Law 25-compliant AI for Quebec small businesses

Artificial intelligence saves a staggering amount of time. But in Quebec, it comes with a question few business owners think to ask: where does your data go?

Under Law 25, every business is accountable for the personal information it handles — its clients', its employees', its suppliers'. And most mainstream AI tools send that data to servers in the United States. That's exactly where the risk begins.

Obrio exists to fix this: Law 25-compliant AI, with your data hosted in Canada and a human approving every action. You get the benefit of AI without exposing your business.

Start a pilot

Why AI hosted in the United States (ChatGPT and the rest) exposes you

Here's a concrete example. An employee pastes your client list into ChatGPT to write emails faster. Nothing malicious — they just want to move quickly. Except that list holds names, addresses, phone numbers: personal information.

Most mainstream AI tools — ChatGPT and the others — host their data on servers located in the United States. The moment your employee pastes that list, the information leaves Quebec.

That's precisely what Law 25 governs. Its Article 17 states that before transferring personal information outside Quebec, a business must first assess whether the information will receive protection equivalent to what's required here. In plain terms: you can't just send your clients' data anywhere, unchecked.

This isn't about bad intentions. It's about knowing where your data goes — and, most of the time, no one in the business does.

What Law 25 requires when your business uses AI

Law 25 never says the words "artificial intelligence." But its rules kick in the moment any tool — AI or not — touches personal information. For a small business, it comes down to a few simple principles:

• You're accountable. Your clients' and employees' data stays your responsibility, even when a piece of software or an AI is the one processing it.
• You need to know where it goes. You can't protect what you don't track. Every tool that touches personal data should be known and governed.
• A transfer outside Quebec requires an assessment. That's the heart of Article 17: before information leaves the province, you have to make sure it will stay properly protected.
• Transparency matters. Your clients have the right to know how their information is used.

None of this bans AI. Law 25 doesn't stop you from using AI at work, legally, in Quebec — it asks you to do it in a governed way. That distinction is everything: the problem isn't AI, it's ungoverned AI. (For a deeper dive, see our guide Law 25 and artificial intelligence for SMBs.)

"Shadow AI": your employees may already be using AI on the sly

Here's the real blind spot. While management debates "should we adopt AI?", employees are already using it. It's called shadow AI: the use of AI tools quietly, without any oversight from the business.

An assistant summarizing emails in a free tool. A salesperson having a public AI draft their quotes. A clerk translating a letter meant for a client. Every time, personal information can leave your business without you knowing.

Shadow AI in small businesses isn't a discipline problem — it's a vacuum problem. When the company doesn't offer a safe AI tool, employees find one themselves. And they pick the best-known option, almost always hosted in the United States.

The right answer isn't to ban AI — that only pushes the habit further into the shadows. It's to offer an official option that's safe and compliant, so the useful AI happens in the open, under your control.

How Obrio makes AI compliant (your data stays in Canada)

This is where Obrio changes the game. Our AI agents are built to respect Law 25, starting from one simple principle: your data stays in Canada.

In practice, the information our agents process is hosted on Canadian infrastructure — servers located in the country. AI data hosting in Canada isn't a technical footnote: it's the direct answer to the concern raised by Article 17. Your clients' data doesn't leave for the United States by default.

We also don't use your data to train public models. What comes into Obrio is there to do your work, full stop. For example, the invoicing agent connects to your tools like QuickBooks with no double entry — and without exposing your books to a foreign service.

Does that make you "100% compliant" overnight? No — compliance also depends on your own practices, and no honest provider will promise you an absolute guarantee. But by keeping your data in the country and governing every use, Obrio measurably reduces the risk instead of ignoring it. That's the difference between AI you chose and AI that happened to you.

The human gate: the agent prepares, you approve

Hosting data in Canada solves half the problem. The other half is control.

Obrio's agents never act on their own. Each agent prepares the work — a payment reminder, a quote, a staff schedule, an email — then stops and waits for your go-ahead. Nothing important goes out until a human has approved it. That's what we call human control, or the "human gate": the agent prepares, you approve.

Set to "always ask" by default, this changes everything on the compliance side. A responsible person sees what the agent proposes before it ever reaches a client. Mistakes get caught before, not after. And you keep a clear record of who approved what.

It's also what sets Obrio apart from "autonomous" AI that would act behind your back. Here, the AI does the heavy lifting; the final judgment stays human. That's more reassuring for you — and it holds up far better under Law 25.

Fines and stakes (up to $10M or 2% of worldwide revenue)

Why care now? Because Law 25 has teeth.

The penalties on the books can reach $10 million or 2% of your worldwide revenue — whichever is higher. For a small business, even a fraction of that would be devastating.

And the topic has stepped into the spotlight. In the spring of 2026, mainstream Quebec media — including La Presse — reminded readers that using AI at work could, in many cases, raise real privacy concerns. Your clients read those articles. "Where does my data go?" is no longer a lawyers-only question.

Beyond the fine, there's trust. A client who learns their information wandered onto foreign servers doesn't always come back. Compliance isn't only about dodging a penalty — it's about protecting your reputation.