On Thursday in Montreal, Prime Minister Mark Carney said the federal government plans to invest up to $1.6 billion for an equity stake in Cohere, the Toronto AI company that sells to businesses and governments. Ottawa is investing on commercial terms beside Nvidia, Bell and Germany's Schwarz Group, which owns Lidl and is leading a round that Cohere says targets $7 billion. The money comes in stages, with regular reporting against what Cohere has promised.

Those promises are specific. Cohere must keep its Canadian incorporation and headquarters, create at least 1,000 technical jobs in Canada by 2030, put at least $1.7 billion more into Canadian computing by then, and keep working with the Canadian AI Safety Institute. Carney announced it the morning his government released its first national security strategy in more than 20 years, which counts AI among the things a sovereign country must be able to reach securely. If you buy from Cohere, your vendor now has a government on its cap table and a list of promises to keep. (Prime Minister of Canada; Carney's remarks; CBC/Reuters)

Who gets the strongest models first is turning into a policy choice. Google released Gemini 4 Carbon on Wednesday and says it leads public benchmarks for finding, exploiting and patching software flaws. It is going first to a subset of cyber defenders through Fairwind, Google's program for trusted outside defenders: selected Google Cloud customers, government agencies and security firms.

Google says it is taking part in the US government's voluntary pre-release testing and will widen access to developers and businesses after more work on guardrails. The opening price is $2 per million input tokens. Companies outside that first circle may find attackers using tools like this before their own defenders can. (Google; Fairwind)

Dubai is putting regulators in the room earlier. The Dubai Future Foundation opened an AI Sandbox this week in which companies test market-ready AI products in real settings with government bodies, including the Dubai Centre for Artificial Intelligence. Depending on the use case, that can include regulatory exemptions, if the relevant authority approves.

Products must be at least at minimum viable product stage, and the foundation says regulators will use the trials to gather evidence for future rules. Applications close on December 18. A company inside a sandbox helps write the rules it will later live under, and its regulator sees how the product behaves. (WAM)

Singapore wants the people using AI, not only the people building it, to report what goes wrong. At a virtual meeting of leaders on frontier AI safety on Wednesday, hosted by Norway and Finland, Prime Minister Lawrence Wong proposed that interested countries start a pilot for sharing AI incidents. He noted that most of what is known about frontier model safety comes from the developers, while governments and businesses using the models meet serious failures and near misses of their own.

His plan starts small: agree on common incident categories and what to share, then test how to exchange the information securely before building anything larger. He pointed to aviation, where incidents and near misses are reported and studied. Someone on your staff has probably seen a near miss that nobody wrote down. (Prime Minister's Office Singapore; CNA)

Already filed, if you want the run-up: The Spare (India's markets regulator weighing its own AI model), The Model Card (US health regulators dropping required AI model cards) and The Penalty (Japan weighing penalties in its AI law).

Also on the shelf: The Owner (Korea's bank supervisor saying the bank owns every AI mistake), The Buffer (China telling employers to warn workers before AI takes their jobs) and The Lab (Britain's new AI biosecurity lab, funded partly in OpenAI and Anthropic credits). Read today beside The Spare. Yesterday a regulator wanted a model of its own. Today a government bought a piece of one.

Public money has come with strings before. In 1979, with Chrysler near bankruptcy, Congress passed a law allowing up to $1.5 billion in federal loan guarantees. The company had to cut costs, sell assets, win labor concessions and pledge collateral.

The law also set up a Loan Guarantee Board of officials from the Treasury, the Federal Reserve and the Comptroller General, and required regular reports to Congress. Chrysler returned to profit and repaid the loans with interest in 1983. The conditions were written down at the start, and someone was named to check them. (Chrysler Loan Guarantee Act; Chrysler)

Put these to management. Which of our AI vendors now have a government shareholder or government conditions attached, and could those conditions change where our data sits or what the vendor must put first?

Then access and reporting. If the strongest AI tools go to trusted users first, are we on the list or behind it? When our people see an AI failure or near miss, who records it, and would we share it with a regulator if asked?

The Move

Canada now owns part of an AI company and has written down what it expects in return. Google is choosing who gets its strongest cyber model first, and Dubai and Singapore are pulling regulators and users closer to how AI gets tested.

Ask the chief technology officer to list every AI vendor we rely on, who owns it, what conditions its owners have set, and how our own AI incidents and near misses are logged.

Know who owns your vendor.

Seven bullets. One move.