What counts as an automated decision under Law 25?

Which decisions are covered?

Those rendered exclusively through automated processing of personal information — with no human involvement at the moment of deciding. That one word carries the whole regime: a decision where a person exercises real judgment before it takes effect is not covered. Conversely, a rubber-stamp human step — clicking “approve” without examining — is not meaningful involvement.

The regime lives in twin texts: section 12.1 of the private-sector Act and section 65.2 of the public-sector Act respecting access — the one that applies to public bodies, municipalities included.

What duties does the law create?

Three, borne by the organization that decides:

• Inform the person, no later than the moment of the decision, that it rests exclusively on automated processing.
• Disclose, on request, the personal information used, the principal factors and parameters that led to the decision, and the person’s right to have the information corrected.
• Receive their observations through a staff member in a position to review the decision.

The exact scope is worth reading in the text itself: the right conferred is to submit observations — not a guaranteed fresh decision.

What must an organization be able to demonstrate?

First, something simple: knowing which of your systems decide alone. The duty only triggers at the moment of an exclusively automated decision — but that presupposes being able to say, with evidence, which tools process personal information, which ones render decisions, and where a person genuinely intervenes. It is an inventory fact before it is a legal one.

That is what Agentica maintains: continuous mapping of every AI agent in your business environment, recorded in a tamper-proof history — enough to answer “which ones decide alone?” with a dated register rather than an estimate.