Skip to main content
Agentica

Answer — AI Governance

What belongs on a Law 25 + AI checklist for a municipality?

A Law 25 + AI checklist for a municipality names generic best practices: designate a person in charge, keep an inventory of the AI tools in use, run a privacy impact assessment, document automated decisions, and keep an incident register. It informs your governance — it does not certify compliance.

How to read this checklist

This is a generic, best-practice checklist — the same starting point any Québec municipality using AI would work from. Each item is a named control pattern with one sentence of grounding. It is not legal advice, and no checklist makes an organization compliant. Since September 2023, Law 25 has bound municipalities directly, overseen by the Commission d’accès à l’information (CAI).

The items

  • Designate a person in charge of personal-information protection. Law 25 requires a municipality to name a responsible person — the office AI usage puts under pressure.
  • Keep an inventory of the AI tools in use. List every copilot, agent, and integration touching municipal data, including the ones a vendor switched on by default.
  • Run a privacy impact assessment (ÉFVP) for AI projects touching personal information. Law 25 requires an assessment before acquiring, developing, or overhauling such a system — with particular care where data leaves Québec.
  • Document decisions based exclusively on automated processing. Where a decision is fully automated, s. 65.2 requires informing the person, disclosing the principal factors and parameters on request, and receiving their observations.
  • Keep a register of confidentiality incidents. The public-sector Act (A-2.1, ss. 63.8–63.11) requires an incident register and, where an incident presents a risk of serious harm, notifying the CAI and the people concerned.
  • Govern transfers of personal information outside Québec. Assess the data leaving the province before an AI tool sends it there.
  • Record your governance measures as they happen. Contemporaneous records — not paperwork assembled before a review — are what demonstrable reasonable diligence rests on.

Where a checklist stops

A generic checklist informs your thinking; it does not do the work or prove it was done. The versioned, record-integrated governance instruments library — the same items as procedures and templates you can adopt — ships inside AI Auditability, where adopting each instrument lands in the record as dated evidence. Agentica, an AI Governance company in Montréal, keeps that record continuously.

Agentica provides AI-governance evidence and risk intelligence. It does not constitute legal advice or compliance certification.

Sources