Quebec AI Scribe Rules: the CMQ Position, Law 25, the Health Information Act and French

More than any other Canadian regulator, and the first requirement is one no other College has imposed: the CMQ decides which tools its members may use.

Use a certified scribe. The CMQ requires any physician using an AI scribe to use a tool certified by Santé Québec's Bureau de certification des produits et services technologiques. Certification covers data security, protection of personal information and interoperability, through the TGV verification kit and a provincial privacy impact assessment. The CMQ points to the list maintained by the ministry. Using an uncertified scribe, including one funded through the national Infoway programme, is a professional matter for the physician and is prohibited outright inside Santé Québec establishments.

Obtain explicit, documented consent. Free and informed consent from the person being treated is required. The CMQ is specific that consent cannot be implied from a poster in the waiting room. The physician must discuss the purpose of the tool, its benefits, risks and limitations, and how the vendor handles the data: recording, transmission, whether it is used for training, and where servers are located. Consent is obtained at first use and documented; at later visits a reminder that the patient previously consented, with an opportunity to withdraw, is sufficient. Fresh consent is needed when the subject of the visit is more sensitive than what was first discussed, when a major technological change increases privacy or security risk, or when data begins to be used for training outside Canada.

Review and correct every note. The quality of the note remains the physician's responsibility. The CMQ asks for particular attention to hallucinations, misinterpretations and biases, and requires the physician to review and correct the note so that it meets the College's documentation standards before signing.

Destroy the recording. Recordings and verbatim transcripts are treated as drafts, like handwritten notes, and must be destroyed immediately after the note is reviewed and signed. The physician must verify the vendor's retention practice. Anything retained and later accessed must be reviewed for accuracy again.

The CMQ frames all of this against the Act respecting health and social services information, citing articles 16, 77, 78 and 106 in its scribe guidance. Compare the Ontario, British Columbia and Alberta positions: all require consent and review, none restricts the choice of tool.

Santé Québec set up a provincial committee to evaluate AI scribes as a structured process, which is what takes them outside the government's moratorium on generative AI in the public sector. Two conditions apply before any use in a Santé Québec establishment: the vendor must hold TGV certification from the Bureau de certification, and an ÉFVP must have been completed. The committee's ÉFVPs cover one use only, recording a clinical consultation to produce or summarise a clinical note; other functions such as form generation, laboratory result analysis or add on modules require their own assessment.

The government's programme page listed the position in September 2026 as follows.

Santé Québec's position of August 4, 2025 is that only scribes officially evaluated and approved by the committee may be used in establishments, that establishments have no discretion to allow others, and that this applies to scribes qualified by the Infoway programme. Physicians practising under privileges are bound by it even though they are not employees, because the establishment remains responsible for the information collected by anyone practising within it. For public family medicine groups, including university GMFs, Santé Québec's ÉFVPs are taken to apply provided the group follows their recommendations and uses the tool only for the assessed purpose. For private GMFs and other private clinics, Santé Québec may share its assessments through the CMQ and the FMOQ to inform their analysis, but each organisation remains responsible for its own ÉFVP.

The list changes. Check the quebec.ca programme page before any purchase and put the vendor's certification status, and its obligation to tell you if it changes, in the contract. Which of these vendors publish Canadian hosting and CAD pricing is on our best AI scribe in Canada guide.

Two statutes, and which one governs a given clinic depends on whether it is a body under the health information act or a private enterprise under the private sector act. Many clinics are both in different respects, and the safe course is to meet both.

The Act respecting health and social services information (c. R-22.1), in force since July 1, 2024, governs health and social services bodies and reaches the service providers they engage. It requires consent for uses and communications outside the purposes it authorises, requires a privacy impact assessment before acquiring, developing or overhauling an information system that involves health information, treats a technological product or service that handles the information as something the body must assess and, where the minister requires, have certified, and restricts communication of information outside Quebec to cases where an assessment shows it would receive adequate protection. These are the articles the CMQ cites: consent, the ÉFVP, and certification of technological products. Santé Québec's own framework policy on access to information and governance of personal information requires everyone practising in its establishments to use only authorised products.

Law 25 and the private sector act (c. P-39.1) apply to private clinics as enterprises and to vendors directly. The relevant duties are a designated person in charge of personal information; a privacy impact assessment before any project to acquire, develop or overhaul an information system involving personal information, which a scribe is; a privacy impact assessment before communicating personal information outside Quebec, considering the sensitivity of the information, the purpose, the protection measures and the legal regime of the destination, with the communication permitted only if the assessment establishes adequate protection; mandatory recording and, where there is a risk of serious injury, reporting of confidentiality incidents to the Commission and the individuals; and transparency about technology that collects information. A scribe hosted in Ontario is a communication outside Quebec for these purposes and needs the assessment, although the destination's legal regime makes that assessment straightforward. A scribe hosted in the United States needs a harder one.

Penalties are what make Quebec different in practice. The Commission d'accès à l'information can impose administrative monetary penalties of up to 10,000,000 dollars or 2 percent of worldwide turnover, and penal fines run to 25,000,000 dollars or 4 percent. Those numbers are aimed at enterprises rather than at a family physician, but the vendor is an enterprise, and a vendor that cannot show its own Law 25 compliance is a vendor whose incident becomes your incident. The vendor's HIPAA badge is beside the point: as our HIPAA and AI page explains, HIPAA is a United States statute with no standing in Quebec, and a business associate agreement is neither a service provider contract under the health information act nor a Law 25 written mandate.

