A strategy for safety, legislation, and allied market power

Partagez les preuves et les capacités. Ne transférez jamais l'autorité. Gardez le recours là où se prend la décision. Share the evidence and the capabilities. Never transfer the authority. Keep the remedy where the decision is taken.

Purpose

Canada needs a single, coherent approach to AI safety, legislation, and capability, and this document sets it out in that order: what AI safety consists of for a government deciding whether to authorize, procure, deploy, or restrict an AI-enabled system; what domestic legislation must contain to make that definition enforceable, including what Canada's last legislative attempt proposed, why it failed, and how the next bill should be prepared; and, conditionally, how Canada builds multilateral capability if partners align, through an alliance whose instrument is pooled market power. Legislation is the priority, and every element in the document is designed to work without any partner agreement. The multilateral track adds capability; it is not a precondition, and no part of the domestic program waits for it.

All three parts rest on one distinction: evidence and capability should move freely among partners, legal authority should not move at all, and every remedy should stay attached to whoever actually decides.

Nothing here authorizes anything. It asks specific ministers to begin specific feasibility work under stated conditions.

1. Safety as answerability

1.1 Two errors about AI systems

Policymakers make two symmetrical errors about AI systems. Both come from judging a system by a property of the model and ignoring its consequences in the world.

The first error is to treat capability as the whole question: to see the model working and stop there. In 2017, the UK Information Commissioner found that the Royal Free NHS had provided Google DeepMind the records of over 1.5 million patients without a lawful basis, for an application that was clinically valuable and technically sound. The failure ran through data governance, institutional authority, transparency, and accountability, and the model was not the cause of it. The system worked, and the arrangement was still a governance failure with a privacy violation at its centre.

The second error is the mirror image: treating autonomy as an answer, on the reasoning that a tool which merely "informs" a human decision must therefore be low-stakes. Ontario's SAFER tool is an automated risk-scoring tool used in the provincial correctional system to help set security classification, governing movement, visits, programming, and family contact for people held on remand who have not been convicted of anything. It may be defended on the grounds that a human is in the loop. But a human in the loop is not the same thing as oversight. The score's causal contribution to observed racial disparities is not established, the people most affected cannot meaningfully obtain or challenge their scores, and no reviewer's override is meaningful without the authority, information, independence, and practical ability to reject the score.

Neither case was decided by how capable or how autonomous the system was. Both were decided by who was exposed, who could contest, and who could stop it. A working definition of safety has to survive both.

1.2 The harms model

Harm is an adverse effect on a person, a group, an institution, an environment, or a public value, whether individual or collective, immediate or cumulative, material or not. A payment or a correction remedies some harms; it does not restore privacy, dignity, cultural authority, democratic trust, or a life. A safety regime that prices harm in reimbursements therefore measures the wrong thing.

Risk is the possibility of a specified harm in a particular context, given exposure, uncertainty, and controls. A capability is therefore not a risk. The same capability produces different risks under different users, permissions, infrastructures, and populations. A high benchmark score is a finding of capability under stated conditions and nothing more: it does not establish that the capability was used, that anyone was exposed, or that a harm occurred.

Impact does not reduce to an average. Its dimensions are magnitude, distribution, duration, reversibility, detectability, and remediability. A low aggregate error rate conceals concentrated harm to a subgroup, and a low average error rate settles no rights claim; SAFER is the standing Canadian example.

Failure mechanisms are how a harm gets generated, and they are not interchangeable. Deliberate misuse calls for access controls and user safeguards. Accidental mistakes call for reliability, correction, and safeguards at the point of human uptake. Structural risks, rising from institutional or multi-agent dynamics, cannot be fixed by changing any one person's behaviour or any one model's controls. "Misalignment" is a technical term of art for models knowingly acting against intent; it is reserved here for that narrow use, and is not applied to bad outputs generally. The practical test is that the same misleading or biased output demands a different policy response depending on which mechanism generated it: content review for a mistake, access restriction for misuse, institutional redesign for structural incentives. Independent taxonomies from multiple research groups, including consolidated repositories of more than forty taxonomies and seven hundred identified risks, converge on this outcome-and-mechanism structure without producing a canonical list. That convergence is why the questions below are built specific to Canada instead of adopting any single list. Appendix A.9 nevertheless reproduces one convergent taxonomy in full, Google DeepMind's six areas of harm from generative AI systems, as a working reference for officials.

