Quebec Law 25 Raises Compliance Questions for Generative AI Deployments

A Quebec-focused technical guide argues that companies using generative AI must address specific obligations under Law 25 before going into production. The law designates the highest-ranking person in an organization as its privacy officer by default and lists penalties that can reach $10 million or 2% of worldwide turnover. Two of the most relevant penalty grounds concern security measures and automated decision-making, both of which intersect with AI system design. The authors note that the Commission d'accès à l'information has not yet published any administrative monetary penalties or rulings interpreting the automated decision rule, though it has issued orders against AI and biometric systems. They emphasize that the absence of fines should not delay compliance work, since system shutdown orders and class actions remain possible.