The 2026 Canadian Sovereign Agent Deployment Playbook

By Sherif AbdElGawad, Chief AI Officer · Published 15 August 2026

This is the method we run on engagements. It is written out so you can run it yourself, run it with someone else, or read it before deciding whether to run it with us. Work through it in order: each chapter produces a written artifact that the next chapter consumes. Chapters 1 to 4 decide whether to proceed. Chapters 5 to 8 decide what to build and how you will know it works. Chapters 9 to 12 decide how it runs, what it costs and how it gets bought.

Who is this playbook for?

A program owner, chief information officer (CIO), enterprise architect or risk officer. The institution can be Canadian federal or provincial, a Crown corporation, a health or education organization, or a federally regulated financial institution. It assumes an internal knowledge workflow where a human already reviews the output (briefing, triage, service-desk research) rather than an automated decision about a member of the public. That distinction shapes everything that follows.

Chapters

• 1. What sovereign AI means in Canada, and what residency does not settle
• 2. Choosing the workload: a decision tree
• 3. Data classification and information-boundary screening
• 4. Algorithmic Impact Assessment (AIA) and decision-impact screening
• 5. The six architecture stages
• 6. Shared responsibility across four parties
• 7. Architecture patterns and their trade-offs
• 8. The evaluation and acceptance scorecard
• 9. The six-week pilot plan
• 10. Operations: what changes on day one of production
• 11. Unit economics: what drives cost per completed task
• 12. The procurement checklist
• Templates in this playbook
• Limitations and what this does not cover
• Primary sources

What does sovereign AI mean in a Canadian institution?

It means your institution can state, in writing, who can compel, administer, observe, change, interrupt and recover the service, and can act on those answers. Residency tells you where data is stored and processed. Sovereignty covers legal jurisdiction; infrastructure ownership; administrator and support access; encryption key custody; model provenance; telemetry; update control; incident response; and exit. A Canadian region operated by a foreign-controlled provider may satisfy residency while leaving that list unanswered.

Record the eight domains in writing. For each one, name the responsible party, the evidence you have seen, and the date you saw it. Domains where the entry is “not yet established” form the work list. An architecture review that covers one of the eight has not covered the question.

The obvious objection is that this is disproportionate for an internal drafting assistant. Often it is. Proportionality is the point: depth of evidence follows the classification and decision impact settled in chapters 3 and 4. But proportionality is decided after asking, not instead of asking. The long-form argument is in Canadian data residency is not AI sovereignty, and the control-by-control detail is on the sovereign AI page.

Run every candidate through this sequence. Failing a gate does not disqualify a workflow forever; it disqualifies it from being first.

1. Is a human already reviewing the output? If yes, oversight adds no new burden. If no, you are proposing to change who decides, which is a much larger governance problem. Take the first case.
2. Is there a measurable baseline today? Cycle time, queue age, backlog, rework rate or handle time, already recorded in a system rather than something you will start measuring during the pilot. Without one, the pilot cannot conclude anything.
3. Do approved sources exist, and can they be named? A finite, classifiable, retrievable corpus with an owner. “Everything on the shared drive” is not a corpus; identifying and classifying it is a separate project.
4. Can you assemble representative historical cases? You need real past examples with known good answers for the golden dataset in chapter 8. If nobody can produce 100 to 300 real cases, you cannot evaluate the pilot.
5. Is there a named sponsor and a named operating owner? Usually two different people. The operating owner runs it after the project team leaves and must agree to that in advance.
6. Is the integration read-only for the pilot? Retrieval and drafting first. Write-back into a system of record extends both the timeline and the risk profile, and can follow later.

Which workflow should a Canadian institution pilot first?

One where a person already reviews the output and a baseline metric already exists, with finite, classifiable source documents and 100 to 300 real historical cases to test against. In practice that means policy and research support; document intake and triage; or internal service-desk knowledge retrieval. Avoid anything that decides an entitlement, a benefit or a sanction for a member of the public as a first workload.

Score the survivors rather than arguing about them, using a weighted matrix like the worked example on the Governance Sprint page. Any consistent method puts disagreement into a cell where evidence can settle it. The three patterns documented on this site: policy and research support, document intake and triage, and the service-desk knowledge agent.

The characteristic failure is classifying the source corpus and approving the design. Then someone discovers that prompts, retrieved passages, embeddings, evaluation datasets, logs, caches and backups are all derived copies living somewhere else, under a different control regime. An agent architecture produces more copies of your information than a traditional application does, and each copy inherits the classification of what it was derived from.

