Quebec Law 25 section 12.1 requires notice and an explanation when automated processing alone decides about a job applicant or employee. Text and checklist. The rule sits in the Act respecting the protection of personal information in the private sector (CQLR c P-39.1) and has applied since 22 September 2023. It does not ban AI hiring tools. It gives the person a notice, a short explanation on request and a chance to be heard. This guide is based on the statute text and the Commission d'accès à l'information (CAI) publications, and it is general information, not legal advice.
Quebec automated decision rules at a glance
Every row comes from the Act or from a CAI publication, with the source named.
| Item | What the sources say |
|---|---|
| Provision | Section 12.1 of the Act respecting the protection of personal information in the private sector (CQLR c P-39.1) |
| Trigger | A decision "based exclusively on an automated processing" of personal information |
| Who must act | "Any person carrying on an enterprise" |
| In force | 22 September 2023 (Law 25, S.Q. 2021, c. 25, s. 175) |
| Duty 1 | Tell the person about the automated decision no later than when you tell them the decision |
| Duty 2, on request | Give the personal information used, the reasons and the principal factors and parameters, and the right to have the information corrected |
| Duty 3 | Give the person the opportunity to submit observations to a member of personnel "in a position to review the decision" |
| Employees and applicants | The text protects "the person concerned" and has no employee or applicant exception |
| Money exposure | Administrative penalty up to $10,000,000 or 2% of worldwide turnover, whichever is greater (s. 90.12), and punitive damages of at least $1,000 for intentional or grossly negligent harm (s. 93.1) |
| Regulator | Commission d'accès à l'information (CAI) |
What section 12.1 says
This is the full text of section 12.1 in the English version of the Act:
Any person carrying on an enterprise who uses personal information to render a decision based exclusively on an automated processing of such information must inform the person concerned accordingly not later than at the time it informs the person of the decision.
He must also inform the person concerned, at the latter's request,
1° of the personal information used to render the decision;
2° of the reasons and the principal factors and parameters that led to the decision; and
3° of the right of the person concerned to have the personal information used to render the decision corrected.
The person concerned must be given the opportunity to submit observations to a member of the personnel of the enterprise who is in a position to review the decision.
In plain terms, the section creates four duties.
- Notice. You must say the decision was made by automated processing. The deadline is the moment you communicate the decision. Nothing in the text requires notice earlier than that.
- Explanation on request. If the person asks, you must give the personal information used, the reasons and the principal factors and parameters, and tell them they can have that information corrected.
- A chance to be heard. The person must be able to submit observations to a member of your personnel who is "in a position to review the decision."
- Correction rights. The right to correct personal information comes from sections 27 and 28 of the Act. Section 12.1 requires you to tell the person about it.
Two points are easy to get wrong. The section does not say a reviewer must have "real authority to overturn" the outcome, and it does not use the word "meaningful." The statutory test is that the reviewer is "in a position to review the decision." How far that goes in practice has not been settled by CAI guidance or a reported court decision. A cautious employer picks a reviewer who can actually change the result.
Also note what the section leaves out. It sets no deadline for answering an explanation request, and it does not require you to explain how a model works in general terms. The CAI's own commentary says it gives a degree of explainability for each decision, not a view of how the whole system works.
What "exclusively" means
The trigger is a decision based "exclusively" on automated processing. A decision with a human actually weighing the evidence is outside the section. A decision where an algorithm decides and a person only passes it along is inside it, on the usual reading.
Between those two poles the law is unsettled. No CAI guidance or reported court decision defines "exclusively." The "meaningful human involvement" test that appears in many law-firm and vendor articles is commentary, not a rule from the Act or the regulator. Some commentators read "exclusively" more narrowly than others, so treat any single reading as a risk position.
The CAI has made three observations that help. In a January 2025 brief it said that section 12.1 does not apply to decisions that are not entirely automated. It said the Act sets no criteria for how significant an action must be to count as a "decision." It also warned about automation bias, the tendency of a person to approve what a system proposes without studying the full analysis. For hiring teams, the practical lesson is simple: a reviewer who only clicks approve gives you a weak argument that a decision was not exclusively automated.
Employees and job applicants
Section 12.1 protects "the person concerned," meaning the person whose personal information is used. It has no exception for employees, and none for applicants. The Act's only workplace carve-out is narrow: personal information about someone's performance of duties, such as name, title, duties and work contact details, falls outside Divisions II and III (s. 1). Scoring a candidate, ranking a résumé or rating an employee's performance is not that kind of information.
