# What is an "automated decision" under Quebec's Law 25?

Date: 2026-10-28 · Author: Robert Scales · https://guidetoartificialintelligence.com/en/learn/automated-decision-law-25-explained/

**Answer:** Under section 12.1 of Québec's private-sector privacy act, an automated decision is one a business makes about a person using their personal information with no human involved, such as software that automatically rejects a job application or a credit request. The business must tell the person, explain on request what information and main factors led to the decision, and let them present their point of view to a staff member who can review it.

Section 12.1 of Québec's private-sector privacy act (CQLR, chapter P-39.1), added by **Law 25** and in force since September 22, 2023, covers a situation that AI makes more common every month: a computer decides something about a person on its own. The section applies when a business uses personal information to make a decision **based exclusively on automated processing**, meaning no human takes part in the decision itself.

The Commission d'accès à l'information (CAI), Québec's privacy regulator, gives everyday examples: granting credit, assessing a request for financial support, deciding which request gets priority. In its guidance on hiring, it adds a very concrete one: sorting software that automatically rejects some job applications. Any of these can be done by a classic rules engine or by a modern AI model; the law looks at whether a person was involved, not at the technology.

## Inside or outside section 12.1?

The word "exclusively" does most of the work. A tool that recommends while a person decides is generally outside the section; a tool that decides and sends the result is inside it. The table below shows how that plays out in typical small-business situations. It is a learning aid, not a legal ruling on your system.

| Situation | Decision made exclusively by automation? | Why |
|---|---|---|
| Hiring software rejects every CV scoring below 60, and candidates get an automatic email | Yes | No person looks at the rejected files |
| An AI ranks CVs, and a recruiter reads all of them before choosing whom to call | No | A person makes the decision |
| A website chatbot refuses refunds over $100 without escalating | Yes | The refusal goes straight to the customer |
| A lender's model suggests "decline," and an analyst reviews the file and decides | No, if the review is real | The analyst can and does change outcomes |
| A manager approves every AI recommendation in bulk without opening files | Risky | A rubber stamp may not count as genuine human involvement |

The last row is a judgment call. If you rely on human review to stay outside section 12.1, make sure the reviewer has the information, the time and the authority to decide differently, and that it sometimes happens.

Even when a decision falls outside 12.1, the CAI expects transparency. For hiring, it says candidates should be told from the start of the process when AI is used to sort or assess applications, and that an employer must carry out a privacy impact assessment before using an AI system for hiring.

## What the law requires when it applies

If a decision is fully automated, the business has three duties:

1. **Tell the person** that the decision was made by automated processing, no later than when it informs them of the decision itself.
2. **Explain on request.** If the person asks, tell them which personal information was used, the reasons and main factors and parameters behind the outcome, and that they have the right to have that information corrected.
3. **Offer a human review.** Give the person a chance to submit observations to a staff member with the authority to look at the decision again.

Separately, section 11 requires that information used to make a decision about someone be up to date and accurate, which is a good reason to check what your system is actually reading.

## A worked example: a rental application

A property management company in Sherbrooke uses screening software for apartment applications. It checks income against rent, verifies references and returns "approve" or "decline." Declines go out by email without anyone looking. That is a decision based exclusively on automated processing, so the company:

- adds one sentence to every decline email saying that the decision was made automatically and how to request an explanation and a review;
- keeps, for each application, a short log of the inputs used and the rule or score that produced the result;
- names a property manager who handles review requests and can overturn a decline.

> **Try it:** List every decision your business makes about customers, applicants or employees. Mark each one "person decides," "software recommends, person decides," or "software decides." Every item in the third group needs the notice, the explanation and the review described above.

## How do you explain an AI-assisted decision to a customer who asks?

Start from the log, not from the model. The person is entitled to know which of their information was used and the main reasons, not to receive the source code. A good explanation is specific to them, uses plain words and ends with a way to respond. For the rental example, it might read:

"Your application for unit 4 was declined automatically by our screening system. It used the information you provided: your declared monthly income, the monthly rent, and the replies from your two references. The main factor was the income-to-rent ratio: our rule requires income of at least three times the rent, and your declared income was 2.4 times the rent. Your references were not a factor. If any of this information is wrong, you can ask us to correct it. You can also send your comments to Julie Gagnon, property manager, who can review the decision."

An AI assistant can help you draft these letters quickly, as long as you give it the log with identifying details removed and check every fact before sending:

```prompt
Write a short, polite explanation letter in plain language for an applicant whose rental application was declined by an automated screening system. Use only the facts below. Say that the decision was automated, list the information used, explain the main factor with the actual numbers, mention the right to have information corrected, and give the name of the staff member who can review the decision. Do not add reasons that are not listed.
Facts: unit [UNIT]; information used: declared monthly income, monthly rent, two reference replies; rule: income must be at least 3 times rent; applicant's ratio: 2.4; references: not a factor; reviewer: [NAME], property manager.
```

If you cannot write that explanation because nobody knows why the system said no, that is a sign the tool should not be making the decision on its own. This article is a general explanation, not legal advice; for a system that decides about many people, have the setup reviewed by a privacy professional.

## Sources

- Act respecting the protection of personal information in the private sector (CQLR c P-39.1): https://www.legisquebec.gouv.qc.ca/en/document/cs/P-39.1
- Utilisation et communication de renseignements personnels (entreprises privées): https://www.cai.gouv.qc.ca/protection-renseignements-personnels/information-entreprises-privees/utilisation-communication-renseignements-personnels
- Recrutement de personnel : les renseignements personnels des candidats: https://www.cai.gouv.qc.ca/protection-renseignements-personnels/sujets-et-domaines-dinteret/operation-recrutemement-emploi