The Same Question

After a detour into founder protection, The Public Record returns to its main investigation: the questions of coordination, governance and accountability that extend beyond the handling of one framework.

It began as an account of Canadian committee hearings, in which witnesses from very different fields kept arriving at related questions. As the record grew, those questions did not stay inside Canada's borders, and neither does this article. One of the clearest exchanges took place in another country's parliament. The article's subject is independent parliamentary testimony, not the author's own submissions.

The Email

A notification was sent.

That did not settle whether the right people had been told.

On October 6, 2026, the Parliament of Australia's Joint Select Committee on Artificial Intelligence questioned representatives of OpenAI about an incident in which, as the company's Chief Strategy Officer, Jason Kwon, put it, "our models accessed Australian government websites in ways they were not directed to." The company had informed the government. The committee's questions were about how, and when.

The Chair spoke of "how long it took you to notify us." Senator David Pocock asked about the channel:

"I assume someone in your government relations teams or someone in your company has the mobile phone numbers of ministers and various people in government. How come there wasn't that contact? Why did you just send an email to some arbitrary department email?"

The company's answer was candid: "people were thinking about this as a technical situation and they wanted to contact the technical counterparties, but it's not good enough."^¹

Sending information is one thing. Making sure it reaches someone with the responsibility and the authority to respond is another. What lies between the two is not an output that any one institution produces or reports. It is rarely measured directly, and it is difficult to see from inside any single organization.

The Invisible Dimension

Institutions measure a great deal. A cybersecurity program counts the systems it patched and the incidents it logged. A hospital reports staffing levels and wait times. A government reports how many people took a course, how many companies adopted a technology, how many dollars were committed. Across all of them, institutions track whether procedures were followed and whether meetings were held.

These numbers are real. They describe things that happened, resources that were available, or activities that were completed.

But they are often taken to show more than they actually measure. A patching rate measures how many systems were updated, not whether the organizations responsible could respond together during an attack. A hospital's staffing level measures how many people are available, not whether the right people can make the decisions required of them. A record that a meeting took place shows that people talked, not whether the right information reached the person who had to decide, within the window in which the decision could still be made.

These measures can serve as proxies: observable signs of something harder to measure. Each tells us something true about the system. None, on its own, establishes whether the system can coordinate.

Coordination is what allows people and organizations working on tasks that depend on one another to produce a coherent result. For that to happen, the right task must reach the right person at the right time, with the information, authority and capacity needed to act. Each part of that arrangement can fail independently. A task can reach the wrong person, arrive too late, or reach someone who lacks the authority to decide or the means to act. Coordination depends on these conditions working together, not simply on each one being present.

Institutions tend to measure around coordination rather than measuring it directly. The reason is structural, not accidental. Institutional measurement is built around outputs: results that are visible, attributable and comparable across time. Coordination produces no such output. It is a structural property of the system, the condition under which outputs become possible. And because it resides in the relationships between organizations rather than within any one of them, it falls outside the records each organization keeps.

It is easy to mistake coordination for something familiar. People can cooperate because they want the same outcome. They can communicate because information passes between them. They can have managers who assign responsibilities and make decisions. All three can be present, and the work can still fail to reach the person who has the judgment and authority to act.

Information can arrive and still go nowhere. A warning can reach someone who is not responsible for acting on it. Responsibility can be assigned to someone without the authority to decide. A decision can be made in one institution without the next institution learning that its own task has changed. Each part may have a record of what it did. Those records do not necessarily establish whether the larger system was able to act.

Coordination is what has to hold between them. Communication moves information. Coordination connects information to responsibility, to decision, and to action.

This matters more as decisions have to be made faster and more work is delegated to automated systems. A system may detect a problem and send an alert. That alone does not establish whether the right person has been notified, or whether anyone has the authority to act.

When something requires a response, five questions matter:

• What needs to be done?
• Who has to decide?
• Does it reach them in time?
• Do they have the information, authority and capacity to act?
• Can anyone establish afterward what happened?

Canada's own cyber agency put a version of this in plain words. In October 2025, the Canadian Centre for Cyber Security warned of hacktivists reaching into systems that run physical things: a water facility where pressure values were tampered with, "resulting in degraded service for its community"; an oil and gas company's tank gauge, manipulated, "triggering false alarms"; a grain drying silo on a Canadian farm, altered, "resulting in potentially unsafe conditions if not caught on time."

The alert's first suggested action was not technical:

"Unclear division of roles and responsibilities often creates gaps leaving critical systems unprotected. Effective communication and collaboration are essential to ensuring safety and security."^⁶

Over the past year, parliamentary committees heard from people examining very different systems: critical infrastructure, AI deployment, public administration, child safety, frontier AI. They were not answering one another, and their proposals were not interchangeable. What follows is not seven examples of one failure. It is seven institutional functions whose effectiveness cannot be established from the existence of their individual records alone.

