By Jen Evans, PatternPulse AI and Laszlo Lakatos-Hayward, Hyxos
Canada has the infrastructure for a sovereign cloud. The unowned layer is the model, and there is now a buildable, fundable path to one.
Canada’s AI sovereignty debate has organized itself around the compute layer. Hyperscale data centres. Sovereign cloud capacity. National model hosting. Procurement relationships with a small number of vendors. Cohere as flagship. CoreWeave as the financing structure underneath the SCIP announcement. Palantir as the procurement footprint inside federal departments. The state buys AI as a managed service from a centralized provider, and the sovereignty conversation reduces to which provider, which jurisdiction, and which contract terms.
The most recent contribution to the debate illustrates the limit of the frame. Writing in Policy Options in May 2026, Guillaume Beaumier and Hubert Cadieux argue that Canada’s Sovereign AI Compute Strategy directs too much of its budget toward private investment, and that funding should rebalance toward public, non-commercial computing infrastructure. The diagnosis is sound. Foreign-owned data centres on Canadian soil deliver little real sovereignty, because they remain under foreign jurisdiction and concentrate value with a handful of US firms. The prescription stops short. Rebalancing the compute budget addresses who owns the data centre. It does not address who owns the model running inside it, and the model is the layer where sovereignty is decided.
The compute layer is the part Canada has already learned how to specify, finance, site, and procure, even though ownership and jurisdiction remain unresolved. Canada hosts hundreds of data centres and multiple hyperscaler cloud regions, placing it among the most cloud-served countries in the world. The gap at the cloud layer is ownership and jurisdiction, a problem of arrangement addressable through procurement design and domestic hosting requirements. The model layer is different in kind. Canada does not own a model whose weights, update channel, licensing, and commercial lifecycle sit under Canadian control. A country can host every server domestically, on public infrastructure funded exactly as Policy Options recommends, and still depend entirely on a model controlled abroad.
Treating the model layer as buildable is no longer a stretch, and that changes what Canada should fund. This piece sets out the analytical case briefly and then states six actions in instrument form: the legal vehicle, the accountable owner, the trigger that activates it, and the enforcement hook. The two highest-leverage moves are a procurement default, the only action a minister can directly authorize, and an IP vehicle, the mechanism that would have kept Canada’s most important recent model breakthrough in the country.
The enabling technology is an architecture class, not a single model
Samsung’s SAIL Montréal lab published the Tiny Recursive Model in late 2025. TRM reaches roughly 45 percent accuracy on ARC-AGI-1 and 8 percent on ARC-AGI-2 using a seven-million-parameter network, outperforming DeepSeek R1, o3-mini, and Gemini 2.5 Pro on those reasoning benchmarks, models thousands of times larger by parameter count. It achieves this through recursion, drafting an answer and repeatedly revising it, rather than through scale. It was trained for roughly ten thousand dollars on a single GPU over a few days, and released under an MIT license that makes it commercially usable by anyone.
TRM as published is a structured-reasoning solver trained on grid and puzzle tasks. It is not a general-purpose language model and not a system a government would deploy as-is for citizen-facing text. Its significance is as an existence proof: a capable reasoning model can be built at a parameter count, a cost, and a timescale that put model ownership inside the reach of a national research program rather than only inside the reach of firms spending hundreds of millions on frontier training runs.
The more important point is that the approach has not stood still. Tracking by Laszlo Lakatos-Hayward indicates that within months of the original publication the recursive small-model approach has split into a family of variants spanning a range of parameter scales, with competitive versions now well below the original seven million, and that independent research groups are adapting it to new application classes and pushing it toward deployment on edge silicon. Work at ETH Zurich by Thorir Mar Ingolfsson is extending recursive models to time-series tasks and quantizing them for deployment on microcontroller-class hardware. The sovereignty case does not rest on Samsung’s specific artifact. It rests on the architecture class being public, cheap, reproducible, and improving quickly, which is what the record now shows. The strategic posture is to build toward where this technology is heading, not where it sits today.
The consequence for deployment is direct. Application-specific recursive models can run on mobile-class ARM processors, on CPUs from Intel and AMD, and on FPGAs and microcontrollers from vendors including ST, Renesas, and NXP. They do not require frontier-scale GPUs or hyperscale data centres for inference. That moves not only computation but decision-making, governance logic, and security functions onto operational-technology devices at the edge, rather than backhauling them to a centralized authority. That is the architecturally different approach sovereignty requires.
Distribution changes the security problem rather than removing it. Recent work from the University of Toronto and the Vector Institute demonstrated, in a closed lab, that a stripped open-weight model can power a worm that adapts as it spreads across connected devices, turning a sprawling endpoint estate into an expanding attack surface. An edge inference layer that places workloads on thousands of institutional and field devices inherits exactly that exposure. The architecture answers it on the same terms the research implies: each tier is segmented so a compromised node cannot traverse, managed and institutional devices are hardened, patched, and credentialed to a defined baseline, and consumer hardware is excluded from critical functions. An attested, segmented edge mesh is more defensible than either an unmanaged device sprawl or a single centralized system that fails all at once. Securing the edge is a design requirement of this architecture, sized and owned alongside the serving layer, not an afterthought.
