Artificial Intelligence

The cryptographic mechanisms that currently secure digital transactions, communications and signatures may become vulnerable with the advent of sufficiently powerful quantum computers. For businesses, the issue is no longer merely technological: it also affects governance, contracts, information protection and migration planning. Understanding post-quantum cryptography Imagine spending an entire week without transmitting sensitive information over the internet—no banking, no checking health records and no shopping online. Everyday transactions rely in particular on cryptographic mechanisms that: protect the confidentiality and integrity of information; authenticate individuals and systems; and secure digital signatures. However, the advent of sufficiently powerful quantum computers could compromise some of these mechanisms and consequently undermine a key pillar of our current digital security. Cryptography brings together the techniques used to protect the confidentiality and integrity of information, authenticate individuals and systems and secure digital signatures. It plays a role in particular when a browser displays a padlock icon, someone electronically signs a document or a company transmits confidential data. Many of these mechanisms rely on public-key cryptography, which uses a pair of mathematically linked keys: a public key and a private key. These keys derive their security from mathematical problems that would take conventional computers an astronomical amount of time to solve. A sufficiently powerful quantum computer, however, could solve some of these problems in virtually no time. As a result, widely used mechanisms, such as RSA and elliptic-curve cryptography, will no longer offer adequate protection. The immediate nature of the quantum threat Currently, only prototype quantum computers exist, and it is still difficult to predict exactly when they will become commercially viable or when major corporations and nation-states will use them. The Canadian Centre for Cyber Security nonetheless estimates that a quantum computer capable of posing a threat to current mechanisms could emerge as early as 2030, while acknowledging the uncertainty surrounding this timeline.1 In August 2024, the U.S. National Institute of Standards and Technology released its first three standards establishing cryptographic algorithms capable of withstanding this threat.2 For organizations, the issue is therefore not merely knowing when the threat will materialize, but determining what steps to take today to keep their information and systems secure into the future. Post-quantum cryptography refers to methods designed to resist attacks from both conventional computers and future quantum computers. From a mathematical standpoint, resistant algorithms exist, but many IT systems have yet to adopt them. The threat of “Harvest Now, Decrypt Later” The most pressing threat can be summed up by the phrase “Harvest Now, Decrypt Later.” A threat actor can intercept and store encrypted data today, then attempt to decrypt it once sufficient quantum capacity becomes available. Information that retains its value or sensitivity over several years, such as trade secrets, financial data, strategic information and privileged communications, is therefore at the greatest risk.3 The level of urgency depends on each organization's specific technological infrastructure. Key considerations include how long information must remain confidential and the time required to replace vulnerable mechanisms. According to Canadian best practices in the field, some systems have product lifetimes of 15 to 30 years, and a cryptographic migration can itself take several years.4 An organization can therefore fall behind long before a cryptographically relevant quantum computer ever reaches the market. Why businesses rely on their suppliers for the transition Most organizations do not develop replacement cryptographic solutions themselves. Instead, they rely on their software, cloud service, hardware, certificate and cybersecurity vendors. Such reliance does not make planning pointless—on the contrary. It shifts the focus toward governance, procurement and contracts. When it comes to contracts, organizations must assess these risks right now, particularly the allocation of liability between the contracting parties. Ideally, technology service contracts should specify whether the provider or the client bears the risks associated with using technologies that fall short on quantum security. Achieving balanced risk allocation requires open dialogue: Client organizations must ask the right questions and technology providers must be transparent about the limits of their systems. The federal government has begun its transition to post-quantum cryptography The federal government is no longer treating post-quantum cryptography as just a research topic. In June 2025, the Canadian Centre for Cyber Security published a roadmap to migrate the Government of Canada’s unclassified systems. Among other milestones, the document establishes an initial departmental plan and a first progress report starting in April 2026, the migration of high-priority systems by the end of 2031, and the