A policymaker's task is to trace the whole pathway, not to answer any single question:

capability → immediate output → human or institutional uptake → changed conditions → who bears the effect, and for how long

Benefits run through the same pathway as harms, and each arrow requires its own evidence. Two shortcuts block the trace: stopping at the first stage to raise an alarm over a capability, and stopping at the second to declare a deployment safe.

1.3 The definition of safety

Against those distinctions, safety is defined as follows: a system is safe to the extent that someone specific can be held answerable for it, by name, with stated evidence, and under a stop condition someone can actually trigger.

The meaning of "specific" matters. A safety regime relying on a vendor's good practice, an operator's judgment, an auditor's eventual report, or a minister's general responsibility answers "who decides?" while leaving untouched what anyone harmed can do about it. Safety without a nameable claimant is only a management preference, and it does not survive the first incident.

Three disciplines follow, applying to any deployment Canada touches, domestic or allied:

Name the decision owner. Every AI-enabled intervention in government (procurement, deployment, expansion, restriction, pause) has a specific accountable authority behind it. Where the owner cannot be named, no decision has actually been made; it has drifted through a procurement calendar or a vendor relationship. A completed assessment whose recommendations no named owner must act on becomes a form standing in for a decision that was already settled.

State the status of every claim. Claims carry five possible states: observed or documented, reported, contested or alleged, unknown, refuted. A benchmark result establishes capability under stated conditions. A corporate case study documents reported use, not independent effect. An official regulatory finding establishes what it found in its jurisdiction and nowhere else. A governance case's reasoning questions travel; its legal rules and institutional facts do not. This discipline matters most when a decision would otherwise rely on shared evaluation evidence from partner jurisdictions.

Attach a stop condition. Every deployment states, in advance, what evidence or conditions would trigger pause, restriction, or termination, and names who has the standing and practical capacity to trigger it and who is empowered to act. A stop condition that requires a capacity nobody holds is not a control. Where the exposed party and the decision owner are different parties (a prisoner and a correctional ministry, a patient and a procurement authority), the record makes that gap explicit, so the authority that can act is told, in terms it must answer, who cannot reach it.

These disciplines are reasoned, and Canada's constitutional structure is the reason. Authority over AI here is distributed across federal, provincial, territorial, municipal, and Indigenous governments, so Canada cannot defer its questions to one comprehensive code the way a single-statute jurisdiction can. It must ask, of every instrument (statute, directive, guidance, voluntary code, strategy, procurement term), what it is, whom it binds, what duty it creates, and what remedy it offers. The country's constitution imposes that heavier set of questions.

1.4 Pooled capability and the stack

The above applies to any single system. Safety at the level of the stack (compute, models, infrastructure, supply chains) runs through a different channel, because the stack is not a system any one government authorizes and no middle power can secure it alone. Governing stack-level risk, including coercive dependency, opaque infrastructure, and capability concentrated in unaccountable providers, is therefore a domestic statute question and an alliance question at once. The legislation section and the alliance section that follow are the two halves of that design.

Capability is already leaving the lab. A growing class of models is released as open weights: the parameters can be downloaded and run by anyone with sufficient compute. That class includes systems from Chinese labs and from non-Chinese firms, including Canadian ones. Once weights are public, a pause agreed among a few frontier developers does not pause the capability. It pauses the developers who will talk to governments, while copies and fine-tunes continue to circulate. That fact is a design constraint, not a reason to abandon rules. A statute that only binds the operator of a closed API will not reach the copy. The obligations in the next section therefore attach to whoever makes a system available in Canada — the publisher of the weights, the fine-tuner who ships a derivative, or the deployer who offers it for use. Evaluation evidence can still be shared. Legal authority cannot follow the file.

