Answer — AI Governance
Can a municipality use ChatGPT or Copilot?
Yes — a municipality can use ChatGPT or Copilot; Law 25 does not prohibit it. It does require governing the use: no personal information without prior analysis (an ÉFVP where needed), transparency when a decision is fully automated (s. 65.2), and records that demonstrate that diligence over time.
What does Law 25 allow — and require?
No text forbids a municipality from using a generative-AI tool, and many already do: first drafts, summaries, document preparation. What Law 25 requires is governance — in force since September 2023:
- Personal information first. Entering citizens’ information into an AI tool is a communication of personal information: it presupposes prior analysis, a privacy impact assessment (ÉFVP) where the project requires one, and particular care if data leaves Québec.
- Automated decisions next. When a decision about a person is based exclusively on automated processing, s. 65.2 requires informing the person, disclosing on request the principal factors behind the decision, and letting them submit observations. Assisted use — the employee decides, the tool helps — falls outside that case; you still have to be able to show where the line runs.
- Governance throughout. Adopted policies, a designated person in charge, documented practices — overseen by the Commission d’accès à l’information.
And one point that circulates badly: Québec’s generative-AI directive covers provincial bodies, not municipalities. Your framework is Law 25 — in full.
What does governed use look like in practice?
Three simple habits: a clear guardrail (what may go into the tool and what may not), an inventory of the AI tools actually in use — including the ones nobody declared — and a trace of what happens, recorded as it happens. The policy says what ought to happen; the inventory and the trace show what does.
And when the council asks?
The answer that holds is not “we have a policy,” but “here is what our AI tools did, here are the gaps we found, here is how we addressed them” — backed by contemporaneous records. That is demonstrable reasonable diligence, and it is what Agentica provides: every AI agent in your business environment, continuously mapped and recorded in a tamper-proof history, from which the council-ready report is generated on demand — never reconstructed.