Businesses face a critical decision when determining how much control to retain over the technology, data and third-party vendors sustaining their AI systems. Making that decision requires evaluating governance, operational dependencies, risk management and internal capabilities. Integrating AI raises many issues, including choosing between building a proprietary solution and buying an off-the-shelf one—the build vs. buy dilemma. To complicate matters, the choice must be made against an evolving regulatory backdrop and a constantly shifting technological landscape. Should an in-house tool tailored to organizational needs be built or an existing commercial product be bought? Which functions should be controlled internally? What data can be shared with third parties, and who will have access to it? What technological or contractual dependencies stem from these choices? The choice between building in-house AI capabilities and buying an off-the-shelf solution carries ramifications that reach far beyond the technology itself, requiring a broader analysis of governance and how much control an organization intends to maintain over its AI environment. Building or buying an AI solution: a strategic decision The business needs that AI can address vary widely across organizations and can include automation, productivity gains, decision-making support, data analytics and processing sensitive information. Beyond the identified need, a strategic assessment must factor in several elements: Intended uses Data sensitivity Acceptable risk tolerance Internal capabilities Regulatory requirements Current and future needs A commercial product can quickly address certain requirements without tying up a specialized internal team. Conversely, adaptability requirements or sensitive data processing can lead a business to favour in-house development. The real issue is weighing the control each option offers against the dependencies it creates. AI and data governance AI governance is inextricably linked to data governance. When an organization entrusts data to a third party, it is not enough for it to simply know where that data is hosted. It must also have full visibility into the environment in which the data flows and who can access and process it. Data is a strategic asset that organizations cannot expose without accounting for risk, particularly in sectors where confidentiality is critical. The legal sector is a prime example given the sensitive nature of client information, but the principle holds true across every industry. Governance is not merely a matter of compliance. It also dictates how data is protected, organized and used to support organizational objectives. Exercising governance requires a precise grasp of how data flows through the technical environment. Organizations must be able to obtain clear answers to questions such as: Where is the data hosted? Who can access it? Which jurisdictions may have authority? Even when a commercial vendor states that it stores data within a specific jurisdiction, its underlying infrastructure, redundancy mechanisms or third-party dependencies can create far more complex data flows. Selecting an AI vendor: assessing technical and contractual dependencies Selecting a vendor involves more than evaluating a solution’s capabilities or cost. Using a commercial AI solution can create technical and contractual dependencies that an organization must be able to identify and govern. This means determining: Which third-party vendors may be involved What infrastructure underpins the solution Which jurisdictions are involved This assessment should enable the organization to determine what it will control directly and what it will outsource to third parties. Deciding whether to build or buy AI tools is not merely a technical choice —it dictates operational autonomy and exposure to third-party risk. Integrating AI into a business: balancing adoption and critical thinking For many organizations, employee adoption is already a concern. Some employees may hesitate to use AI, while others may embrace it too quickly without understanding how it works or what risks it carries. Considerations include: whether users will use AI securely; how to mitigate data leaks; and how steep the learning curve will be. The challenge lies in building an environment where employees trust AI enough to use it, while continuing to exercise sound judgment and critical thinking. Striking that balance requires not only robust governance frameworks, but also trained employees who can use AI and question its output when warranted. As AI capabilities evolve, human oversight will remain essential. Long-term AI governance: future-proofing a business What will an organization that has truly integrated AI look like in ten or twenty years? It will have: Appropriate governance Clear lines of accountability The required skill sets A culture supporting deliberate AI use Control mechanisms High-quality information and data An organization must be able not only to use AI, but also have full visibility into how its data is handled, how its vendor network operates and what risks come with AI use. An AI strategy does not simply involve rolling out a new