The CAI's January 2025 brief treats current and prospective employees alike. It says the privacy issues are similar and uses "employees" to cover both. Law-firm commentary reaches the same view for applicants. Section 9 also shows that the Act expects hiring to be covered, because it bars refusing "a request relating to employment" over a person's refusal to give personal information, except where the information is necessary.
When it took effect
Law 25 came into force in stages. Section 175 of the 2021 Act sets 22 September 2023 as the general date and lists exceptions for 2021, 2022 and 2024. The provisions that created section 12.1 (section 110 of Law 25), section 8.1 (section 107), section 3.3 (section 103, apart from sections 3.1 and 3.5 to 3.8), the administrative penalties (section 159) and the punitive damages rule (section 161) are not in the exception lists. They took effect on 22 September 2023. The CAI's own summary of Law 25 changes also dates the transparency rules to September 2023.
Which hiring tools can trigger section 12.1
Section 12.1 does not mention AI. It covers any "automated processing," so a simple scoring rule counts as much as a machine learning model. The CAI's brief lists AI uses in employment that engage these rules. They include scoring candidates against a profile, sorting applications automatically, evaluating candidates in video interviews, deciding who to hire or what pay to offer, and predicting which employees might break rules or leave.
Common hiring situations, read against the text (these are readings of the statute, not CAI rulings):
- Likely in scope: an applicant tracking system that rejects every candidate below a score threshold with no person reading the file.
- Likely in scope: an automated knockout question, such as a work authorization or credential filter, that ends the application on its own.
- Likely in scope: an interview scoring tool whose score alone decides who is invited to the next round.
- Likely outside the section: a ranking that a recruiter reads, tests against the actual résumé and can override, where the recruiter really decides.
- Unclear: a ranking that recruiters follow in nearly every case. A regulator could ask whether anyone really reviewed the candidates, so keep records of overrides.
A separate point: section 12.1 covers decisions about a person. A tool that only supports an analysis of a pool of candidates, with no decision about an individual, is a different question.
Other parts of the Act that reach hiring tools
Section 12.1 is one rule among several. An AI hiring tool usually triggers more than one.
| Provision | What it requires | Why it matters for hiring tools |
|---|---|---|
| Section 8.1 | Before collecting personal information from a person with a technology that includes functions that identify, locate or profile them, tell them about the technology and how to activate those functions. "Profiling" includes analyzing a person's work performance | Video interview scoring or behavior analysis may collect profiling data directly from the candidate. The CAI reads the rule as requiring those functions to be off until the person turns them on |
| Section 3.3 | A privacy impact assessment (PIA) for any project to acquire, develop or overhaul an information system or electronic service delivery system involving personal information. Consult the person in charge of privacy from the start | The CAI says an AI system is, in most cases, an information system that needs a PIA. The assessment must be proportionate to sensitivity and scale |
| Section 17 | A PIA before communicating personal information outside Quebec, including when you entrust a person or body outside Quebec with collecting, using or keeping it for you. A written agreement is required | Most HR tech vendors host data outside Quebec |
| Sections 4 and 5 | Collect only what is necessary for a serious and legitimate purpose set in advance | Collecting more candidate data than the decision needs is a separate problem from automation |
| Section 11 | Information used to make a decision must be accurate and up to date, and kept for at least one year after the decision | Keep the inputs and outputs for automated hiring decisions for a year at minimum |
| Section 12 | Consent is needed to use information for a new purpose, and it must be express for sensitive information, which includes biometric information | Reusing interview data for a new purpose, such as training a model, may need consent |
| Sections 3.1, 3.2 and 8.2 | A person in charge of personal information, published governance practices, and a plain-language confidentiality policy when information is collected by technological means | The CAI notes the policy duty extends to employees |
| Section 3.5 | Reasonable measures after a confidentiality incident, and prompt notice to the CAI and affected people where there is a risk of serious injury | An applicant data leak at an HR vendor is an incident you must assess |
Biometrics in hiring and onboarding
Facial analysis, voice analysis and fingerprint checks raise a higher bar. Under the Act respecting the legal framework for information technology (CQLR c C-1.1), section 44 allows identity verification by biometrics only if it was previously disclosed to the CAI and the person gives express consent, and it limits what may be used and kept. Section 45 requires a database of biometric characteristics to be disclosed to the CAI promptly and not later than 60 days before it is put into service. The CAI's 2023 findings on biometric time clocks say that, in the cases it analyzed, employers rarely showed the collection was necessary, and that convenience does not meet the test even with consent.
What the CAI has actually said about AI at work
The CAI has not published a dedicated rule or guideline on automated decisions in hiring. Its AI and employment views are in a few documents.