Two rules keep this tractable. Design to the highest classification present in the boundary, or remove the offending sources from it. The second option is often the cheaper one. Write down the personal-information position early: whether it is present, necessary and reducible. Record how it will be handled consistently with the Privacy Act and your institution’s privacy instruments. Involve your privacy office here, not at the acceptance review. Our control model is on the security and governance page.

Does the Directive on Automated Decision-Making apply to a knowledge assistant?

It applies to production systems that make or support administrative decisions or related assessments about clients. It excludes test and research systems. A retrieval assistant that returns passages and citations to an analyst, who then independently reasons to a recommendation, generally falls outside that scope. But the boundary is a judgement your institution makes and records, and the Algorithmic Impact Assessment is how you document it. Screen early; the answer shapes the architecture.

The screening questions are short. Is the output used in an administrative decision about a client? Does it produce a score, ranking, recommendation or eligibility signal? Would a reviewer in practice adopt it without independent reasoning? Production or research? Does it touch protected characteristics or proxies for them? If the answers point toward the Directive, complete an Algorithmic Impact Assessment and let the impact level drive the peer-review obligation. Levels II to IV require peer review, and qualified reviewers may come from government, academia, civil society, a contracted specialist, or a board specified by the Treasury Board Secretariat.

The full treatment is in when does an AI assistant trigger an Algorithmic Impact Assessment. Federally regulated financial institutions run the parallel exercise against Office of the Superintendent of Financial Institutions (OSFI) Guideline E-23, effective 1 May 2027. It covers AI and machine-learning models, including third-party models. See OSFI Guideline E-23 and AI agents.

Stage 06 is the one a budget most easily leaves out, because it is the only one that requires continuing effort after launch. Budget for it in chapter 10.

Complete the matrix below per engagement, attach it to the statement of work, and re-issue it whenever a model, connector or hosting decision changes. The cells that come back empty the first time you fill it in are the ones to work on.

Two clarifications save arguments later. First, “owns” means accountable for the decision and able to change it, which is more than being consulted. Second, a provider’s published shared-responsibility model describes the platform rather than your workflow. The rows about classification, entitlements, approval authority and records retention have no platform-side answer, and your institution has to fill them in. Where a delivery partner claims a row, ask what evidence they will produce and on what cadence.

Which architecture pattern should we choose?

Choose the cheapest pattern that satisfies the classification and decision impact established in chapters 3 and 4, and no cheaper. For unclassified internal knowledge work where the value case is unproven, a managed API in a Canadian region is usually the rational first move. Where model telemetry is a hard prohibition or the corpus carries higher classification, an open-weight model on Canadian-controlled infrastructure is the stronger position. Decide with a written trade-off, not a preference.

A fourth shape, splitting traffic by classification across two patterns, is legitimate. Treat the routing decision as an evaluated control with its own test suite and a fail-closed default: a misrouted request is a disclosure, not a performance issue.

Build the golden dataset from real historical cases: 100 to 300 items, stratified across the question types, source areas, languages and edge cases the workflow contains. The people who do the work label them. A named adjudicator resolves disagreements and the reasoning is recorded. Refresh it on a schedule and whenever the corpus or the workflow changes.

Two disciplines make the scorecard credible. Safety and permission suites are pass or fail, never averaged, because a 99% pass rate on disclosure means one in a hundred disclosures. And the institution signs every threshold before the build starts, so nobody can renegotiate acceptance at week six. You will find the full method, including red-teaming, bilingual evaluation and the release gate, in how to evaluate a knowledge agent.

On the first day of production, five things become somebody’s standing job. Name that somebody before go-live, on both sides.

Regression testing on a schedule

The golden dataset runs on a defined cadence and before every release, against the acceptance thresholds. Drift then shows up as a number rather than a rumour from users.

Change control across four surfaces

The model version and the system prompt; the connectors and tools; and the source corpus. The institution proposes, evaluates, approves and releases each change with a tested rollback. Corpus changes are the easiest to miss, and they can cause a sudden drop in answer quality with no change to the model or prompt.

Access review

Entitlements drift as people move. Review who can reach the agent, what the agent can reach, and whether service identities still need what they were granted.

Incident classification and response

Define what counts as an AI incident before you have one. Three examples: a disclosure across an entitlement boundary, a confidently wrong answer that reached a client, and a source that should not have been in the corpus. Classify, respond, record, and add the case to the evaluation suite so it cannot recur silently.

