CapabilitiesMaturityApproachDiagnosticAI & Tech ReviewContact
Weekly Review

AI & Tech Review

Emerging developments across AI and technology.

Week of May 18 to 23, 2026
Lead Story
Canada & Enterprise
CanadaEnterpriseAI

Cohere Releases Command A+ as Open Source Under Apache 2.0, Positioning Sovereign Critical Infrastructure as the Strategic Frame

Toronto based Cohere released Command A+ on May 20 as its most powerful model to date, an open source 218 billion parameter Sparse Mixture of Experts decoder model with 25 billion active parameters per generation step, 128,000 token context window, support for 48 languages, and multimodal text plus image capability. The model is published under an Apache 2.0 license and is engineered to run on as few as two NVIDIA H100 GPUs through aggressive quantization (BF16, FP8, and W4A4). Cohere's positioning is explicit: sovereign critical infrastructure and enterprise workloads where deployment locality, weight ownership, and citation grounded reasoning are non negotiable.

  • Cohere Command A+ released May 20 under Apache 2.0 license
  • 218B parameter Sparse MoE, 25B active per step, 128K context, 48 languages, multimodal text plus image
  • Runs on as few as two H100 GPUs via BF16, FP8, and W4A4 quantization
  • Positioned for sovereign critical infrastructure and regulated enterprise deployment

Enterprise Impact: Canadian enterprises evaluating AI deployment options should add Command A+ to the model bench alongside US and Chinese alternatives, particularly for workloads where weight ownership, on premises deployment, citation provenance, or Canadian residency are operating constraints rather than preferences. Procurement should request explicit licensing, support, and indemnity terms for production deployment of open weight models. Architecture teams should test the 4 bit quantized variants for inference cost efficiency before locking in proprietary API spend. Boards should expect open weight Canadian model availability to factor into customer due diligence and federal procurement vendor lists through 2026 and 2027.

Source: Cohere
CanadaEnterpriseAI

Cohere Acquires Montreal and Berlin Based Reliant AI to Build North for Pharma, Extending Sovereign Enterprise AI Into Life Sciences and Biopharma

Cohere announced on May 19 the acquisition of Reliant AI, a biopharma AI company with operations in Montreal and Berlin, to build out North for Pharma as a purpose built version of its agentic AI workspace for research, clinical development, and scientific analytics. Reliant AI's full team of more than 30 staff joins Cohere, with co founder Moritz Hermann becoming VP of AI Verticalizations and chief scientific officer Marc Bellemare becoming VP of modelling. Cohere assumes Reliant's customer relationships including GSK, Ipsen, and Kyowa Kirin. The deal follows the recent Aleph Alpha merger and is Cohere's second German rooted acquisition this year.

  • Cohere acquires Reliant AI, biopharma AI company with operations in Montreal and Berlin, announced May 19
  • Reliant's 30+ team joins Cohere; leadership roles include VP AI Verticalizations and VP Modelling
  • Builds out North for Pharma as purpose built agentic AI workspace for research and clinical development
  • Brings GSK, Ipsen, Kyowa Kirin customer relationships and follows the Aleph Alpha merger

Enterprise Impact: The acquisition signals that vertical purpose built AI agents will be a primary differentiation axis through 2026 and 2027, particularly in regulated industries with proprietary data and compliance overlays. Canadian healthcare, life sciences, and biopharma buyers should evaluate North for Pharma alongside Microsoft, Google Vertex AI, and OpenAI vertical offerings, with explicit attention to data residency, IP ownership, and regulator facing audit trail. Procurement should request reference customer evidence and explicit terms covering model training data, weight ownership, and clinical evidence handling. Boards should expect AI vertical specialization to become a recurring procurement criterion in regulated industries.

Source: Cohere
CanadaEnterpriseRegulation

Canadian Tech Leaders Press Concerns on Bill C 22 Lawful Access Provisions, Signal and Windscribe Warn They May Exit Canada If the Bill Passes Unchanged

Bill C 22, the federal Lawful Access Act introduced in March 2026, would require electronic service providers to build technical surveillance capabilities and retain user metadata for up to one year. Signal has stated it would pull out of Canada rather than comply, Toronto headquartered Windscribe has warned it may relocate, and NordVPN has indicated it would consider following. Apple and Meta have raised concerns on encryption and cybersecurity impact, and the chairs of the US House Judiciary and Foreign Affairs Committees have written to Public Safety Minister Gary Anandasangaree warning the bill threatens cross border data flows. Parliamentary committee hearings began May 7.

