AI and Law 25: Beware of fear tactics and disinformation

For the past few months, aggressive advertisements have flooded social media, brandishing Bill 25 as a $25 million threat to force Quebec companies to adopt so-called "sovereign" AI solutions. At Digitech Marketing Inc. , we believe that innovation must be based on transparency, not fear.

According to the guidelines of the Quebec Access to Information Commission (CAI) , the objective of the law is first and foremost to ensure the protection of citizens and to encourage best practices, and not to blindly penalize SMEs.

Here's what you really need to know to protect your business without falling for misinformation.

1. The myth of the "Miracle Jurisdiction"

Some advertisements claim that simply storing data in Canada (often in Toronto) automatically makes an AI compliant. This is false .

* Law 25 does not prohibit the transfer of data outside Quebec.

• However, it requires a Privacy Impact Assessment (PIA) to be carried out to ensure that the level of protection is equivalent elsewhere.

• A company based in Ontario or the United States that does not comply with Quebec's consent and right to be forgotten protocols is in violation, regardless of the location of its server.

2. Fear of fines: A marketing lever

The figure of $25 million (or 4% of global revenue) is the maximum limit reserved for repeat offenses or serious misconduct by large entities.

• For the majority of SMEs, administrative sanctions are proportionate and primarily aim to correct practices.

• A company that demonstrates a clear intention of compliance (via a secure architecture) drastically reduces its risk, contrary to what alarmist advertisements suggest.

3. How to verify the reliability of an AI solution?

Before entrusting your customer data to a third party, ask yourself these three critical questions:

1. Is the company established in Quebec? Use the Quebec Enterprise Register (REQ) to verify its legal existence. A firm without a French name or an office here might be unaware of the intricacies of Bill 101 and Bill 25.

2. What is the data architecture? Ask if the solution uses multi-tenant isolation . If your data is mixed with that of other clients, your trade secrets are at risk.

3. Decoupling of sensitive data (PII): A serious solution separates intelligence (AI) from identity (User) to guarantee total anonymity.

Keep in mind

• Sovereignty vs Security: Hosting in Canada is an advantage, but if the software is poorly designed (mixed data), the risk of leakage is higher than secure and isolated hosting elsewhere.

• Jurisdiction: The use of recognized AI (OpenAI, Google) is permitted if the contracts guarantee adequate protection and a PPI has been carried out.

Conclusion

Don't let fear-mongering dictate your digital transformation. Bill 25 is an opportunity to build lasting trust with your customers. Choose partners who prioritize security by design over alarmist slogans.

To assist you, we suggest you consult the CAI's Guide to the new responsibilities of businesses .