technology. It must rest on data governance, workforce skills, corporate culture and the controls necessary to drive responsible, value-generating use. Making AI a collective decision Whether an organization chooses to build its own AI capabilities or buy an off-the-shelf solution, the decision should never be made in a silo. Technical considerations are only one part of the equation. Data, cybersecurity, data protection, legal and regulatory requirements, vendor dependencies, internal capabilities, costs, user adoption and business objectives are deeply intertwined. Looking at the decision through a single lens risks shifting risk exposure elsewhere rather than mitigating it. Integrating AI successfully means bringing all key decision-makers to the table right from the start. As AI takes on a larger role, businesses that take a unified approach to oversight will be far better equipped to make informed choices and turn AI investments into enduring, value-generating capabilities. Survey of 495 American AI decision-makers conducted from November 7 to 25, 2025. Participants included executives, VPs of engineering and product and leaders charged with AI procurement and development within organizations actively using AI. Read the 2025 survey.

The energy transition is transforming the way major infrastructure projects are designed, financed, approved, and built. Decisions made today will have repercussions for decades to come, as technologies, markets, regulatory frameworks, and the geopolitical climate continue to evolve. In this context, the ability to manage uncertainty is crucial. For decades, energy infrastructure has advanced in a relatively predictable environment. The technologies were proven, the business models were well-established, and the risks could be assessed based on relatively stable parameters. Today, the projects that will shape the coming decades must be designed with several simultaneously changing variables in mind: Emerging technologies Growing energy demand The decarbonization of the economy Weather events The availability of capital Changes in regulatory frameworks Social acceptability A new geopolitical climate Yet infrastructure evolves at a different pace; it requires substantial capital investment and shapes economies for decades. This discrepancy is one of the major challenges of the energy transition. We have to make decisions today that will have repercussions for 50, or even 100, years—and yet the data needed for us to make them remains uncertain. Waiting for the uncertainty to pass isn’t necessarily the least risky strategy. The cost of inaction must now be an integral part of risk analysis. The energy transition: Managing uncertainty in infrastructure projects The energy transition will likely not be driven by one single technology. Electrification, energy efficiency, renewable energy, dual-energy systems, renewable gases, storage, and carbon capture and removal technologies can play different roles depending on the sector, region, and time horizon. This is changing the way we approach infrastructure investments. Historically, many infrastructure projects were evaluated individually with the goal of minimizing the risk associated with each one as much as possible. Now, the pace of technological advancement calls for a greater focus on solution portfolios. Some technologies are already mature, while others aren’t yet. Some will quickly reach commercial scale, while others will develop differently than we currently anticipate. The energy system’s resilience will therefore depend less on identifying a definitive solution now than on combining different approaches and maintaining enough flexibility to adapt. A project may involve greater technological uncertainty while still creating value system-wide, particularly through: Diversification Additional capacity Security of supply Reduction in emissions Greater resilience Risk analysis, therefore, is no longer solely about seeking to reduce the risk associated with carrying out a project. It must also take into account the risk to the system as a whole of failing to carry it out. Energy transition, competitiveness, and infrastructure resilience While decarbonization remains a key driver of infrastructure transformation, it is no longer the only one. Energy security, supply chain resilience, access to reliable and competitive energy, and geopolitical tensions are now playing an increasingly important role in investment decisions. In Canada, the abundance of certain resources, the expertise developed in the energy and infrastructure sectors, access to largely renewable electricity in several provinces, and the geological potential for carbon storage could become significant industrial advantages. The energy transition must therefore be viewed not only as an obligation to reduce emissions, but also as an economic transformation that has the potential to redefine competitiveness. For companies and investors, this changes the nature of strategic thinking. Decisions regarding energy, infrastructure, and decarbonization now directly affect: Investment strategies Asset location Supply chains Market access Long-term resilience Turning innovation into fundable