How Loi 25 Affects Your AI Receptionist — What Quebec Businesses Need to Know

If your Quebec business uses any software that touches personal information — including an AI receptionist that answers calls — you are subject to Loi 25, formally known as Act 25 (An Act to modernize legislative provisions as regards the protection of personal information). And the obligations it creates are meaningfully stricter than what most Canadian business owners expect.

What Loi 25 Actually Requires

Loi 25 came into full force in September 2023. It imposes four categories of obligation on any organization that collects, uses, or communicates personal information about Quebec residents.

Consent must be explicit and purposeful. You cannot bury data collection in fine print. When a caller shares their name, phone number, or health information with your AI receptionist, that person must understand what is being collected and why. Implied consent is not enough under Loi 25 for sensitive data categories.

Data must stay in Canada — or you must disclose cross-border transfers. If your AI receptionist uses servers outside Canada, you are required to conduct a privacy impact assessment and inform customers. This is not optional. Tools built for the US market almost never address this, because PIPEDA and CCPA do not have the same requirement.

Data subjects have the right to access, correct, and delete their information. This means your AI tool must have a mechanism — a real one, not just a privacy email address — to fulfill these requests in a timely manner. Under Loi 25, the timeline is 30 days.

Privacy incidents must be reported. If there is a breach involving personal information collected by your AI receptionist, you must report it to the Commission d'accès à l'information (CAI) and notify affected individuals. The fines for non-compliance are up to 4% of worldwide revenue or $25 million CAD, whichever is greater.

Why Generic AI Tools Fall Short

Most AI receptionist platforms are built for the US market and bolt on Canadian compliance as an afterthought. They reference PIPEDA — Canada's federal privacy law — but PIPEDA is a floor, not a ceiling. Quebec's Loi 25 sits above it and has requirements that PIPEDA does not.

The most common gaps we see in generic tools are: data stored on US servers with no privacy impact assessment, consent language that does not meet Quebec's explicit-consent standard, no mechanism for data deletion requests, and no French-language notice that meets Loi 25's language requirements.

What a Loi 25-Compliant AI Receptionist Looks Like

At Callara, we built Loi 25 compliance in from the start rather than adding it later. That means all customer data is stored in Supabase's Canadian region (ca-central-1), so your callers' information never leaves Canada. Our consent language is reviewed for Loi 25 alignment. We maintain a sub-processor list so you can always see exactly which third parties touch your data. And we have a structured process for handling data access and deletion requests.

We also provide audit logs for every call — timestamp, caller ID (where available), what information was collected, and what actions were taken. If the CAI ever asks, you can show exactly what happened on any given call.

The Bottom Line for Quebec Business Owners

Using an AI receptionist that is not Loi 25 compliant is not just a theoretical risk. The CAI has been actively issuing orders and investigating complaints since 2023, and fines have been issued. Choosing a tool built for Quebec compliance is not a nice-to-have — it is the responsible choice for any business that operates here.

If you are currently using a US-based AI receptionist, the questions to ask your provider are: Where is my caller data stored? Can you provide a signed data processing agreement in French? Do you have a privacy impact assessment for cross-border data transfers? What is your process for handling deletion requests within 30 days?

If they cannot answer all four clearly, you have a compliance gap.