Canada wants AI sovereignty. It hasn't secured the AI itself.

On June 4, 2026, Prime Minister Mark Carney launched a federal "AI for All" strategy built on three pillars: build trust, create opportunity, and reinforce Canadian sovereignty. The plan targets roughly $200 billion in additional growth, about 250,000 new AI-related jobs over five years, and AI adoption lifted from roughly 12 percent today to 60 percent by 2034. These are projected targets, not realised spending. A separate federal Canadian Sovereign AI Compute Strategy, announced in Budget 2024, commits about $2 billion over five years: up to $700 million through the AI Compute Challenge for private data centres, and up to $1 billion for public supercomputing under the AI Sovereign Compute Infrastructure Program. Both figures are committed ceilings, not disbursements.

The trust pillar funds the legislative and evaluation layer. The sovereignty pillar funds the data centres. Devi Narayan, a former Toronto Police investigator who now runs the security firm Autnhive, argues in a recent BetaKit essay that those two pillars are not the same problem.

In that essay, Narayan puts sovereignty on one side (ownership and control of the AI stack, including compute, data, and models) and security on the other (whether the AI system behaves as intended). Her argument is that current stacks, including firewalls, antivirus, and endpoint monitoring, were built for deterministic software and do not watch how AI systems reason or respond.

That framing lands on something most readers have already met. A chatbot at a Watsonville, California, Chevrolet dealership agreed in 2023 to sell a $70,000 vehicle for one dollar after a customer typed a careful, conversational prompt at the end of a normal exchange, according to a report originally filed by Yahoo News and cited within Narayan's BetaKit essay. No exploit, no malware, no code injection. It was not a glitch. It was a system behaving the way language models behave. A request framed persuasively enough becomes a new instruction, and the chatbot, with no underlying logic for what counts as a deal, simply agrees.

Mechanically, the difference is determinism. Traditional software is deterministic: the same input produces the same output, a known bug can be patched, and a test that passes today will pass tomorrow too. AI systems are probabilistic. Their outputs depend on training data, on context, and on the specific language used to ask the question. Guardrails are written as instructions to be followed, not walls to be enforced. Slow drift, poisoned data, and persuasive prompts are part of the attack surface in a way they never were for a database or a web server.

This is the layer the cybersecurity industry has not finished building. A firewall cannot tell whether a model's answer was safe before it was sent. Endpoint monitoring cannot tell whether a prompt was a routine request or a slow-motion jailbreak. Narayan's argument is that the federal strategy's trust pillar is missing an operational counterpart. Not a law. Not an institute. A working security discipline that watches AI behaviour in production.

The strategy does expand the Canadian AI Safety Institute to run transparent model evaluations, and it does move on modernised frameworks: deepfake and surveillance-pricing protections, plus an online safety regime for chatbots and social platforms. Those are real things. They are also upstream of the problem Narayan is naming. Evaluation tells you what a model does in a lab. It does not tell you what it does on day 700 of running in a hospital scheduling system or a police evidence-management platform.

The Five Eyes intelligence alliance (the United States, the United Kingdom, Canada, Australia, and New Zealand) has warned separately that AI-powered cyber incidents could produce "crises" inside allied governments. Narayan's essay channels that warning for Canadian readers, but the broader point translates: if Canada and its closest allies are publicly worried about AI as a security surface, owning the hardware is not the same as defending it.

None of this argues against building national AI capacity. A country dependent on foreign clouds for its models has a real sovereignty problem, and the $2 billion envelope is a reasonable public investment in addressing it. The point is sequencing. Sovereignty is a precondition for a sovereign trust conversation. You cannot judge whether your own model is safe before you have your own model. Once the data centres exist, the security discipline has to be designed into the deployed systems, not bolted on after a hospital or a police service finds out the hard way.

Three things are worth watching. The first AI Compute Challenge awards will show who is actually building the infrastructure and on what terms. The Canadian AI Safety Institute's first public model evaluation results will show whether the trust pillar has teeth. And the first public incident involving a deployed Canadian AI system behaving like the Watsonville chatbot will tell us whether the security discipline arrived in time.