Last updated on June 2nd, 2026 at 12:09 pm
A National AI Strategy Names Goals. Regulation Binds Conduct. The United States Spent a Year Showing How Far Apart Those Two Things Sit.
By Jen Evans, Principal, Pattern Pulse AI; co-founder, Tech Reset Canada
A companion to the “Whose AI Runs the Government?” series.
———
Canada’s national AI strategy is rumoured to drop this week. The Prime Minister told reporters on Parliament Hill on May 27 that it was “coming out next week,” after a timeline that had slipped from the end of 2025 through a sequence of “very soon” and “released in 2026” deferrals. The spring economic statement gave the shape of it: six pillars, covering new privacy and online safety laws, sovereign compute infrastructure, support for Canadian AI companies, coordination with international allies, AI training for Canadians, and putting AI to work across the economy.
A strategy is a statement of goals. It names where a government intends to go and which priorities it will fund to get there. The conduct of vendors, professionals, and institutions stays untouched by a strategy on its own. Binding conduct is the work of regulatory instruments: disclosure requirements, liability rules, reporting obligations, enforceable standards with a body authorized to enforce them. Canada’s strategy points at two such instruments, a private-sector privacy bill expected from the AI minister and an online harms bill led from the culture portfolio, and defers both to future legislation that has yet to be tabled. The strategy is the destination. The regulation is the vehicle. This week Canada arrives, in some form. What will that destination include and what will be missing?
The distance between those two things is concrete, and the United States has spent the past year measuring it at full scale. The American demonstration is worth Canada’s attention precisely because it ran in the opposite political direction and arrived at the same place.
What the American Year Showed
The American year turned on a federal decision not to act. Congress had the one instrument that can bind AI conduct nationally, legislation, and twice declined to use it, rejecting a moratorium on state AI laws in the One Big Beautiful Bill Act and again in the National Defense Authorization Act. What followed shows what happens when the federal level holds the power to regulate and chooses not to: the binding falls to whatever level of government does act.
What the administration reached for instead was Executive Order 14365, signed in December 2025, “Ensuring a National Policy Framework for Artificial Intelligence.” In form it was a complete federal posture. It set policy as a “minimally burdensome national framework,” established a Department of Justice litigation task force to challenge state AI laws, directed the Federal Trade Commission to treat state-mandated bias mitigation as a deceptive trade practice, and conditioned billions in broadband funding on states repealing regulations the administration deemed onerous. The one power it lacked was the power to do the thing it was written to do. Federal preemption flows from acts of Congress, and an executive order sits below that threshold, so an order cannot displace state law that Congress had just declined to displace itself. Legal analysts at White & Case and Latham & Watkins said so within days: the order’s effect on state statutes runs through litigation and funding pressure that face significant hurdles. In April the Department of Justice intervened in a case seeking to invalidate Colorado’s AI Act, the first federal move against a state law under the order, and that case is the test of whether litigation can reach what legislation was never passed to reach.
The states held the authority the federal government had declined to override. Governors in California, Colorado, and New York stated that the order would not stop them from passing or enforcing their AI laws. State legislation regulating private AI conduct kept moving in several directions at once, Colorado’s high-risk deployer obligations, Utah’s disclosure requirements, Illinois’s biometric provisions, because there was no federal floor to defer to. Congress had chosen not to build one. The teeth in the American system stayed where they have always been, in state statutes enforced by states that hold the constitutional authority to enforce them.
The lesson is structural. A federal government that declines to legislate does not create a regulatory pause. It relocates the regulation to the level that will act. The most aggressive thing the United States did was decline to regulate and then try to stop anyone else from doing it, and the attempt failed on both ends: the field was not cleared, and the regulating went on where the authority sat.
The Vehicle Canada Has Already Built, and What It Carries
Canada has produced recent AI-adjacent legislation. Bill C-22, the Lawful Access Act, 2026, was tabled in March and now sits at committee. This series examined that bill in Paper 12, and the relevant point here is narrow: C-22 is an instrument with real teeth, and the conduct it binds is access and retention rather than safety or accountability. It mandates metadata retention, builds technical interception capability into electronic service providers, and attaches a secrecy obligation that suppresses disclosure of specific orders.
The pushback has been substantial and on the record. Signal’s leadership has said the company would leave Canada rather than compromise its privacy guarantees. Windscribe said it would relocate its headquarters, and NordVPN warned it might follow. Apple and Meta raised encryption and cybersecurity concerns. The Canadian Chamber of Commerce, the Canadian Civil Liberties Association, CIPPIC, and the Cybersecurity Advisors Network called for changes. The chairs of two U.S. House committees wrote to the Public Safety Minister warning of cross-border data risk. The bill’s own oversight body told the committee it lacks the access it would need to oversee what the bill assigns it.
So the Canadian statute book holds binding obligation with enforcement behind it. The obligation it holds is a surveillance obligation. The domestic-use question, how AI systems that shape medical, legal, financial, and educational outcomes for Canadians are required to behave, sits outside any binding instrument the country has enacted. The strategy names privacy and online safety bills as future work. The regulation governing how AI is actually deployed on citizens remains a vehicle Canada has yet to build.
The Instruments That Govern Domestic Use
Canada’s structure carries the same logic the American year exposed. The federal strategy is the posture. The authority to bind how AI is deployed on citizens sits substantially with the provinces, which regulate the professions and the delivery of medical, legal, financial, and educational services. The provinces are where the states are, and the professional-use lever Paper 8 mapped is the instrument that holds the enforcement authority. A federal posture that names goals without building the instrument leaves the binding to that layer, coordinated or not. The sovereignty series has spent fifteen plus papers specifying instruments. Paper 5 set out the instruments a functioning sovereignty regime requires. Paper 8 built the five-element coordination architecture for federal, provincial, and municipal alignment. Paper 11 specified the capability-sharing and procurement instruments Canada needs at the CUSMA table. Paper 12 specified the surgical amendments and defensive instruments C-22 would require to be survivable. Each of those instruments governs sovereignty: who controls the infrastructure, who can reach the data, whether Canada holds a seat at the coordination table.