2. What domestic legislation should look like

The legislative gap

Canada has a national AI strategy (AI for All, June 2026) that commits to safety-first governance in law, and a minister responsible for the portfolio. It has no federal AI statute. The Artificial Intelligence and Data Act died on the Order Paper at prorogation in January 2025. A strategy directs money and attention only: nothing in it binds anyone to a duty, entitles anyone to a remedy, or creates an individual right. Authority and remedy have been separated at the level of the state. Naming the minister answers who decides; it leaves untouched what anyone harmed can do.

The correct conclusion is that Canada needs legislation shaped by the safety definition in the previous section and by Canada's constitutional structure. A design imported from a single-statute jurisdiction does not share that structure and does not fit. This section is the priority track, and everything in it is designed to stand alone: the statute binds whoever offers AI in Canada whether or not any partner agrees to anything, and the interim authorities below need no international decision to operate.

Five objectives the statute must serve

1. A named, accountable decision owner for every AI-enabled government decision, with the owner's duties set out in the act itself.
2. An AI Risk Evidence Record with legal status: an instrument that ties evidence provenance, causal assumptions, affected interests, controls, residual risk, decision ownership, and revision conditions to a named accountable authority. Canada already has a structured assessment aid (the federal Algorithmic Impact Assessment); it lacks a record whose completion carries a consequence, and a refusal to state what was decided, on whose behalf, with whose evidence, subject to what revision.
3. Accessible remedy for affected persons: a route any individual exposed to a consequential decision can actually invoke, not only enforcement machinery available to the state after harm has occurred.
4. Independent oversight with investigation powers of its own, held outside the department that promotes AI development.
5. A distinct Indigenous data and decision-power chapter hard-wiring the information–consultation–co-design–consent–oversight–refusal ladder, with the rule that a completed consultation is never recorded as consent, and engagement preceding infrastructure siting and any use of Indigenous data, knowledge, or languages.

Two other requirements apply to the whole statute. The first is an interoperability requirement: records are structured to be legible to comparable instruments outside Canada if and when those exist — the EU AI Act's conformity assessments (the EU AI Act being the European Union's binding, single-market AI regulation, cited here as the leading example), allied assurance regimes if partners align, and Canada's own Algorithmic Impact Assessment — without claiming legal equivalence and without any of it being a precondition for the statute's operation. The second is a common safeguard floor applied per order of government: lawful authority, rights and privacy review, identification of affected interests, representative evaluation, named decision owner, accessible recourse, and explicit stop conditions. Each level of government carries that floor within its own powers; no single level claims supremacy over the rest. A sixth objective completes the statute on its own terms and independently of any partner: a market-supply power. Product-safety law already lets Canada bar goods from sale in Canada; the statute must do the same for AI, so that a model or system failing Canada's transparency and safety requirements cannot lawfully be offered, provided, or deployed for use by Canadian users, whether the buyer is a government or a commercial operator. Without this power, compliance requirements would bind only government purchases, and non-compliant providers could still serve Canadian users through the market. The obligations attach to whoever makes a system available (the publisher of weights, the developer of a system, or the deployer offering it for use), so open-weight publishers, fine-tuners, and commercial providers are all covered, and the rules in the section after the legislation section state what each layer must do to comply.

Ontario's Auditor-General findings this year show what fills the space when the floor is absent: approximately 12,000 staff reaching some 400 AI websites (about 60% rated unsafe), 3% completing responsible-use training, a facial-matching service validated on 214 people, and all 20 approved AI scribe vendors producing inaccuracies, with 11 of the 20 having no third-party audit. Deployment conditions and procurement controls decide outcomes on their own in a jurisdiction with no common floor.

Pending a statute, the authorities that exist must be used and named honestly: the amended federal Directive on Automated Decision-Making (a Treasury Board instrument binding covered federal institutions) and the Algorithmic Impact Assessment for federal deployments, procurement conditions for joint challenges, and provincial and municipal analogues where they apply. These interim levers exist because Canada holds them without new legislation; their purpose is to build the statute. The pilot, the joint challenge, and the allied-market levers are designed as temporary instruments whose outputs (tested record fields, compliance findings, agreed requirements) become the content of the statute, so that the eventual regulation is drafted from used, field-tested material. A strategy that practised procurement instead of building law would repeat the AIDA problem from the other direction, substituting compliance machinery for rights and a floor. Every lever proposed here is tested by whether it produces statutory content or only a filled-out form.