The cost of inaction, stated as a recurring pattern
TRM is the worked counterfactual. The lead author did her PhD at Mila, lives and works in Montreal, and built the work on Canadian public research infrastructure. The talent, the compute, and the research base were Canadian. The intellectual property belongs to Samsung, a South Korean conglomerate. The researcher never left, but the IP did.
This is a structural pattern, not an isolated loss. Palantir captures the federal procurement layer. CoreWeave captures the financing layer beneath sovereign compute. Samsung captures the IP layer beneath Mila. Each comparable breakthrough transfers the commercial value of a model class abroad while Canada retains only the training cost. The defensible statement of urgency is this recurrence, not a fabricated dollar figure. A precise “X billion lost” number would be the first thing a hostile reader demolishes, and the structural claim is stronger without it. Canada built the talent pipeline and lacks the vehicle to keep what the pipeline produces.
Why an edge serving layer is the fast path
Training frontier models requires capital, chips, energy, and ownership structures Canada will not replicate at hyperscaler scale. Inference is a different problem, and most day-to-day government AI use is inference. Small recursive models are built for exactly the lightweight, distributed inference that existing telecom infrastructure can host. Canadian carriers already hold fiber, towers, a national 5G build-out, and edge compute at metropolitan aggregation points.
The decisive figure is lead time. An edge serving layer built on existing, permitted telecom real estate can reach service in roughly 18 to 24 months, against three to five years for a hyperscale campus, with capacity added incrementally rather than in a single build. The reason is the bottleneck it routes around. A distributed edge serving layer runs on the medium-voltage distribution Canada already has, avoiding the high-voltage transformer constraint that is stalling hyperscale buildout elsewhere. Workloads stay in-jurisdiction, on allied silicon, on infrastructure that is already sited and powered.
The sizing below is an engineering sketch from Laszlo Lakatos-Hayward, included to establish order of magnitude. It has not been independently validated and is not a procurement input until it is. A serving layer for the roughly eight million people of the Greater Toronto region, holding to a target of 100 milliseconds to first token, sits on the order of three megawatts of IT load, roughly ninety racks at the 35-kilowatt class, distributed across eight to twelve existing metropolitan hub sites on medium-voltage distribution and metro fibre already in place. The defensible range pending validation is roughly three to five megawatts, and the spread is driven by two unvalidated parameters, per-rack model throughput and total query demand, which is precisely what an engineering validation must pin. Batch inference, fine-tuning, and any training sit off the latency path at regional sites on the order of two twenty-five-megawatt facilities, sized separately. Frontier pretraining is out of scope and bursts to cloud or a third site if required.
Serving architecture (critical path ≤100 ms first-token)
• Users — ~8 million, Greater Toronto region. Devices, public workers, citizen services.
• 5G RAN access — existing carrier last-mile. 10–30 ms access, the dominant latency term.
• Serving tier — distributed edge mesh. ~3 MW IT, 35 kW/rack, across 8–12 existing central-office / aggregation sites, linked by metro fibre at sub-millisecond latency.
Each action below names a legal instrument, an accountable owner, a trigger or threshold, and an enforcement hook. The procurement default and the IP vehicle carry the argument. It is important to note that strong contract governance is necessary up front, at the start — not just a years-later, after-the-fact, political AG report.
1. Procurement default: an edge-first feasibility gate
Instrument. Amend the Treasury Board Directive on the Management of Procurement to require a documented edge-first feasibility assessment before any centralized AI service contract is signed.
Owner. Treasury Board Secretariat. Exemption sign-off escalates to the departmental CFO or deputy head above a defined contract-value threshold.
Trigger and exemptions. The assessment is mandatory for every centralized AI procurement. Exemptions are defined, not discretionary: frontier-scale training, demonstrated absence of domestic capability, or a time-critical operational or national-security need.
Teeth. The assessment is a gating artifact, not advice. Non-compliant procurements are flagged in mandatory internal audit, subject to PSPC internal audits and fall within the Auditor General’s performance-audit scope. This is the centrepiece, and the only recommendation a minister can authorize directly. It isn’t sufficient, but it is what we currently have.
The buying question changes accordingly. Procurement stops asking which vendor will provide the service and starts asking what the smallest model is that can perform the task, where inference should occur, what data must leave the device, what runs offline, what fallback exists if the provider withdraws, who controls model updates, and whether the institution can switch models without rebuilding the service. PSPC would do the documented edge-first feasibility assessment before any centralized AI service contract is signed.
2. IP and commercialization vehicle
Instrument. An arms-length federal IP-holding entity, a Crown corporation or sovereign IP fund, capitalized through the Strategic Innovation Fund and mandated to hold, license, and defend model IP produced on Canadian public infrastructure.
