The Week AI Rules Moved: Canada Buys In, the US Builds a Wall
This post is part of my Medium blog.
If you only follow the loud arguments, AI regulation looks frozen. Congress has not passed an AI statute. Canada let its AI bill die on the order paper almost two years ago. And yet this week, between October 24 and October 30, the rules around AI moved more than they have in months. Not because anyone passed a big law. Because two governments stopped waiting for one.
Canada stopped regulating and started buying
On Thursday in Montreal, Prime Minister Mark Carney announced that the Government of Canada will make an equity investment of up to $1.6 billion in Cohere, the Toronto company that builds AI systems for governments and regulated industries. The money comes in stages, and it was announced alongside private backers including NVIDIA, Bell, and Schwarz Group. Cohere itself announced the initial close of a Series E targeting up to $7 billion, which its own release calls the largest private capital raise in Canadian history, at a $35.7 billion valuation.
The word Ottawa kept using was sovereignty. Digital sovereignty, secure sovereign AI. The federal government could not get its AI statute through Parliament, so it is trying something older than regulation: ownership. Buy the national champion, keep the headquarters in Toronto, and make sure the country that invented some of this technology still has a company at the table.
The investment comes with strings, and the strings are the interesting part. Cohere has committed to creating at least 1,000 Canadian technical jobs by 2030, spending at least $1.7 billion more on computing infrastructure inside Canada by 2030, keeping its Canadian incorporation and headquarters, and continuing to work with the Canadian AI Safety Institute on safe development. That last item matters. The money is industrial policy, but the safety institute condition means Canada is attaching at least one governance hook to its bet. It is regulation written into a term sheet instead of a statute.
The US kept building the wall instead of the rulebook
South of the border, the same week, the US Treasury proposed new rules under its Outbound Investment Security Program to tighten restrictions on American money flowing into Chinese AI companies. The proposal, issued October 22, carries out a law Congress passed with bipartisan support in December 2025, which turned what began as one president's executive order into a permanent part of US national security regulation. The direction is unmistakable: the US government has decided the AI race is partly a capital problem, and it is going to manage where the capital goes.
Meanwhile the security agencies are treating AI like infrastructure now. On October 23, the cyber agencies of the US, UK, Canada, Australia, and New Zealand published joint guidance on understanding, monitoring, and optimizing AI token consumption for operational resilience. Five nations' security services jointly telling organizations how to watch their AI usage is a quietly large signal. That is the language agencies use for power grids and pipelines.
And at the state level, Colorado's comment period on its automated decision-making rules closed October 26. The Colorado law behind those rules takes effect January 1, 2027, with enforcement currently stayed by litigation. California's own automated decision rules hit their compliance date the same day. The federal government keeps arguing about preemption, and the states keep issuing rules anyway.
Why this week rhymes with the books
I write about certified orchestrators and certifying agencies for a living, so I notice the shape of this. In Redundant, the certifier everyone trusts is the one that got captured. In Contingent, the agency that granted exceptions for everything discovers, during a blackout, what the exceptions cost. The through-line in all three books is that the question is never whether rules exist. It is who holds the pen when a system fails, and what happens to the person who signed.
This week, Canada answered that question with a purchase and a condition. The US answered it with a capital wall and a security memo. Colorado and California answered it with compliance dates. Three different pens, three different hands, no coordination. That is how this actually gets built, and it is closer to the books than any single grand statute would be.
What to watch next
If you want to follow this without the noise, the checklist is short. Watch whether the Colorado litigation un-stays enforcement before the January 1, 2027 effective date. Watch the Treasury comment period on the outbound investment rules, because the definition of which AI deals get blocked will decide where venture money goes. Watch whether Cohere's staged tranches actually require the safety institute work, or whether it stays a press-release commitment. And watch the California compliance deadline on January 1, 2027, the same day Colorado's law lands, which is when a lot of US companies find out what these rules cost. Two dates, one comment period, and one term sheet. That is the real regulatory calendar for the next year.