Updated September 25, 2026: every legal and factual statement in this article was re-checked against the primary source and corrected where needed.
If an algorithm turns down a loan application, screens a job candidate, or flags a benefits claim for denial, who has to explain why? In the EU, and for credit decisions in the United States, that question has real statutory answers. In Canada, the federal answer died on January 6, 2025, when Parliament was prorogued and Bill C-27 — which carried the Consumer Privacy Protection Act, the Artificial Intelligence and Data Act (AIDA) and a new privacy tribunal — fell off the Order Paper while still in committee, after passing second reading. But one Canadian jurisdiction already has a working answer, and it wrote that answer into law in 2021, the year before AIDA was tabled: Quebec's Law 25.
What Law 25 actually requires when a decision is exclusively automated
Section 12.1 of Quebec's private-sector privacy law applies when a business uses personal information to make a decision about a person based exclusively on automated processing — which Quebec's privacy regulator, the Commission d'accès à l'information (CAI), describes as a decision made without human intervention. When that's the case, the CAI is direct about what a business must do:
- Notice, no later than the decision itself. The person must be informed at the latest when the decision is communicated to them — not buried in a privacy policy they never read.
- Explanation on request. If asked, the organization must disclose the personal information used to make the decision, and the reasons plus the main factors and parameters that led to it.
- A correction right. The person can have inaccurate personal information used in the decision corrected.
- A right to be heard by someone who can review it. The organization must give the person the opportunity to submit observations to a member of its staff who is in a position to review the decision. The Act guarantees that hearing, not a particular outcome.
This has been enforceable law in Quebec for private-sector organizations since September 22, 2023, the second of Law 25's three implementation dates. It is not a proposal, and it did not depend on anything Ottawa was working on.
Why this isn't just a Quebec problem
Law 25 doesn't turn on where your company is headquartered. The CAI's own guidance says an organization located outside Quebec is subject to the private-sector Act when it collects, holds, uses or communicates personal information in the course of its business activities in Quebec. The Act itself doesn't draw a precise territorial line, so a business based outside Quebec, or outside Canada entirely, that serves people in Quebec should assume it is in scope. If your AI system makes an exclusively automated decision about anyone in Quebec — a loan model, a hiring screen, an eligibility engine — section 12.1 is a live question for you, not a hypothetical one.
The federal picture: what died, and what's actually left
With AIDA dead, there is currently no federal, AI-specific law governing how private organizations use automated decision-making on Canadians outside Quebec. What does still exist federally is the Treasury Board Directive on Automated Decision-Making — but that instrument governs how federal government institutions make their own administrative decisions using automated systems, including a mandatory Algorithmic Impact Assessment. Existing federal systems developed or procured before the directive's June 24, 2025 update had until June 24, 2026 to meet its updated requirements. None of it reaches private-sector deployments. PIPEDA itself contains no equivalent automated-decision-specific notice or explanation right. That could change: Bill C-36, introduced on June 15, 2026, would repeal PIPEDA's private-sector privacy rules and replace them with a new Protecting Privacy and Consumer Data Act, which includes an on-request explanation of automated-system predictions, recommendations and decisions that could have a legal or similarly significant effect, plus a chance to make written representations to an employee who can review them. It is still a bill before the House of Commons, and it is a privacy bill, not a replacement for AIDA. Ontario, meanwhile, has required employers with 25 or more employees to disclose in publicly advertised job postings whether they use AI to screen, assess or select applicants since January 1, 2026 — a disclosure rule, not an explanation right. For most organizations outside Quebec, that still leaves general privacy-law principles (transparency, accuracy, purpose limitation) as the closest thing to a rulebook.
What this means for your AI deployment right now
- Map every AI-assisted decision that touches a real person's outcome — credit, employment, benefits, service eligibility — and ask whether any step involves a person in Quebec.
- For each one, determine honestly whether a human is exercising real judgment before the decision is finalized, or just signing off on what the model already decided. Section 12.1 covers only decisions based exclusively on automated processing, and the Act doesn't say how much human involvement takes a decision outside that category — so treat a rubber-stamp sign-off as automated unless you can show real review.
- Build the four things Law 25 actually requires: a notice trigger, an on-request process for disclosing the information, reasons and principal factors behind a decision, a correction path, and a route for the person to submit observations to a staff member who can review the decision — not just a paragraph in a privacy policy.
- If you sell into or operate within the federal government's own systems, ask separately whether your tool feeds a federal administrative decision — that's Treasury Board Directive territory, a different rulebook with its own assessment requirement.
How Mosaic helps
Mapping which of your AI use cases actually trigger a legal obligation — and building the evidence trail to prove you've met it — is exactly the kind of regulatory-to-operations translation our practice is built for. Mosaic's approach is a proprietary, standardized methodology: we identify every automated decision point in your organization, test each one against the applicable rule (Law 25, sector-specific requirements, or general privacy-law principles), and hand your team a governance model — expert-led, with a named senior practitioner behind every finding — that holds up under regulator scrutiny, not just internal sign-off.