migration of all other relevant systems by the end of 2035.5 A Security Policy Implementation Notice, which took effect in October 2025, reinforces these requirements and compels relevant federal institutions to demonstrate measurable progress.6 While these milestones do not apply directly to private businesses, they can still indirectly affect federal contractors. Since April 1, 2026, in-scope federal contracts with a digital component must incorporate clauses that support post-quantum cryptography and cryptographic agility, among other requirements.7 Federal directives make clear that orderly migration requires governance, inventories, prioritization, financial planning, procurement policies and coordination with vendors. Moreover, the post-quantum transition is by no means confined to the federal government. In September 2026, Canada joined a call to action from the G7 Cyber Security Working Group urging public and private organizations to adopt a phased, risk-based transition. Canadian guidelines likewise recommend that organizations begin preparing before large-scale solutions are rolled out.8 Legal implications for Quebec businesses No Quebec statute expressly requires private businesses to use any specific post-quantum algorithm or complete a migration according to the federal timeline. Instead, Quebec law establishes functional and technologically neutral obligations, which require the adequacy of the selected measures to be assessed in context. Protection of personal information and reasonable security measures The Act respecting the protection of personal information in the private sector requires businesses to take reasonable security measures, taking into account, in particular, the sensitivity, purpose, quantity and distribution of the information and the medium on which it is stored. It also mandates a privacy impact assessment for projects to acquire, develop or overhaul information systems or electronic service delivery systems that process personal information.9 For an organization that retains sensitive information with a lifespan of several years, such as banking information or Social Insurance Numbers, the quantum threat may become a material factor when assessing whether existing security measures are reasonable. Document integrity and confidentiality of transmissions The Act to establish a legal framework for information technology follows the same approach, requiring in particular that the integrity of a document be maintained throughout its life cycle. For instance, where the information contained in a document is declared by law to be confidential, section 34 requires that it be protected by means appropriate to the mode of transmission.10 Documentation explaining the mode of transmission and the measures taken to protect confidentiality must also be readily available to prove compliance. Rather than mandating specific technologies, the law sets outcome-based obligations, in particular safeguarding document integrity and information confidentiality. Civil liability and the state of knowledge As Quebec legal scholars emphasize, security measures only matter in the eyes of the law if they actually work.11 Accordingly, official publications and technical standards—while not giving rise to a civil obligation on their own—can help establish the state of knowledge, the foreseeability of the risk and recognized industry practices.12 An organization’s liability regarding its data protection obligations must be assessed according to the general rules of civil liability.13Liability would turn primarily on whether the organization acted with prudence and diligence at the relevant time, taking into account: the knowledge available at the time; the sensitivity of the protected information; the lifespan of its systems; and the availability of alternative solutions. Using a cryptographic mechanism that could soon become vulnerable may constitute a civil fault in light of current knowledge. Connected devices and reasonable security expectations Similar considerations could apply to manufacturers, distributors and suppliers of connected devices. Under the Civil Code of Québec, factors include the safety that a person is normally entitled to expect and the state of knowledge at the time the item was manufactured, distributed or supplied. Given these criteria, a product’s reasonably expected capacity to receive security updates could form part of the circumstances weighed when assessing a potential safety defect.14 Practical steps for businesses to prepare now Preparing does not call for an immediate overhaul of all existing mechanisms. Rather, it requires developing cryptographic agility—the ability to identify and replace cryptographic mechanisms without having to rebuild the underlying systems from scratch. The Canadian Centre for Cyber Security recommends a number of practical measures in particular:15 Inventory cryptographic assets. The inventory should cover internal and client-facing systems, certificates, authentication mechanisms, digital signatures, network equipment and cloud services. Special attention should be paid to legacy, custom-built or hard-to-update systems. Establish priorities. Organizations should identify information