Bill C-27, the Digital Charter Implementation Act, 2022, proposed the Artificial Intelligence and Data Act (AIDA) in June 2022, alongside privacy-law reform. It underwent parliamentary committee review and a further amendment package (November 2023), and it died on the Order Paper when Parliament was prorogued on 6 January 2025. It never came into force. The objections it accumulated are the design constraints for the next bill.

It proposed a risk-based framework for AI in international and interprovincial trade and commerce. Everyone handling an AI system would assess whether it was a "high-impact system," with a November 2023 amendment schedule naming initial high-impact classes. High-impact systems would owe duties to identify, assess and mitigate risks of harm or biased output, to continuously monitor those measures, and to keep records; plain-language public descriptions; incident reporting including near-misses, with cease-operations powers where serious harm occurred or could not be mitigated. Prohibitions, carrying penalties up to $25 million or 5% of global revenue, covered knowingly using unlawfully obtained personal information and knowingly or recklessly making a system available that was likely to cause serious harm or substantial property damage or economic loss to an individual. Enforcement sat largely with the Minister of Innovation, Science and Industry, supported by a new AI and Data Commissioner. After November 2023 the Commissioner held investigation, audit, and scope-determination powers, but remained a civil servant inside the promoting department.

The objections it gathered, from parties across the House and from civil-society and academic critics, were consistent: scope and definitions were deferred to future regulation while penalties attached to them; the act reached into pure university research while carrying proposals of criminal penalties for conduct not yet defined; government use was categorically excluded even though it is the highest-risk, non-voluntary relationship the state has with its citizens; no individual remedy existed for anyone harmed by a consequential automated decision; the Commissioner was structurally dependent on the promoting minister; architectures were misaligned with the EU AI Act and therefore unportable across allied markets; the industry's promoter and regulator sat in one department; and consultation was promised only after passage.

What we will do differently

The majority of AIDA's objections were well-founded, and each leads to a clear design decision for the next law:

The market-supply power takes the same constitutional treatment as the statute's other obligations: barring a non-compliant model from Canadian commercial users sits closest to consumer-product-safety authority for offerings presenting serious risk of harm, and to trade-and-commerce authority for offerings to Canadian users generally. The readiness map assigns a head of power to each class of offering and moves the remainder to FPT arrangement.

What "within our control" means. Impact Assessment Act jurisprudence holds that an intention to regulate does not create jurisdiction. The roadmap therefore assigns each obligation to an instrument Canada can actually enforce, in declining order of certainty: federal operations and spending (the government's own decisions and procurement, including the non-voluntary government-citizen relationship); federal works and genuine interprovincial or international commerce (defensible with care); federal–provincial–territorial (FPT) arrangements carrying the floor across orders of government; and standards or market conditions attached to access, which is the only lever that reaches foreign providers without extraterritoriality. Pure basic research and intraprovincial private activity are outside current federal authority, and the statute must not claim them. Anything not assigned to a head of power moves to FPT arrangements or is cut in the first draft, before anyone challenges it in court.

Worked case: the objectives applied to advanced biological tools

The objectives above are not hypothetical design exercises. An arriving class of AI-enabled biological tools exercises them all at once.

