AI is accelerating. Law 25 is in force. The two can coexist, but not by accident.
In 2026, artificial intelligence is no longer a pilot project reserved for large enterprises. Quebec SMBs are using it to write, analyze, automate, and respond to customers. That's a good thing. But while the tools keep multiplying, Law 25 (the Act to modernize legislative provisions as regards the protection of personal information) is fully in force and applies to you, whether you have five employees or five hundred.
The good news: compliance and AI adoption are not competing goals. They reinforce each other, as long as you do things in the right order.
What Law 25 concretely requires of your SMB
Law 25 imposes several obligations that directly affect how you use AI:
A Privacy Officer Every organization must designate a privacy officer. In an SMB, that's often the owner or CEO. That responsibility doesn't disappear just because you've delegated a task to an AI agent.
A published privacy policy Your customers need to know what data you collect, why you collect it, and how you protect it. If you're using an AI tool that processes customer information, that has to be reflected in your policy.
A Privacy Impact Assessment (PIA) Any project involving personal information, and most AI projects do, requires a PIA before deployment. This is not a formality: it's a serious risk analysis.
The right to portability and correction Your customers can request their data, correct it, or ask for it to be deleted. Your AI systems need to be capable of honouring those rights. If your AI-enriched CRM retains data indefinitely, you have a problem.
Transparency around automated decisions If a decision affecting an individual is made or influenced by an automated system, that person must be able to find out, and to challenge it.
The most common pitfalls we see in SMBs
The same mistakes keep coming up, over and over:
✦ Connecting an AI tool to customer data without reading the vendor's terms. Is your data being used to train their models? Where is it hosted? Is the vendor a "third party" under Law 25?
✦ Confusing "the tool is secure" with "our use is compliant." Microsoft Copilot or ChatGPT Enterprise may be secure, but if your team is pasting social insurance numbers into a prompt, the liability is still yours.
✦ Forgetting subcontractors. If you're giving a mandate to an agency or consultant who uses AI with your data, you need a proper data processing agreement in place.
✦ Neglecting training. AI compliance starts with the people using the tools. A single untrained employee can cause a personal information breach.
How to adopt AI responsibly
At ProspèrIA, the core idea is straightforward: before you automate, you need to understand, analyze, prioritize, and govern.
In practice, what does that look like for Law 25 compliance?
- Map the personal data flowing through the processes you're targeting with AI.
- Evaluate each AI tool or agent you choose: who hosts what, and under what rights.
- Document: your policy, PIA, subcontracting agreements, and incident register.
- Train your team on what is and isn't acceptable to submit to an AI tool.
- Review regularly, because the tools evolve and so do your obligations.
It's not more complicated than that. But it does require investing real time, not just checking a box.
What the Commission d'accès à l'information is watching
Quebec's Commission d'accès à l'information (CAI) has made it clear that it views AI as a high-risk area for privacy. Organizations that deploy AI systems without a PIA, without a documented policy, or without a complaint-handling mechanism are exposing themselves to penalties. The fines provided under Law 25 can reach significant amounts, and an SMB's reputation is even more fragile than its balance sheet.
Compliance is also a matter of customer trust. In a market where consumers are increasingly sensitive about how their data is used, being the SMB that handles AI with rigour is a genuine competitive advantage.
Conclusion: governed AI is sustainable AI
Adopting AI in 2026 without accounting for Law 25 is building on sand. The tools will keep evolving, and so will the regulations, but the foundations don't change: collect only what you need, protect what you hold, and be transparent with your customers.
You don't need to be a lawyer to get this right. You need a plan, the right partners, and a genuine willingness to do things properly.
Ready to take stock of your AI maturity and your Law 25 compliance? Contact us for a no-pressure conversation, we'll help you see clearly before you go any further.
Live long and prosper. 🖖