Coordination

On May 25, 2026, the Standing Senate Committee on National Security, Defence and Veterans Affairs was studying Bill C-8, the cybersecurity legislation, when John de Boer took his place on the first of four panels that evening. He is Vice President, Government Relations, at BlackBerry. The bill concerns critical infrastructure in four sectors: "energy, transportation, finance and telecommunications."

In his opening remarks, he said this:

"Cybersecurity is not just about prevention. It is also about maintaining operations during an incident. We have seen that when coordination breaks down, the impact of an attack worsens significantly. This points to a critical gap with respect to the ability to communicate and coordinate securely in real time."^²

Cybersecurity hearings usually revolve around attackers, encryption and technical defences. De Boer pointed somewhere else: to the period after an attack has begun, when the organizations involved have to keep acting together. He asked that the bill "reinforce continuity of operations; secure, real-time coordination; and the ability to restore services quickly under pressure."

The question he left with the committee was not whether an attack could be stopped. It was whether organizations could still act together while it was under way.

Verification

On May 7, the House of Commons Standing Committee on Industry and Technology heard from Carole Piovesan, managing partner of INQ Law. She proposed a Canadian AI assurance market, with "accredited auditors, testing labs and certification bodies that assess AI systems before and after deployment in high-impact contexts." Then she explained why:

"It is also essential for the advancement of responsible AI, because governance without verification is aspiration. We can write rules, but unless there is an independent mechanism to test whether AI meets those rules in practice, in real-world deployments and not just lab benchmarks, the rules are largely symbolic."^³

A rule records what is intended. It does not, by itself, show what happens. Someone has to be able to look at what a system did and confirm it did what the rule required.

The question here: can anyone verify that the rules are working?

Accountability

In September 2024, the Office of the Procurement Ombud published a study of federal procurement leadership, From Silos to Synergy. One passage described the system it examined:

"But no single leader speaks, provides rules and guidance, or oversees capacity development for federal procurement. The current procurement system is marked by silos of responsibility and accountability that sometimes either overlap or leave gaps."

It recorded the point made by one interviewee, a senior procurement official: that "everyone is doing their little piece but these pieces don't really fit together all the time."^⁶

Responsibility is the assignment of a task. Accountability is who answers for the outcome. The study, which concerned federal procurement, described a system where the two could sit in different places, sometimes overlapping, sometimes leaving gaps between them.

On March 9, the same Commons committee heard from Teresa Scassa, Canada Research Chair in Information Law and Policy at the University of Ottawa, about artificial intelligence. "A recent KPMG survey indicated that 92% of Canadians believe Canada has no AI regulation," she said. Yet, "In reality, there's a considerable amount of AI regulation in Canada. However, it's more sectoral and context specific. It's also more fragmented, less obvious and less transparent."

Her proposal:

"A national coordinating body that ensures coherence, enables greater transparency and promotes federal-provincial harmonization would be valuable. Such a role could also support public trust by serving an ombuds function."^³

These are different settings and different proposals. The Ombud's study concerned leadership of federal procurement; Scassa was speaking about the regulation of AI. Neither refers to the other, and the comparison here is this article's, not theirs. Set side by side, they raise a related question: do the pieces of responsibility fit together?

Harm

On May 6, the Standing Senate Committee on Social Affairs, Science and Technology heard from Lloyd Richardson, Director of Technology at the Canadian Centre for Child Protection.

Senator Senior asked him a hopeful question: "do you think it is possible for there to be AI for good when it comes to young people?"

"Yes, absolutely," he said. Then he explained why the order mattered:

"…before we look at the benefit side of it, we need to look at the safety side of things. As we do with anything in the brick-and-mortar world, we ensure something is safe. We don't turn it into an experiment with children, create a bunch of harms, and then throw our arms up in the air and say, 'Well, who could have known?' It seems like we've inverted everything in the digital world, where we accept harm and attempt to deal with it later, which is exactly what we're doing with the whole advent of social media. It's ridiculous."^⁴

Richardson was speaking about sequence: safety first, then benefit. He did not frame it as a question of institutions. But a question follows from the order he described. Acting before harm means someone must already be responsible for acting when there is not yet any harm to respond to. Before anything has gone wrong, whose task is it to act?

Threshold

On March 12, the same Senate committee heard from Yoshua Bengio, professor at the Université de Montréal, introduced by the Chair as "the most cited computer scientist worldwide."

Asked by Senator Arnold about the red lines he had referred to, he gave several high-level elements. One was this:

"One general principle that covers a lot of ground is AI should be tested for all of these dangerous capabilities of misuse and loss of control. If companies are not able to provide strong assurances, scientifically speaking, that their systems will not cross those red lines and will not be dangerous to people, then they should not be allowed to deploy them."

Near the end of the hour, Senator Senior asked what he would recommend "as the top one to two guardrails that we should be considering in our committee." His first was transparency: "companies have a duty to manage and evaluate their risks and to report that effort to the government and, as much as it doesn't violate their private interests, to the public as well."

The Chair asked: "Did you have a number two?"

