There is no single Quebec “AI regulator” that answers every clinic question. A health AI project can touch health-information law, privacy oversight, product certification, Santé Québec requirements, professional standards and operational evidence at the same time.
The practical map
Quebec legislature and health-information law
The Loi sur les renseignements de santé et de services sociaux establishes duties for organizations that hold health information. Article 106 addresses privacy impact assessments for technology acquisition, development and redesign.
Commission d’accès à l’information
The CAI oversees Quebec privacy law and publishes guidance on privacy impact assessments. Its EFVP approach starts with the project, personal-information flows, privacy risks and a mitigation plan.
MSSS, Santé Québec and the certification office
The Quebec AI-transcription program publishes the current scribe table and separates supplier TGV certification from the acquiring organization’s EFVP. Santé Québec procurement or assessment decisions do not automatically authorize another clinic’s use.
Professional orders
The CMQ translates professional duties into physician-facing expectations for consent, validation and the medical record. Other orders may issue profession-specific guidance, so a mixed clinic should map requirements by role.
INESSS and evidence for deployment
INESSS examines clinical, organizational, ethical, legal and implementation considerations. Its work helps teams ask whether and how a technology should be deployed, but it does not replace the clinic’s governance decision.
Use the map as a decision sequence
- Identify the exact use, users, information and clinical record impact.
- Check the live product and certification source.
- Complete the organization-specific privacy and security assessment.
- Apply the professional rules for every participating role.
- Test workflow, language, exceptions, human review and downtime.
- Record who approved the pilot and what evidence is required for production.
Why the distinction matters
A vendor can meet a product-level certification requirement while a clinic still has an unacceptable workflow or privacy risk. A clinic can complete an EFVP while the product version or professional process remains unsuitable. Strong governance joins the layers instead of treating one badge as the whole decision.
For the scribe-specific version of this map, read TGV and EFVP for AI scribes in Quebec.
Official sources reviewed
- Quebec health-information law, article 106
- CAI EFVP guidance
- Quebec AI-transcription program
- CMQ AI-scribe guidance
- INESSS large-scale deployment considerations
Evidence reviewed: August 26, 2026. This map is practical information, not legal advice.
