Starting with AI
in a Québec company.

Five questions to answer before choosing a tool

1. Which task, and who does it today?

   Name one task, the people who do it and roughly how much time it takes. Vague goals like “use AI in sales” are hard to test.

2. What would success look like?

   Pick a measure you already track: time per file, response delay, error rate or backlog. Decide the target before anything is built.

3. What data does the task use?

   List the documents and systems involved, and whether they contain personal information. This decides how carefully the next steps must be planned.

4. Where must a person decide?

   Mark the points where someone must review or approve. AI can prepare the work; responsibility stays with your team.

5. What happens if the AI is wrong?

   Describe the worst realistic error and how it would be caught. If a mistake would be costly and invisible, the task needs stronger checks or is not a good first choice.

Where AI usually helps first

Good first projects are frequent, text-heavy tasks where a person can check the result quickly:

• Drafting replies, summaries and reports for a person to review.
• Answering internal questions from your own documents and procedures.
• Extracting information from forms, PDFs and emails into your systems.
• Sorting and routing incoming requests.
• Preparing first versions of quotes, plans or schedules that someone approves.

Be more careful with tasks that decide something about a person, such as hiring, credit or discipline, with regulated advice, and with anything that would run without human review. They are possible, but they need stronger safeguards and are rarely the right first project.

Law 25: what to check before an AI project

Québec’s Law 25 modernized the Act respecting the protection of personal information in the private sector. For an AI project, these are the points to check early.

This is a practical summary, not legal advice. For your situation, confirm with a lawyer specialized in privacy.

Inventory the personal information

Know which personal information the project will use, where it comes from and how sensitive it is. Use only what the purpose requires, and destroy or anonymize it once the purpose is achieved.

Privacy impact assessment

A privacy impact assessment (PIA, or ÉFVP in French) is required for a project to acquire, develop or overhaul an information system or electronic service involving personal information, and before communicating personal information outside Québec.

Data processed outside Québec

If an AI provider processes personal information outside Québec, the assessment must show it will be adequately protected, and the communication must be set out in a written agreement.

Purpose and consent

Use personal information only for the purposes it was collected for, unless the person consents or the law allows another use. Feeding customer data into an AI system is a new use to check.

Automated decisions

When a decision about a person is based exclusively on automated processing, inform the person. On request, explain the information and the main factors behind it, and let them submit observations to someone who can review the decision.

Identification, location and profiling

Before using technology that can identify, locate or profile a person, inform them, and tell them how to activate those functions.

Privacy by default

A technological product or service offered to the public must provide the highest level of confidentiality by default.

Accountability and incidents

Name a person in charge of personal information (by default, the person with the highest authority in the company) and publish their title and contact details on your website. Keep a register of confidentiality incidents, and notify the Commission and the people concerned when an incident presents a risk of serious injury.

SourcesCommission d’accès à l’information du Québec ↗CAI, “Vers la conformité à la Loi sur le privé” (in French) ↗

The three stages, in practice

Each stage answers one question and ends with a decision: continue, adjust or stop.

1. 01Explore

   Where can AI help, and where shouldn’t it?

   We map your processes, data and constraints with the people who do the work. I check your privacy obligations under Québec’s Law 25 before any data moves.

   You leave withUse cases ranked by value, risk and effort, and a clear recommendation to go ahead or not.

2. 02Pilot

   Prove one use case on your real data.

   We agree on success criteria before anything is built. I build a working pilot where people review and approve what the AI produces, then measure it against how you work today.

   You leave withA working pilot, measured results and an honest recommendation.

3. 03Deploy

   Put it into daily work, safely.

   I take the pilot to production with security, monitoring, cost control and the human checkpoints that remain. Your team is trained to run it.

   You leave withA system in production, its documentation and a team that can run it.

Mistakes to avoid

• Starting with a tool instead of a task.
• Running a pilot without success criteria, so no one can say whether it worked.
• Using real personal information before checking what the law requires.
• Removing the human check to save time before the error rate is known.
• Ignoring the running cost per use until the first invoice.
• Deploying without an owner who will maintain the system after launch.

Readiness checklist

• One task chosen, with the people who do it.
• A success measure and a target, decided in advance.
• Examples of the documents or data involved.
• Personal information identified, and the need for a privacy impact assessment checked.
• The points where a person reviews or approves.
• A budget for the pilot and an estimate of the cost per use.
• Someone who will own the system after launch.

If you can tick most of these, you are ready for a pilot. If not, the Explore stage is where to start.