Owner. Innovation, Science and Economic Development Canada.
Trigger. When publicly funded research yields commercializable model weights and rights are about to assign to a foreign-controlled entity, the vehicle’s right of first refusal activates at a pre-agreed valuation. The capture mechanism is an IP-assignment or right-of-first-refusal condition attached to federal research funding.
Note. SR&ED is a tax credit and cannot carry IP-assignment conditions. The hook must be conditional grants. Canada has no statutory march-in right equivalent to the US Bayh-Dole Act; any march-in or claw-back power must be created contractually in each funding agreement and cannot be asserted as existing law.
3. Sovereign model program: staged go/no-go gates
Instrument. A staged, gated program funded by rebalancing the Canadian Sovereign AI Compute Strategy, a roughly $2.4 billion envelope across Budgets 2024 and 2025, of which up to $1 billion is committed to public supercomputing and roughly $890 million is earmarked for the SCIP supercomputer. No phase funds without the prior gate passing.
Owner. A named ISED–Mila/CIFAR consortium with a single accountable lead.
Phase 0, funded pilot. Train a recursive small-model variant on a defined government structured-inference workload. Gate on accuracy parity at lower cost per inference.
Phase 1, workload validation. Extend across the structured-inference class, including classification, routing, document tagging, and form processing. Gate on accuracy, latency, and cost across a pre-defined set of production workloads agreed at the Phase 0 gate.
Phase 2, text extension. Attempt citizen-facing text generalization, with open-weights models covering the interim. Gate before any deployment.
4. Capacity estimate: funded independent validation
Instrument. A commissioned engineering deliverable. Independent network-and-power validation by a qualified firm of DNV or KEMA class, or a named Canadian firm partnered with a carrier, scoped to demand, per-rack throughput, RAN access latency, and power siting, delivered inside a stated window of roughly six months.
Owner. ISED, in partnership with a participating carrier.
Status until it reports. The sizing in this paper is cited as illustrative only and never as a procurement input. The serving-layer target is 100 milliseconds to first token, stated explicitly because full-response generation at 100 milliseconds is infeasible for non-trivial output and claiming otherwise would cost credibility.
5. Silicon diversification, with a trade-law anchor
Instrument. An Allied Qualified-Vendor List for edge-inference silicon, covering FPGA and CPU classes from Germany, Japan, Korea, the UK, and the Netherlands, with a procurement-preference hook anchored in the government-procurement chapters of existing trade agreements such as CETA and CPTPP, so allied sourcing is trade-law defensible rather than arbitrary.
Owner. ISED and Public Services and Procurement Canada.
Reference pilot. One production edge node running non-Nvidia silicon on a real workload.
This is diversified allied dependency, not sovereignty. It is a real improvement because export-control exposure is the most volatile risk in Canadian AI infrastructure, and concentrating that exposure on a single foreign jurisdiction when alternatives exist is a procurement choice rather than a physical necessity.
6. Model provenance as a procurement requirement
Instrument. A provenance-aware model-selection requirement in AI procurement, treating a model’s upstream control the same way compute location is treated, applied to the open-weights models that cover workloads the sovereign program has not yet reached.
Owner. Treasury Board Secretariat, as a companion to the item 1 directive.
Rationale. Running a foreign open-weights model on a Canadian government device delivers compute-layer and data-layer sovereignty without model-layer sovereignty. The update channel is its own dependency: if an upstream provider sunsets a model, alters its alignment behaviour, or restricts commercial use, a sovereign edge tier built on it degrades. Open-weights European alternatives such as Mistral, hostable on Canadian infrastructure under transparent licensing, sit closer to the sovereign end of that spectrum than models whose upstream lifecycle is controlled by a US, Chinese, or Korean corporate parent.
The Model Conversation is Inevitable
A centralized AI strategy asks where Canada can buy or build enough compute to remain sovereign. The cloud answer to that question is largely in hand. The decisive question is whether Canada owns the model running on top of that compute, and a Montreal lab has shown that a capable model can be built for the price of a used car, by people already here, on infrastructure already here, with the architecture class now improving in public month over month.
The next phase of the sovereignty conversation will be settled at the model layer. It will be won by a procurement default that tests edge-first feasibility before centralized contracts are signed, by an IP vehicle that keeps the next Montreal breakthrough in Canadian hands, by a staged sovereign model program funded from the envelope already committed to compute, and by an edge serving layer that reaches service in two years on infrastructure Canada already controls. The sovereign question is where the computation happens, what data moves, what still works when the cloud does not, and whether the model itself belongs to the country running it.
Jen Evans is the founder of Pattern Pulse AI and co-founder of Tech Reset Canada. She publishes the Canadian AI sovereignty series tracking infrastructure dependency, procurement risk, and AI reliability. Laszlo Lakatos-Hayward is the founder of Hyxos Innovations and works on edge and grid-edge infrastructure and AI deployment architecture. Capacity figures are illustrative and require independent network and power engineering validation.
