The Quebec generative AI directive:where do you stand?
On December 5, 2025, Quebec’s chief information officer issued a binding administrative instruction (IA-RI-2025-003-OP), complementing ministerial order 2025-02 of December 3, 2025, imposing a framework on generative AI use across the public bodies subject to the LGGRI: ministries and agencies, the health and social services network, school service centres, cégeps and universities. The instruction allowed a maximum six-month implementation period: June 5, 2026. It has passed.
Three questions your organization must answer, with documents to show
- 01
Is your AI governance structure in place and documented, with named approvers (article 3)?
- 02
Was a documented training and awareness program delivered to staff before any generative AI system was made available to them (article 11)?
- 03
Does a privacy impact assessment exist for every generative AI system, from the design stage, including systems that seem to involve no personal information (article 4)?
What the directive requires
- A formalized governance structure: committees, roles, authorized approvers (art. 3)
- A privacy impact assessment for every generative AI project from design, even without apparent personal information (art. 4)
- A training program delivered before any system is made available to staff (art. 11)
- No confidential data in public AI tools (art. 19)
- A documented six-step risk management cycle
The Quebec module of AI Governance & Compliance Readiness establishes your position article by article: a severity-rated gap register, a realistic remediation plan, and an executive briefing in French. Fixed scope, fixed price, signable by mutual agreement in most organizations.