Google DeepMind's AlphaGenome Atlas, released September 2026, returns a finding on each element of the framework: capability, harm, and evidence status. The capability finding: the Atlas contains predictions for the molecular effects of roughly 9 billion single-letter DNA variants across the human genome, with an aggregated impact score for rapid variant ranking, made freely available to academic researchers through a web portal. Academic collaborators report using it to identify experimentally verified variants in unsolved rare diseases, including a splicing variant relevant to epileptic encephalopathy that earlier analysis had overlooked. The harm findings: several questions sit unresolved, and Canadian policy must address them whether the source is Google, a biotech vendor, or an open-weights release. Genetic predictions fall inside two Canadian legal contexts that already regulate genetic information (the Genetic Non-Discrimination Act of 2017 bars requiring or disclosing genetic-test results to insurers and employers; the act should state explicitly that predictions from AI biological tools receive the same protection). Genomic data is among the most sensitive categories of Indigenous data, and Indigenous data-sovereignty principles apply to any use of First Nations, Inuit, and Métis genomic information, with the decision-power ladder applying before collection. Predictions for 9 billion variants can support rare-disease diagnosis and can also serve selection-oriented uses that raise germline and disability-rights concerns. And the predictions themselves are probabilistic (the publisher states they are not validated for, or approved for, any clinical use), a caveat that must accompany any downstream use, so that a health system, insurer, or employer never treats a score as a diagnosis.

On the evidence-status discipline above, the Atlas carries three useful labels at once: the model's predictions are analytic outputs (observed or documented as predictions), their diagnostic value is contested until experimentally validated (as collaborators have done for individual variants), and any population-level health claim is unknown until tested at scale. The commercial dimension is also part of the record: the dataset and models are available free for academic use and for commercial licensing through Google Cloud, which makes the evaluation record relevant to competition as well as safety, since a private company now holds the most comprehensive catalogue of genomic-effect predictions and related infrastructure.

Applied to the objectives above, the case is direct. The high-impact schedule should name AI-enabled biological prediction and design tools as a class, so that their offerings in Canada carry the same transparency, evaluation, and market requirements as other consequential AI; the safeguard floor applies to genomic and health-adjacent deployments with particular weight on genetic non-discrimination and Indigenous genomic data governance; and the "not validated for clinical use" caveat travels with any regulatory recognition of such tools, since a prediction score admitted to a market is not thereby a medical device.

The record must also weigh biosecurity alongside the diagnostic benefit. Predictive and design tools for biological systems are dual-use by construction: the same capability that maps disease-relevant variants can in principle be pointed at sequences of concern, and successive generations of biology models (protein design, variant-effect prediction, whole-cell modelling) move toward design capability that lowers the expertise, time, and cost of engineering biological systems. The relevant risk extends past use of the AI system itself to its role before anything is manufactured: model predictions can guide sequence design, variant selection, and experimental optimization, so a harmful agent may be conceptualized, designed, and computationally tested before any physical synthesis occurs. Oversight then has to reach the computational stage, upstream of the wet lab and of the biosafety facility's access controls. Canada already holds instruments for the physical stage, including the Human Pathogens and Toxins Act, licensing and biosafety standards, export controls, and public-health authorities, and the statute must connect to them instead of duplicating them: AI-enabled biological tools offered in Canada should carry misuse screening and access controls proportionate to the biological design capability they expose, documented conditions of use for higher-capability systems, incident-cooperation duties for suspected misuse, and shared evaluation with public-health and biosafety authorities. Allied-market requirements would carry the same screening across participating members, which matters because a tool excluded from one market is worth little to a developer if another member licenses it freely. Open access serves research and also removes friction for misuse, so the record for each such tool must state what screening, monitoring, and access-tier decisions were made, by whom, and on what evidence, instead of relying on the tool's general purpose as a defence.

The legislative roadmap

Speed matters as much as design: a floor that arrives in 2029 arrives after three more years of unregulated deployment. The roadmap therefore runs its stages in parallel, with each stage's output published and each gate serving as a quality check rather than a calendar slot: a failed gate pauses introduction at that point instead of counting time, so speed does not hide structural problems. The Indigenous rights-holder review remains a hard pre-tabling requirement, and it is resourced and scheduled in the first weeks precisely so that speed never reproduces AIDA's error of consulting after passage.