infrastructure Turning energy innovation into actual infrastructure involves more than just inventing a technology. It’s also important to: Find a site Protect energy security Obtain the necessary authorizations Structure the financing Negotiate trade agreements Establish risk-sharing mechanisms Build lasting relationships with the communities involved In other words, the next stage of the energy transition is as much a matter of implementation as it is of innovation. The issue of “bankability” then becomes central. Early-stage projects that use emerging technologies are often costly and difficult to finance. Their implementation then makes it possible to build expertise, standardize processes, and gradually reduce costs. The challenge, therefore, is to create enough predictability to allow investors to commit, without prematurely locking in technological or regulatory models. Social acceptability: Integrating stakeholders into the project architecture The development of major infrastructure projects requires particularly close collaboration among developers, governments, regulatory bodies, lenders, investors, and advisors. Acceptability isn’t something that’s achieved at the end of a project. Even when a project is technically sound and economically viable, its success also depends on our ability to build a long-term relationship with the communities involved. This aspect takes on greater importance in a context where trust in institutions is eroding and information spreads rapidly. Consultation should therefore not be viewed as an administrative step that takes place at the end of a project’s development. For large-scale infrastructure projects, relationships with stakeholders are an integral part of the project’s very architecture. This approach is particularly important in relationships with Indigenous communities. Early engagement and models that enable meaningful participation in project design, benefits, and governance can profoundly change the dynamics of project development. The same logic applies to local communities. Trust is not based on a promise of zero risk. It relies more on transparency regarding the: Risks Profits Unknowns Mechanisms for resolving problems as they arise This aspect is all the more important given that the public already sees a connection between infrastructure, the economy, and the climate. According to the Global Infrastructure Index 2026, **72% of respondents believe that investing in infrastructure creates jobs and boosts the economy, while 59% believe that such investments make a significant contribution to combatting and mitigating the effects of climate change.**¹ However, this favourable perception cannot be taken for granted. For the organizations leading these projects, the quality of the dialogue and stakeholder engagement is in itself a key aspect of project risk management. Regulatory frameworks capable of supporting the transformation Regulatory frameworks play a vital role in protecting public interest. They must be able to adapt to the pace of the changes they oversee. The challenge is to develop processes that are sufficiently predictable, coordinated, and agile to enable developers and investors to understand the rules of the game and make long-term decisions. Effective regulation must pursue several objectives simultaneously: Protecting the environment and communities Maintaining the security of infrastructure Creating predictability for investors Enabling the integration of new technologies When approval cycles become much longer than cycles of technological innovation or investment, the risk is no longer merely administrative: it becomes economic. Legal considerations also come into play early in the project: risk allocation, the contractual framework, financing, regulations, and governance all help create the conditions necessary for the project’s implementation. Major infrastructure projects: Moving from ambition to implementation The coming years will likely see no shortage of climate goals, capital, and innovation. The key factor will be the ability to turn them into operational infrastructure. This process requires that several conditions be met: A long-term vision Capital and financing Government decisions Technologies Regulations Partnerships Community engagement and stakeholder relations Effective risk allocation In this new environment, the law is no longer confined to the periphery of a project, after business decisions have been made. It helps lay the groundwork for the project to exist. The projects that move forward will be those whose developers have managed to address uncertainty clearly enough to enable the various stakeholders to move forward together. The energy transition thus imposes a new discipline on infrastructure builders: that of thinking in the very long term while retaining the ability to adapt; of accepting risk without compromising on rigour; of exploring multiple solutions rather than seeking a single answer; and of building trust as methodically as the assets themselves. In a world where uncertainty is becoming the norm, the ability to implement projects is itself becoming a strategic advantage.