Three things, and vendors from outside Quebec routinely underestimate the first.

The software must be available in French. Since Bill 96 amended the Charter in June 2022, section 52.1 requires that all software, including operating systems, be available in French unless no French version exists, and that where other language versions exist the French version be accessible on terms at least as favourable and with equivalent technical characteristics. A scribe sold in Quebec with an English only interface, English only templates or an English only consent flow is not compliant, and Santé Québec's programme made French support a mandatory condition. Ask to see the French interface rather than accepting a statement that French is supported.

The patient must be served and informed in French. Section 5 gives consumers the right to be informed and served in French, and the Office québécois de la langue française's guidance after Bill 96 is that enterprises must offer service in French at all times and on conditions equivalent to service in any other language. For a scribe this means the consent conversation, the written consent form, the patient facing notice and any patient summary or after visit document the scribe generates must exist in French. Health and social services bodies have their own duty to communicate with users in French, subject to the exceptions in the health directive for members of the English speaking community and where health or safety requires another language.

The workforce and the record. Section 4 gives workers the right to carry on their activities in French, and enterprises must provide staff documentation and training in French. The clinical note itself may be written in the language the physician and the receiving clinician use, and English language institutions recognised under the health legislation may keep records accordingly, but the scribe's default output for a francophone clinic must be French of clinical quality. Test it: French Canadian medical speech, code switching within a visit, drug names, and the accuracy of a note generated in French from a French consultation are the things that separate a genuinely bilingual scribe from one with a translation layer. Several Quebec built products exist precisely because national vendors did not pass that test.

The contract belongs in French too. Contracts of adhesion must be presented in French first, and an English version may be used only after the French one has been examined. Vendor terms of service presented in English only are a Charter problem before they are a privacy problem.

The skeleton in our AI policy template for medical practices with seven Quebec specific clauses, in French.

1. Certification. Only scribes on the Santé Québec certified list may be used; the named product and version; who checks the list and how often; what happens if certification is suspended, as happened to one product.
2. Consent, CMQ pattern. Explicit consent at first use covering purpose, benefits, risks, vendor handling, training and server location; documented in the record; reminder and opportunity to withdraw at later visits; renewal triggers for sensitive subjects, major changes and training outside Canada; no reliance on signage.
3. Review and signature. No note enters the record unread; attention to hallucination, misinterpretation and bias; the physician's responsibility for the note stated verbatim from the CMQ position.
4. Destruction. Recordings and verbatim transcripts destroyed immediately after signature; vendor retention set accordingly and verified; retained material reviewed again before any later use.
5. Privacy impact assessment and service provider contract. An ÉFVP before acquisition and before any communication outside Quebec, drawing on Santé Québec's assessment where available; a written contract meeting the health information act's service provider requirements and Law 25's mandate requirements, with incident notification and a prohibition on training.
6. French. French interface, templates, consent materials and patient documents; French contract presented first; French output tested on the clinic's own consultations.
7. Incident handling. The confidentiality incident register, the risk of serious injury assessment, and notification to the Commission and to patients.

The procurement questions in our AI scribe checklist apply once the business associate agreement is replaced with the Quebec contract, and the general market context is on the AI medical scribes comparison.

Start with certification, because it decides whether the conversation continues. Is the product TGV certified, for which version, and has Santé Québec completed an ÉFVP for it? Will you notify us in writing if certification is suspended or withdrawn? Then the privacy questions: where is data stored and processed, and does any of it leave Quebec or Canada; will you delete recordings and verbatim transcripts on signature and can you evidence it; do you use any data, including de-identified data, for training or product development; which subprocessors handle our data, including the speech and language model providers; will you sign a contract meeting the health information act's service provider requirements and Law 25, in French; what is your confidentiality incident notification commitment; and what is your own Law 25 compliance evidence. Then French: show us the French interface, the French consent form, a French note generated from a French consultation, and the French contract.

On cost, published Canadian pricing for scribes on the Quebec certified list and the Infoway list ranged in September 2026 from free tiers to roughly 100 to 150 dollars per clinician per month, some in Canadian dollars; Infoway licences were free for 12 months and expire by December 31, 2026. The scribe pricing comparison lists what vendors publish, the AI scribe ROI calculator converts time saved into a break even, and the workflow is described on our ambient scribe page. Budget for the ÉFVP and the contract review; they are not in the subscription price and in Quebec they are not optional.

Quebec has done something no other province has: it has told physicians which scribes they may use. That removes one decision and creates several others. The certified list is short and changes; the Infoway list overlaps it only partly and does not satisfy the CMQ; the ÉFVP is a real document that a private clinic must produce; the vendor contract must meet two statutes in French; and the French output has to be tested rather than promised.

An independent advisor with no vendor commissions, working in French and English, does that work with you. We compare the certified and pre-qualified products against the CMQ's requirements and your specialty, draft the ÉFVP to Santé Québec's pattern, negotiate the service provider contract and its Law 25 clauses, test the French output on your own consultations, and write the policy and consent materials your inspection file needs. We also keep watching the list, because a suspension after purchase is a scenario Quebec has already produced once.

That is what our vendor selection engagement does for scribes and our AI governance and compliance engagement does for the assessment, the contract and the policy. To talk through where your clinic or establishment is, book a call.