• Draft-now material exists. AIDA spent two and a half years in parliamentary review and produced an amendment package with a high-impact schedule, incident reporting, and regulator-held audit powers. That drafting base is available now; the bill starts from it instead of starting over.
• Readiness (days 1–45, parallel with drafting): Justice Canada maps each obligation to a head of power, confirms the floor's content, and flags where the federal-Indigenous and FPT interfaces need agreement. This is a targeting exercise, not a consultation.
• Drafting (months 1–4, parallel): the bill is drafted directly from the AIDA amendment base, corrected for the objections catalogued above, and carrying the evidence record and the market-supply power.
• Consultation (months 2–5, parallel): public, worker, and Indigenous consultation on the draft runs while drafting proceeds, so the committee stage is not the first time anyone outside Cabinet sees the design.
• Introduction (months 5–6): a minister tables the bill with the readiness map published alongside it. Assessment evidence from the pilot keeps arriving after introduction and informs committee review and the regulatory program.

3. Scaling power with partners: a conditional track

No middle power can secure the full AI stack alone: computing power, models, energy, data, talent, evaluation capacity, and market leverage each require more scale than one country holds. This track is conditional. The legislation in Section 2 is drafted and pursued on its own schedule, and nothing in it waits for a partner decision. What follows describes what Canada should be ready to do if the expected alignment materializes, and it currently shows promise: Canada and Germany launched the Sovereign Technology Alliance in February 2026, and Norway and Finland are publicly exploring participation. Partner alignment is an opportunity that feasibility testing either validates or does not. The domestic program does not treat it as a dependency.

The same distribution fact rules out a pause as Canada's instrument. Partners may slow their own training runs. They cannot recall weights already released, and they cannot bind labs that will not join. The alliance is therefore built as pooled evaluation and pooled market consequence, not as a coordinated halt. Open-weight release remains a lawful route to market; it is not a route around the floor. How publishers and fine-tuners meet that floor is set out later in this section.

A middle power regulates by controlling access to something the regulated want. Canada alone controls nothing the AI industry needs badly enough to obey. The United States and China organize technology ecosystems at a scale Canada cannot match, and the European Union is building nineteen AI Factories and up to seven gigafactories, which are currently open only to European users. Canada's own commercial and public procurement, meanwhile, still purchases AI from providers Canada cannot independently evaluate. The remainder of the section describes what a partner-aligned structure adds. Canadian statutes would still apply at home, but pooled procurement and market conditions are what extend Canada's reach to foreign providers on terms Canada actually influences.

The alliance

The alliance's expansion may also receive a public bilingual identity and name, to be tested as a go/no-go option: any name proceeds only if the partners support it and it clears federal linguistic, trademark, and identity review, and a no-rebrand alternative is carried through the feasibility phase alongside it. Canada and Germany would remain bilateral co-founders. The European Union, represented by the European Commission within its competences, would be invited as a founding institutional partner, and France as a founding design partner. No partner is presumed committed, and national and Union authority are kept separate throughout.

Three workstreams convert that architecture into capability, and each pairs a pooled capability with a governance condition drawn from the safety disciplines:

Compute. Reciprocal, pre-negotiated access to sovereign compute (national or tightly governed high-performance AI computing capacity) for approved researchers, firms, and public-interest workloads: a federated catalogue, reserved capacity, and common security and data-residency standards. No eligibility is assumed. Access is negotiated, with a named allocation authority and Canadian-priority and cost-recovery arrangements resolved before any commitment is made.

Shared evaluation record. A common report format and joint evaluations so that testing in one member country can inform assessment in another, with the European AI Office participating where general-purpose models or AI Act implementation are involved. The record creates no model approval, no presumption of conformity, and no transfer of liability. It informs assessment; it does not replace it. The five evidence states, versioning, model-change triggers, and reassessment rules are built into the format itself.

Coordinated procurement: wildfire and smoke situational awareness. A common problem statement and evidence framework; separately competed, separately authorized procurements under the Canada–EU Comprehensive Economic and Trade Agreement (CETA) and each buyer's own procurement law; transparent performance, accessibility, and security benchmarks; and a pathway for compliant suppliers to sell across participating markets.

The allied market

The workstreams build capability. The allied market converts that capability into leverage.

