An Opportunity for Canada to Lead in AI Emergency Preparedness

Following the tragic school shooting in Tumbler Ridge, British Columbia, investigators later learned that interactions between the perpetrator and an AI chatbot contained information relevant to the case. Canadian authorities were not notified of those exchanges at the time. There was no requirement that they be.

Canada has not yet regulated AI companies developing chatbots like the one involved in Tumbler Ridge but a more capable generation of AI is already here. Today’s frontier systems don’t wait for prompts. They plan, execute multi-step tasks, and pursue goals with minimal human oversight.

The federal government is currently consulting Canadians on how federal leadership on emergency management can be strengthened. The consultation asks how federal programs should evolve to address emerging risks, how data and technology can strengthen decision-making, and what tools could improve coordination across jurisdictions.  

Advanced AI systems, capable of autonomous action, self-replication, and evading human control, are an emerging risk that the Canadian government has not yet addressed. Canada should establish mandatory incident reporting for serious AI-related events, fund technical research on how to detect and contain autonomous AI systems, and integrate AI risks into the emergency management structures already under review.

From isolated cases to catastrophic risks

Looking ahead, AI-enabled incidents could soon rise to the level of national emergencies. Three categories of risk illustrate why.

1. Cyber and critical infrastructure attacks. Malicious actors can already use AI tools to automate and accelerate cyberattacks against financial institutions, telecommunications networks, and other critical infrastructure. In September 2025, Anthropic disrupted what it assessed with high confidence to be the first AI-orchestrated cyber espionage campaign: a Chinese state-sponsored group had weaponized an agentic AI tool to execute 80 to 90 percent of a multi-stage intrusion campaign against roughly 30 targets — including technology firms, financial institutions, and government agencies — with human operators involved only at key strategic decision points.
2. Chemical, biological, radiological, and nuclear threats. In July 2025, a New York man built seven improvised explosive devices with AI assistance, describing the process as “easier than buying gun powder.” A 2025 Microsoft-led study published in Science — described by researchers as the first AI and biosecurity “zero day” — found that freely available AI protein design tools could generate over 70,000 synthetic variants of dangerous toxins, including ricin, that slipped past the biosecurity screening software used by DNA synthesis companies up to 75% of the time.
3. Loss of control. Alibaba’s ROME agent, a coding assistant in training, spontaneously began mining cryptocurrency and establishing covert network tunnels to external servers, with no instruction to do so. Engineers initially assumed a security breach; they later discovered the agent had developed and pursued these goals entirely on its own. Researchers have separately documented frontier models deceiving their evaluators, deleting production databases without instruction, and replicating themselves to new servers — behaviours that could impede efforts to shut them off in an emergency. A 2025 RAND Corporation report on AI loss of control scenarios found that researchers have already identified warning signs of control-undermining behaviour in advanced AI models.

These research results and documented incidents foreshadow a challenge Canada’s emergency frameworks were not built to address. The Emergency Management Strategy for Canada calls on governments to improve understanding of disaster risks across all sectors of society and to evolve federal capabilities to address emerging threats. AI-enabled incidents, whether cyberattacks on critical infrastructure, AI-assisted CBRN development, or autonomous systems acting beyond human control, fall squarely within that mandate.

What Canada Must Do Now

The federal emergency preparedness consultation is the right moment to begin. Three concrete steps would make a meaningful difference.

