Quebec's Automated-Decision Disclosure Rule Has Been Law Since 2023. Most Businesses Still Can't Comply With It.

A candidate gets auto-rejected by an applicant-tracking system before a recruiter opens the file. A buy-now-pay-later provider auto-declines a financing request in under a second. A fraud-scoring tool freezes a payout with no person involved in the call. In Quebec, each of those moments can trigger a specific legal obligation that has already been in force for three years, and that most businesses running these workflows have never checked their tools against. Section 12.1 of Quebec's private-sector privacy act, added by Law 25, took effect September 22, 2023. It arrived with far less attention than the law's consent and breach-notification rules, and it is quietly becoming one of the more consequential ones.

What the provision says is narrower and more specific than most summaries suggest. It applies to a decision based exclusively on an automated process of personal information — not to any decision a business happens to make with AI assistance, and not to every outcome a model merely influences. Where that condition is met, the person affected has the right to be told the decision was automated, to learn the main factors and parameters behind it, and to request review by a person. It is a disclosure and explanation right, not a right to a different outcome. The business doesn't have to reverse the decision — only be able to say, in plain terms, what drove it, and give the person a real path to a human.

The word doing the most work here is "exclusively." A process with even a light human sign-off — someone glancing at the output before it's final — sits outside the provision's reach. That used to describe most business decisions by default, because a person was somewhere in the loop even if their review was thin. It describes fewer of them with each automation project a business ships, since removing that last human step is usually the point of the project. A resume-screening tool that auto-rejects below a score threshold, a financing engine that auto-declines, a claims system that auto-denies a warranty request, a pricing engine that auto-blocks a discount — these are exactly the workflows businesses have spent the last two years trying to run end-to-end, and each one that fully succeeds at removing the human step walks, unintentionally, into section 12.1's scope.

The gap this creates isn't a failure to read the statute. It's that the systems making these decisions are frequently not built to answer the question the statute requires a business to answer. A resume-ranking feature bundled into an applicant-tracking platform, a fraud-scoring model licensed from a vendor, a pricing engine built on a third-party machine learning service — these are usually opaque to the business running them, in exactly the way the vendor's marketing never mentions. The business can see that a candidate scored low or a transaction got flagged. It often cannot produce, in a form it could hand to the person affected, what the main factors actually were, because the vendor never exposed that layer and nobody asked for it before signing.

This isn't a provision sitting quietly on the books waiting to matter. Quebec's privacy regulator, the Commission d'accès à l'information, has real enforcement tools under Law 25 — audits, binding orders, administrative monetary penalties — and the statute reaches any business processing the personal information of people in Quebec, not only businesses headquartered there. An Ontario company selling into Quebec, running a national hiring process, or operating a financing or claims workflow that touches Quebec residents is inside scope regardless of where its head office sits — the same extraterritorial logic GDPR already runs on, applied to a Canadian statute most businesses outside Quebec haven't checked their automation against.

The practical audit is narrower than it sounds, because the statute's own trigger does most of the sorting. List the decisions your business makes about an individual using their personal information, and ask plainly whether a person reviews each one before it's final, or whether the system's output is the end of it. Where the answer is the latter, two things need to be true before that workflow touches a Quebec resident: someone can actually produce the main factors behind a given decision in plain language, and there's a real path for the person affected to reach a human who will look at it again — not a contact form that dead-ends into the same system. Where a vendor's tool can't surface that explanation today, that's a contract term to negotiate at the next renewal, not an exception to quietly accept.

None of this argues against automating decisions that genuinely benefit from speed and consistency, including ones that affect people directly. It argues for knowing, before a decision ships without a human in the loop, whether your business can say why it came out the way it did. The businesses that get caught out here won't be the ones that automated a decision. They'll be the ones that automated it all the way through, never checked whether the tool could explain itself, and found out only when someone in Quebec asked.