Law 25: automated decisions
Since September 22, 2023, section 12.1 of Québec’s Act respecting the protection of personal information in the private sector governs decisions based exclusively on automated processing of personal information. Section 65.2 of the Access Act provides the same for public bodies. The organization must:
- inform the person that automated processing was used, no later than when it informs them of the decision;
- on request, tell them which personal information was used, and the reasons and principal factors and parameters that led to the decision;
- inform them of their right to have that information corrected;
- give them the opportunity to submit observations to a staff member able to review the decision.
To answer these requests, you first need to know which decisions are made without human involvement. ISO/IEC 42001 makes you document exactly that: the intended use of each AI system and the human oversight measures.
Law 25: privacy impact assessments
Section 3.3 of the private-sector act, and section 63.5 of the Access Act for public bodies, require a privacy impact assessment for any project to acquire, develop or overhaul an information system or electronic service delivery involving personal information. An AI system fed with personal data is almost always in scope.
The ISO/IEC 42001 impact assessment (clauses 6.1.4 and 8.4, objective A.5) goes further: it also covers effects unrelated to privacy, such as access to a service, discrimination or physical safety. Run both as one exercise with two parts, rather than two documents that contradict each other six months later.
Public bodies: a framework already in force
Québec’s Ministère de la Cybersécurité et du Numérique governs the use of AI by public bodies under the Act respecting the governance and management of information resources. The following instruments already apply.
| Instrument | Date | What it requires |
|---|---|---|
| Ministerial order 2024-01 on information resource requirements for the use of AI | February 28, 2024 | Declare every AI asset, project or initiative to the chief information officer, with objectives, data, costs and benefits, by June 15 each year. |
| Statement of principles for the responsible use of AI by public bodies (order 2024-02, annex replaced by order 2025-02) | June 27, 2024, updated December 3, 2025 | Twelve principles, including human oversight and digital sovereignty. |
| Application directive IA-RI-2025-003-OP, measures for the use of generative AI | In force December 5, 2025 | Governance structure, six-step risk management, privacy impact assessment from the design phase, reliability testing against hallucinations and bias, staff training before deployment, internal guidelines on permitted and prohibited uses, human oversight. |
The directive allows implementation to be phased in over at most six months, so until early June 2026. An application guide followed in March 2026.
None of these documents mentions ISO/IEC 42001. The application guide points to the NIST AI Risk Management Framework for high-risk cases. The standard still has a practical use: it turns a list of obligations into a system that is audited every year, with named owners and dated evidence.
Financial institutions: the AMF and OSFI on May 1, 2027
The Autorité des marchés financiers guideline on the use of artificial intelligence, published in final form on April 7, 2026, will apply from May 1, 2027 to authorized insurers, financial services cooperatives, trust companies and deposit institutions. Its main expectations:
- a senior executive accountable for all AI systems;
- a centralized register of AI systems, with a risk rating for each, reviewed periodically;
- governance over the full lifecycle, from choosing a system to monitoring it in operation;
- sufficient collective competence on the board;
- towards customers: tell them they are interacting with an AI system, offer access to human help and explain decisions.
Federally, OSFI Guideline E-23 on model risk management, published on September 11, 2025, takes effect on the same day, May 1, 2027. Its definition of “model” includes AI and machine learning methods.
Federal level
The Treasury Board Directive on Automated Decision-Making, amended on June 24, 2025, applies to federal institutions. Bill C-27, which contained the Artificial Intelligence and Data Act, died on the Order Paper in January 2025. Bill C-36, tabled on June 15, 2026, deals with privacy and includes provisions on automated decisions; it was at second reading in October 2026.
Where ISO/IEC 42001 helps
The table links each Québec requirement to where the standard organizes it. It helps split the work: one management system can answer several requirements with the same evidence.
| Requirement | Where it comes from | Where ISO/IEC 42001 organizes it |
|---|---|---|
| Inventory of AI systems | Order 2024-01; AMF (register) | Scope (4.3), resources and documentation of AI systems (A.4, A.6) |
| Accountable person | AMF; directive IA-RI-2025-003-OP (governance) | Leadership, roles and responsibilities (5.1, 5.3, A.3) |
| Risk rating, risk management | AMF; directive (s. 4) | AI risk assessment and treatment (6.1.2, 6.1.3, 8.2, 8.3) |
| Effects on people, privacy impact assessment | Law 25 (s. 3.3 and 63.5); directive (s. 4) | AI system impact assessment (6.1.4, 8.4, A.5) |
| Review by a person, human oversight | Law 25 (s. 12.1 and 65.2); Statement of principles; directive (s. 17) | Intended use and use of AI systems (A.9) |
| Information to individuals and customers | Law 25 (s. 12.1); AMF | Information for interested parties (A.8) |
| Reliability testing | Directive (s. 6) | Verification and validation (A.6.2.4) |
| Staff training | Directive (s. 11) | Competence and awareness (7.2, 7.3) |
| Generative AI suppliers | Directive; AMF | Third-party and customer relationships (A.10) |
Where to start
If your organization already runs ISO 9001 or ISO/IEC 27001, much of the work is done. The best return usually comes from starting with the inventory, then an impact assessment on the most exposed system. The free guide The Bridge lays out a 90-day plan. TechVibes offers readiness assessments, internal audits and training, in French and English.