Quebec's Act respecting the protection of personal information in the private sector requires a business that uses personal information so that a decision is made exclusively by automated processing to tell the person concerned no later than when the decision is communicated. On request, the business must also state the personal information used, the reasons and principal factors behind the decision, and the right to have that information corrected, and it must give the person a chance to submit observations to a staff member able to review the decision. The duty sits in section 12.1, has applied since September 22, 2023, and never mentions artificial intelligence by name.
Key takeaways
- Section 12.1 covers decisions based exclusively on automated processing: notice is due at the latest when the decision is communicated.
- On request, the business explains which information was used, the reasons and principal factors, and the right to correct; the person may submit observations to someone able to review the decision.
- Two neighboring rules matter for AI tools: a notice before collecting data through identification, location, or profiling technology (section 8.1) and a privacy impact assessment for new information systems (section 3.3).
- The administrative penalty ceiling is CAD 10 million or two percent of worldwide turnover, whichever is greater, and the Commission d'accès à l'information enforces it.
- The Act does not use the words artificial intelligence, and the Commission's guidance treats AI-assisted decisions as within it.
The four elements of section 12.1
Section 12.1 applies to any person who carries on an enterprise and uses personal information so that a decision is made exclusively through automated processing of that information. Four elements follow. The person concerned is told of the automated basis for the decision at the latest when the decision itself is communicated. On request, the business states which personal information was used, then the reasons and the principal factors and parameters that led to the decision. Also on request, it informs the person of the right to have the information used corrected. Whether or not a request is made, the person must be given the opportunity to submit observations to a member of the enterprise's staff who is in a position to review the decision. Section 11, as amended in 2021, adds that information used to take a decision is kept for at least one year after the decision. Wording as enacted is in the sanctioned text of the 2021 amending Act.
What counts as exclusively automated
The Act does not define the word exclusively. The Commission d'accès à l'information describes the rule as covering decisions made fully through automated processing, with no human involvement, and gives examples such as granting credit, assessing a request for financial support, or prioritizing a request, adding that such decisions may be made with AI. In its guidance on the use and disclosure of personal information, the Commission repeats the notice timing and the right to submit observations. Its recruitment page applies the rule to software that automatically rejects applications and recommends telling candidates at the start of the process when AI screens or assesses them. Whether a human step that merely confirms a system output takes a decision outside the rule is not settled in the Act or in the Commission pages reviewed for this article.
Notice for identification, location, and profiling technology
Section 8.1 adds a duty at the point of collection. A business that collects personal information from a person through technology with functions allowing the person to be identified, located, or profiled must first inform the person that such technology is used and of the means available to activate those functions. The Act defines profiling as collecting and using personal information to evaluate characteristics of a natural person, notably work performance, economic situation, health, personal preferences, interests, or behavior. The Commission states that these functions cannot be switched on by default; the person activates them. A separate rule, section 9.1, requires a business offering the public a technological product or service with privacy settings to set them, by default, to the highest level of confidentiality without any action by the person, with cookie settings excluded. Whether a given recommendation engine or hiring tool falls within the profiling definition depends on how it collects and uses the data.
Privacy impact assessment
Section 3.3 requires a privacy impact assessment for any project to acquire, develop, or overhaul an information system or an electronic service delivery system that involves collecting, using, communicating, keeping, or destroying personal information. The business consults the person in charge of the protection of personal information from the start of the project, and the project must allow computerized personal information collected from the person to be handed back in a structured, commonly used technological format. The assessment is proportionate to the sensitivity of the information, the purpose of its use, its quantity, its distribution, and its medium. The Act does not say that AI tools are covered, but a tool that processes personal information is in ordinary terms an information system, and the Commission recommends an assessment before an AI system is used to screen candidates. A separate assessment applies before personal information leaves Quebec.
Phases and dates of entry into force
Bill 64 was introduced on June 12, 2020, adopted on September 21, 2021, and sanctioned on September 22, 2021 as chapter 25 of the Statutes of Quebec, 2021. Section 175 of that Act sets September 22, 2023 as the general date, with listed exceptions. The Commission's compliance guide, dated February 8, 2023, describes three phases.
- September 22, 2022: a designated person in charge of personal information, confidentiality incident rules, and rules on disclosure for research and business transactions.
- September 22, 2023: governance policies, privacy impact assessments where the law requires them, new consent rules, the technology notice in section 8.1, the automated decision duty in section 12.1, and the penalty regime, none of which appear among the listed exceptions.
- September 22, 2024: the right to data portability.
