How to Deploy a Voice AI Agent Compliant with Quebec's Law 25: The 9 Technical Steps Before CAI's First Fine

Why now: the grace period is over

Law 25 phased in between 2022 and September 2024. For two years, the CAI mostly played a teaching role. Inspections were rare, fines nonexistent. That's done.

Three things shifted in 2026. The CAI doubled its inspection resources. Citizen complaints exploded — especially around generative AI and chatbots. And the regulator publicly flagged healthcare, professional services, and online commerce as priority enforcement sectors.

What does this mean for a voice AI agent? A clinic, a law firm, or an e-commerce shop recording calls without the "manifestly informed and explicit" consent required by Section 14 is staring down an administrative fine of up to $10M or 2% of worldwide revenue. For serious breaches — undisclosed cross-border transfers, mishandled voice biometrics — the ceiling jumps to $25M or 4%.

Step 1 — Map your voice data flow (before anything else)

Before you touch your agent's prompt, sketch out on paper the exact path a customer's voice takes. The audio leaves their phone, lands at Twilio (or another SIP provider), passes through speech recognition (Deepgram, OpenAI Whisper, ElevenLabs Scribe), runs through an LLM (GPT-Realtime-2, Claude, Gemini), then loops back through text-to-speech (ElevenLabs, Cartesia) before reaching the customer's ear.

Every hop is a vendor. Every vendor has a headquarters, servers somewhere, and a default retention policy. If even one link in that chain ships audio to the United States, you're triggering Section 17 of Law 25 — which requires a risk assessment and explicit consent for the cross-border transfer.

So your first technical step is paperwork. List every vendor, their jurisdiction, their default retention window, and whether they offer a Zero Data Retention (ZDR) option or Canadian residency. This document is the first thing the CAI will ask for during an inspection.

Step 2 — Write a "manifestly informed" voice consent (Section 14)

Section 14 of Law 25 requires consent to be "manifestly informed and explicit." For a voice agent, that means three things: the caller has to know they're talking to an AI, they have to understand what data is being collected, and they need a real, working way to refuse.

Here's an opening script that passes the test, one we've deployed for several Quebec clinics:

"Hi, you're speaking with an automated voice agent powered by artificial intelligence. This call will be transcribed to handle your request, and the transcript is kept for 30 days on Canadian servers. If you'd rather speak with a person, just say 'human' at any time. Otherwise, how can I help you?"

Three critical elements: the AI disclosure happens in the first sentence (not buried in fine print), the retention period is stated out loud, and the human transfer option is offered upfront. It's short — about 12 seconds — and it's defensible in front of the Commission.

Step 3 — Run a Privacy Impact Assessment (Section 3.3)

The Privacy Impact Assessment — in French, the EFVP — isn't optional anymore. Section 3.3 requires one for any processing that creates a "high risk" to personal information, which almost always includes automated decision systems like a voice agent that qualifies leads or routes emergency calls.

A usable PIA for a voice agent covers seven sections minimum: nature of data collected, specific purpose (an agent that books appointments shouldn't be collecting social insurance numbers), retention period by data type, third-party vendors and their jurisdictions, consent mechanisms, technical security measures (TLS 1.3 minimum, encryption at rest), and incident response procedure.

The PIA needs to be signed by a named accountable person (usually the Privacy Officer, or RPRP in French) and reviewed annually. The CAI treats the absence of a PIA as an aggravating factor: according to the enforcement framework published by the Commission, organizations that can demonstrate proactive compliance get substantially reduced sanctions.

Step 4 — Implement the right to human review (Sections 12.1 and 27)

Section 12.1 requires that you tell people when a decision is made exclusively by automated processing. Section 27 goes further: the individual has the right to request a human review of that decision.

For a voice agent, that translates into two technical behaviors. First, your agent must always honor an escalation keyword — "human," "person," "representative" — that transfers smoothly to an actual employee. Not voicemail. A real human, within a defined window.

Second, for stakes-bearing decisions (appointment refusal, service denial, credit qualification), the agent has to log the criteria it used and allow a documented human review within 30 days. Most SMBs miss this one because they assume "the AI decided" is invisible. It's not invisible — it's exactly what Section 12.1 targets.

Step 5 — Set retention and automatic deletion

How long are you keeping audio recordings? Transcripts? LLM logs? It's probably the question you've never asked your vendor — and probably the one that'll cost you the most.

The minimization principle in Section 5 says you keep data "only as long as necessary for the purposes for which it was collected." For a voice agent booking appointments, that's not 12 months. A reasonable baseline: audio deleted after 7 days (enough to audit a one-off issue), transcripts kept 30 to 90 days depending on industry, LLM logs anonymized after 30 days.

These windows need to be enforced automatically by your infrastructure, not by a manual procedure an employee runs "when they remember." On platforms like ElevenLabs Agents, this is in the per-conversation retention settings. On Vapi or Retell, it lives in your workflow's environment variables. Our guide on GPT-Realtime live transcription and Law 25 walks through the exact parameters to enable.

Step 6 — Choose compliant infrastructure (Section 17)

Section 17 governs cross-border data transfers. Most Quebec SMBs either ignore it or assume a single line in their privacy policy covers them. It doesn't.

For a voice agent, infrastructure choices boil down to three options. Option A: everything hosted in Canada (Bell Canada Cloud, Google Cloud Montreal, AWS Canada Central). Technically possible, but expensive and limited in LLM choice. Option B: Zero Data Retention (ZDR) with OpenAI, Anthropic, or Google — your data crosses borders but isn't stored or used for training. Option C: a hybrid agent where the transcribed voice stays in Canada and only encrypted text transits through US-based LLMs with ZDR enabled.