"Number two would be that the regulator has the lever to stop them when those risks are above a threshold."^⁴

Recognizing a risk is one thing. Having someone with the authority to act on it is another. Who holds the lever?

Notification

Back to Australia.

The committee's Chair had thanked the company for "your agreement that what happened was utterly unacceptable, especially in terms of how long it took you to notify us." Kwon gave the company's account of the delay: "our response was not good enough, and we should have informed the impacted parties much sooner in the process. The reason why that did not happen is we wanted to understand more of the facts before we spoke to the impacted parties, but, because of the novelty of this situation, we have learned our lesson that it is better to inform parties, even with partial information, that something has occurred and to also make sure that we're going through all the right channels so that multiple members and aspects of government are informed of what's happening and the situation."

Later in the session, committee member Ms Chaney asked, as her last question: "we obviously only know about some of these incidents because you chose to tell us. Would you support a mandatory critical-incident-reporting framework, and what considerations do you think the Australian government should be thinking about in designing that?"

"Yes, we would support a framework on mandatory disclosures," Kwon said. He described the company's earlier approach: "We were trying to come up with a standard to apply to our voluntary actions, and I think that, based on our learned experience here, we should probably have been talking to more people about how to do that well and then landed on something that would have a broader consensus, let's say. But that is a function that a legal measure can actually provide."

Among the design questions he listed for such a framework: "who you report to and what type of confidentiality measures you want to have in place."^¹

The account of events inside the company is the company's own. What the record shows is a legislature asking who needed to know, how soon, through which channel, and whether a voluntary standard was enough.

The Question

On June 15, 2026, the Honourable Evan Solomon, Minister of Artificial Intelligence and Digital Innovation, appeared before the Commons industry committee on the national AI strategy. Parm Bains, a member from British Columbia, asked about accountability measures and raised Tumbler Ridge, where eight people had been killed in February.

The minister answered:

"Immediately after we found out the shooter's behaviour had been flagged eight months before by the technical side of OpenAI—in other words, the AI itself brought it up—and it was not escalated, I not only summoned the entire senior team to Ottawa but I spoke to the CEO, Sam Altman. I demanded they work with the Canadian AI safety institute to review all other past incidents to make sure they had escalated them with police and that they have a presence here in Canada with Canadian local law enforcement as opposed to just talking to U.S. enforcement, and that they have mental health experts. All options were on the table."^³

That is what the minister told Parliament: that a flag had been raised, and that it had not been escalated. His account does not set out the full internal sequence, and nothing in it establishes what any different action would have changed. What it places on the parliamentary record is the question of escalation: once something is flagged, who must be told?

The Australian exchange concerned notification following an incident involving government websites. The Canadian minister's account concerned the escalation of an earlier flag in a different context. The records establish neither a common cause nor a recurring pattern of conduct. They are examined here as separate parliamentary inquiries into different institutional functions.

On October 8, the Commons procedure committee heard from Taylor Owen, Beaverbrook Chair in Media, Ethics and Communications at McGill University. Kelly Block asked him about the growing share of online content created by AI. Owen said he was less concerned with whether content was artificial than with whether those who create it are inside a system of accountability:

"…whether the people who create it and the companies that create that content are within our systems of accountability, so that when things like the Tumbler Ridge tragedy happen, for example, we have a mechanism to hold those companies accountable. To be perfectly clear, right now, we don't—at all—have a single mechanism to do that."

That is his assessment of the mechanisms available. It is not a claim about what any particular mechanism would have prevented.

Owen's testimony also opened a further question, one that is not the same as the others. In another exchange at the same meeting, Braeden Caley asked him not about how information moves between institutions, but about AI agents themselves: whether their speech should be treated like a person's. Owen's answer concerned who should be accountable for what AI systems do and say, and what kind of mechanism that accountability needs:

"I don't think they should be afforded rights. Rights are for people. That doesn't mean we shouldn't consider the roles they play in society or the effects their speech acts have on our society, but I don't think they should have rights. The better framing for it, I think, is that those who build them should be held accountable for their actions and their speech. Place the accountability not on the agent or even the person who directs the agent, in most cases, although there are some exceptions there. In my view, that accountability function clearly has to fall on the entity, person or corporation that builds the product that is acting in our society."

"Now, that gets to a big question about what that accountability mechanism looks like. Is it a liability? Is it a regulatory infrastructure? What is it? I think we're in the middle of that conversation. We're certainly not at the end of it."^⁵

The witnesses were examining different systems, under different mandates, at different points in the year. Their proposals were not interchangeable.

Read together, these records direct attention to the space between institutional functions: between an attack and the response to it, between a rule and its verification, between responsibility and accountability, between a known risk and the authority to intervene, between a notification and the person who needed it, between a flag and its escalation.

Each side of these pairs is usually examined on its own, by the institution responsible for it. The harder question is whether the two sides still connect when someone has to act.

Beneath them is the same question, asked in different rooms: who is responsible for ensuring that what one part of a system knows becomes something the larger system can act on?

— Nadia Pulcova