RegTech / PrivacyTech / Private & sovereign AI
Law 25 — AI-assisted analysis
On-device AI that locates personal information in an organization’s documents, for Québec’s Law 25
Meeting Law 25 obligations starts with knowing where personal information lives — and most organizations cannot say which of their thousands of documents hold a social insurance number, a health-card number or a medical condition. This solution finds 42 categories of personal information inside the organization’s own environment, with no cloud, no external API and no large language model.
- 42 categories of personal information detected
- 4 detectors run in parallel on every document
- 0 external API calls — no cloud, no LLM
- Status
- In production
- Model
- B2B
- Market
- Québec, Canada
The problem
Québec’s Law 25 — the Act to modernize legislative provisions as regards the protection of personal information, overseen by the Commission d’accès à l’information du Québec — requires organizations to know what personal information they hold and to protect it. In a document management platform with thousands of heterogeneous files, in French and English, that inventory cannot be done by hand; and sending the documents to a cloud service to analyze them would create the very exposure the law is meant to prevent.
The solution
An autonomous AI service installed on a dedicated machine inside the organization’s network. It reads the document queue of the organization’s document management platform, analyzes each document locally with four detectors running in parallel, reconciles the candidates in three stages and writes structured findings back to the platform — the personal information stays where it already is. Next on the roadmap: gap analysis against Law 25 obligations, privacy impact assessments, internal policies, risk mapping, corrective measures, reports and dashboards, built on top of this detection layer.
What the platform does
- Local detection, four detectors Two named-entity-recognition models (CamemBERT for French, a multilingual DistilBERT), entity dictionaries covering Québec organizations and places, and 79 pattern rules for structured identifiers — run in parallel on each document, after automatic language identification.
- Three-stage reconciliation Overlapping candidates are merged and the most specific category selected; contextual validation then filters false positives (a job title is not a person, a signature block is not an address); algorithmic checks close the pass.
- Algorithmic validation of identifiers Credit-card and social-insurance numbers (Luhn), RAMQ health-card numbers, passport machine-readable zones (MRZ) and bank identifiers (IBAN) are validated by their own check rules before they are reported.
- Platform integration The service polls the platform’s document queue in MariaDB, processes documents in batches and writes the findings back as a structured record per document — a single outbound connection, to the organization’s own database.
- Operations and installation Execution logging and processing metrics per stage and per category; an offline installation package for machines without internet access; versioned deployments with rollback.
Architecture
Python services (30,000+ lines) for document processing, detection, reconciliation and database integration; frozen public NER models compiled to Core ML for local inference on the machine’s neural engine; MariaDB connector to the document platform; unit tests and benchmarks per detector. No training on the organization’s data. Delivered with a complete architecture and code dossier for independent security review by the organization’s IT team.
Who uses it
Organizations subject to Law 25 that run a document management platform — professional-services firms first — and, on their side, the IT and privacy teams who review the findings and decide what to do with them.
Markets
Québec (Law 25, identifier formats specific to Québec and Canada, bilingual documents); the detection architecture is designed to extend to other Canadian privacy regimes.
Where AI fits — and where it does not
The AI is two frozen, public named-entity-recognition models running on the machine itself — no large language model, no cloud inference, no external API, no training on client data. They propose candidates; dictionaries, pattern rules, contextual validation and algorithmic checks decide what is reported, which keeps the behaviour auditable. The solution locates personal information; it does not certify compliance with Law 25 — the legal interpretation and the decisions remain those of the organization’s professionals.
My role
Founder and architect: product vision, detection-pipeline and security-model architecture, technical direction; my team at SOFT M POWER CANADA built it and operates it under my direction, and delivered with the security-review dossier.