January 2025 brief to the Ministry of Labour. On 27 January 2025 the CAI filed "L'IA au travail : pour un meilleur encadrement" in a consultation on the digital transformation of workplaces. Some commentary calls this workplace AI guidance. It is a consultation submission, mostly asking for new legislation, and it is not binding. Its main points are:
- Existing privacy laws already apply to AI at work, but with limits. Section 12.1 does not cover partly automated decisions, and the person must ask to get the extra information.
- It recommends requiring employers to disclose AI and monitoring tools in their privacy policy, and to tell employees when partly or fully automated decisions are planned.
- It recommends requiring an algorithmic impact assessment for any AI system that makes partly or fully automated decisions, covering fundamental rights and privacy, with mandatory employee involvement.
- It recommends prohibiting some uses, notably emotion or psychological state recognition, most biometric categorization, and fully automated decisions with major effects on employees.
- It describes voluntary good practice for employers today: more transparency, upgrading PIAs into algorithmic impact assessments, involving employees, and training staff.
The important detail is that the brief asks lawmakers to make these changes. It does not say the Act already requires an algorithmic impact assessment, and it does not say emotion analysis is merely "to be scrutinized." It says such systems should be prohibited. A current PIA duty exists under section 3.3. An algorithmic impact assessment is a recommended practice and a legislative proposal.
June 2026 five-year report. The CAI's seventh five-year report, tabled in June 2026, returns to the idea. Recommendation 45 asks that a PIA be accompanied by an algorithmic impact assessment when it concerns an AI system aimed at automated decisions about people. The report also lists emotion recognition in work or education and biometric categorization to infer sensitive information among practices whose explicit prohibition could be considered in a collective reflection. These are recommendations to the legislature, and the report states that its content does not bind the CAI in its adjudicative and oversight functions.
What the CAI has not published. No CAI decision interpreting section 12.1 is known, and the CAI's list of featured topics has no page on automated decisions. Its May 2026 joint investigation report on OpenAI's ChatGPT, with the federal, British Columbia and Alberta regulators, concerns consent, transparency and accuracy in an AI product, not hiring.
Quebec also has no dedicated AI statute in force. The Conseil de l'innovation du Québec recommended a framework law in its 2024 report, but none has been enacted, so check for developments.
Does the Act apply to employers outside Quebec?
The Act applies to personal information that a person collects, holds, uses or communicates "in the course of carrying on an enterprise" within the meaning of article 1525 of the Civil Code (s. 1). The CAI states that an organization located outside Quebec that collects, holds, uses or communicates personal information in the course of its enterprise's activities in Quebec is subject to the Act. It adds that organizations are assessed case by case.
That is narrower than the common claim that the Act follows the individual wherever the employer is based. The test looks at the enterprise's activities in Quebec, and a Quebec-resident candidate is strong evidence of those activities, but the CAI does not say a single remote applicant always brings an out-of-province employer inside the Act. Employers that actively recruit in Quebec, have Quebec employees or operate there should assume it applies. Federally regulated employers, such as banks, telecoms and airlines, may fall under federal privacy law instead, so ask counsel.
Penalties and enforcement
| Mechanism | What the Act says | Section |
|---|---|---|
| Administrative monetary penalty | Applies to a person who does not inform the person concerned of a decision based exclusively on automated processing, or does not give them the opportunity to submit observations, in contravention of section 12.1. Maximum $50,000 for an individual and, in other cases, $10,000,000 or 2% of worldwide turnover for the preceding fiscal year, whichever is greater | 90.1(5), 90.12 |
| Undertaking | A person may enter into an undertaking with the CAI to fix the failure. If accepted and met, no administrative penalty may be imposed for those facts | 90.1 |
| Penal fine | $5,000 to $100,000 for an individual and, otherwise, $15,000 to $25,000,000 or 4% of worldwide turnover, whichever is greater, for listed offences. Fines double for a repeat offence. Section 12.1 is not named in section 91, although the general offence of using personal information "in contravention of the law" could be argued to reach it | 91, 92.1 |
| Punitive damages | Where an unlawful infringement of a right under the Act or Civil Code articles 35 to 40 causes an injury and is intentional or the result of gross fault, the court "shall award punitive damages of not less than $1,000" | 93.1 |
The section 12.1 administrative penalty covers the failure to inform and the failure to offer a chance to submit observations. It does not list the on-request explanation duties by name. Treat all of the section as a compliance duty anyway, because other penalty grounds, such as using personal information in contravention of the law, are broad. The CAI publishes a general framework for administrative monetary penalties that sets the criteria for deciding when to impose one and how much.