The cryptographic mechanisms that currently secure digital transactions, communications and signatures may become vulnerable with the advent of sufficiently powerful quantum computers. For businesses, the issue is no longer merely technological: it also affects governance, contracts, information protection and migration planning. Understanding post-quantum cryptography Imagine spending an entire week without transmitting sensitive information over the internet—no banking, no checking health records and no shopping online. Everyday transactions rely in particular on cryptographic mechanisms that: protect the confidentiality and integrity of information; authenticate individuals and systems; and secure digital signatures. However, the advent of sufficiently powerful quantum computers could compromise some of these mechanisms and consequently undermine a key pillar of our current digital security. Cryptography brings together the techniques used to protect the confidentiality and integrity of information, authenticate individuals and systems and secure digital signatures. It plays a role in particular when a browser displays a padlock icon, someone electronically signs a document or a company transmits confidential data. Many of these mechanisms rely on public-key cryptography, which uses a pair of mathematically linked keys: a public key and a private key. These keys derive their security from mathematical problems that would take conventional computers an astronomical amount of time to solve. A sufficiently powerful quantum computer, however, could solve some of these problems in virtually no time. As a result, widely used mechanisms, such as RSA and elliptic-curve cryptography, will no longer offer adequate protection. The immediate nature of the quantum threat Currently, only prototype quantum computers exist, and it is still difficult to predict exactly when they will become commercially viable or when major corporations and nation-states will use them. The Canadian Centre for Cyber Security nonetheless estimates that a quantum computer capable of posing a threat to current mechanisms could emerge as early as 2030, while acknowledging the uncertainty surrounding this timeline.1 In August 2024, the U.S. National Institute of Standards and Technology released its first three standards establishing cryptographic algorithms capable of withstanding this threat.2 For organizations, the issue is therefore not merely knowing when the threat will materialize, but determining what steps to take today to keep their information and systems secure into the future. Post-quantum cryptography refers to methods designed to resist attacks from both conventional computers and future quantum computers. From a mathematical standpoint, resistant algorithms exist, but many IT systems have yet to adopt them. The threat of “Harvest Now, Decrypt Later” The most pressing threat can be summed up by the phrase “Harvest Now, Decrypt Later.” A threat actor can intercept and store encrypted data today, then attempt to decrypt it once sufficient quantum capacity becomes available. Information that retains its value or sensitivity over several years, such as trade secrets, financial data, strategic information and privileged communications, is therefore at the greatest risk.3 The level of urgency depends on each organization's specific technological infrastructure. Key considerations include how long information must remain confidential and the time required to replace vulnerable mechanisms. According to Canadian best practices in the field, some systems have product lifetimes of 15 to 30 years, and a cryptographic migration can itself take several years.4 An organization can therefore fall behind long before a cryptographically relevant quantum computer ever reaches the market. Why businesses rely on their suppliers for the transition Most organizations do not develop replacement cryptographic solutions themselves. Instead, they rely on their software, cloud service, hardware, certificate and cybersecurity vendors. Such reliance does not make planning pointless—on the contrary. It shifts the focus toward governance, procurement and contracts. When it comes to contracts, organizations must assess these risks right now, particularly the allocation of liability between the contracting parties. Ideally, technology service contracts should specify whether the provider or the client bears the risks associated with using technologies that fall short on quantum security. Achieving balanced risk allocation requires open dialogue: Client organizations must ask the right questions and technology providers must be transparent about the limits of their systems. The federal government has begun its transition to post-quantum cryptography The federal government is no longer treating post-quantum cryptography as just a research topic. In June 2025, the Canadian Centre for Cyber Security published a roadmap to migrate the Government of Canada’s unclassified systems. Among other milestones, the document establishes an initial departmental plan and a first progress report starting in April 2026, the migration of high-priority systems by the end of 2031, and the migration of all other relevant systems by