The opening
Cybersecurity is not a topic most leaders enjoy discussing, unless they do it for a living. It is a bit like insurance: you want to be protected, you want it to work, but you would rather not talk about it every day.
Quebec’s Law 25 works the same way. We all want our personal data to stay where it belongs. But as SMB and organization leaders, we do not always do the work in our own house. When we put ourselves in our clients’ shoes, the motivation comes a little easier.
On May 1, 2026, La Presse Affaires ran an article with a blunt headline: “Votre recours à l’IA au boulot pourrait être illégal” (Your use of AI at work could be illegal). What the article brought back into focus was not on most SMB and organization leaders’ radar. Everyday use of artificial intelligence tools, with no framework, already exposes the business to Law 25 breaches.
This post offers a practical way in. And to help you act on it, I have prepared two free resources you can download at the bottom of this article: a one-page Starter Pack (seven questions to settle in one hour with your team) and an 18-page Practical Guide (fourteen detailed sections with a PIA template, a 4-level classification grid, a use case registry, 9 questions to ask AI vendors, precise legal references and a 3-level Pack).
Two ways in. One to start right away. The other to go deep, now or on the day your organization requires it. No outside law firm to retain, no forty-page binder to digest. An accessible starting point your cybersecurity or privacy specialists can then enrich, wherever your organization’s complexity calls for it.
The signal that changes everything
The La Presse article is not a one-off. It lands after two years of heavy ChatGPT, Copilot and Gemini use in Quebec organizations, and it signals that the window of tolerance is closing.
Three areas are hit at the same time. Personal data passing through third-party tools. AI-assisted decisions that should be governed. Parallel use across teams with no clear policy, what specialists call “shadow AI.”
For its part, the Commission d’accès à l’information du Québec reminds businesses that personal information governance must cover the use of artificial intelligence tools. The monetary administrative penalties it can impose reach 2% of worldwide revenue or $10 million, whichever is higher. And if the case goes to penal proceedings before the courts, the fine for a business can climb from $15,000 to $25 million, or 4% of worldwide revenue.
What was tolerated as a grey area since ChatGPT arrived in 2023 has become a quantifiable risk in 2026 for Quebec SMBs and organizations.
Why the one-page Starter Pack is enough to get started
When we talk about governance, many leaders picture a thick binder, a lawyer at $400 an hour, and three months of meetings to produce a PDF nobody will read.
To get started, you need none of that.
Seven operational questions
The one-page Starter Pack (yes, one page) answers seven questions:
- Which AI tools are approved in the organization?
- For which use cases?
- Which data must never go in?
- When must a human always validate?
- Who consents to what, and how is it documented?
- What is our guiding principle?
- Who is responsible for approving, reviewing and updating the guide?
Seven questions. One page. A leader sitting down for an hour with their IT person or operations lead.
Why this format works
A one-pager gets read right away. A forty-page legal manual sleeps in a shared drive.
Your employees are not asking the law for permission. They want to know what they can and cannot do. One page answers them.
And AI shifts every three months. The one-page Starter Pack gets revised in thirty minutes. An outside legal manual never gets revised.
What this Starter Pack gives you is an accessible starting point. Your cybersecurity or privacy specialists can then enrich it, working from something that already exists in your organization instead of from a blank page.
And for those who want to go further today, I have also prepared an 18-page Practical Guide that details each of the seven questions, with a simplified PIA template for SMBs, a 4-level classification grid, a ready-to-fill use case registry, nine specific questions to ask your AI vendors and a three-level structural Pack. The short version gets you started this week. The long version is there when you want the depth.
The hidden cost of free
Here is a pattern I have watched play out in several SMBs and organizations I have worked with recently.
The situation before
A team starts using the free version of an AI tool. Nobody bans it, nobody frames it. Rewriting an email, summarizing a client file, prepping a financial analysis. It is useful, it saves time.
What changes
Somewhere else, someone finds a fragment of that information in an answer generated for another person. Not the raw data, but enough to make out a context, a pricing logic, an internal way of phrasing things.
The result
Here is the simple mechanic, and it is the line worth keeping: free versions are not free. The price is your data. What your employees type in can be used to train the model. It is written in the terms of use, and most leaders do not know it.