that must remain confidential over the long term and systems whose modification or replacement will require several years. Engage vendors. Organizations should obtain their vendors’ post-quantum roadmaps to determine whether the transition can be completed through updates or if it will require acquiring new products. Applicable standards, support lifecycles and impacts on interoperability should also be verified. Align contracts and procurement. New agreements could include, as appropriate, terms governing security updates, end-of-support notifications, the adoption of standardized mechanisms, cooperation during migration and the allocation of associated costs. Not all organizations face the same level of exposure. However, immediate attention is warranted where a business retains sensitive information over multiple years, operates systems that are difficult to replace or relies on vendors whose migration roadmaps remain unknown. While vendors will likely deliver the technical solutions, each organization must understand its own requirements, ask the right questions and ensure it remains agile enough to adopt these solutions when the time comes. Key takeaways: The quantum threat is already here, even if quantum computers capable of breaking certain cryptographic mechanisms are not yet widely available. The primary threat is “Harvest Now, Decrypt Later.”Data encrypted today can be intercepted, stored and decrypted in the future. The most exposed organizations are those that retain sensitive information over many years, operate systems that are difficult to replace or rely on vendors whose migration strategies are uncertain. In Quebec, there is no general obligation mandating any specific post-quantum algorithm, but businesses are bound to adopt reasonable security measures, assessed in context and in light of the state of knowledge. Preparation starts with cryptographic agility: inventorying assets and uses, prioritizing critical systems, engaging vendors and adapting contracts. CANADIAN CENTRE FOR CYBER SECURITY, “Preparing your organization for the quantum threat to cryptography (ITSAP.00.017),” February 2025, online: https://www.cyber.gc.ca/en/guidance/preparing-your-organization-quantum-threat-cryptography-itsap00017 NATIONAL INSTITUTE OF STANDARDS AND TECHNOLOGY, “NIST Releases First 3 Finalized Post-Quantum Encryption Standards,” August 13, 2024, online: https://www.nist.gov/news-events/news/2024/08/nist-releases-first-3-finalized-post-quantum-encryption-standards CANADIAN CENTRE FOR CYBER SECURITY, supra, note 1. CANADIAN FORUM FOR DIGITAL INFRASTRUCTURE RESILIENCE and CANADIAN NATIONAL QUANTUM READINESS WORKING GROUP, Canadian National Quantum-Readiness Best Practices and Guidelines, Version 04, July 10, 2024, pp. 3–7, online: https://ised-isde.canada.ca/site/spectrum-management-telecommunications/sites/default/files/documents/Quantum-Readiness%20Best%20Practices%20-%20v04%20-%2010%20July%202024.pdf. CANADIAN CENTRE FOR CYBER SECURITY, Roadmap for the migration to post-quantum cryptography for the Government of Canada (ITSM.40.001), June 23, 2025, p. 13, online: https://www.cyber.gc.ca/en/guidance/roadmap-migration-post-quantum-cryptography-government-canada-itsm40001. TREASURY BOARD OF CANADA SECRETARIAT, Migrating the Government of Canada to Post-Quantum Cryptography: Security Policy Implementation Notice, effective since October 9, 2025, online: https://www.canada.ca/en/government/system/digital-government/policies-standards/spin/migrating-government-canada-post-quantum-cryptography.html. TREASURY BOARD OF CANADA SECRETARIAT, supra, note 6, s. 6.3.1. CANADIAN CENTRE FOR CYBER SECURITY, “G7 Cybersecurity Working Group call to action on preparing for the post-quantum era,” September 3, 2026, online: https://www.cyber.gc.ca/en/news-events/g7-cybersecurity-working-group-call-action-preparing-post-quantum-era?; CANADIAN FORUM FOR DIGITAL INFRASTRUCTURE RESILIENCE and CANADIAN NATIONAL QUANTUM READINESS WORKING GROUP, supra, note 4, ss. 3–5.  Act respecting the protection of personal information in the private sector, CQLR c. P-39.1, ss. 3.3 and 10. Act to establish a legal framework for information technology, CQLR, c. C-1.1, ss. 6 and 34. Éric LABBÉ, “L’efficacité technique comme critère juridique ou la manière dont les lois se technicisent,” (2004) 9-2 Lex Electronica. Éric LABBÉ, “La multiplicité des normes encadrant le contrat électronique : l’influence de la technologie sur la production des normes,” (2004) 9-2 Lex Electronica; Charles-Étienne DANIEL, “Coder son propre droit : quand la machine pousse l’humain à énoncer de nouvelles normes de gouvernance,” dans Quand la société fait son droit : la gouvernance de proximité en action, 2026, EYB2026QSD19, pp. 397–432. Civil Code of Québec, CQLR, c. CCQ-1991, s. 1457; Act respecting the protection of personal information in the private sector, supra, note 9, s. 10. Civil Code of Québec, supra, note 13, arts. 1468, 1469 and 1473. CANADIAN CENTRE FOR CYBER SECURITY, supra, note 1; CANADIAN CENTRE FOR CYBER SECURITY, Guidance on becoming cryptographically agile (ITSAP.40.018), May 2022, online: https://www.cyber.gc.ca/en/guidance/guidance-becoming-cryptographically-agile-itsap40018.

