AI Regulation Tracker  /  Legislation in force

Quebec Law 25 forces notice and explanation for fully automated decisions on residents

Section 12.1 of Quebec's private-sector privacy law requires any organization that makes a purely automated decision about a resident to tell the person, hear their side, and disclose the personal information and main factors used. Penalties reach C$10 million under Law 25's general administrative monetary penalty regime, not a section-12.1-specific fine.

By Anthony Guerriero  ·  Reviewed by The Leveraged Years Editorial Desk  ·  Published July 7, 2026  ·  Last updated July 7, 2026

Quebec has one of the few privacy statutes in North America that gives residents a direct, enforceable right to be told when a machine decided their fate and to demand an explanation. That right has been law since September 22, 2023, and in 2026 it is the part of Law 25 that most directly reaches firms building automated decision systems.

The provision is section 12.1 of the Act respecting the protection of personal information in the private sector, the private-sector arm of the reform commonly called Law 25 (formerly Bill 64). It applies to a specific category of decision: one made "based exclusively on automated processing" of personal information. If a human meaningfully reviews and makes the call, section 12.1 does not attach. If the system decides on its own, it does.

What the section actually requires

When an organization makes a purely automated decision, it must inform the person of that fact, at the latest when it tells them the decision itself. On request, the organization must then disclose the personal information used to reach the decision, the reasons and the principal factors and parameters that led to it, and the person's right to have the personal information corrected. The person must also be given a chance to submit observations to a staff member who is in a position to review the decision.

The reach is broad because the triggering decisions are ordinary business functions. An automated credit approval or denial, an insurance underwriting or pricing decision, an algorithmic resume screen that rejects a candidate, and automated content moderation that removes a user or an account can all fall inside section 12.1 when they significantly affect a Quebec resident and no person is in the loop.

What it does not do

Section 12.1 is a transparency and contestability rule, not a ban. It does not prohibit automated decision-making, and it does not require that a human make every decision. It requires disclosure, an explanation on request, and a route to human review. It also does not force an organization to hand over its source code or the full model; the duty is to disclose the personal information used and the principal factors and parameters, framed so a person can understand and contest the outcome. Reading it as an outright prohibition on algorithmic decisions overstates it.

Enforcement is what gives the section its weight. Quebec's regime carries administrative monetary penalties of up to C$10 million or 2 percent of worldwide turnover, whichever is greater, alongside a separate penal track. Those figures are among the steepest privacy exposures in Canada and put section 12.1 compliance on the same risk footing as the statute's consent and breach obligations.

The regulator's posture

Quebec's Commission d'acces a l'information (CAI) supervises the Act and has been sharpening its expectations around AI in the workplace and algorithmic impact through 2025 and 2026. According to reporting on that guidance, the CAI has signaled skepticism toward fully automated hiring tools and emotion-recognition AI, and has pressed organizations to assess and document the impact of automated systems on individuals. The precise date and location of that guidance could not be independently confirmed for this piece, so it is noted here as the regulator's reported direction rather than as a fixed instrument. The binding obligation remains section 12.1 itself.

The cross-border angle

For a United States firm, the practical point is simple: section 12.1 follows the data, not the head office. A lender, insurer, or hiring-screen vendor in the United States that runs automated decisions on the personal information of Quebec residents owes the same notice and explanation duties as a Quebec company. Because Quebec's rule predates and in places exceeds most United States state privacy laws on automated decisions, it functions as a de facto compliance floor for any cross-border operation that touches the province, and a preview of where automated-decision transparency rules in other jurisdictions are heading.

For working professionals, the operational question is whether a given decision is truly "based exclusively on automated processing." That classification, more than any single disclosure template, determines when the section applies and where the compliance work has to sit.

Browse the full AI Regulation News tracker

Informational analysis for working professionals, not legal advice. Confirm how any rule applies to your situation with qualified counsel.