New CAI Guidelines on AI and Law 25: What Quebec Businesses Need to Know

On May 6, 2026, the CAI published a comprehensive 151-page report detailing its investigation into OpenAI's ChatGPT. The report highlights critical concerns regarding user consent, the transparency of algorithmic training, and the principle of data minimization. The CAI sends a clear warning to organizations utilizing public generative AI models: copying and pasting corporate secrets or customer data into public platforms is a violation of Law 25's security requirements. Organizations must establish clear guidelines to define which tools are authorized, ensure employees are trained, and mandate the use of private, enterprise-grade AI instances where data is not reused for public model training.

On June 11, 2026, the CAI released its 381-page Quinquennial report proposing 74 recommendations to modernize the legal framework for privacy and access to information in Quebec. Recommendations 71 to 74 focus specifically on strengthening the CAI's operational autonomy and enforcement capabilities. The Commission proposes transitioning from a reactive, complaint-driven regulator to a proactive oversight body with the authority to conduct independent compliance audits, issue direct administrative monetary penalties (AMPs), and access additional funding. This shift indicates that in the near future, organizations deploying AI systems will face active regulatory audits rather than just post-incident reviews.

To protect your organization from compliance risks and eventual audits, you must adopt a structured AI governance framework. First, map your AI usage to identify any hidden 'Shadow AI'. Second, before implementing any tool that processes personal data, conduct a mandatory Privacy Impact Assessment (ÉFVP/PIA), as required by Article 3.3 of Law 25. Third, draft a clear internal AI Policy to set boundaries for your team. Finally, ensure all AI vendors are audited for data encryption, hosting location (preferably in Canada), and strict data-handling clauses. Security is not just a checkbox; it is the foundation of competitive trust.