How Quebec compares with other AI employment rules
Quebec's rule comes from a general privacy statute. Other places use dedicated employment or AI laws. The rows below show what each requires and when. Items marked with an asterisk rest on law-firm or news reporting, so check the official text before relying on them.
| Jurisdiction | Instrument | Status | Core requirement for hiring and employment AI |
|---|---|---|---|
| Quebec | Act respecting the protection of personal information in the private sector, s. 12.1 | In force since 22 September 2023 | Notice, explanation on request, chance to submit observations, for decisions based exclusively on automated processing |
| New York City | Local Law 144 | Enforced since 5 July 2023 | Bias audit within one year before using an automated employment decision tool, public audit information, notice to candidates 10 business days before use |
| Illinois | HB 3773 (Public Act 103-0804) amending the Human Rights Act | In force since 1 January 2026 | A civil rights violation to use AI that has the effect of discriminating, to use zip codes as a proxy, or to fail to give an employee notice of AI use in covered decisions. No audit duty. See the Illinois AI law guide |
| Colorado* | SB 26-189, the Automated Decision-Making Technology Act | Signed 14 May 2026; duties phase in from 1 January 2027, with rules pending | Disclosure and transparency framework replacing the 2024 AI Act. See the Colorado ADMT Act guide |
| California | CPPA regulations on automated decisionmaking technology | Regulations effective 1 January 2026; ADMT requirements for significant decisions from 1 January 2027 | See the California ADMT regulations guide |
| Ontario* | Employment Standards Act job posting rules | From 1 January 2026 | Employers with 25 or more employees must say in a public job posting if AI is used to screen, assess or select applicants |
| European Union* | AI Act, high-risk employment systems | Moved to 2 December 2027 by the 2026 Digital Omnibus on AI | Risk management, data governance and human oversight for hiring and employment systems. See the EU AI Act Digital Omnibus guide |
| Canada, federal | Artificial Intelligence and Data Act (Bill C-27) | Not enacted; the bill ended with the parliamentary session in January 2025 | No federal AI statute |
For the European counterpart to section 12.1, see our GDPR Article 22 guide. Quebec's wording differs in two ways. Section 12.1 states no significance threshold like Article 22's "legal effects or similarly significant" wording, although the CAI notes that the Act gives no criteria for what counts as a "decision." And its remedy is notice, explanation and a right to submit observations to a reviewer, with no general ban on fully automated decisions.
Quebec AI hiring compliance checklist
Items marked "recommended" are good practice, not statutory duties.
▢ Confirm the Act applies: identify your enterprise's activities in Quebec, such as Quebec employees, Quebec recruiting or Quebec customers (s. 1)
▢ List every hiring and employment decision where a tool acts with no person weighing the result: score cut-offs, knockout questions, automated rankings (s. 12.1)
▢ For each, decide whether a real review exists, and record who reviews, what they see and how often they override the tool
▢ Add a notice that a decision was based on automated processing, delivered no later than the decision itself (s. 12.1)
▢ Prepare a response template for explanation requests: personal information used, reasons, principal factors and parameters, and the right to correct (s. 12.1)
▢ Name a reviewer who is in a position to review the decision, and give applicants a way to submit observations (s. 12.1)
▢ Get the explanation from the vendor in advance: ask for factors and parameters in writing before you sign
▢ Run a privacy impact assessment before buying or building the tool, and consult your privacy officer from the start (s. 3.3)
▢ Run a separate assessment before any data goes to a vendor or server outside Quebec, and sign a written agreement (s. 17)
▢ Check whether the tool profiles candidates and, if so, tell them and make profiling functions opt-in (s. 8.1)
▢ Collect only the candidate data you need and keep decision records for at least one year (ss. 4, 5 and 11)
▢ For facial, voice or fingerprint analysis, check CAI disclosure and express consent duties (Act respecting the legal framework for information technology, ss. 44 and 45)
▢ Update your published privacy policy to describe the technologies you use (s. 8.2)
▢ Recommended: widen your PIA into an algorithmic impact assessment that covers fundamental rights and bias, and involve employees
▢ Recommended: avoid emotion recognition and biometric categorization in hiring
▢ Recommended: set a date to re-check the Act and CAI publications, since a Quebec AI framework law has been recommended
How Secure Privacy fits
The checklist is mostly documentation, ownership and deadlines. Secure Privacy puts those in one place, and several checklist items map to a module.
- Register the tools. The AI Governance module registers each AI system with its risk level, use case and responsible owner, maps systems to regulations including the EU AI Act, flags high-risk deployments and generates audit-ready documentation. A resume screener or interview scoring tool belongs in that register. Systems Management holds the inventory with evidence and change tracking, and the AI Governance page covers the personal-data side of AI: lawful basis, consent withdrawal and vendor diligence.