Participating members would converge on a common set of transparency, safety, evaluation, and security requirements for AI offered in participating markets. The requirements attach to providers (vendors, labs, model suppliers, cloud and infrastructure operators) wherever a system is offered, provided, or deployed for use in the market, not only when a government buys it. Compliance with the requirements of one member confers standing across the allied market. Failure of those requirements, such as opacity where transparency was required, unsafe deployment, or refusal of evaluation, makes the provider subject to exclusion by all participating members, so the provider faces the consequences of non-compliance in the combined market instead of one jurisdiction at a time. The goal is that a non-compliant model is not offered in any participating market, whether on public procurement or commercial sale.

Each member adopts the common floor into its own law and keeps its own specific rules above the floor. The floor states what any AI offering in an allied market must satisfy (transparency, safety evaluation, incident cooperation, security standards); how a member reaches that floor, and what it adds above it, stays within that member's jurisdiction, whether that member is the European Union operating under the AI Act, or a country legislating, regulating, or procuring under its own powers. Compliance in one market confers standing in all of them because the floor is one; the superstructure is each member's own.

The mechanism is drawn narrowly so that its limits are explicit. The requirements are jointly defined through the evaluation-record and standards work. The bar is coordinated, and it is not automatic: each member administers exclusion within its own authority, through its own procurement rules, regulators, and market-access instruments, with CETA coverage, EU procurement law, and state-aid and competition rules preserved and no named firm advantaged. Pooling lies in one compliance perimeter and jointly made enforcement decisions, executed separately by each member. Evidence and market consequence therefore move together across partners, and each legal act remains Canada's, the EU's, or another member's own. Each member also states which instrument carries the commercial piece. The European Union can already bar non-conforming systems from its single market under the AI Act; Canada needs the market-supply power described in the legislation section, which only legislation can grant. That statute is therefore a precondition for commercial exclusion in Canada. The compliance perimeter is drafted to become the floor's full expression once the statutes in each jurisdiction exist; until then it binds public purchases and EU-market offerings, and it reaches other Canadian and allied commercial users elsewhere only where members' existing law permits.

The allied market carries a collective-response mechanism as well: any member facing coercive use of stack dependency (a cutoff, pressure applied through a provider) can invoke consultation, and partners commit to a menu of coordinated responses drawn from the same market instruments: aligned procurement demand, reciprocal compute reservation, preference for the affected member's trusted suppliers, and coordinated export and allow-list positions. Each response is separately authorized, and none is triggered automatically. The commitment is to consult, and every lever it can reach (market access, compute capacity, procurement demand) is one the alliance actually holds.

For a provider whose economics depend on trusted-market access, this discipline is stronger and cheaper than anything Canada could enact alone: the compliance perimeter follows the provider into every participating market, and a provider cannot avoid it by choosing a friendlier regulator. The deterrent and the market-pooling benefit are the same fact. The requirements without the pooled market are conditions nobody must meet, and the pooled market without the requirements is only a larger market with no standards.

Open weights and fine-tuned derivatives

The constraint in 1.4 is operationalized here. Distribution through open weights remains lawful. The record travels with the weights.

The requirements attach to whoever makes a system available, so they allow open-weight publishers and fine-tuners to comply. Distribution through open weights remains a lawful route to market; the obligations follow the offering, not the price or licence.

Base-weight publishers comply by publishing the evaluation record with the weights: a model card covering intended use, capabilities, known limitations, and prohibited uses; the evidence record with its five status labels; stated conditions and restrictions for downstream use; and a commitment to cooperate on incident reports and to publish updated weights or guidance when incidents show the documented limitations are wrong. The record travels with the weights, which is what makes downstream compliance checkable.

Fine-tuners and derivative builders inherit the base publisher's record by default. A fine-tuner who makes a modified model available supplies a delta record: what was changed, what new evaluation was run for the changed behaviour, and any new limitations introduced. The delta is the fine-tuner's own compliance evidence, and it is what keeps the exclusion aimed at non-compliant derivatives instead of at the base weights themselves. Small fine-tuners face proportionate obligations (lighter evaluation duties where the base record carries over unchanged), and purely private use, meaning research or personal use not placed on the market for others, stays outside the perimeter, consistent with the jurisdictional limits described earlier.

