Canada
AI Automation for Canadian Service Businesses
Reviewed by Noah Altit · Updated September 2, 2026
Automation in Canada carries obligations that generic advice ignores. PIPEDA applies federally. Quebec Law 25 applies to any organization handling the personal information of Quebec residents, wherever that organization is located, and its rules on automated decisions directly constrain how an automation system may be designed. These are architecture decisions, not settings you adjust after launch.
Two regimes, and the stricter one probably applies to you
Canadian businesses often assume PIPEDA is the whole picture. For anyone touching Quebec residents' data it is not, and Law 25 is materially stricter on the points that matter to an automation project.
| Requirement | PIPEDA | Quebec Law 25 |
|---|---|---|
| Consent | Implied consent accepted in many commercial contexts | Express opt-in required, with implied consent narrowly limited |
| Privacy officer | Recommended, not strictly mandated | Mandatory, defaults to the CEO if undesignated, and the name must be published |
| Breach handling | Report where there is a real risk of significant harm | Report where there is a risk of serious injury, and keep an incident register for five years |
| Automated decisions | Not specifically addressed | Disclosure at the time of the decision, explanation on request, and a right to human review |
| Cross-border transfer | Permitted with comparable protection, no formal assessment | Transfer impact assessment required before personal information leaves Quebec |
| Data portability | Not included | Individuals may request their data in a structured, portable format |
| Maximum penalty | $100,000 per violation | The greater of $25 million or 4 percent of worldwide turnover |
This is a summary for planning an automation project, not legal advice. Confirm your specific obligations with counsel before you rely on any of it.
Why Law 25 changes how automation is built
The provision that matters most to automation work concerns decisions made exclusively by automated processing. Where a decision about a person is made that way, the organization must inform them of it no later than when it informs them of the decision, must on request provide the personal information used, the reasons and the principal factors and parameters behind it, and must give the person an opportunity to submit observations to an employee who is in a position to review the decision.
Note the word exclusively. The requirement is triggered when there is no meaningful human intervention before the decision is final. That single word is the difference between two architectures.
This is one reason we design automation with a person in the loop on consequential decisions. It is better engineering, because a system that escalates ambiguity rather than resolving it quietly is more trustworthy. It also happens to keep you out of the strictest interpretation of this obligation. An automation that scores, ranks, approves, prioritises, or declines people should be built with a review step from the beginning, not retrofitted with one after someone reads the statute.
Where your data actually goes
The transfer impact assessment requirement makes hosting and vendor choice a design decision rather than an operational detail, and AI automation makes this sharper than conventional software does.
When a workflow sends document text or client information to a hosted AI model, that is a transfer, and the receiving jurisdiction and provider terms become relevant. Before scoping a build, it is worth knowing which cloud regions your infrastructure will sit in, which model providers will process content and where, whether that content may be retained or used for training, and which subprocessors sit behind your vendors.
Canadian regions exist for the major cloud providers, and several AI providers offer data residency or zero-retention arrangements. These are answerable questions, and answering them at design time is far cheaper than answering them during an incident or an audit.
- Which cloud regions host the application and the database
- Which AI providers process content, in which jurisdiction
- Whether content is retained, and for how long
- Whether content may be used for model training, and how that is disabled
- Which subprocessors your vendors rely on
- Whether backups and logs leave the country separately from the primary data
Bilingual is a system requirement, not a translation task
For businesses operating in Quebec, French is not a localisation layer applied at the end. Client-facing communication, portal interfaces, automated notifications, and generated documents all need to work in both languages, and language is a property of the client record rather than a browser setting.
This is straightforward when designed in from the start and expensive when retrofitted, because by then the language decision is embedded in templates, notification logic, and generated content. If you operate in Quebec, say so in the brief.
Questions buyers ask
Does Quebec Law 25 apply to businesses outside Quebec?
It applies to private-sector organizations operating in Quebec or handling the personal information of Quebec residents, regardless of where the organization is located. A business in Toronto or Vancouver serving Quebec clients is generally within scope. Confirm your position with counsel.
What does Law 25 require for automated decisions?
Where a decision about a person is based exclusively on automated processing, the organization must inform them of that no later than when it communicates the decision, provide on request the personal information used and the principal factors and parameters behind it, and give them an opportunity to submit observations to an employee able to review the decision. The requirement turns on the word exclusively, meaning no meaningful human intervention before the decision is final.
Can we still use AI automation under Law 25?
Yes. The obligations concern transparency, review rights, and how information moves, not a prohibition on automation. Building with a human review step on consequential decisions and being deliberate about where data is processed addresses most of what the automated-decision provisions are aimed at.
Does our data have to stay in Canada?
Law 25 does not impose a blanket residency requirement, but it does require an assessment before personal information is transferred outside Quebec, considering the receiving jurisdiction's framework. In practice many organizations choose Canadian hosting to simplify that analysis, particularly for sensitive categories.
What are the penalties for getting this wrong?
Law 25 provides for maximum administrative and penal exposure at the greater of $25 million or 4 percent of worldwide turnover, substantially above PIPEDA's $100,000 per violation. That gap is why Quebec obligations are worth scoping properly rather than assuming federal compliance is sufficient.
Does Creative Society Studios work across Canada?
Yes. We are based in Montreal and work in English and French across Canada, the United States, and remote worldwide. Our production work includes Canadian mortgage operations software, which is a context where these privacy considerations are not theoretical.