By Maple and North
Opening Hook
By now, the conversation around artificial intelligence has moved beyond experimentation.
Organizations are integrating AI into cybersecurity operations, software development, customer support, fraud detection, research, and business decision-making. The question is no longer whether AI will become part of critical workflows.
The question is whether organizations are prepared when those workflows fail.
Throughout this issue of Claw & Charter, we have explored the risks of AI dependency, the role of local models in resilience planning, the importance of mapping critical dependencies, the continuing need for human accountability, and the value of testing AI outage scenarios.
The next step is action.
Canada does not need to own every AI capability it uses.
It does need a practical framework for understanding, governing, and testing the capabilities it depends upon.
This checklist is designed to help security leaders, technology teams, risk professionals, and executives assess their current readiness.
Why This Matters
Most organizations already maintain inventories for:
- Critical applications.
- Cloud providers.
- Vendors.
- Security controls.
- Business continuity plans.
Few maintain an inventory of AI dependencies.
As AI becomes embedded in operational processes, that gap becomes increasingly important.
A resilient organization is not the one with the most advanced AI.
It is the one that understands where dependencies exist and has a plan when those dependencies fail.
The Canadian AI Resilience Checklist
1. Inventory AI Services
Create a complete inventory of AI services used across the organization.
Include:
- External AI platforms.
- Embedded AI capabilities.
- Internal AI applications.
- Autonomous agents.
- AI-enabled workflows.
The goal is visibility.
You cannot govern what you cannot see.
2. Identify Critical Workflows
Determine where AI supports business-critical functions.
Examples include:
- Security operations.
- Fraud detection.
- Customer service.
- Software development.
- Risk analysis.
- Financial reporting.
- Executive decision support.
Not every AI capability requires the same level of oversight.
Critical functions deserve additional scrutiny.
3. Assign Ownership
Every critical AI dependency should have:
- A named owner.
- A business sponsor.
- A review schedule.
- An escalation path.
Ownership matters as much as technology.
If everyone owns it, nobody owns it.
4. Document Jurisdictional Exposure
Understand:
- Where providers operate.
- Which laws apply.
- Which jurisdictions have authority.
- What contractual protections exist.
This is not about avoiding foreign technology.
It is about understanding dependency.
5. Assess Concentration Risk
Multiple products may rely on the same underlying provider.
Ask:
- Are several services dependent on the same cloud platform?
- Are multiple tools using the same foundation model?
- Is there a shared identity provider?
- Is there a common data pipeline?
Apparent diversity can sometimes conceal a single point of failure.
6. Evaluate Local Capability
Not every organization needs local AI.
However, leaders should understand whether local capability could support critical workflows during a disruption.
Questions to consider:
- Can a local model perform basic analysis?
- Can sensitive investigations remain internal?
- Can operations continue in a degraded mode?
The objective is resilience, not replacement.
7. Review Access and Identity
AI systems should be treated as governed identities.
Document:
- Authentication methods.
- Privileged access.
- Credential storage.
- Approval boundaries.
- Logging requirements.
- Revocation procedures.
AI governance begins with identity governance.
8. Test an AI Outage
Conduct a tabletop exercise.
Ask:
- What happens if the provider becomes unavailable?
- What happens if access is restricted?
- What happens if outputs change unexpectedly?
- What happens if an autonomous workflow fails?
An untested fallback is not a fallback.
9. Preserve Auditability
Organizations should be able to answer:
- Which system made the recommendation?
- Which data was used?
- Who approved the outcome?
- What actions were taken?
Trust requires accountability.
Accountability requires evidence.
10. Keep Humans Accountable
AI may assist decisions.
Humans remain responsible for them.
Particular attention should be given to:
- Financial decisions.
- Regulatory decisions.
- Privileged access approvals.
- Security response actions.
- Customer-impacting outcomes.
Automation can accelerate decisions.
It should not eliminate accountability.
11. Review Vendor Resilience
Ask providers:
- How are outages managed?
- What recovery objectives exist?
- How are model changes communicated?
- What continuity commitments are documented?
Resilience should be part of procurement, not an afterthought.
12. Reassess Annually
AI adoption is changing rapidly.
A dependency map that was accurate twelve months ago may already be outdated.
Review:
- New providers.
- New workflows.
- New agents.
- New regulatory obligations.
- New concentration risks.
Resilience is not a one-time project.
It is an ongoing discipline.
What Not to Overstate
This checklist is not a call for complete AI sovereignty.
It is not a recommendation to abandon cloud AI.
Nor is it a prediction that every organization will experience a major AI outage.
The objective is preparedness.
Organizations routinely prepare for risks that may never occur because the consequences of being unprepared are unacceptable.
AI should be treated the same way.
Closing
Canada's future success with artificial intelligence will depend on more than innovation.
It will depend on governance, resilience, accountability, and preparation.
Organizations that understand their dependencies, test their assumptions, and plan for disruption will be better positioned to benefit from AI while managing its risks.
The durable lesson is not that Canada must control every capability.
It is that organizations should understand which capabilities matter most, who controls them, and what happens when they are no longer available.