Artificial intelligence (AI) is no longer merely a futuristic concept but a present-day reality—a practical business tool that is routinely used in management and production. Organizations are increasingly adopting generative AI and analytics solutions for tasks such as writing, sorting, decision-making, monitoring and evaluating. However, this is often done without any prior structured planning.  Employers now face the dual challenge of achieving productivity gains quickly while ensuring that AI does not pose legal, reputational or operational risks. The range of applications is expanding to include writing assistance, decision-making support, performance analysis, digital monitoring and incident and accident prediction. This raises questions of interest to both executives and the media. For example, who should be held responsible when the tool makes a mistake? What data is being used? How far can employers go in monitoring their employees?  If properly regulated, AI can support innovation and expedite its implementation, while also contributing to workplace well-being, health and safety. In Quebec, these benefits are particularly significant in the context of an aging population, labour shortages and increased pressure to boost productivity. Addressing this situation requires solutions that foster growth and competitiveness.  The use of AI systems in the workplace raises real and multifaceted challenges. These include protecting personal information and maintaining confidentiality, establishing liability and accountability where errors or failures occur, and considering the potential impact on workloads and the work environment.  Aware of the effect that digital transformation and AI are having on the workplace, the Minister of Labour launched a consultative process to assess whether existing legislation adequately addressed these developments. In October 2025, he tasked the Comité consultatif du travail et de la main-d’œuvre (the “CCTM”) with further exploring ideas and developing a shared vision regarding:  Consultation processes that factor in the implications of AI use in the workplace;  Ethical, governance and transparency principles in human resources decision-making;  The prevention of emerging occupational health and safety risks.1  CCTM report: Recommendations  The Avis du CCTM concernant les enjeux entourant l’implantation et l’usage des systèmes d’intelligence artificielle en milieux de travail au Québec [CCTM report on the implications of implementing and using artificial intelligence systems in Quebec workplaces] (“CCTM Report”) was released on April 29, 2026. The recommendations set out in the report regarding the implementation and use of AI systems in Quebec workplaces include, in particular:  Applying the current legal framework governing labour and employment law in Quebec; Preserving the essential role of human judgment—and the responsibility that comes with it—in automated decision-making processes;   Applying laws respecting the protection of personal information2 when developing, implementing and using AI systems, and prioritizing solutions that limit the use of electronic surveillance;  Implementing an algorithmic impact assessment process that would involve employees and take into account the impact of automated decision-making on fundamental rights and privacy;  Ensuring that organizations continue to support employee mobility and ongoing professional development;  Regulating algorithms through sound governance practices that promote transparency and explainability in algorithmic decision-making;  Placing emphasis on the need to pay special attention to discriminatory biases.   In its report, the CCTM also makes recommendations to the Commission d’accès à l’information, such as updating its guide on drafting privacy policies to include disclosure requirements regarding AI and surveillance technologies, and encouraging employers to inform employees of their intention to use partially or fully automated decision-making processes.  Lastly, the CCTM recommends that the Ministère du Travail develop, in collaboration with the CCTM, a guide to support the implementation of responsible, compliant and socially acceptable AI.  Guide released by the Ministère du Travail: 5 principles  Further to the recommendations made in the CCTM report, the Minister of Labour released, on June 12, 2026, a document titled L’intelligence artificielle au travail : Guide d’accompagnement pour une intégration responsable [A guide to using artificial intelligence responsibly in the workplace] (the “Guide”).  The Guide aims to ensure that AI is integrated into workplaces in a responsible, user-centric and collaborative manner. It sets out five (5) key principles designed to inform discussions and help organizations recognize the main issues, namely:  Respect for rights and freedoms in the workplace;  Protection of privacy and data governance;  Governance, participation and social dialogue;  Human oversight and transparency;  Sustainable development and well-being.  For each principle, the Guide provides examples of how AI is used in the workplace. It also highlights the associated benefits and challenges, and suggests practical steps to ensure that AI is adopted and used responsibly.  The Guide serves as a practical, evolving tool that organizations and labour market stakeholders are encouraged to tailor to their specific circumstances.   Accessible and regulated AI  While the adoption of AI in the workplace offers tangible opportunities for improvement, it also raises important issues that require careful oversight. With that in mind, the Guide aims to support the use of AI in a way that protects rights and users, while taking workplace considerations into account. It also aims to provide the various stakeholders involved with the tools they need to facilitate the adoption of AI at work.  A number of interesting challenges are likely to arise over the next few years, and Lavery’s highly qualified professionals are ready to help you deal with them. Contact the team today.  Comité consultatif du travail et de la main-d’œuvre, Avis du CCTM concernant les enjeux entourant l’implantation et l’usage des systèmes d’intelligence artificielle en milieux de travail au Québec, online: lien, April 9, 2026, p. 6. (In French only) Act respecting the protection of personal information in the private sector, CQLR c. P-39.1; Act respecting Access to documents held by public bodies and the Protection of personal information, CQLR c. A-2.1.

