By Maple and North
Most discussions about AI risk focus on data exposure, privacy, or model accuracy.
Those concerns matter. But there is another risk emerging beneath the surface—dependency.
The question is not whether Canadian organizations should use artificial intelligence. The question is whether critical business and security processes become dependent on tools, models, platforms, or autonomous agents that sit outside the organization's control.
That question becomes more important as AI moves beyond advice and into action. AI systems are increasingly involved in security investigations, software development, cloud administration, identity workflows, customer service operations, and decision support. As organizations integrate these capabilities into daily operations, they should also examine what happens if access is disrupted, restricted, or withdrawn.
The Dependency Problem
Many organizations conduct security reviews of AI vendors before adoption. These reviews often focus on protecting sensitive data and ensuring regulatory compliance.
Far fewer evaluate dependency risk.
Dependency risk emerges when an organization relies on a single provider, platform, or jurisdiction for capabilities that become operationally important. If access to those capabilities is disrupted, the organization may discover that processes assumed to be resilient have become dependent on a service outside its control.
This is not a new problem. Organizations have long managed concentration risk in cloud providers, telecommunications networks, software vendors, and supply chains. AI introduces a similar challenge.
The difference is that AI is increasingly being embedded directly into operational workflows rather than serving as a standalone technology.
Export Control Risk
Organizations often evaluate where data is stored but spend less time considering whether access to the underlying capability could be restricted.
Governments around the world have increasingly applied export controls to advanced semiconductor technologies and certain artificial intelligence capabilities. While these controls are often designed to address national security concerns, they can also affect the availability of technologies across jurisdictions.
For Canadian organizations, this creates an important governance question:
If a foreign government can influence whether a critical capability remains available, how should that risk be incorporated into resilience planning?
Export control risk does not mean organizations should avoid foreign technology. It means they should understand where dependencies exist and assess whether alternative options are available if circumstances change.
Jurisdictional Risk
Jurisdiction matters because laws, regulations, and government authorities differ across countries.
When evaluating AI providers, organizations should consider:
- Which country's laws govern the provider.
- What regulatory obligations apply.
- What legal mechanisms exist for government access.
- How disputes would be resolved.
- Whether operational restrictions could affect service availability.
These considerations extend beyond privacy and compliance. They influence continuity, resilience, and organizational control.
As AI becomes more deeply integrated into business operations, jurisdictional questions become operational questions.
Provider Concentration Risk
Many organizations deliberately avoid excessive dependence on a single supplier in critical areas of technology.
The same thinking should apply to AI.
When multiple business processes depend on the same provider, a disruption can create cascading operational effects. An outage, contractual dispute, regulatory action, pricing change, or strategic shift by the provider may affect numerous functions simultaneously.
The United Kingdom's National Cyber Security Centre (NCSC) has repeatedly highlighted the importance of supply chain resilience and avoiding single points of failure in critical systems. Similar principles apply to AI-enabled services. Diversification does not eliminate risk, but it can reduce the consequences of a disruption. National Cyber Security Centre
Why This Matters for Canada
Canada has historically benefited from access to global technology markets. That access remains important.
The challenge is not globalization.
The challenge is ensuring that critical capabilities remain available when geopolitical conditions, regulations, commercial disputes, or technical failures create unexpected disruptions.
Organizations routinely build resilience plans for cloud providers, telecommunications services, and critical vendors. AI should increasingly be evaluated through the same lens.
This does not require every organization to operate its own models or abandon cloud-based AI platforms. It does require understanding which capabilities are essential, who controls them, and what alternatives exist if they become unavailable.
The Cybersecurity Impact
From a cybersecurity perspective, dependency risk becomes more significant as AI systems gain access to sensitive environments and begin participating in operational decisions.
Examples may include:
- Threat analysis.
- Security operations workflows.
- Vulnerability prioritization.
- Software development.
- Cloud administration.
- Identity and access management.
- Automated remediation activities.
When these capabilities become embedded in security operations, availability becomes part of the security discussion.
An unavailable security capability can become a security problem.
This is particularly relevant as organizations begin deploying AI agents capable of taking actions rather than simply providing recommendations.
What Leaders Should Do
Security and technology leaders should treat AI systems and autonomous agents as governed identities rather than informal productivity tools.
Practical steps include:
- Inventory critical AI dependencies.
- Assign accountable owners for AI-enabled workflows.
- Document access controls, authentication mechanisms, logging requirements, approval boundaries, and revocation procedures.
- Assess provider concentration risk.
- Evaluate jurisdictional and export-control considerations.
- Test fallback procedures and continuity plans.
- Include AI availability, auditability, and resilience requirements during procurement reviews.
- Identify alternative providers or degraded-mode operating procedures.
Most importantly, organizations should regularly test assumptions about AI availability rather than assuming critical services will always remain accessible.
What Not to Overstate
This is not an argument against artificial intelligence.
It is not an argument that every AI platform should be treated as critical infrastructure.
It is an argument that organizations should govern the systems they increasingly depend on.
The more operational responsibility assigned to AI systems, the more important resilience planning becomes.
Closing
The enduring lesson is simple.
Resilience is not measured when everything is working.
It is measured when access disappears, authority becomes unclear, or an autonomous system acts faster than accountability can catch up.
Organizations do not need perfect AI sovereignty to manage these risks.
They do need visibility into their dependencies, an understanding of who controls critical capabilities, and a plan for what happens when those capabilities are no longer available.