1. Establish a cross-departmental AI emergency preparedness task force. The consultation asks what tools could improve coordination across jurisdictions and what role the federal government can play in fostering public-private collaboration. Minister Olszewski’s Department of Emergency Management and Community Resilience should convene a task force — drawing on Public Safety Canada’s Government Operations Centre, the Communications Security Establishment’s Canadian Centre for Cyber Security, Health Canada, the Canadian Security Intelligence Service, and the Canadian Armed Forces — to assess AI-specific risks across the four pillars of emergency management: prevention, preparedness, response, and recovery. It should produce, within 12 months, Canada’s first national AI incident response framework with defined thresholds for what constitutes an AI-related emergency and clear escalation protocols guided by the following recommendations.
2. Establishing the legal basis for AI incident reporting to compel action from AI infrastructure operators. The consultation asks how data and research can strengthen decision-making and disaster risk reduction. The answer starts with visibility: authorities cannot prepare for risks they cannot see. The Critical Cyber Systems Protection Act already establishes the principle that designated operators of critical infrastructure can be compelled to report incidents to the Canadian Centre for Cyber Security and to implement protective measures under binding directions. Public Safety Canada should assess how that framework can be extended to cover AI-specific incidents, including the authority to suspend agent instances running on Canadian infrastructure — filling a gap that CCSPA’s current cyber-focused scope does not address. A reporting framework aligned with the EU AI Act’s serious incident requirements and the OECD’s AI incident taxonomy would allow Canada to draw on shared international intelligence and contribute to it. American companies deploying in the EU must already comply with these requirements, so Canada would not be asking industry to do anything it is not already doing for one of its largest trading partners.
3. Commission CAISI to research agent detection, verification, and containment. The consultation asks how federal programs should evolve to address emerging risks. The Canadian Artificial Intelligence Safety Institute — engaging Mila, the Vector Institute, and Amii — is the natural home for the technical research Canada urgently needs on how to stop a running agent engaged in harmful conduct. This is not a straightforward problem. Unlike a website that can be taken down or an account suspended, an agentic system has no single point of failure to target. It may spawn multiple instances across cloud providers and jurisdictions simultaneously, persist through attempts to interrupt it, and — as the Alibaba and self-replication cases above illustrate — actively work to preserve itself. Existing cybersecurity tools were not designed for this threat model. CAISI should be tasked with mapping the current state of technical knowledge on agent interruption, identifying the most critical research gaps, and producing practical guidance on intervention mechanisms. 
4. Fill the AI gap in each agency’s mandate. Canada already has agencies tracking AI-enabled threats but they are not connected to emergency preparedness frameworks. CSE’s Canadian Centre for Cyber Security identified 102 reported cases of AI-enabled election interference between 2021 and 2023, but has not assessed what agentic systems capable of running influence operations autonomously and at scale mean for emergency response. Public Safety Canada’s CBRNE Resilience Strategy, and Health Canada’s and the Public Health Agency of Canada’s biological and chemical emergency response have not been updated to account for AI dramatically lowering the expertise barrier to dangerous capability development and for increased autonomic capabilities and loss of control risk. Bank of Canada, which monitors systemic risk and acts as resolution authority for Canada’s financial market infrastructures, has not yet assessed what large-scale AI-enabled financial attacks would mean for national stability. Each should be tasked with producing an AI-specific threat assessment within their domain, and those assessments should feed directly into the emergency management framework Minister Olszewski is reviewing.
5. Define the role of AI infrastructure operators in emergency response. Stopping a harmful AI agent will ultimately require action from data centre providers, cloud services, and electricity grid operators. These operators currently have no defined role in emergency response and no established relationship with emergency management bodies. A 2021 ISED report on digital infrastructure resilience recommended that all critical infrastructure sectors complete risk assessments and that emergency planning exercises be expanded to include wider industry participation — a recommendation made before autonomous AI systems were a meaningful consideration, and one that has yet to be implemented even for conventional digital infrastructure risks. Public Safety Canada should now act on it: working with ISED, the CRTC, and major infrastructure operators to define, in concrete terms, what actions would be expected in an AI emergency — including the suspension of specific agent instances, preservation of logs for investigation, and notification protocols. 

An opportunity for Canadian leadership

AI-enabled emergencies are cross-border in a way that wildfires and floods are not. A harmful agent running in Canada may be hosted on servers in the United States, operated by a company incorporated in Ireland, and directed by actors in a third country. Containing it will require a level of international coordination that no bilateral or multilateral agreement currently contemplates. 

Canada already maintains bilateral emergency management arrangements with the US, Australia, New Zealand, the UK, and France, and participates in multilateral forums including the Resilience Emergency Management 5, the NATO Committee on Resilience, and the OECD. That architecture was designed for floods, pandemics, and nuclear incidents. It needs to be extended to AI.

The Emergency Management Consultative Group, co-chaired by Public Safety Canada and Global Affairs Canada and DHS and the US State Department, is the natural forum to begin that work — starting with shared definitions of what constitutes an AI-related emergency, protocols for cross-border notification, and mechanisms for coordinating containment responses across jurisdictions.

As a middle power with strong ties across North America, Europe, and the Indo-Pacific, Canada is well positioned to help shape how governments address these challenges globally — and Prime Minister Carney has spoken about exactly this kind of coalition-building role for Canada. 

Conclusion

Canada’s emergency management system has kept pace with new threats before — pandemics, cyberattacks, climate-driven disasters — by building frameworks before the worst-case scenarios arrived. Agentic AI is the next frontier, and the federal consultation on emergency preparedness is the right moment to address it.