Biotechnology projects rely on sensitive genetic data and biological material Nowadays, innovation-driven companies involved in life sciences, research and biotechnology handle some of the most legally sensitive assets: human tissue, biological material and genetic data. Innovation models involving tissue engineering, biobanks or AI-based analytical technologies are now based on the transfer and use of biological data with high scientific and commercial value. Yet, many organizations still prioritize the scientific and operational aspects of their projects without giving sufficient consideration to the legal restrictions that arise when a project involves a person’s DNA or biological material. From a business standpoint, the risk is that an organization—whether a private company or a public institution—might develop a technology, but then be unable to market that technology because it does not hold the necessary rights to use the biological material and information involved. In Canada, and particularly in Quebec, laws that protect personal and health information have become central to such projects.1 We are no longer simply dealing with typical cybersecurity or privacy concerns. These laws directly affect how biological material is:  collected used transferred stored altered and potentially leveraged for commercial or collaborative research purposes2. Why DNA and human tissue are subject to a particular legal protection The highly sensitive nature of DNA and genetic data is no longer disputed. Canadian case law has long recognized the highly personal and private nature of this type of information.3 It also emphasizes the fact that human tissue and genetic data play a unique role in research and innovation projects because of the identification risks they carry, their scientific value, and the ethical and commercial concerns related to their use.4 This perspective is evident in section 2 of the Act respecting health and social services information5, for example, which defines health information as any information that concerns “any material taken from [a] person,” including biological material. Section 5 and following of this act set out the conditions under which such information may be used, disclosed or transferred in the context of research or collaboration involving third parties6  These obligations supplement those set forth in the Act respecting the protection of personal information in the private sector,7 which requires in particular that personal information be collected for specific and legitimate purposes, and that it be used in a manner consistent with the purposes for which it was originally collected.8 Artificial intelligence, genetic data and the risk of re-identification From a biotechnology perspective, the matter becomes particularly touchy when human tissue or genetic data, which was initially collected for clinical or scientific purposes, is then used for technology or artificial intelligence projects. In fact, many projects that utilize artificial intelligence require not only biological samples and DNA, but also phenotypic data, health information and family history information from the patients from whom the biological samples were obtained. As such, there is a real risk of data cross-referencing here that must be managed with full awareness of the potential impact on those individuals. In certain projects, combining DNA with family information could compromise the privacy of not only the individuals from whom the biological material was collected, but also their family members. This problem has already been raised in relation to genetic genealogy.9 Consent, health information and secondary uses tend to be overlooked A project that was initially intended for research purposes can quickly drift into secondary uses that extend beyond its original scope. However, consent obtained at the outset does not necessarily cover all future uses, particularly where derived data or analysis results are integrated into technology platforms or used to develop analytical tools.10 Research agreements and biological material transfer agreements constitute an essential governance mechanism Agreements have thus become the key governance mechanism. Biological material transfer agreements, collaborative research agreements and data-related provisions are no longer solely intended to protect intellectual property or commercial confidentiality. They also serve to define the processes involved in transferring biological samples, ensuring data traceability, imposing restrictions on reuse and meeting anonymization requirements.11 The rights relating to intellectual property, DNA and personal information are interconnected The interplay between biotech innovation, intellectual property and personal information protection raises complex legal issues. A genetic database or a biological model derived from it can be both a strategic business asset AND a collection of highly sensitive personal information. However, any intellectual property rights that may apply to the results, algorithms or analytical methods do not exempt organizations from the obligations set out in Quebec laws regarding the protection of personal and health information12. On the contrary, in order to market a technology, organizations must hold not only the necessary intellectual property rights but also the rights required under the legal framework governing health and personal information. The commercialization of a technology begins long before it is brought to market As organizations increasingly seek to leverage data from scientific research, issues related to the governance of human tissue, DNA and biological material should no longer be treated as a secondary consideration addressed only at the end of a project. They are becoming an integral part of the legal, operational and commercial framework of modern biotechnology projects and therefore deserve careful consideration from the outset. Summary 1. From a legal standpoint, DNA is considered to be health information In Quebec, biological material and genetic data are not merely instruments of research. Under the law, they are defined as highly sensitive “health information”. The collection, use and transfer of this type of information is strictly regulated and requires explicit, informed consent. 