Penalties and remedies
Failing to inform a person of a fully automated decision, or failing to give the opportunity to submit observations, is named in section 90.1 as a ground for an administrative monetary penalty. The maximum is CAD 50,000 for an individual and, in other cases, CAD 10 million or two percent of worldwide turnover of the previous fiscal year, whichever is higher. A business may offer the Commission an undertaking to remedy the breach, and an accepted and respected undertaking bars a penalty for the acts it covers. Penal fines under section 91 reach CAD 15,000 to CAD 25 million or four percent of worldwide turnover for businesses, and CAD 5,000 to CAD 100,000 for individuals, doubled for repeat offences. As enacted in 2021, the list of penal offences does not name section 12.1 or section 8.1. The Commission's sanctions page confirms the penalty amounts. Section 93.1 requires punitive damages of at least CAD 1,000 where an unlawful infringement of a right under the Act is intentional or results from gross fault.
Situations, duties, and enforcers
| Situation | What must be done | Who enforces it |
|---|---|---|
| A business reaches a decision about a person using only automated processing of personal information | Inform the person at the latest when the decision is communicated; on request, state the information used, the reasons and principal factors, and the right to correct; allow observations to a staff member able to review the decision | Commission d'accès à l'information, through administrative monetary penalties (section 90.1) and its oversight powers |
| A business collects personal information through technology that can identify, locate, or profile a person | Inform the person beforehand of the technology and of the means to activate those functions | Commission d'accès à l'information |
| A business plans to acquire, build, or overhaul an information system that handles personal information, such as an AI tool | Carry out a privacy impact assessment, consult the person in charge of personal information from the start, scale the work to the sensitivity of the data | Commission d'accès à l'information; the duty is not named separately in the penalty list |
| A public body, rather than a business, makes a fully automated decision | Same four elements under section 65.2 of the Access Act | Commission d'accès à l'information |
| A right under the Act is infringed intentionally or through gross fault and causes harm | Court awards punitive damages of at least CAD 1,000 (section 93.1) | Courts, on the claim of the person affected |
What the law does not say
The 2021 amending Act contains no reference to artificial intelligence, algorithms, or machine learning, so the duties turn on how a decision is reached and not on the technology behind it. The text does not define exclusively, does not state a right to refuse an automated decision or to demand a human decision, and does not require disclosure of the model itself. It requires explanation of reasons and principal factors only on request. In June 2026 the Commission tabled its five-year report with 74 recommendations and says that laws must keep pace with AI; those proposals are not law. This article is general information, not legal advice, and a specific compliance question calls for a lawyer and the current consolidated text of the Act.
FAQ
Does Quebec's Law 25 regulate artificial intelligence?
Not by name. The Act contains no AI-specific provisions, but its duties on fully automated decisions, profiling technology, and privacy impact assessments apply to AI tools that use personal information.
Is a notice needed every time a business uses AI?
No. Notice is required when a decision rests exclusively on automated processing (section 12.1) or when technology with identification, location, or profiling functions is used to collect information (section 8.1).
Can a person demand a human decision?
The Act gives the person an opportunity to submit observations to a staff member able to review the decision. It does not state, in terms, a right to refuse an automated decision.
What is the maximum penalty for ignoring section 12.1?
An administrative monetary penalty of up to CAD 10 million or two percent of worldwide turnover of the previous fiscal year, whichever is higher, for a business; up to CAD 50,000 for an individual.
Does the rule also bind government bodies?
Yes. Section 65.2 of the Access Act sets a parallel duty for public bodies, with the same notice, information, and review elements.
Related reading
- How the federal privacy law applies to AI
- AI rules across the provinces
- Canada's overall approach to AI regulation
- The Quebec guide on AI for teachers
More in AI Law in Canada.
Last verified: October 2026
Sources
- An Act to modernize legislative provisions as regards the protection of personal information, S.Q. 2021, c. 25, sanctioned text, National Assembly of Quebec, 2021
- Bill 64 legislative file, National Assembly of Quebec, 2021
- Vers la conformité à la Loi sur le privé, compliance aid dated February 8, 2023, Commission d'accès à l'information du Québec
- Utilisation et communication de renseignements personnels, Commission d'accès à l'information du Québec, 2026
- Principaux changements de la Loi 25, automated processing and technology pages, Commission d'accès à l'information du Québec, 2026
- Sanctions pour les entreprises, Commission d'accès à l'information du Québec, 2026
- Recrutement et emploi, Commission d'accès à l'information du Québec, 2026
- Publication du rapport quinquennal 2026, Commission d'accès à l'information du Québec, June 11, 2026