Skip to content
Cogio

Law 25 compliance

An AI project that complies with Law 25, documented from day one

Law 25 applies to every business that holds personal information in Québec, regardless of size. Any AI project that processes such information requires a privacy impact assessment (s. 3.3) and, if data leaves Québec, a transfer assessment (s. 17). Cogio prepares these documents with you and designs the AI so your data stays with you.

Let’s talk about your project

What Cogio actually does

Four deliverables designed for an AI project. They are built on your real processes and remain yours. We do not give legal advice: on interpreting the law, your legal counsel and your person in charge of the protection of personal information have the final word.

  • Privacy impact assessment (PIA)

    Data flow mapping, risk assessment, mitigation measures and a dated report you can reuse whenever the system changes. Required before any project that processes personal information (s. 3.3).

  • Records and traceability

    An inventory of the personal information the AI reads, a log of what each agent does and an up-to-date incident register, so you can answer the CAI or a person concerned.

  • AI use policy

    What employees may or may not give an AI tool, which tools are approved, who approves what. A policy that reflects reality, not a generic template.

  • Sovereign hosting

    The AI runs on a server at your site or with a host in your region. No data leaves Québec: there is no transfer to assess under section 17, and the scope of the PIA narrows.

Our Law 25 guides

How we work

  1. First step

    Discovery call

    Confirm that your need lends itself to a sovereign solution, and set the boundaries of what comes next.

    Deliverable: An expert opinion on whether it is worth going further, plus a few recommendations on which implementations to tackle first.

    FreeLet’s talk about your project

  2. Step 1

    Digital diagnostic and plan

    Confirm that the project is both buildable and profitable: a map of your processes, your data and your systems, then a dollar value for each use case.

    Deliverable: A costed digital plan and a requirements document, often eligible under stream 1B of the ESSOR program.

    ESSOR 1B (50%)

  3. Step 2

    Build and rollout

    Implement the selected solutions on your infrastructure: install the server on your premises or with a Canadian-owned host in Quebec, configure your AI, and connect it to your environment and everyday tools.

    Deliverable: A working solution in a controlled environment, technical documentation and test suites.

    ESSOR 1C (50%) MFOR (75%) C3I (15% to 25%)

  4. Step 3

    Maintenance and support

    Keep the solution fast and compliant: monitoring, model updates and a monthly report.

    Deliverable: Uptime maintained, a bank of hours for enhancements, and documented governance.

Funding

When compliance is part of an AI project, some public programs may fund a share of it. We check your eligibility on the first call. No grant is guaranteed.

Investissement Québec

ESSOR 1A · Feasibility study

50% · max. $50,000

For-profit companies registered in Quebec, with no employee or revenue threshold. Covers consulting fees, analyses and travel (market, technology, site visits). Excludes real estate, finance, health care and construction other than productivity projects, among others. Since March 13, 2026, professional services (legal included) and administrative services are no longer prioritized.

Investissement Québec

ESSOR 1B · Digital diagnostic and plan

50% · max. $20,000

SMEs with 250 employees or fewer AND revenue of at least $2.5M. Required deliverables: a maturity index, at least 9 documented processes, a costed digital plan, a requirements document and a change management plan. Since March 13, 2026, several industries are no longer prioritized, including professional services (legal included), health care, real estate, finance and construction other than productivity projects.

Investissement Québec

ESSOR 1C · Implementation

50% · max. $50,000

SMEs with 250 employees or fewer AND revenue of at least $2.5M. Prerequisite: the 1B plan must already be done, with the application filed within 24 months. Minimum private contribution of 20%. Since March 13, 2026, several industries are no longer prioritized, including professional services (legal included), health care, real estate, finance and construction other than productivity projects.

Services Québec

MFOR · Workforce training

Up to 75% · max. $100,000

All employers except the public sector. Covers trainer fees, course material and wages paid during training. The application must be filed before training begins.

Every program in detail

Frequently asked questions on Law 25 and AI

Another question? Write to us at support@cogio.ai.

Does Law 25 apply to my SME?

Yes, if it holds personal information in Québec: the law sets no threshold for size or revenue. All of its obligations have been in force since September 22, 2024.

Does an AI project need a privacy impact assessment?

In almost every case. Section 3.3 requires a privacy impact assessment before any project to acquire, develop or overhaul an information system that processes personal information.

Is using ChatGPT or Copilot a transfer outside Québec?

When personal information is processed outside Québec, section 17 requires a prior assessment showing adequate protection. Sovereign AI, hosted at your site or in your region, avoids that transfer.

Does Cogio replace our legal counsel?

No. We prepare the technical and operational documents (PIA, records, policy, architecture) and design the AI accordingly. Interpreting the law remains the job of your legal counsel and your person in charge of the protection of personal information.

What does a non-compliant business risk?

Three regimes can apply together: administrative penalties up to $10M or 2% of worldwide turnover, penal fines up to $25M or 4%, and a private right of action. The CAI published its first monetary penalties in 2026.

Your AI project, compliant from the start

A free call with an expert: we look at your processes, tell you where to start and check your eligibility for grants.

Let’s talk about your project

or write to support@cogio.ai