2. Intellectual property does not confer all rights to the holder Just because a company develops a high-performance AI algorithm or an innovative biological model does not mean it can circumvent Quebec’s privacy laws. Bringing biotech products to market requires holding the necessary intellectual property rights AND complying with the legal framework governing the use of health data. 3. The pitfall of project drift (secondary uses) Consent obtained at the outset of a clinical research project usually does not extend to future uses, such as the integration of data into AI platforms. Organizations that fail to establish a solid contractual framework (e.g., transfer agreements, anonymization clauses) from the start may never be able to market their technology. Act respecting health and social services information, CQLR c R-22.1, ss. 1, 2, 5, 44 to 49 and 77. Act respecting the protection of personal information in the private sector, CQLR c P-39.1, ss. 4, 5, 8, 12 and 14. R. v. Dyment, 1988 CanLII 10 (SCC), [1988] 2 SCR 417 Marie Hirtle and Bartha Maria Knoppers, Le stockage des éléments du corps humain, les droits de propriété intellectuelle et les autres droits de propriété, Industrie Canada, 2014. Act respecting health and social services information, supra, note 1, s. 2. Id., ss. 5, 44 to 49 and 77. Act respecting the protection of personal information in the private sector, supra, note 2. Id., ss. 4, 5, 8, 12 and 14. Clausius, K., Kenny, E. & Crawford, M. J. (2023). BILL S-231: The Ethics of Familial and Genetic Genealogical Searching in Criminal Investigations. Canadian Journal of Bioethics / Revue canadienne de bioéthique, 6(3-4), 44–56.  Act respecting health and social services information, supra, note 1, ss. 44 to 49; Act respecting the protection of personal information in the private sector, supra, note 2, ss. 12 and 14. Act respecting health and social services information, supra, note 1, ss. 48 and 49; Act respecting the protection of personal information in the private sector, supra, note 2, ss. 18.3 and 23. Act respecting health and social services information, supra, note 1, ss. 5 and 49; Act respecting the protection of personal information in the private sector, supra, note 2, ss. 12, 17 and 18.3.

On June 4, Canada unveiled AI for All, its new national artificial intelligence strategy. Anchored in the principle that the benefits of AI must accrue to all Canadians, the strategy emphasizes the democratization of AI through expanded training, governance, and Canadian infrastructure. A strategy centred on adoption Canada’s new national AI strategy rests on the premise that the benefits of AI will materialize only if individuals, businesses, and institutions are able to use it with confidence. The government notes a significant gap between AI’s potential in Canada and its actual adoption. According to Statistics Canada, only 12% of Canadian businesses used AI to produce goods or services between mid-2024 and mid-2025. The stated objective is to increase that rate to 60% by 2034. To achieve this, the strategy is structured around six pillars: protecting Canadians and safeguarding democracy, developing skills, promoting adoption, building sovereign infrastructure, supporting Canadian AI champions, and strengthening trusted international partnerships. Trust as a driver of adoption The strategy emphasizes that trust is not presented as an obstacle to innovation, but rather as a condition for its adoption. In particular, the strategy provides for the modernization of privacy rules, protection against certain online harms, transparency of AI systems, and strengthened capacity for the Canadian AI Safety Institute. The government also announced its intention to advance measures such as watermarking AI-generated content, transparent model evaluation, a Canadian certification program for trustworthy AI, and support for the standards ecosystem. For organizations, this confirms an underlying trend: AI will not be assessed solely on the basis of technical performance, but also on its transparency, security, governance, and protection of personal information. Training before broad deployment The strategy places significant emphasis on AI literacy. Canada plans to create a National AI Literacy Initiative, provide training content to one million post-secondary students and more than 3,000 teachers, and give post-secondary students access to trustworthy AI agents. This approach reflects the recognition that AI adoption depends not only on access to tools, but also on users’ ability to understand risks, limitations, biases, misinformation, and privacy issues. The strategy also extends training efforts to workers