The Plus vs. Business nuance that changes everything
Paying $20 a month for ChatGPT Plus is not enough. Plus stays on the “training by default” setting and requires a manual opt-out for each user. Training is contractually excluded only on the Business, Enterprise and Edu plans, or through OpenAI’s official APIs. Same logic with Microsoft 365 Copilot, Google Workspace with Gemini, and the official APIs of other vendors.
Here is the truth table for ChatGPT in 2026:
| ChatGPT plan | Training by default | Action required |
|---|---|---|
| Free, Go, Plus, Pro | On | Manual opt-out per user, forward-looking only |
| Business (formerly Team) | Off | None, contractual commitment |
| Enterprise | Off | None, contractual commitment |
| Edu | Off | None, contractual commitment |
| API (after March 1, 2023) | Off | None, contractual commitment |
The first move is mechanical. List the AI tools your team uses. Identify the ones on a free version or a paid personal plan. Switch them to a Business plan or take them out of work use.
It is the first brick in the framework you are building.
Three places your current AI use already touches Law 25
Beyond free versions, your current AI use probably touches three areas that Law 25 governs directly. Few SMB and organization leaders have mapped them.
Area 1: personal data moving outside your control
When your team pastes a client file, a resume or an HR file into an AI tool hosted in the United States, you are communicating personal information to a third party outside Quebec.
The Act respecting the protection of personal information in the private sector (CQLR, chapter P-39.1), as amended by Law 25, requires under section 17 that a privacy impact assessment (PIA) be conducted before any personal information is communicated outside Quebec, including to another Canadian province. The PIA must look at the protections in place (including contractual ones) and the legal framework that applies in the destination jurisdiction.
This obligation has applied since September 22, 2023.
Area 2: automated decisions without transparency
If AI makes a decision based exclusively on automated processing (for example: automatically screening job applications with no human involvement, automatically refusing a credit application, scoring and sorting files without anyone on staff reviewing them), you are in section 12.1 territory under the same Act.
Section 12.1 sets out three obligations:
- Inform the person concerned no later than the time they are informed of the decision.
- On request, tell them the personal information used, the reasons and the principal factors and parameters that led to the decision, and their right to have the information used corrected.
- Give them the opportunity to submit observations to a member of your staff who is in a position to review the decision.
Note: if a human genuinely takes part in the final decision, section 12.1 does not apply. The key word is exclusively. The nuance matters, and many leaders miss it.
Area 3: parallel use, with no policy
This is shadow AI. Nobody banned it, nobody framed it, so everyone uses whatever they like. No policy means no explicit employee consent on the use of their data (including the content they produce), no clear framework for the clients whose files are being processed, and no trace if something goes wrong.
It is the widest blind spot, and the least visible. It is also the one the one-page Starter Pack fixes fastest.
Three moves to get started fast
These three areas are not fixed by calling a lawyer first. They are fixed with three practical moves you can make quickly, and those moves lay the foundation your specialists can then build on.
Move 1 · Choose your tools, close the door on the rest. Pick one or two official AI tools for the organization, on a Business or Enterprise plan. Explicitly ban free versions and paid personal versions for work use. It is not authoritarianism, it is a smaller surface to protect.
Move 2 · Document a minimal privacy grid. Under the Private Sector Act, a PIA is mandatory in two specific cases: for any project to acquire, develop or overhaul an information system involving personal information (section 3.3), and before any communication of personal information outside Quebec (section 17). For an SMB or organization, a grid of 10 to 15 documented questions is enough in most cases: which data is processed, by whom, for what use, where it travels, who has access, how long it is kept, how it is deleted.
Move 3 · Adopt the one-page Starter Pack. The seven-section skeleton is right below. You can also download it pre-filled at the bottom of this article, along with the 18-page Practical Guide.
Three moves. A workload spread over two or three sessions. And a framework a specialist can then validate or strengthen, instead of one you wait for them to build from zero.
The Starter Pack skeleton, in seven sections
Here are the seven sections to fill in, with their intent and format.