The perimeter creates market positions for compliant participants at every layer. A fine-tuner can sell into every participating market on the strength of a base publisher's record plus its own delta, and this structure is what allows new suppliers to enter.

Scope limits

Security and defence cooperation proceeds only through existing protected channels. No new compute-infrastructure funding decisions ride on the alliance's work; access and co-investment optionality only, and every dollar is a separate business case. No private-sector conduct is regulated by alliance language, guidance, or norms. Conduct rules enter through the legislation track or through each member's own law. Excluded domains re-enter scope only by Cabinet escalation, the same mechanism that expands the alliance's work.

What this asks of government

Ownership. The Minister of Artificial Intelligence and Digital Innovation owns the strategy, jointly with the Minister of Foreign Affairs and with the concurrence of the Minister of Industry, with named co-sponsors per track: Global Affairs Canada and Innovation, Science and Economic Development Canada for the alliance; Justice Canada and the Treasury Board of Canada Secretariat for legislation and the shared record; Public Safety Canada and Natural Resources Canada for the wildfire mission. The Privy Council Office holds a named escalation route: any track crossing another minister's authority moves to whole-of-government ownership, and Cabinet governs scope expansion from there.

The ask. A 90-day feasibility and partner-engagement phase across three tracks, under existing mandates and with no financial, procurement, infrastructure-access, or international commitment. The alliance track is authorized to test and comes back with go/no-go options; the two domestic tracks are the priority and proceed either way. The 90-day window covers the feasibility phase only: drafting and consultation run on the fast-track roadmap and continue after the 90-day return.

1. Legislative readiness (priority track): the Justice Canada–led 45-day map described earlier, running in parallel with drafting rather than ahead of it. The readiness map is published and the drafting gates are applied to it; this deliverable returns whether or not any partner agrees to anything.
2. Evidence record (priority track): pilot the AI Risk Evidence Record inside a live wildfire-relevant federal procurement, selected by the Public Safety Canada co-sponsor, with five-status evidence labelling, named decision owners, stop conditions, bilingual and accessibility-tested documentation, and Indigenous data-governance questions raised before design. The pilot stands on its own as a domestic instrument; if partner alignment holds, it doubles as the alliance's first joint project under the Canada–EU Digital Partnership Council's existing public-good mandate (the bilateral channel that already commits both sides to cooperating on AI for public-good uses such as wildfire and flood modelling). The record's outputs land in committee review and the regulatory program after the bill is tabled.
3. Alliance (conditional): co-design with Germany; joint soundings with the European Commission and France, then Norway and Finland; one detailed project feasibility case (recommended: wildfire and smoke situational awareness, doubling as the domestic pilot's vehicle) and two concept screens; EU-competence and authority mapping; procurement, competition, state-aid, and security review; costed options and go/no-go assessment. Planning envelope unchanged: 8–10 seconded personnel and $300,000–$500,000 incremental operating funds for 90 days, released only against a workplan with a confirmed source of funds. If the go/no-go tests fail, the domestic tracks continue on their own schedule and the alliance workstream closes.

Two named line items beyond the feasibility envelope, each released under the same confirmed-funds rule: resourced Indigenous rights-holder review of the Indigenous provisions, on the rights-holders' terms, before that content is treated as settled or published; and blinded evaluation of the pilot evidence record against a pre-specified rubric, with participant-burden measured. Dollar figures are planning-estimate language for officials to cost; accountable owners are named above.

Measures of success (published at 12 and 24 months, whether or not flattering):

Status. For discussion, not government policy. Nothing here estimates the probability or severity of any AI harm. Evidence cutoff 9 September 2026; instrument statuses re-verified at any decision point. All partner positions prospective until agreed; no commitment is created by any sentence above.

Appendix A. Safety framework and reference tables

This appendix consolidates the reasoning constructs used in the document so officials can apply them without other source material. It adds no new policy; it restates what the three sections use.

Related documents

This strategy is part of a three-part package on this site:

• The essay — AI Safety and Necessary Action. What safety means when exercised through regulation.
• The roadmap — From Readiness to Royal Assent. The staged path to Canadian AI legislation.