Does Québec’s generative-AI directive apply to municipalities?

Where does the confusion come from?

On December 19, 2025, Québec’s ministry of cybersecurity and digital affairs published the province’s generative-AI framework: an application directive (IA-RI-2025-003-OP) and a statement of principles, with full compliance required by June 5, 2026. A number of articles and newsletters reported that it applied to “all public bodies, including municipalities.”

The text says otherwise. The directive is issued under the Act respecting the governance and management of information resources (LGGRI), and its section 2 lists the bodies it covers: ministries, government agencies, school service centres, cégeps and universities, and health-network institutions. Municipalities, MRCs, and other local public bodies are not on the list.

So what governs AI in a municipality?

Law 25 — and it applies in full. Since September 22, 2023, every municipality has been required, among other things, to adopt governance policies for personal information, designate a person in charge of the protection of personal information, and carry out a privacy impact assessment (ÉFVP) for projects involving personal information — which includes most AI projects.

The provision most directly tied to AI is section 65.2 of the public-sector Act: when a decision is based exclusively on automated processing, the body must inform the person concerned, disclose on request the principal factors and parameters of the decision, and give the person a chance to submit observations to a staff member able to review the decision. Meaningful human involvement in the decision changes the analysis — which is exactly why knowing precisely what each tool does matters.

What does this mean for accountability?

Two concrete takeaways:

1. The government directive is not your framework. A municipality waiting for a “directive for cities” is waiting for a text that does not exist. The obligations are already in place, under Law 25, with the Commission d’accès à l’information as overseer.
2. The council’s or auditor’s question will be a question of proof. Knowing which AI tools are in use (including the ones nobody declared), documenting what they touch, and being able to demonstrate it from contemporaneous records — that is demonstrable reasonable diligence, the standard regulators assess. A policy adopted without a record of what actually happens cannot be demonstrated.

Agentica, an AI Governance company in Montréal, keeps that record continuously: every AI agent in your business environment, mapped and recorded in a tamper-proof history — read-only, metadata and signals only.