A frame that’s too heavy and nobody uses it. Too loose, and you take risks with personal information and trade secrets. Most SMEs we meet are stuck in that split: a few curious people paste almost anything, and everyone else uses nothing.
We write the version your teams can pin next to the screen. Operational guidance — not a legal opinion. For a legal read of your situation, talk to your counsel.
The tool is not the privacy issue. The fog is.
ChatGPT, Copilot, Claude, Gemini: most companies already have something. Law 25 data protection and AI collide in ordinary places. A salesperson pastes a client thread into a personal ChatGPT account to “just summarize.” HR tries Copilot on a complaint letter. Leadership bought licences and hoped a policy would appear later.
Without a simple frame, people take risks or they freeze. Neither is a process.
Who sees the data
When someone pastes text into an AI tool, treat it as a copy that left the building. Who can see it, in practice:
- The person who pasted it, and anyone they share the chat with.
- Admins, if you actually have a company workspace.
- The vendor that runs the model, and the subprocessors in that chain.
- In some consumer plans, the vendor may use content to improve the product. Check the current terms. Don’t assume last year’s setting still holds.
If you cannot name those parties for the tool in use this week, you have a habit, not a frame. A short inventory — tools, teams, files, where the data sits — is usually the first hour of a diagnostic.
Free ChatGPT vs a company workspace
A personal ChatGPT account — free or paid — is a personal account. No company workspace, no admin, no shared retention setting. People mix weekend questions with client files. That is how a confidential sentence leaves without anyone meaning to.
A Team, Business, or Enterprise workspace (ChatGPT, Copilot in Microsoft 365, Claude for work, Gemini for Workspace) is a different object: admin, retention settings, and contractual language about training and data use. That does not make the tool “Law 25 complete.” It makes it governable.
What we tell SMEs, operationally:
- Don’t put other people’s personal information into a consumer account. Ever, as a default rule.
- If the company endorses a tool, put people in a workspace you control, turn off what you don’t need, and write down who can invite whom.
- Match the tool to how sensitive the files actually are. We have no allegiance to a platform.
We help you choose and configure. We don’t resell the licence.
What not to paste
Until you have a written classification, keep this out of a consumer tool — and out of any tool until the workspace is decided:
- Anything that identifies a client, member, employee, patient, student, or supplier in a real file.
- Health, SIN, credit, disciplinary, or family information.
- Unpublished financials, passwords, keys, in-progress deals, or anything your professional order would call a confidential file.
Usually fine: public text, a blank template, your own outline with names removed, a generic example you invented.
The test is simple. If the sentence identifies a person, or would hurt if it left the building, it stays out until the frame says otherwise. Redact first. When in doubt, don’t paste.
We write that into four buckets: public, internal, confidential, forbidden.
When a privacy impact assessment is a practical trigger
A privacy impact assessment (a PIA, or ÉFVP in French) is the written pause before you turn a trial into a company tool. Law 25 expects that pause when you acquire or overhaul a system that handles personal information, and before personal information is communicated outside Quebec. Most US-hosted AI tools sit in that second conversation.
We will not tell you, on a website, that your project “requires” a PIA. That call belongs to your privacy officer and, when the file is sensitive, to your lawyer. Practical triggers we treat as a pause in the mandate:
- You are about to give a whole team access to a cloud AI tool.
- The tool will see customer, employee, or member personal information — and that information may leave Quebec.
- You are replacing a human step with a tool that decides something about a person.
- You are putting a chatbot on a site that collects names, emails, or file numbers.
- The “shadow” use is about to become official.
You don’t need a 50-page report for a small deployment. You need a dated note: what data, who sees it, where it goes, what you turned off, who said yes. If the file is sensitive, we prepare the operational picture; we do not replace counsel.
What article 12.1 changes for the team
Article 12.1 of Quebec’s private-sector privacy act covers decisions based exclusively on automated processing of personal information. In plain English for the people who do the work:
- If a human still reads the file and makes the call, you are usually not in that bucket.
- If the tool rejects a candidate, sets a limit, approves a claim, or closes a file with no one able to change it, you have a transparency and review problem. Tell the person the decision was automated, be able to explain the personal information used and the main factors, let them correct that information, and give them a staff member who can actually review the decision.
- “The AI did it” is not a process.
What changes on Monday: name which steps are draft, recommend, or decide. Keep decide with a person unless you have built the notices and the review path. We write that into the playbook. We do not issue a legal opinion on whether your stack is “exclusively automated.”
The frame we actually write
Responsible use and Law 25, on our services page, is a working frame — not a compliance product:
- A usage policy in plain language. English for mixed teams, Quebec French when the room is French.
- Classification: public, internal, confidential, forbidden.
- Alignment with Law 25 and sound retention practice.
- Roles: who decides, who reviews, who trains newcomers.
- Tool settings that match the classification, not a stack of extra subscriptions.
That frame travels with the rest of the mandate: diagnostic and roadmap, training by role, playbooks, adoption coaching. An AI consultant in Quebec who ignores the frame gives you a workshop legal will shut down. One who only writes policy gives you a PDF nobody opens. The approach is both: understand the real work, then write the process.
Formats
30-day sprint. Diagnostic, one workshop, one written process — including the usage frame for that process.
90-day program. Roadmap, cohort training, playbooks on two or three key processes, coaching the leads. The format we get asked for most.
Year-round support. Governance, a training calendar, a quarterly review.
Workshops happen in person in Montreal and in the regions when the trip is worth it, or remotely. We give you a range on the first call, before any written proposal.