- Document the assessments. The DPIA and impact assessment module runs DPIAs, TIAs, PIAs, LIAs, AIAs and FRIAs from pre-built templates, with AI-assisted risk and mitigation suggestions and approval workflows. Use it for the section 3.3 and section 17 assessments and for an algorithmic impact assessment. Check that your template covers the factors named in those sections.
- Track HR tech vendors. Vendor Management keeps a register of vendors and processors, tracks contracts and data processing agreements, and scores vendor risk. Use it for the written agreements and the outside-Quebec questions.
- Handle explanation requests. DSAR forms and request handling track each request from intake to resolution, with deadlines and audit logs. Log section 12.1 requests there. Section 12.1 sets no deadline, so choose an internal one.
- Record the processing. The Process Register records purposes, data categories and retention for each processing activity, which supports the one-year decision record and the necessity analysis.
- Keep owners and due dates. Task Management and the compliance calendar assign an owner and due date to each action and keep a history.
Some limits matter. Secure Privacy's platform materials list PIPEDA among the supported laws but do not describe a section 12.1 workflow, and its Quebec Law 25 page covers cookie banners, privacy notices, data request forms and consent records, not automated decisions. The platform does not decide whether a hiring decision is "exclusively" automated, does not write the explanation of reasons and principal factors for you, and does not replace advice from a Quebec privacy lawyer. The reasons and factors have to come from your vendor and your own review process. For a wider view of AI risk work, see our AI governance guide and our guide to automating privacy impact assessments. For the Quebec basics, see our Quebec Law 25 guide and the PIPEDA overview.
FAQ
Does Quebec Law 25 apply to AI hiring tools?
Yes, when they are used to make a decision about a person based exclusively on automated processing. Section 12.1 does not name AI, but it covers any automated processing of personal information. A tool that only assists a person who really decides is outside section 12.1, although other duties, such as the section 3.3 privacy impact assessment, can still apply.
What does section 12.1 require employers to do?
Tell the person the decision was based exclusively on automated processing, no later than when you tell them the decision. On request, give them the personal information used, the reasons and principal factors and parameters, and tell them about the right to correct the information. Give them the opportunity to submit observations to a member of your personnel who is in a position to review the decision.
What does "exclusively automated" mean?
The Act does not define it, and no CAI guidance or reported court decision does either. The plain reading is that no person weighs the decision. The CAI says section 12.1 does not cover decisions that are not entirely automated, and it warns about reviewers who approve a system's proposal without studying the analysis. Treat a click-through approval as a weak defense.
Does section 12.1 apply to job applicants?
The text protects "the person concerned" and has no applicant exception. The CAI's January 2025 brief treats candidates and employees alike, and law-firm commentary reads section 12.1 the same way. No CAI or court decision on an applicant case is known, so plan on applicants being covered.
Does Quebec Law 25 apply to employers outside Quebec?
It can. The CAI says an organization outside Quebec that collects, holds, uses or communicates personal information in the course of its enterprise's activities in Quebec is subject to the Act, and that this is assessed case by case. Having a Quebec-based candidate or employee is relevant but not the stated test. Federally regulated employers may be under federal law instead.
Did the CAI publish AI hiring guidelines in 2025?
Not as a binding guideline. On 27 January 2025 the CAI filed a brief with the Ministry of Labour, "L'IA au travail : pour un meilleur encadrement." It recommends that the law require algorithmic impact assessments and prohibit emotion recognition, most biometric categorization and fully automated decisions with major effects on employees. These are proposals to lawmakers, plus voluntary good practices. They are not current legal requirements.
Do I need an algorithmic impact assessment under Quebec law?
Not by name. Section 3.3 requires a privacy impact assessment for projects to acquire, develop or overhaul an information system that involves personal information, and the CAI says most AI systems qualify. The CAI recommends that lawmakers add an algorithmic impact assessment requirement for AI that makes automated decisions about people, and suggests employers adopt it voluntarily now.
What are the penalties for breaking section 12.1?
An administrative monetary penalty can be imposed for failing to give notice of an exclusively automated decision or the chance to submit observations (s. 90.1(5)). The maximum is $50,000 for an individual and, in other cases, $10,000,000 or 2% of worldwide turnover, whichever is greater (s. 90.12). Penal fines go up to $25,000,000 or 4% of worldwide turnover for listed offences. Punitive damages of at least $1,000 apply where an infringement causes injury and is intentional or the result of gross fault (s. 93.1).
