Under Law 25, yes. Few small businesses know it. The good news: once you know it, it is simple to get right. The kit walks you through structuring your compliance, one document at a time. You add your information, and you leave with your file, ready to sign.
Six short modules, about two and a half hours. You move at your own pace, on your own time, nothing to watch. At the end, your compliance file is built.
Here are the four documents you hold at the end, and what each one is for.
The ground rules for your team, written once. You date it, you post it, and everyone knows what may go into AI. The first document in your file.
Your data map and your enterprise mode configured. Everyday use stays on the right side, without a second thought. The habit that keeps you clear of missteps.
A consultant bills this document at $1,500 and up. Here, you fill it in with your information, and your registers come with it. Ready to date and sign.
The exact order of moves to make, and your complete file gathered in your 228 Toolkit, ready to download. You know what to do, and in what order.
You leave with a file you can date, sign and show, because you filled it in yourself, with your information.
Two screens from the kit, redrawn exactly. On the left, Module 0: your starting picture, and the zone to start with. On the right, the piece that picture points you to, your section 17 assessment. The example carries the name of a fictional company; you put in your own.
Your weakest zone: Outside Québec. Start with your Law 25 assessment already filled in and your registers (Module 03). One piece filled in, and this zone turns green.
Ten statements, one verdict per zone. Your starting point, in black and white.
You fill in your fields and check your measures on the left of the screen, the document takes shape on the right, like this. All eight sections are shown in full.
The first screen names your weak zone. The second fills it in. This is how the whole kit works: each module adds a piece to your file.
Two screens out of six. Your documents take shape in your browser as you enter your information, and nothing is sent to us.
The kit exists for one simple reason: so you can use AI in your business without breaking Law 25, and without becoming a legal expert.
About two and a half hours in total. What you fill in at each module adds to your 228 Toolkit.
Ten statements, one verdict per zone. You see right away where you stand and where to start.
You answer a few questions, and your policy takes shape on screen. You leave with a dated document, ready to post for your team.
The map of what may go into AI and what never does, plus the enterprise mode setup. The habit that keeps you clear of missteps day to day.
You add your information, and your Law 25 assessment fills in live, with your registers. The key document in your file, ready to date and sign.
The exact order of moves to make over 30 days, and an announcement email ready for your team. You know where to start tomorrow.
All your documents gathered in one place, ready to download, put on your letterhead and have signed.
Six modules · about two and a half hours · your complete compliance file
Pasting identifiable information into a public AI tool hosted outside Québec is a communication outside Québec within the meaning of section 17. It calls for a written assessment. Few small businesses know it, and that is exactly what this module settles. You add your information, the assessment takes shape on screen, and you leave with a document ready to date and sign, plus your registers. A consultant bills this work at $1,500 and up. Here, the how is already done.
The substance does not come from an opinion. It draws on the text of Law 25 and on the public guidance of the Commission d'accès à l'information (CAI).
Between the free template you find online, which gives you principles, and the consultant at several thousand dollars, the middle was missing: the how, already done. The kit is that middle.
The running example follows a concrete case: a client file entered into an AI tool. The skeleton is reusable; you replace it with your own situation, your business, your tools.
A practical compliance tool. The kit is not legal advice and does not replace consulting a legal professional for your specific situation.
Your signed policy, your data rules, your filled-in Law 25 assessment, your plan for the next 30 days. Your whole file together, ready to date, sign and show.
The kit brings your AI under control. When you want to know where automation would pay off the most, Audit OPERATORS looks at your whole operation.