already in the labour market. It provides support for reskilling pathways for mid-career workers, practical training tailored to real-world AI use cases in workplaces, and employer-led training, particularly with the support of colleges, CEGEPs, and polytechnic institutions. The objective is to ensure that AI adoption benefits workers by strengthening their skills, productivity, and ability to participate in the transformation of their organizations. Helping organizations move from experimentation to implementation This component of the strategy is aimed particularly at small and medium-sized enterprises. The government observes that many organizations are already experimenting with AI, but that the transition to sustainable integration remains more difficult. Identified barriers include costs, access to expertise, and uncertainty about the first steps to be taken. Measures announced include the Business Development Bank of Canada’s LIFT program, a $500 million initiative to help Canadian SMEs access the financing needed to integrate AI tools into their operations, as well as a $500 million investment to strengthen the Regional Artificial Intelligence Initiative. The strategy also provides for AI literacy and readiness assessment tools to help businesses identify concrete use cases. Health as the first “national mission” The government plans to launch an AI missions program. The first mission will focus on health, with $200 million allocated to improving outcomes in that sector. The strategy specifically targets applications related to access to care, wait times, avoidable visits, and reducing physicians’ administrative burden. This mission-based approach reflects a desire to concentrate efforts on concrete problems rather than treating AI as an abstract technology. It also seeks to bring researchers, businesses, governments, and practitioners together around measurable objectives. Sovereignty as a strategic issue The strategy presents digital sovereignty as a central issue. It notes that several essential capabilities (computing, cloud infrastructure, connectivity, data, and talent) remain largely located outside Canada. This dependence can expose sensitive data, intellectual property, and critical infrastructure to foreign rules or decisions. Canada plans, among other things, to build a world-class public supercomputer, expand sovereign computing and cloud infrastructure, and invest in secure digital systems for government operations. Supporting Canadian AI champions The strategy also links sovereignty to the ability to grow Canadian businesses domestically. The government states that, in order to retain its most successful entrepreneurs and companies, as well as its most valuable intellectual property, Canada must strengthen its investment environment, support domestic commercialization, and enable companies to compete from within Canada. In this regard, the strategy provides, among other measures, an additional $700 million in affordable sovereign computing capacity for Canadian SMEs, allowing them to develop, test, and deploy their products on Canadian infrastructure rather than relying primarily on foreign platforms. Establishing trusted international partnerships Finally, the strategy presents international alliances as a lever for resilience, sovereignty, and market access. Canada intends to work with trusted partners to develop shared AI capabilities, harmonize standards, support more resilient supply chains, and offer alternatives to closed systems or systems that are not aligned with democratic values. This direction includes expanding the Sovereign Technology Alliance, supporting open-source AI, and using diplomatic and trade networks to attract investment, promote Canadian champions, and open new markets. Key takeaways The publication of the AI for All strategy confirms a shift observed for several years: the question is no longer whether organizations will adopt AI, but how they will do so. For several years, discussions surrounding AI focused primarily on technological breakthroughs, investment, and competitiveness. Canada’s strategy instead emphasizes the conditions required for sustainable adoption: trust, skills, governance, infrastructure, and organizations’ ability to integrate these tools into their day-to-day operations. This shift is significant. The question is no longer only what AI is capable of doing, but how organizations can use it effectively, responsibly, and in a manner suited to their context. In this respect, the challenges facing organizations in the coming years will likely be less technological than organizational. The ability to develop a culture of innovation, train teams, implement appropriate governance mechanisms, and maintain stakeholder trust may prove just as decisive as the choice of tools themselves. The federal strategy also acknowledges a reality that is becoming increasingly clear: AI is no longer solely a matter of productivity or innovation. It is gradually becoming an issue of sovereignty, economic resilience, and long-term competitiveness. In this context, it will be particularly interesting to observe how organizations, institutions, and the various levels of government translate these directions into concrete practices. As is often the case with innovation, true transformation will not arise solely from the technologies that exist, but from the way they are integrated into the processes, decisions, and relationships of trust that shape our organizations.