On December 5, 2025, Quebec's chief information officer issued a binding administrative instruction (IA-RI-2025-003-OP), complementing ministerial order 2025-02 of December 3, 2025, imposing a framework on generative AI use across the public bodies subject to the LGGRI: ministries and agencies, the health and social services network, school service centres, cégeps and universities. The instruction allowed a maximum six-month implementation period: June 5, 2026. It has passed.

Three questions your organization must answer, with documents to show

1. Is your AI governance structure in place and documented, with named approvers (article 3)?
2. Was a documented training and awareness program delivered to staff before any generative AI system was made available to them (article 11)?
3. Does a privacy impact assessment exist for every generative AI system, from the design stage, including systems that seem to involve no personal information (article 4)?

What the directive requires

• A formalized governance structure: committees, roles, authorized approvers (art. 3)
• A privacy impact assessment for every generative AI project from design, even without apparent personal information (art. 4)
• A training program delivered before any system is made available to staff (art. 11)
• No confidential data in public AI tools (art. 19)
• A documented six-step risk management cycle

Municipalities, MRCs and transit authorities are not subject to the LGGRI instruction. They remain bound by Law 25's privacy impact assessment obligations for any AI project involving personal information, and the provincial framework is rapidly becoming the standard of practice they will be measured against by auditors, insurers and citizens.

Establish your position in two weeks

The Compliance Diagnostic establishes your position article by article: a severity-rated gap register, a realistic remediation plan, and an executive briefing in French. Fixed scope, fixed price, signable by mutual agreement in most organizations.