the end of 2035.5 A Security Policy Implementation Notice, which took effect in October 2025, reinforces these requirements and compels relevant federal institutions to demonstrate measurable progress.6 While these milestones do not apply directly to private businesses, they can still indirectly affect federal contractors. Since April 1, 2026, in-scope federal contracts with a digital component must incorporate clauses that support post-quantum cryptography and cryptographic agility, among other requirements.7 Federal directives make clear that orderly migration requires governance, inventories, prioritization, financial planning, procurement policies and coordination with vendors. Moreover, the post-quantum transition is by no means confined to the federal government. In September 2026, Canada joined a call to action from the G7 Cyber Security Working Group urging public and private organizations to adopt a phased, risk-based transition. Canadian guidelines likewise recommend that organizations begin preparing before large-scale solutions are rolled out.8 Legal implications for Quebec businesses No Quebec statute expressly requires private businesses to use any specific post-quantum algorithm or complete a migration according to the federal timeline. Instead, Quebec law establishes functional and technologically neutral obligations, which require the adequacy of the selected measures to be assessed in context. Protection of personal information and reasonable security measures The Act respecting the protection of personal information in the private sector requires businesses to take reasonable security measures, taking into account, in particular, the sensitivity, purpose, quantity and distribution of the information and the medium on which it is stored. It also mandates a privacy impact assessment for projects to acquire, develop or overhaul information systems or electronic service delivery systems that process personal information.9 For an organization that retains sensitive information with a lifespan of several years, such as banking information or Social Insurance Numbers, the quantum threat may become a material factor when assessing whether existing security measures are reasonable. Document integrity and confidentiality of transmissions The Act to establish a legal framework for information technology follows the same approach, requiring in particular that the integrity of a document be maintained throughout its life cycle. For instance, where the information contained in a document is declared by law to be confidential, section 34 requires that it be protected by means appropriate to the mode of transmission.10 Documentation explaining the mode of transmission and the measures taken to protect confidentiality must also be readily available to prove compliance. Rather than mandating specific technologies, the law sets outcome-based obligations, in particular safeguarding document integrity and information confidentiality. Civil liability and the state of knowledge As Quebec legal scholars emphasize, security measures only matter in the eyes of the law if they actually work.11 Accordingly, official publications and technical standards—while not giving rise to a civil obligation on their own—can help establish the state of knowledge, the foreseeability of the risk and recognized industry practices.12 An organization’s liability regarding its data protection obligations must be assessed according to the general rules of civil liability.13Liability would turn primarily on whether the organization acted with prudence and diligence at the relevant time, taking into account: the knowledge available at the time; the sensitivity of the protected information; the lifespan of its systems; and the availability of alternative solutions. Using a cryptographic mechanism that could soon become vulnerable may constitute a civil fault in light of current knowledge. Connected devices and reasonable security expectations Similar considerations could apply to manufacturers, distributors and suppliers of connected devices. Under the Civil Code of Québec, factors include the safety that a person is normally entitled to expect and the state of knowledge at the time the item was manufactured, distributed or supplied. Given these criteria, a product’s reasonably expected capacity to receive security updates could form part of the circumstances weighed when assessing a potential safety defect.14 Practical steps for businesses to prepare now Preparing does not call for an immediate overhaul of all existing mechanisms. Rather, it requires developing cryptographic agility—the ability to identify and replace cryptographic mechanisms without having to rebuild the underlying systems from scratch. The Canadian Centre for Cyber Security recommends a number of practical measures in particular:15 Inventory cryptographic assets. The inventory should cover internal and client-facing systems, certificates, authentication mechanisms, digital signatures, network equipment and cloud services. Special attention should be paid to legacy, custom-built or hard-to-update systems. Establish priorities. Organizations should identify information that must remain