Loi 25 and AI: know which AI tools touch personal information
We inventory the AI tools your team uses on personal information, draft the privacy-impact worksheets and prepare the questions to ask each supplier. A readiness and gap review, not a compliance guarantee.
- About 1 to 2 weeks
- 60 min Google Meet readout
- 100% remote, Canada-wide
Quebec businesses that use ChatGPT, Copilot, Gemini or AI features inside other software are often handling personal information without a clear picture of where it goes. Loi 25 expects businesses to know what personal information they hold, to assess privacy impacts before certain projects and before disclosing personal information outside Quebec, and to keep their practices documented.
This service builds the AI-specific layer of that picture. You get a written inventory, draft privacy-impact worksheets for your highest-risk uses, and a set of supplier questions ready to send. It is designed to sit on top of the 1,499 CAD Loi 25 website and security pack, or to stand alone if you only need the AI side.
What you get
Inventory of AI tools handling personal data
A structured register of every AI tool and AI feature in use, who uses it, what categories of personal information go in, where the vendor processes data, and which account type is used.
Privacy-impact worksheet drafts
Draft worksheets for your highest-risk AI uses, pre-filled from the inventory, ready for your privacy officer to review, complete and sign off. They are drafts for your decision, not a finished assessment.
Supplier question list
A tailored list of questions for each AI vendor: data location, retention, training on your inputs, sub-processors, deletion, incident notification and contract terms.
Gap review summary
A short written review listing where current practice differs from good practice, ranked by priority, in plain language for management.
Staff-use rules outline
A one-page outline of the rules your inventory suggests you need, which can feed directly into the AI Policy + Staff Training Pack.
60 minute readout
A Google Meet session to walk through the findings with you and your privacy officer or designated lead.
Who it is for
Quebec organizations of about 5 to 50 staff that handle personal information and have started using AI tools.
- Clinics, dental offices and wellness practices that hold client or patient information
- Accounting, legal, notary and consulting firms working on client files
- Real estate, insurance and financial service offices
- HR-heavy businesses using AI to draft, screen or summarize staff or candidate information
- Any business whose privacy officer has asked "where does our AI use touch personal data?"
How it works
1. Pay online
Choose the add-on price if you bought the 1,499 CAD Loi 25 pack, or the standalone price. Add to cart and pay.
2. Secure intake
You complete a short questionnaire and, if you wish, grant read-only visibility to tool admin pages. NDA on request. No passwords by email.
3. We work
We build the inventory, draft the worksheets and prepare the supplier questions, usually within 1 to 2 weeks.
4. Readout
We walk through findings in a 60 minute Meet session and deliver the documents.
Scope and limits
- This is a readiness and gap review. It does not certify, approve or guarantee compliance with Loi 25 or any other law.
- Privacy-impact worksheets are drafts. Your business, usually through its privacy officer, remains responsible for completing and approving them.
- We do not give legal advice. We recommend that a Quebec privacy lawyer reviews final decisions, especially on cross-border disclosure.
- We do not negotiate with your vendors or send the supplier questions for you unless agreed in writing.
- We do not cover your website, cookie banner or policies here. Those are in the 1,499 CAD Loi 25 website and security pack.
- We do not store your clients' personal data. Access, when needed, is read-only and limited to tool settings and configuration.
Why AI needs its own look under Loi 25
AI tools are different from ordinary software because inputs often leave your control: a prompt can contain names, health details or financial figures, and the vendor may process it on servers in another country. Loi 25 expects a privacy impact assessment before disclosing personal information outside Quebec, so knowing where your AI tools process data is a practical starting point.
The inventory also helps with everyday questions: who is your designated privacy lead, which vendors are involved, and what would you say if a client asked how an AI tool handled their file. We help you answer those with documents rather than guesses, while keeping the final decisions where they belong, with your organization.
Pricing
Add-on to the Loi 25 pack
- AI tool inventory (personal data)
- Privacy-impact worksheet drafts
- Supplier question list
- Gap review summary
- 60 min Meet readout
Standalone
- Everything in the add-on
- Short scoping call before work starts
- Full intake questionnaire design
- Suitable if you only need the AI side
- 1 to 2 weeks
The add-on price applies only when bought with the 1,499 CAD Loi 25 pack. Without the pack, choose standalone. Taxes are added at checkout.
Questions and answers
Does this make us compliant with Loi 25?
What is the difference between the add-on and standalone prices?
Do you write the privacy impact assessments for us?
What access do you need?
Do you cover AI features inside other software?
Can the supplier questions be sent as-is?
Related services and reading
Related reading : Shadow AI: the hidden risk of unapproved tools · Canada federal AI law: where things stand · IT security audit checklist for businesses
Find out where AI touches personal information in your business
Choose your option and add it to the cart, or call us to talk it through.