Do you have to tell callers they are speaking to an AI?

The act does not impose a set wording. It requires informing the person, at collection, of the purposes, the means and their rights (s. 8), and informing them of a decision based exclusively on automated processing (s. 12.1). Saying it plainly at the start of the call is the clearest way to do it.

Can calls be recorded?

Yes, provided the person is informed and told the purposes at collection (s. 8), the recording is kept only as long as needed (s. 23) and it is protected like any personal information.

Can an AI voice agent’s data be hosted in the United States?

It is not prohibited. But before communicating personal information outside Québec, the business must conduct a privacy impact assessment and cover the communication with a written agreement (s. 17).

Who is responsible if the vendor has an incident?

Your business remains responsible for the information it holds (s. 3.1). The contract with the vendor must require it to notify you without delay of any breach (s. 18.3), so you can notify the Commission and the people concerned when needed (s. 3.5).

Buyer’s guides · updated October 1, 2026

AI voice agents and Québec’s Law 25: what to check (2026 guide)

Yes, a Québec business can have an AI voice agent answer its phone. But everything the agent collects — name, number, reason for the call, recording, transcript — is personal information protected by the Act respecting the protection of personal information in the private sector, as amended by Law 25, all of whose obligations have been in force since September 2024. Before choosing a vendor, check six points: where the data is processed (a privacy impact assessment is required before communicating it outside Québec), the written contract, what the agent tells the caller, how long data is kept, notice of an incident, and automated decisions. This guide summarizes the law; it is not legal advice.

Published by Zen Solutions (Laval), which sells one of these services. We rank nobody here: prices come from the vendors’ own pages, rules from the text of the law, with the links. Spotted an error? Write to info@zen-solutions.net.

What the agent collects

The caller’s name and number, the reason for the call, the appointment, sometimes the audio recording and its transcript, and the summary sent to your team. In a clinic, the reason may concern health: information is sensitive when, for instance by its medical nature, it gives rise to a high level of reasonable expectation of privacy (s. 12).

The basic rule: collect only what is necessary for the purposes determined before collecting it (s. 5). An agent booking an appointment does not need the symptoms in detail.

The 6 points to check

Where the data is processed and stored. Before communicating personal information outside Québec, the business must conduct a privacy impact assessment that considers, among other things, the sensitivity of the information, the purpose, the protection measures and the legal framework of the destination, and the communication must be covered by a written agreement (s. 17). Ask: “In which countries are my recordings, transcripts and summaries processed and stored, and by which subcontractors?”
The written contract. A vendor that receives the information to provide the service must do so under a written contract that specifies the protection measures, limits use to the service and provides for destruction at the end (s. 18.3). Ask: “What happens to my data if I stop?”
What the agent tells the caller. At collection, the person must be informed of, among other things, the purposes, the means used and their rights of access and rectification (s. 8); if a technology can identify, locate or profile them, they must be told that too (s. 8.1). Ask: “How does the agent inform the caller, and can I change what it says?”
Retention and destruction. Once the purposes are achieved, the information must be destroyed or anonymized, subject to any retention period set by law (s. 23). Ask: “How long do you keep recordings and transcripts, and can I delete them?”
Confidentiality incidents. The business must reduce the risk, notify the Commission d’accès à l’information and the people concerned when the incident presents a risk of serious injury, and keep a register of incidents (s. 3.5 to 3.8). Ask: “How fast do you tell me about an incident?”
Automated decisions. A decision based exclusively on automated processing must be disclosed to the person, who can ask for the reasons and submit observations to a staff member (s. 12.1). Ask: “Does the agent make decisions on its own — refusing an appointment, setting a priority — and can the caller reach a person?”

Your obligations, whatever the vendor

Your business is responsible for the personal information it holds; by default the person with the highest authority is responsible for its protection, and their title and contact information are published on your website (s. 3.1).
Policies and practices governing personal information, with detailed information published on your website (s. 3.2).
A register of confidentiality incidents (s. 3.8).
According to the Commission d’accès à l’information, administrative monetary penalties can reach 10 million dollars or 2% of worldwide turnover (CAI).

What Zen Solutions does

Our application and database are hosted in the United States, which our privacy policy states plainly; it also names the person responsible for the protection of personal information. For a Québec business, that is a communication outside Québec that calls for a privacy impact assessment on your side; if your data must stay in Canada, tell us before you sign.

We sell this service, so we do not rank ourselves. The facts: Zen Solutions is a Québec company based in Laval; the agent is configured for your business by a person. $99.98 + tax a month, or $999.98 + tax a year from month two, with $20 of AI + SMS usage included every month (about 150 minutes of calls), then $0.133 per call minute and $0.036 per text. Setup and training free, no commitment, and 30 days to be sure: first month refunded if it isn’t right. Free 7-day trial, no credit card. Our agent answers at 438 544-5191 — call it the way you would call the others.

Frequently asked questions

Do you have to tell callers they are speaking to an AI?: The act does not impose a set wording. It requires informing the person, at collection, of the purposes, the means and their rights (s. 8), and informing them of a decision based exclusively on automated processing (s. 12.1). Saying it plainly at the start of the call is the clearest way to do it.
Can calls be recorded?: Yes, provided the person is informed and told the purposes at collection (s. 8), the recording is kept only as long as needed (s. 23) and it is protected like any personal information.
Can an AI voice agent’s data be hosted in the United States?: It is not prohibited. But before communicating personal information outside Québec, the business must conduct a privacy impact assessment and cover the communication with a written agreement (s. 17).
Who is responsible if the vendor has an incident?: Your business remains responsible for the information it holds (s. 3.1). The contract with the vendor must require it to notify you without delay of any breach (s. 18.3), so you can notify the Commission and the people concerned when needed (s. 3.5).

Sources

Checked on October 1, 2026. This guide summarizes public rules and prices; it is not legal advice.