Option B is the most common middle ground. But here's the catch: ZDR has to be activated contractually, not just toggled in a console. OpenAI requires a specific enterprise agreement. Anthropic negotiates it per customer. If your voice AI vendor can't produce the signed contract that activates ZDR, you don't have ZDR — you have a marketing promise.

Step 7 — Document the incident registry (Section 23)

Section 23 mandates a confidentiality incident registry. For a voice agent, an "incident" goes beyond spectacular data breaches: a transcript emailed to the wrong recipient, an employee accessing recordings without operational reason, a vendor changing their retention policy without notice.

The registry needs to capture, per incident: the date, the nature, the number of people affected, the root cause, the corrective measures, and the decision to notify or not notify the Commission. That decision isn't discretionary — notification is mandatory whenever there's a "risk of serious harm" (Section 3.5).

A careful SMB builds automatic registry generation into their voice agent dashboard. Every abnormal call — unusual length, failed transfer, ignored escalation keyword — produces an entry the Privacy Officer reviews weekly.

Step 8 — Set up an internal complaints mechanism (Section 9)

Section 9 requires you to name a Privacy Officer (RPRP), publish their contact information, and make an internal complaints mechanism accessible.

In practice: a page on your site that names your Privacy Officer, how to reach them (email + phone), and the response window (30 days max). For a voice agent, add a menu option: "To exercise your rights regarding your personal information, say 'privacy.'" This option either transfers directly to the Privacy Officer or records the request for follow-up.

SMBs that botch this step usually do so out of confusion: they think the Privacy Officer has to be a lawyer. Wrong. It's an internal role, often the GM in a 5-to-20-employee company. What counts is the formal appointment and the auditable trail of requests.

Step 9 — Test and audit quarterly

Compliance isn't an event, it's a process. Every three months, you need to test your agent: is the Section 14 consent still being spoken first? Does the escalation keyword fire reliably across 100 test calls? Is the 7-day automatic audio deletion actually running?

For these tests, we recommend a 10-call audit protocol covering the critical scenarios: normal call, human transfer request, data access request, complaint about recording, crisis scenario (medical emergency, for instance). Our 7-call test protocol for spotting a failing voice agent includes the full script and success criteria.

A serious quarterly audit takes about two hours and costs zero in tools — it's well-spent human time. Compare with a reactive audit after a CAI complaint: $5,000 to $30,000 in legal fees, plus rushed-compliance work that typically costs 3 to 5 times more than the planned version.

The most expensive mistakes we see in the wild

First mistake: copying another website's privacy policy. Law 25 requires the policy to reflect your actual practices, not a template. If your policy says "we don't transfer data outside Canada" but your agent uses GPT-4 without ZDR, you're in misrepresentation territory — an aggravating factor for the Commission.

Second mistake: keeping recordings "just to be safe." Plenty of SMBs think holding audio for 12 months protects them in case of disputes. The opposite is true: the longer you retain, the wider your incident window, and the higher the potential sanction.

Third mistake: ignoring tier-2 vendors. You might have a solid contract with your voice agent provider. But that provider outsources transcription to a US-based player who outsources to a GPU cluster in Virginia. The responsibility traces back to you. Demand the full subprocessing chain — not the marketing version, the contractual version.

What it costs (and what it saves)

Proper compliance for an SMB voice agent runs $2,500 to $8,000 in upfront costs (PIA, infrastructure audit, consent script drafting, retention configuration), plus $800 to $2,000 per year in maintenance (quarterly audits, policy updates).

Compare that to an average CAI investigation: $5,000 to $30,000 in legal fees, 3 to 5 times the normal cost for emergency compliance work, and a public decision posted on the Commission's website that stays online indefinitely. That's before the administrative fine, which even for a $2M revenue SMB can hit $40,000 for a moderate violation.

If you want to size up the other side of the equation — what your voice agent is actually worth — our analysis of missed call costs ($126,000 per SMB per year) has the Quebec market numbers for 2026.

FAQ

Do I need a PIA even for an agent that just books appointments? Yes. As soon as you're automatically processing personal information (name, phone, reason for the call), Section 3.3 applies. The PIA can be short — 6 to 8 pages — but it has to exist, be dated, and be signed.

My voice agent vendor says they're "Law 25 compliant." Am I covered? No. Compliance lives with you, the data controller, not your subprocessor. The vendor can give you compliant tools (ZDR, Canadian hosting), but it's your PIA, your consent script, and your incident registry that get audited. No vendor attestation gets you off the hook.

If I disable audio recording and only keep transcripts, am I compliant? Better, but not there yet. The transcript is personal information under Law 25, and Section 14 (explicit consent), Section 17 (transfers), and Section 12.1 (AI transparency) still apply. Killing the audio shrinks your risk surface — it's not an exemption.

How long before the CAI knocks on my door if I do nothing? Nobody knows. But in 2026, the first sanctions are landing on SMBs — not just multinationals. Inspection probability rises especially in healthcare, professional services, and online commerce. Rational math: spend $5,000 now or risk $40,000 to $200,000 later.

Ready to deploy a compliant voice agent from the first call?

Configuring these 9 steps yourself takes an SMB an average of 60 to 80 hours — time most owners don't have. At Agent IA Vocal, we handle the full compliance buildout before the agent goes live: vendor mapping, PIA drafting, consent scripts, retention configuration, Canadian hosting when required.

Our TECHMA team handles every integration and every parameter — you configure nothing. To talk through your specific case and see a Law 25-compliant voice agent in action, book a personalized demo or reach out to our team. We respond in under 24 hours, in French, from Montreal.