Govern AI in step with Quebec's Law 25.
Quebec's modernized privacy law puts real obligations around automated decisions, transparency, and privacy impact assessments — now fully in force. When AI helps shape a decision about a resident, you need to be able to explain it and stand behind it. LUMINARYX™ is municipal AI governance software that documents AI-assisted decisions so you can defend them.
What Law 25 asks of you, in plain language
Law 25 modernized Quebec's rules for protecting personal information. Adopted in 2021, its provisions were phased in, with the final phase coming into force in September 2024 — bringing automated-decision transparency and full penalties into effect. Municipalities and municipal bodies are public bodies under Quebec's Act respecting Access to documents held by public bodies and the Protection of personal information, so these modernized protections reach the municipal context.
For AI and automated decisions, a few themes matter most:
- Automated-decision transparency. Where a decision is based exclusively on automated processing of personal information, the individual must be informed. On request, they can be given the personal information used, the principal factors and parameters behind the decision, and a chance to submit observations to a person able to review it.
- Privacy impact assessments. A PIA is required in defined situations — including acquiring or launching an information system, and transferring personal information outside Quebec — so new AI tooling can trigger an assessment before it goes live.
- Transparency and consent. Individuals should be told, at or before collection, when their information is used for profiling or automated analysis, with policies that make this clear.
- Data residency expectations. Transfers of personal information outside Quebec attract added scrutiny, which raises the value of keeping data in Canada.
Exactly how each theme applies depends on the facts of a given decision and the current text of the law. Where specifics matter, confirm against the legislation.
What Quebec municipalities can do now
The practical work is the same work that makes any AI use defensible — and it maps directly onto Law 25's expectations.
- Find the automated and AI-assisted decisions. Identify where personal information flows into automated or AI-supported decisions about residents, and flag any that are made exclusively by automated means.
- Prepare the explanation in advance. For each such decision, capture the information used and the principal factors, so you can respond if an individual asks.
- Build human review into the path. Ensure a person can review an automated decision and receive observations from the individual concerned.
- Run a PIA when you adopt new tooling. Treat new AI systems and any transfer of personal information outside Quebec as triggers for an assessment.
- Keep records bilingual and auditable. Maintain documentation in English and French, and keep an audit trail you can produce on request.
This is general information, not legal advice. Law 25 obligations depend on the facts of each decision and the current legislation; confirm your obligations against the Act and, where needed, with qualified counsel.
How LUMINARYX™ helps
A decision register for AI-assisted and automated decisions. Capture each decision with its purpose, the personal information involved, the principal factors, the risk classification, and the reviewer — so the explanation Law 25 contemplates is ready before anyone asks.
Bilingual EN/FR, including Quebec French terminology. Records, assessments, and reporting are available in English and French, using terminology suited to the Quebec municipal context.
Canadian data residency in AWS ca-central-1. Your records stay in Canada, under Canadian privacy law — reducing the cross-border transfer concerns that Law 25 flags for extra scrutiny.
A tamper-evident audit trail. Decisions are hash-chained and logged, so you can show what was decided, by whom, and against which rules — with integrity you can prove.
Compliance mapping across seven Canadian frameworks. One assessment maps to Law 25 alongside Ontario's Bill 194, BC's FOIPPA, the federal Treasury Board Directive, and more — so you prepare once and demonstrate readiness across jurisdictions.
Governance, role by role
For CAOs
Account for AI use to council, residents, and a provincial regulator — with a record you can stand behind.
Explore CAO →For Corporate Services
Turn AI policy into compliance you can prove — framework mapping, records, and access-to-information-ready documentation.
Explore Corporate Services →For IT
Secure, deterministic, and hosted in Canada — with client-side redaction and Microsoft Entra ID SSO.
Explore IT →Sources
- Éditeur officiel du Québec — Act respecting Access to documents held by public bodies and the Protection of personal information (CQLR c. A-2.1)
- CanLII — An Act to modernize legislative provisions as regards the protection of personal information (SQ 2021, c. 25)
- Commission d'accès à l'information du Québec — Official guidance on Quebec privacy obligations
Document AI-assisted decisions you can defend.
Three municipalities. Summer 2026. Full platform access and direct support from our team.
Book a pilot conversationOr email joy@luminaryx.ca