Service · Risk mapping
Know where
You stand
The Radar maps every process in your organization that AI touches, and finds where the privacy impact assessment, the notice to the people concerned and the human review are real — or merely symbolic. The full map is built with you during the Orée Diagnostic.
What it answers
An organization can hold an impeccable policy and work in ways that depart from it: a privacy impact assessment never revisited after a tool was added, notice to affected individuals buried in a page of terms, human review that amounts to a click on approve.
The Radar reads the processes one at a time and names which ones hold, which ones only appear to, and which need correcting before a question arrives.
Format
Process mapping
Scope
The processes AI touches
What is examined
Impact assessment, notice, human review
Frameworks
Law 25
You end with
A risk level for each process
Validation
Every high risk reviewed with legal counsel
The tool
What it is, what it isn't
Radar Loi 25 is one of the tools used during an Orée Diagnostic. It maps, process by process, every AI-touched use case at a client, and pinpoints where three key obligations under Quebec's Law 25 are genuinely met — or only appear to be: the privacy impact assessment (s. 3.3), notice to affected individuals, and human review of decisions (s. 12.1).
What the Radar is
A field tool, filled out during interviews and on-site observation, mandate by mandate — not a remote audit based on written policy. It pushes toward concrete questions rather than stated intentions: how long does validation actually take, on average? Does the person responsible open the file, or just click approve? That kind of digging is what separates genuine oversight from symbolic oversight.
Each mapped process gets an operational risk level — high, medium, or low — used to prioritize the conversation and structure the diagnostic report delivered to the client, with a clear remediation path for each gap identified.
What the Radar isn't
It is not a legal verdict. The risk level shown is an operational estimate, not a compliance conclusion: any high- or medium-risk case is validated with a qualified legal advisor before a conclusion is shared with the client.
Nor is it an automated audit tool that replaces human judgment — it equips it. The Radar directs attention and speeds up the diagnostic; it doesn't substitute for the expertise of the person conducting the interview, or for legal counsel's opinion.
That is the same logic that governs the whole practice: AI drafts, the human decides.
What you keep
The process map
Every AI-touched use case, recorded during interviews and on-site observation — what the process actually does, not what the policy says it does.
A risk level for each process
High, medium, or low. It prioritizes the conversation; it does not settle a question of compliance.
A remediation path
For each gap identified, what would have to change and in what order, carried into the diagnostic report.
The Radar is not legal advice and does not replace your counsel. Any high- or medium-risk case is validated with a qualified legal advisor before a conclusion reaches you; the legal judgment stays where it belongs.
Book your Orée diagnostic
One call to confirm the scope. Three days given to your organization — on site or remotely, whichever suits you best. An honest picture of what slows the work down, whether or not you continue with us.