1. Approved tools
Name the two or three official tools explicitly, with the exact version. Not “ChatGPT” on its own, but “ChatGPT Business.” Not “Copilot” on its own, but “Microsoft 365 Copilot integrated into your tenant.” That precision changes everything: it clears up the confusion between plans that train by default and plans that do not.
Then add: any other AI tool is prohibited for work use without prior approval from the designated person.
2. Permitted use cases
Three to five concrete cases you encourage. Rewriting an outgoing email, summarizing a non-confidential internal document, drafting a presentation, structuring an analysis, generating a project plan.
The goal is not to be exhaustive. It is to give your team clear permission to use AI for those tasks, without hesitating and without asking management every time.
3. Forbidden data
The most important section for an SMB or organization. A four- or five-level grid is enough.
| Category | Examples | Public AI allowed? |
|---|---|---|
| Public | Website, brochure, published article | Yes, no restrictions |
| Internal | Procedures, document templates, general strategic ideas | With caution |
| Confidential | Financial statements, contracts, client lists, negotiated prices | No, except in an approved tool on a Business/Enterprise plan |
| Personal | Name, email, employee file, identifying client data | No, except under a formal framework with a PIA |
| Sensitive | Health, personal finances, delicate HR data | Highly restricted, formal framework required |
The key work: adapt these categories to your organization’s vocabulary and realities. A foundation does not hold the same data as a professional firm or a manufacturer.
4. Mandatory human validation
List explicitly the decisions where a human must always validate, no matter how well the AI performs. Six typical categories for an SMB or organization:
- Decisions affecting a client (acceptance, refusal, special terms)
- HR decisions (candidate selection, evaluations, disciplinary measures)
- Public communications (official notices, press releases, public positions)
- Contracts, offers and quotes sent outside the organization
- Financial data (results, forecasts, filings)
- Strategic recommendations to decision-making bodies
The useful wording for the guide: “AI can recommend, structure, summarize or automate part of the work. But in these areas, final responsibility belongs to the designated human.”
It is also the key to staying out of the strict territory of section 12.1 of the Private Sector Act. As soon as a human genuinely takes part in the final decision, the regime for decisions based exclusively on automated processing does not apply.
5. The consent and transparency mechanism
For any use case that involves personal data (client, employee, supplier), restate the obligation: inform the person concerned, obtain informed consent, document it.
Three sample wordings to adapt to your context:
- “Some responses may be assisted by an artificial intelligence tool.”
- “Your data may be processed using digital tools to improve our service.”
- “Any significant decision is always reviewed by an authorized person.”
The more AI influences a significant decision, the stronger the transparency must be.
6. The guiding principle
One short sentence that serves as an anchor when a new case comes up and no rule covers it directly. It is the guide’s editorial compass.
By default, I recommend this wording, to be adapted to your organizational culture:
““AI can recommend, structure, summarize or automate part of the work. But final responsibility always belongs to the designated human.” – Steve Johnston
Other organizations prefer a clear red line: “No final decision about an employee, a client or a supplier is made by AI alone.” Or a usefulness principle: “Every use of AI must solve a concrete business problem.”
Pick the one that fits your organization’s voice. That principle is what will guide your employees when a new case shows up between two reviews of the guide.
7. The people responsible
Three names are enough: who approves a new tool, who keeps the use case registry up to date, who reviews the guide every six months. In an SMB or organization, these three roles are often held by two people, sometimes one. That is not a problem, as long as the responsibilities are named and leadership is in the loop.
Beyond the Starter Pack: the 18-page Practical Guide
For more complex organizations, or for those that want to go further from the very first exercise, three complementary tools are worth building alongside the Starter Pack. They do not fit on the same page, but they tie directly into it. I have gathered these three tools in the 18-page Practical Guide you can download at the bottom of this article, along with a simplified PIA template for SMBs, precise legal references (sections 12.1, 17 and 3.3 of the Private Sector Act), a four-level data classification grid and a three-level Starter / Secured / Audit-ready Pack. The rest of this section gives you a preview, and the full version is waiting for you to download.
The AI use case registry
A living table, not a frozen document. One row per significant use case in the organization, with these columns: case name, department, owner, tool used, data used, personal data yes or no, risk level (low, medium, high), human validation in place, expected benefit, status (test, approved, retired).
