Home / AI governance and Law 25
Your employees already use AI. Under what rules?
In many SMBs, someone is already summarizing meeting notes with a consumer AI tool or having their quotes rewritten. Nobody decided this, and nobody really knows what data is leaving the company.
Rarely technological. Often legal or contractual.
For an SMB, the danger isn't that AI makes a mistake. It's that an employee pastes a client's data into a consumer tool, on a personal account, without knowing where it ends up.
- Personal information. Quebec's Law 25 applies as soon as a tool processes personal information.
- Commitments to your clients. Your contracts often promise a level of confidentiality nobody has checked.
- Personal accounts. Whatever happens in a personal account is completely outside the company's control.
Mining engineering firm
Governance framework, acceptable use policy and rules for outside consultants, written with leadership. Then a presentation to all employees to explain the rules and answer their questions.
Documents your people will actually read.
Written in plain language, adapted to your size and industry. Not a multinational's template, copied and pasted.
AI governance framework
Who decides, how a new tool gets approved, who answers when there's a problem.
AI acceptable use policy
What's allowed, what isn't, and which data never leaves the company.
Rules for outside consultants
What your subcontractors and consultants can do with AI on your files.
Decision log
A simple record of approved tools and committee decisions, so nothing gets lost.
Presentation to employees
A policy that's signed but not understood protects no one. I present it to your team, explain the why and answer their questions.
What Quebec's Law 25 changes when you adopt AI.
I'm not a lawyer. When a question becomes a legal one, I tell you and we bring in your advisor. But here are the points that come up in almost every project.
Privacy impact assessment
A new system that processes personal information requires a privacy impact assessment (PIA). An AI tool often is one.
Data outside Quebec
Most AI tools process data outside Quebec. Before entrusting them with personal information, that has to be assessed.
Automated decisions
When a decision about someone is made solely by an automated system, that person has the right to be informed.
A clearly designated person in charge
Your AI policy has to align with the person in charge of protecting personal information in your company.
Done right, governance is a springboard.
We look together at what's already happening in your company, then put a framework in place that protects without blocking.