The instruments that govern domestic use form a separate set, and the series has pointed at them while leaving them unassembled. They are the substance of the policy blueprint PatternPulse published in November 2025, and they are worth stating plainly, because the strategy’s own logic implies them even as the strategy leaves them out.
Domestic-use regulation with teeth rests on a small number of concrete mechanisms. A public adverse event registry that makes AI harms visible and measurable, on the model that every other high-consequence sector already operates, from pharmaceutical adverse event reporting to aviation incident reporting to automotive defect tracking. Mandatory reliability disclosure, requiring vendors to publish the operational boundaries within which a system performs as advertised, with real-time warnings when a system passes them. Professional-use restrictions, holding licensed doctors, lawyers, educators, and financial advisors to AI use within disclosed reliability limits and requiring disclosure when AI assists a regulated service. A liability framework that attaches consequences to deployment beyond disclosed limits and to failure to report. A risk-tiered structure that calibrates all of this to consequence, so that high-stakes domains carry strict requirements and low-stakes consumer tools carry light ones.
The professional-use lever matters most for the federal-provincial problem Paper 8 mapped, because it is squarely provincial. Provinces regulate the professions under their authority over property and civil rights. A province can require that a physician use a clinical AI tool only within its disclosed reliability envelope, that a lawyer disclose AI assistance, that a regulated service carry an audit trail, all while leaving jurisdiction over the model developer entirely alone. This is the instrument through which a Canadian provincial layer reaches private AI conduct. As Paper 8 established, it is also an instrument that yields fragmentation in place of coordination unless the analytical and standards work is done across jurisdictions deliberately. The domestic-use layer and the coordination architecture are the same problem seen from two angles.
Where the Teeth Actually Are
Canada has spent the past year strengthening its relationships with the pro-regulation middle powers, and the strategy’s international-coordination pillar formalizes that turn. The relevant comparators show what those partners hold that Canada’s strategy will name and leave undelivered.
Singapore has built the most sophisticated domestic-use governance architecture in the world. Its Model AI Governance Framework now runs to three editions, traditional AI in 2020, generative AI in 2024, and in January 2026 the world’s first framework specifically for agentic systems, supported by the AI Verify testing toolkit and the Project Moonshot evaluation suite. It is the design benchmark. Outside the financial sector, it also remains almost entirely voluntary: the frameworks operate as best practice that regulators reference, while binding force comes from the Personal Data Protection Act and the effectively mandatory central-bank guidelines for financial institutions. Singapore shows that sophistication and enforceability are separate axes. A jurisdiction can hold the most advanced framework in the world and still leave most of it voluntary.
Germany and France regulate AI through the European Union’s AI Act, binding law with a risk-tiered structure and an enforcement apparatus, though the bloc has proposed delaying its high-risk obligations from 2026 into 2027, (standalone high-risk AI rules may move to December 2027, while product-embedded high-risk systems may move to August 2028), a reminder that binding regulation holds only as much force as the date it takes effect. Germany adds a constitutional-court jurisprudence on data retention that has repeatedly struck down general and indiscriminate regimes, a body of enforceable law with direct relevance to instruments like C-22. France adds a capability Canada still lacks: a domestic frontier model in Mistral, which lets France regulate a technology it also builds. Canada’s national champion, Cohere, is taking a different path, building European distribution rather than a domestic frontier model. Its pending acquisition of Germany’s Aleph Alpha pairs Cohere’s enterprise reach with Aleph Alpha’s European public-sector relationships, and in May it signed a sovereign-AI agreement with Spanish defence champion Indra under a cooperation framework backed by the Canadian and Spanish governments, with Cohere supplying the language models and Indra the computing infrastructure. As The Logic reported, the Spanish deals are the latest in a series Canada has forged with European nations as it tries to assemble a middle-power alliance. The reach is real. What Canada lacks is the domestic frontier model it would need to regulate a technology it builds.
The partners Canada is aligning with govern domestic AI use through binding law. Canada is building the reach and leaving the law to future bills.
What This Week Decides
The strategy will arrive as a strong document or a weak one, and either way it will name goals. The question it leaves open, because a strategy structurally leaves it open, is whether Canada will build the regulatory layer that turns goals into binding conduct. The American year stands as the warning: a federal posture, however aggressive, stays inert until an enforceable instrument carries it. The Canadian strategy approaches the same lesson from the enabling direction. Six pillars and two deferred bills amount to a destination statement. The adverse event registry, the reliability disclosure mandate, the professional-use restrictions, the liability framework, and the risk tiers are the vehicle, and several of them are provincial, which means the coordination architecture and the domestic-use layer have to be built together for either to work.
The CUSMA review opens July 1. The federal position it requires has to be implementable across the provincial and professional frameworks where most Canadian AI deployment actually lands. A strategy released just before that window opens is a statement of intent arriving at the moment intent has to become instrument. The strategy is a necessary first step, and the year the United States just lived shows how much weight rests on the second one.
The strategy names where Canada wants to go. The regulation is how Canada gets there. This week delivers the first half, and the public stays exposed until the second half follows.
———
A companion to the “Whose AI Runs the Government?” series. See Paper 5 on the instruments a sovereignty regime requires, Paper 8 on the coordination architecture, Paper 11 on capital and capability, and Paper 12 on Bill C-22. The domestic-use instruments are set out in full in “AI’s Accountability Gap: A Policy Blueprint for Policymakers,” Pattern Pulse AI, November 2025.