This registry becomes the operational inventory of AI in your organization. It also quickly reveals the cases that should have gone through the approval process and did not.
The risk assessment grid
Seven or eight rows, not thirty. A table that matches typical risks with their control measure.
| Risk | Example | Control measure |
|---|---|---|
| Confidentiality | Client data in the free version of an AI tool | Approved tools only, Business plan |
| Hallucination | False content in a proposal sent to a client | Mandatory human validation before sending |
| Bias | Automated candidate sorting with no review | Mandatory HR review before any decision |
| Security | AI connected to the CRM or ERP | Access control, activity logs |
| Vendor dependency | An entire process depends on a single external tool | Documented backup plan |
| Reputation | Incorrect automated response to a client | Prior testing, supervised pilot |
| Legal | Bad contractual advice generated by AI | Validation by a qualified professional |
Questions to ask your AI vendors
Before adopting a new tool, nine questions are worth putting to the vendor in writing:
- Do you use our data to train your models?
- Where is the data stored geographically?
- Who on your side can access the data?
- Do you have an activity log we can access?
- Can our data be deleted on request?
- Do you have subcontractors that process our data?
- Does the data leave Canada?
- What security measures are in place?
- What happens if there is an incident, and how are you required to notify us?
Keep the written answers. They are part of your compliance file.
A three-level AI governance pack
For organizations that want to structure their approach over time rather than do everything at once, a three-level pack works well.
Level 1 · One-page Starter Pack. The short AI charter described in this article. Adopted quickly by leadership. Presented to the whole team in fifteen minutes.
Level 2 · Use case registry. The living table described above. Reviewed quarterly. Kept by a person named in the charter.
Level 3 · Control sheets for each significant use case. One sheet per significant case: CRM, HR, marketing, customer service, finance, operations. Each sheet details the data involved, the human control, how the gain is measured, and the review procedure.
Most SMBs and organizations can live solidly with levels 1 and 2. Level 3 becomes useful when AI touches dozens of different processes and the complexity goes beyond what one person can keep in their head.
The big-picture validation
Beyond the case observed in the field, the authorities are converging. The article La Presse Affaires published on May 1, 2026 put the topic on Quebec leaders’ radar. The Commission d’accès à l’information du Québec regularly reminds businesses that personal information governance must cover the use of artificial intelligence tools. And people working in cybersecurity are seeing incidents tied to ungoverned use of generative AI in organizations pick up speed.
The finding is shared. And it is shared without alarmism: the one-page Starter Pack is enough to get started and bring most situations into line this week. The 18-page Practical Guide takes over for those who want the depth right away, until you go further with specialists wherever the context calls for it.
Signal source: La Presse, Affaires, “Votre recours à l’IA au boulot pourrait être illégal,” May 1, 2026 (in French).
Official text of the Act: LégisQuébec, Act respecting the protection of personal information in the private sector, chapter P-39.1.
Official reference on penalties: Commission d’accès à l’information du Québec, Sanctions.
Where I stand
I work in digital execution architecture and operational transformation. In this practice, cybersecurity, data protection and compliance cut across everything: they are built into every architecture I design. It is not a field outside my work. It is an inclusive, necessary and protective reflex, anchored in the very design of my solutions.
I work with sharp specialists in cybersecurity, privacy and law for final compliance, because those fields demand specific expertise they master better than I do. My role upstream: set a solid architectural framework that makes their work faster, more precise and better anchored in your reality.
What I see most with my clients is the gap between wanting to do the right thing and having no accessible place to start. Many SMB and organization leaders tell me: “I know we should put a framework in place, but where do I start?” The one-page Starter Pack is my first answer, to get started quickly. The 18-page Practical Guide is the second, for those who want the depth right away or who see an audit coming. Not to replace the specialists’ work, but to give leaders concrete things to produce, which then get stronger with the experts.
If you want to talk it over, I would be very happy to do that with you: stevejohnston.co/en/contact-us/.
May 28, 2026 edition of L’Architecte, Steve Johnston’s newsletter (in French) for SMBs and organizations that want to get serious about AI.
Editorial follow-up to the May 21, 2026 post, Before You Shop for AI, Formulate Your Demand.
