In brief
A Quebec organization using AI falls under Law 25, the only framework that obliges it directly. The EU AI Act reaches it as soon as it serves the European market. The NIST AI RMF and ISO/IEC 42001 remain voluntary, and serve to prove governance to a client, an insurer or a prime contractor. The iDIA framework brings all four together into a single evaluation.
Which frameworks govern AI in Quebec?
Published · Last updated · Wissam Daibess
Four frameworks overlap, and they do not carry the same force. Law 25 is a Quebec statute in force: it obliges. The EU AI Act is a European regulation that reaches a Quebec organization through the market it serves, not through its address.
The NIST AI RMF and ISO/IEC 42001 are voluntary. Their value lies elsewhere: they supply the structure and vocabulary that make governance verifiable by a third party.
The iDIA framework weights these four sources into six properties scored on evidence, so an organization answers once rather than four times.
Does Law 25 apply to your AI use?
As soon as personal information enters an AI tool, Law 25 applies. The trigger is the data being processed, never the technology used.
The obligations that touch AI most directly cover transparency on automated decisions, privacy impact assessments, disclosure outside Quebec, and the appointment of a privacy officer.
identifiable certifies compliance in AI governance and with Law 25. Detailed legal interpretation remains with the organization's legal counsel.
Does the EU AI Act reach Quebec companies?
Yes, as soon as the organization places an AI system on the European market, or the output of that system is used within the Union. The test is the market served, not the head office.
The regulation classifies systems by risk level and attaches obligations to that level. A Quebec organization exporting an AI-backed service benefits from knowing its classification before a European client asks for it.
The firm aligns practices with the AI Act, as applied compliance. Legal interpretation remains with legal counsel.
Are ISO/IEC 42001 and the NIST AI RMF worth it in Quebec?
They are not mandatory, and they answer each other. The NIST AI RMF is a voluntary risk management framework; ISO/IEC 42001 is a certifiable management system standard. The first feeds the second.
Their usefulness is commercial as much as technical. In a tender, an answer structured on a recognized framework can be verified; a statement of intent cannot.
For ISO/IEC 42001, identifiable prepares organizations for certification, which is issued by an accredited body.
Where does an organization start?
With the inventory. An organization does not govern what it has never listed, and actual AI use inside teams almost always exceeds declared use.
Then comes the AI Index: evaluating systems and agents across the six properties of the iDIA framework, producing the organization's score and profile.
The Responsible AI Practice designation is granted at the threshold, and only there: the AI Index must reach the designation threshold and no property may fall below the floor. An organization can hold the average and still remain undesignated.
Frequently asked questions
Which law governs AI in Quebec?
Law 25 is the Quebec framework that obliges directly, as soon as personal information enters an AI tool. There is not yet a Quebec statute dealing specifically with artificial intelligence.
Does the EU AI Act apply to a Quebec company?
Yes, as soon as it places an AI system on the European market or the system's output is used within the Union. The test is the market served, not the head office.
Can a Quebec organization be certified to ISO/IEC 42001?
Yes. Certification is issued by an accredited body. identifiable prepares organizations to present themselves for it, and does not issue ISO certification.
Do the four frameworks have to be handled separately?
The iDIA framework weights them into six properties scored on evidence, so an organization documents once and answers all four. That is the point of a single evaluation.
How long does structuring AI governance take?
It depends on the starting point, and that is exactly what the AI Index measures. An organization whose practices are already documented moves considerably faster than one that states them without writing them down.