What is Quebec Law 25 and how does it affect advisors?
The Provincial Layer: Quebec Law 25 and Beyond
PIPEDA establishes the federal privacy baseline for AI tool use. Quebec Law 25 layers additional, stricter requirements on top.
3.1 Does Law 25 Apply to You?
Do You Serve Quebec Clients?
Law 25 jurisdiction is based on where the individual resides, not where the advisor is located. If you serve even one client who resides in Quebec, Law 25 applies to your handling of that client's information. This includes transferring their data to an AI tool.
One question determines whether Law 25 applies to your AI tool use. The answer depends on your client base, not your office address.
3.2 What Law 25 Requires Beyond PIPEDA
Law 25 (fully in force as of September 2024) is now Canada's most stringent privacy regime. For advisors using AI tools, it adds requirements PIPEDA does not impose:
| Requirement | PIPEDA | Law 25 |
|---|---|---|
| Privacy Impact Assessment for new AI tool | Recommended (not mandatory) | Mandatory before adoption (Section 3.3) AND before any transfer outside Quebec (Section 17) |
| Automated decision-making | No specific provisions | Section 12.1: notification, explanation, and human review rights when decisions are based exclusively on automated processing |
| Cross-border notification | OPC guidance (advisory) | Statutory requirement |
| Consent model | Express for sensitive data | Opt-in (explicit) for all collection |
| Penalties | Up to $100K per violation | Two tiers: AMPs up to $10M or 2% turnover; penal up to $25M or 4% turnover |
| Cross-provincial reach | Federal baseline applies nationally | Applies based on individual's residence, not organization's location |
When CIRO, PIPEDA, or Law 25 changes, the Dispatch explains what it means.
Once a month: what is changing across CIRO, PIPEDA, and Quebec Law 25, and what it means for advisors using AI tools. A five-minute read.
Subscribe, freeThe automated decision-making provisions under Section 12.1 deserve particular attention. When an AI tool generates outputs that go directly to clients without meaningful advisor review, Section 12.1 applies: the organization must inform the individual, explain the personal information used and the principal factors behind the decision, and provide the opportunity for human review. If the advisor meaningfully reviews AI outputs before presenting them, Section 12.1 likely does not apply.
3.3 Enforcement Status
No administrative monetary penalties have been assessed under Law 25 as of February 2026. The CAI has adopted a "pedagogical approach" to enforcement. This does not mean the regulator is passive. In September 2024, the CAI ordered Transcontinental Printing to cease collecting biometric data via facial recognition. In November 2024, the CAI investigated Metro's proposed facial recognition system. The CAI received 444 confidentiality incident reports in its most recent reporting period.
The penalty structure exists and is operational. The pedagogical period will not last indefinitely.
Canadian AI Compliance Checklist
The evaluation framework from this guide, condensed into a practical reference PDF. Five regulatory areas. Specific questions for each.
- PIPEDA compliance checks
- Quebec Law 25 applicability
- CIRO/CSA alignment criteria
- Cross-border data assessment
- Vendor due diligence questions
3.4 Alberta, BC, and the Provincial Map
Three provinces have private-sector privacy laws declared "substantially similar" to PIPEDA: Quebec, Alberta, and British Columbia. Each has distinct implications for AI tool use.
Alberta's PIPA is the only Canadian general private-sector privacy law with explicit statutory requirements for cross-border data transfers (Section 13.1). Advisors using AI tools hosted outside Canada must notify individuals of their cross-border transfer policies. In August 2025, the Alberta OIPC published an AI Governance Report recommending a comprehensive provincial AI governance framework, including a standalone AI law.
BC's PIPA applies a "reasonable person" test: collection, use, or disclosure of personal information must be for purposes that a reasonable person would consider appropriate. This standard applies even where consent is obtained. Notably, BC has no mandatory breach notification requirement, a significant gap expected to be addressed in future amendments.
For advisors in all other provinces, PIPEDA applies directly. When data crosses provincial or national borders (as it does with most cloud-based AI tools), PIPEDA applies regardless of which province you operate in.
Key Takeaways
- Law 25 applies based on client residence, not advisor location: one Quebec client triggers obligations
- Law 25 mandates Privacy Impact Assessments before AI tool adoption (PIPEDA only recommends them)
- Section 12.1 creates automated decision-making rights: notification, explanation, and human review
- Penalties reach up to $25M or 4% of turnover, significantly exceeding PIPEDA
- Alberta requires explicit cross-border transfer notification; BC applies a "reasonable person" test