrasing is specific about capacity — routing observations to a support agent who can only escalate does not satisfy a provision that says the recipient must be in a position to review the decision.

Profiling requires its own notice

What the law asks

Where technology allowing a person to be identified, located or profiled is used, the enterprise must inform them of that use and of the means available to deactivate the functions.

What you have to build

A discoverable control that actually turns profiling off, plus a notice at the point of use rather than buried in settings. 'Deactivate' is a functional requirement: an opt-out that suppresses the display while the profile keeps building does not meet it.

Administrative monetary penalties

The Commission can impose administrative penalties reaching the greater of a fixed ceiling in the millions and a percentage of worldwide turnover, with a higher penal ceiling on prosecution. The numbers are the headline; the process matters more, because an administrative track does not require a court to start moving.

A private right of action with minimum damages

Where an unlawful infringement of a right conferred by the statute causes injury, the court must award punitive damages of at least one thousand dollars. A statutory floor that does not require proof of quantified loss is the structural feature that makes class proceedings viable, and Quebec's class-action regime is unusually accessible.

The regulator's own initiative

The Commission investigates on complaint and on its own initiative, publishes decisions, and has been active on incident reporting and on consent design. Public decisions are the compounding cost — they are read by your enterprise buyers' procurement teams long after the file closes.

Language as a parallel exposure

Quebec's language legislation requires software, user interfaces and standard-form contracts to be available in French, with French versions available on no less favourable terms. This is not privacy law and it is enforced separately, but it arrives at the same product, and a compliance plan that localises the privacy notice while shipping an English-only interface has solved half the problem.

Is 'exclusively automated' a real escape hatch if a human approves the output?

It is a real distinction and a much narrower one than product teams assume, and the way you lose it is by winning it on paper. The provision attaches to decisions based exclusively on automated processing, so genuine human involvement takes you outside it. The question a regulator or a court will ask is whether the involvement was meaningful — whether the person had the information needed to reach a different conclusion, the authority to do so, and the time to consider the case individually. A reviewer clearing three hundred model outputs an hour is performing a formality, and the timestamps in your own audit log establish that better than any adverse witness could. There is also a strategic point worth weighing: the artefacts that prove meaningful human review are largely the same artefacts the automated-decision provision would require anyway — a per-decision record, a named reviewer, an override path and a log. Teams that build those get both the compliance position and the exemption argument. Teams that rely on the exemption alone typically have neither, because there was nothing to build.

We are a processor for our enterprise customers. Does Law 25 reach us directly?

It reaches you through the mandate structure and increasingly through the facts of what your model does, so the honest answer is that the label protects you less each year. Quebec law contemplates entrusting personal information to a service provider under a written mandate that specifies the measures to protect it, and a provider acting strictly within that mandate is not carrying the enterprise's obligations. The pressure comes from two directions. First, the written agreement is itself mandatory, so a vendor operating on an order form with no data terms has a defect regardless of allocation. Second, a vendor that trains on customer data, versions the model on its own schedule, decides what factors the model considers and does not disclose the logic is exercising judgement over purposes and means that a mandate does not describe. In practice the more useful question is not which label applies but which of the four automated-decision duties you can actually perform. If your customer must produce the reasons for a decision and only you know the factors, you will be building the explanation artefact whatever the contract says — so build it deliberately and sell it as a feature rather than surrendering it in a negotiation.

How does this compare to the federal Canadian regime we already track?

The federal statute governs organisations across Canada in commercial activity, and Quebec's regime applies to the private sector within the province with obligations that are in force now and that are, on automated decisions, more specific than anything federal. The Artificial Intelligence and Data Act that would have added a federal AI-specific layer did not survive the parliamentary session in which it was introduced, so the widely held belief that Canada is 'waiting for its AI law' is true federally and irrelevant provincially. That asymmetry is the practical planning insight: Quebec residents have an enforceable notice-and-observations right today, while the rest of Canada is governed by general privacy principles that reach automated decisions less directly. It also affects sequencing. Building for Quebec produces the decision inventory, the explanation record and the human-review workflow — which is most of what a federal AI regime would require if one arrives, and most of what the European regime already requires. Building for a future federal statute produces nothing you can point at when a Quebec complaint lands.

Do we really have to ship a French interface, or is a translated privacy notice enough?

The notice is the smaller half. Quebec's language legislation requires that software, including user interfaces, be available in French where a French version exists, and that standard-form contracts and related documents be provided in French, with French versions on terms no less favourable than the English. For a SaaS product sold into Quebec that means the application itself, the contract, the invoices and the support materials — not only the legal pages. Two practical points. The obligation bites hardest at the enterprise sales stage, because a Quebec buyer's procurement process asks for it directly and a missing French interface stalls the deal months before any regulator would notice. And the AI layer creates its own version of the problem that localisation pipelines usually miss: a model that answers a French question in English, or that produces English-only explanations for the automated decisions you are required to explain, has undone the localisation at exactly the surface the law cares about. Test the assistant in French before declaring the product localised.

What does a privacy impact assessment for an AI feature actually contain?

It is a proportionate written analysis, not a form, and the proportionality is genuine — a small feature does not need a large document, but it does need a document. Cover: what the system does and which personal information it processes; the purposes and the lawful basis for each, called out separately where training is a distinct purpose from inference; the sensitivity of the data and the population affected, with minors and special categories flagged; the automated decisions the system produces and how each of the four statutory duties is satisfied for them; the retention schedule for inputs, outputs and logs; the transfers, including every model provider and sub-processor, with the destination jurisdiction's legal framework assessed; the security measures; the risks identified and the mitigations chosen, including the ones you rejected and why; and the residual risk with a named person accepting it. The rejected-mitigation section is what separates a real assessment from a compliance artefact, and it is also the section that protects you: a documented, reasoned decision to accept a known risk reads very differently from silence about a risk you clearly knew existed.

What should we build first if Quebec is a handful of accounts?

Sequence it so the visible defects go first and the expensive engineering is scoped by evidence rather than by anxiety. Start by publishing the privacy officer's title and contact on the website and confirming a written mandate exists with every processor touching that data — both are findable from outside your company and both are cheap. Then run the decision inventory: list every output that changes a person's outcome without a human deciding, which for most products surfaces three to five items nobody had classified as decisions. Then instrument those decisions with an explanation record written at inference time, because it is the only artefact that cannot be produced retrospectively and therefore the only one where delay is irreversible. Then stand up the observations workflow with a named reviewer who can overturn. Then write the impact assessments, transfer-first. Notice that the ordering front-loads discovery and defers documentation: the inventory usually changes what you thought you were building, and writing the assessment before you know which decisions exist means writing it twice.