A monthly report the sponsor reads

Threshold performance, escalation rate, unit cost, changes released, rollbacks, incidents, open corrective actions, and the value trend against the baseline.

Two structural changes matter beyond the checklist. Re-screening against the Directive becomes an item in change control rather than an annual event. And for federally regulated financial institutions, the model enters the model inventory with an owner, a validation schedule and documented limitations, as contemplated by OSFI Guideline E-23. See Managed AgentOps.

The right unit is cost per completed task, meaning a task a human accepted and used. It is not cost per request and certainly not cost per token. The gap between those two is where budgets go wrong: a system that is cheap per request and needs three attempts and an escalation is not cheap.

Model your break-even honestly. The fixed-cost patterns only become cheaper than usage-based pricing above a sustained volume you should calculate, with a dated set of assumptions, before choosing. Then re-run it: inference pricing has moved repeatedly, and a cost model needs a date attached to be usable.

Route

Identify the vehicle and confirm eligibility early. The Public Services and Procurement Canada (PSPC) AI Source List holds more than 145 qualified suppliers across three bands. The bands run up to CAD $37.5M. Count the list on the day you cite it. A further Invitation to Qualify is open; confirm the current solicitation number and closing date with the departmental AI procurement team. Where an institution holds a delegated low-dollar authority and an eligible method of supply, a single-workflow engagement can move under it, with the required searches and written justification. Confirm the eligibility and the standing of any supplier against that route in writing before you plan around it.

Canadian content

The Policy on Prioritizing Canadian Suppliers applies to strategic federal procurements at CAD $5M and above from 15 June 2026. Canadian considerations may also be used below that threshold.

Scope written as outcomes

Name the workflow, the baseline, the acceptance thresholds, the deliverables and the gates. Do not name a technology stack. Buying a stack means you own the outcome; buying an outcome means the supplier does.

Evidence to request from any supplier

Shared-responsibility matrix; data-handling description; subprocessor and hosting locations; and evaluation method with thresholds. Then the incident and breach notification path, the exit and data-return terms, and the accessibility position against the Web Content Accessibility Guidelines (WCAG) 2.2 Level AA.

Intellectual property and data rights

Who owns the prompts, the evaluation suite, the golden dataset and any tuned artifacts, and whether your content may be used for model training. Settle this in the contract, not on the marketing page.

Official languages and accessibility

Some services are public-facing, or serve employees with a right to work in either official language. For those, bilingual quality is an acceptance criterion tested in both languages rather than a translation task at the end.

Security assessment path

Which assessment and authorization process applies, who runs it, and how long it takes. It can add months, so start it first rather than discover it last.

Ask for evidence rather than assurances, and be sceptical of any claim of certification, approval or inspection that is not accompanied by a document you can read. What we can and cannot evidence today is set out in the supplier evidence pack, sent on request, and the buyer-side view is on the government page.

1. Workload selection scorecard

The chapter 2 matrix: seven dimensions, a weight and score for each, and a mandatory reviewer note recording the evidence behind the score. Produces a ranked shortlist and a written reason for each rejection.

2. Governance checklist

The six architecture stages, one row each with an owner, acceptance test, documented failure mode and current status. The standing agenda for design reviews. The twelve control domains are the reviewer-facing expansion of the same ground.

3. AIA screening questions

The chapter 4 screening list, formatted so answers and reasoning are recorded together. A preparation aid for your responsible-AI and privacy functions, not a substitute for the official Algorithmic Impact Assessment tool.

4. Shared-responsibility matrix

The four-party matrix, with rows for classification, sources, identity, keys, thresholds, approval, monitoring and exit. Attached to the statement of work and re-issued on material change.

5. Agent evaluation sheet

The chapter 8 golden-dataset structure: case identifier, question, reference answer, source passages, language, stratum, labeller, adjudication note, and each dimension against its threshold.

6. Pilot statement-of-work outline

A six-week scope written as outcomes and gates, with an explicit right to stop at any gate with a documented rationale.

7. Unit-economics worksheet

The chapter 11 variables with space for your own values, a dated assumptions block, and a break-even calculation between usage-based and fixed-capacity patterns. Ships with no default numbers.

8. Procurement evidence checklist

The chapter 12 request list in a form you can send to any supplier, with columns for the evidence received and the date, so evaluators compare documents rather than claims.