AI Decision Governance Framework: Quebec's Law 25

This framework operationalises Section 12.1 of Quebec's Law 25 into a set of governance checkpoints for any organisation using AI to make decisions about individuals. The law applies specifically to decisions rendered exclusively through automated processing. If a human meaningfully participates in the decision, the requirement does not apply. The first checkpoint in this framework is determining which systems actually meet that threshold.

Where a decision does qualify, the law requires four things. The individual must be informed that automated processing was used, no later than when they are informed of the decision itself. They must be able to request an explanation of the factors and logic that led to the decision. They must be able to access the personal data that was used. They must be able to submit observations to a staff member who is capable of reviewing the decision.

Each of these four requirements is mapped to concrete organisational controls: a disclosure trigger built into the decision workflow itself, a documented explainability process, a data access procedure, and a designated human review pathway. This mirrors the same checkpoint based approach used in the Ghana Data Protection Act framework, adapted here to a jurisdiction with binding automated decision-making requirements and among the highest penalties in the world for non-compliance.