confidential over the long term and systems whose modification or replacement will require several years. Engage vendors. Organizations should obtain their vendors’ post-quantum roadmaps to determine whether the transition can be completed through updates or if it will require acquiring new products. Applicable standards, support lifecycles and impacts on interoperability should also be verified. Align contracts and procurement. New agreements could include, as appropriate, terms governing security updates, end-of-support notifications, the adoption of standardized mechanisms, cooperation during migration and the allocation of associated costs. Not all organizations face the same level of exposure. However, immediate attention is warranted where a business retains sensitive information over multiple years, operates systems that are difficult to replace or relies on vendors whose migration roadmaps remain unknown. While vendors will likely deliver the technical solutions, each organization must understand its own requirements, ask the right questions and ensure it remains agile enough to adopt these solutions when the time comes. Key takeaways: The quantum threat is already here, even if quantum computers capable of breaking certain cryptographic mechanisms are not yet widely available. The primary threat is “Harvest Now, Decrypt Later.”Data encrypted today can be intercepted, stored and decrypted in the future. The most exposed organizations are those that retain sensitive information over many years, operate systems that are difficult to replace or rely on vendors whose migration strategies are uncertain. In Quebec, there is no general obligation mandating any specific post-quantum algorithm, but businesses are bound to adopt reasonable security measures, assessed in context and in light of the state of knowledge. Preparation starts with cryptographic agility: inventorying assets and uses, prioritizing critical systems, engaging vendors and adapting contracts. CANADIAN CENTRE FOR CYBER SECURITY, “Preparing your organization for the quantum threat to cryptography (ITSAP.00.017),” February 2025, online: https://www.cyber.gc.ca/en/guidance/preparing-your-organization-quantum-threat-cryptography-itsap00017 NATIONAL INSTITUTE OF STANDARDS AND TECHNOLOGY, “NIST Releases First 3 Finalized Post-Quantum Encryption Standards,” August 13, 2024, online: https://www.nist.gov/news-events/news/2024/08/nist-releases-first-3-finalized-post-quantum-encryption-standards CANADIAN CENTRE FOR CYBER SECURITY, supra, note 1. CANADIAN FORUM FOR DIGITAL INFRASTRUCTURE RESILIENCE and CANADIAN NATIONAL QUANTUM READINESS WORKING GROUP, Canadian National Quantum-Readiness Best Practices and Guidelines, Version 04, July 10, 2024, pp. 3–7, online: https://ised-isde.canada.ca/site/spectrum-management-telecommunications/sites/default/files/documents/Quantum-Readiness%20Best%20Practices%20-%20v04%20-%2010%20July%202024.pdf. CANADIAN CENTRE FOR CYBER SECURITY, Roadmap for the migration to post-quantum cryptography for the Government of Canada (ITSM.40.001), June 23, 2025, p. 13, online: https://www.cyber.gc.ca/en/guidance/roadmap-migration-post-quantum-cryptography-government-canada-itsm40001. TREASURY BOARD OF CANADA SECRETARIAT, Migrating the Government of Canada to Post-Quantum Cryptography: Security Policy Implementation Notice, effective since October 9, 2025, online: https://www.canada.ca/en/government/system/digital-government/policies-standards/spin/migrating-government-canada-post-quantum-cryptography.html. TREASURY BOARD OF CANADA SECRETARIAT, supra, note 6, s. 6.3.1. CANADIAN CENTRE FOR CYBER SECURITY, “G7 Cybersecurity Working Group call to action on preparing for the post-quantum era,” September 3, 2026, online: https://www.cyber.gc.ca/en/news-events/g7-cybersecurity-working-group-call-action-preparing-post-quantum-era?; CANADIAN FORUM FOR DIGITAL INFRASTRUCTURE RESILIENCE and CANADIAN NATIONAL QUANTUM READINESS WORKING GROUP, supra, note 4, ss. 3–5.  Act respecting the protection of personal information in the private sector, CQLR c. P-39.1, ss. 3.3 and 10. Act to establish a legal framework for information technology, CQLR, c. C-1.1, ss. 6 and 34. Éric LABBÉ, “L’efficacité technique comme critère juridique ou la manière dont les lois se technicisent,” (2004) 9-2 Lex Electronica. Éric LABBÉ, “La multiplicité des normes encadrant le contrat électronique : l’influence de la technologie sur la production des normes,” (2004) 9-2 Lex Electronica; Charles-Étienne DANIEL, “Coder son propre droit : quand la machine pousse l’humain à énoncer de nouvelles normes de gouvernance,” dans Quand la société fait son droit : la gouvernance de proximité en action, 2026, EYB2026QSD19, pp. 397–432. Civil Code of Québec, CQLR, c. CCQ-1991, s. 1457; Act respecting the protection of personal information in the private sector, supra, note 9, s. 10. Civil Code of Québec, supra, note 13, arts. 1468, 1469 and 1473. CANADIAN CENTRE FOR CYBER SECURITY, supra, note 1; CANADIAN CENTRE FOR CYBER SECURITY, Guidance on becoming cryptographically agile (ITSAP.40.018), May 2022, online: https://www.cyber.gc.ca/en/guidance/guidance-becoming-cryptographically-agile-itsap40018.