  • Bill C 22 would mandate technical surveillance capability and up to one year metadata retention by electronic service providers
  • Signal, Windscribe, and NordVPN have publicly raised exit or relocation concerns
  • Apple and Meta have warned on encryption and cybersecurity impact
  • US House Judiciary and Foreign Affairs Committee chairs flagged cross border data flow risk

Enterprise Impact: Canadian enterprises should treat Bill C 22 as a procurement, vendor due diligence, and contract design input, not only a privacy compliance question. Legal, procurement, and CIO functions should jointly review vendor exposure to potential mandated technical capabilities, metadata retention, and contractual change of law provisions. Cloud, SaaS, and AI vendor selection should consider both jurisdiction and the practical implications of vendor exit scenarios. Boards should request a written status from legal and IT on Bill C 22 scenario planning, including vendor concentration risk and metadata retention liability.

Source: The Globe and Mail
AI Models & Platforms
EnterpriseAI

Google I/O 2026: Gemini Spark Lands as a 24/7 Proactive Enterprise Agent Inside Workspace, Salesforce, Zendesk, and SharePoint Connectors

Google introduced Gemini Spark at Google I/O on May 19, framed as a 24/7 proactive agent built on Gemini base models and the Antigravity agentic harness. Gemini Spark in Gemini Enterprise operates across Workspace, custom connectors (Microsoft SharePoint, OneDrive, ServiceNow, Salesforce, Zendesk, and others), and the open web, executes multi step tasks, proactively sends critical updates, and requires explicit user approval for high risk actions like sending emails. Google highlighted use cases such as proactive sales account preparation, churn risk detection, and draft retention strategy generation. Rollout to Gemini Enterprise customers is starting now; Workspace business preview follows.

  • Gemini Spark announced at Google I/O on May 19 as a 24/7 proactive personal agent for Workspace and Gemini Enterprise
  • Built on Gemini base models with the Antigravity agentic harness; runs in a managed secure runtime on Google Cloud
  • Connectors include Microsoft SharePoint, OneDrive, ServiceNow, Salesforce, Zendesk, and others
  • Proactive task execution with explicit approval gates for high risk actions like sending emails

Enterprise Impact: Enterprise leadership should treat Gemini Spark as the most concrete sign yet that proactive agents will operate inside enterprise workflows alongside human users, not only as opt in copilots. CIO and CISO functions need to align on agent identity, permissions, audit logging, data egress, connector trust boundaries, and approval gating before broad deployment. Procurement should compare Gemini Spark, Microsoft Copilot, OpenAI Deployment Company offerings, and Cohere North on agent governance, residency, and audit posture. ISO/IEC 42001 alignment and AI usage logging should be baseline requirements.

Source: Google Cloud
EnterpriseAIInfrastructure

Blackstone and Google Launch TPU Cloud Joint Venture With Initial $5B Equity, Targeting 500 MW of Data Centre Capacity by 2027 and Potential $25B Total Investment

Blackstone and Google announced on May 18 a US based joint venture to deliver a TPU cloud, offering Google Cloud Tensor Processing Units as a compute as a service product alongside data centre infrastructure, networking, and operations. Blackstone is committing an initial $5 billion in equity to bring 500 megawatts of capacity online by 2027, with total investment potentially reaching $25 billion including leverage. Blackstone holds the majority stake and has appointed longtime Google executive Benjamin Treynor Sloss as chief executive of the new company. The structure positions a third party at scale TPU compute lane against the dominant NVIDIA GPU position.

  • Joint venture announced May 18; Blackstone holds majority stake, Benjamin Treynor Sloss appointed CEO
  • Initial $5B equity commitment from Blackstone; potential $25B total including leverage
  • 500 MW of data centre capacity targeted online by 2027
  • Offers Google Cloud TPUs as compute as a service alongside data centre infrastructure and operations

Enterprise Impact: AI infrastructure is now a capital, power, and architecture decision, not only a vendor selection. CIO and CTO offices should evaluate TPU based deployment options alongside NVIDIA GPU deployment paths, particularly for inference cost efficiency on Google Cloud aligned workloads. Procurement should ask Google, AWS, Azure, Cohere, and Canadian sovereign AI providers for capacity reservation, residency, and lawful access terms. Architecture teams should plan multi region, multi accelerator strategies as the TPU lane scales. Boards should expect AI infrastructure capital plans to surface in budget cycles through 2027.

Source: Blackstone
EnterpriseAIInfrastructure

NVIDIA CEO Jensen Huang Confirms $200B CPU Market Forecast Includes China, New Vera Central Processors Frame the Agentic AI Pivot

NVIDIA CEO Jensen Huang told reporters in Taipei on Saturday May 23 that the company's recent $200 billion CPU market forecast includes demand from China. The forecast, anchored on the new NVIDIA Vera central processor line, signals that agentic AI workloads are broadening compute demand beyond GPUs into general purpose CPUs that handle the orchestration, memory, and tool calling components of agent systems. Huang's confirmation of China inclusion underscores that NVIDIA's market sizing assumes continued access to one of the world's largest compute markets despite ongoing US China export control complexity.

  • NVIDIA CEO Jensen Huang confirmed in Taipei on May 23 that the $200B CPU forecast includes China
  • New NVIDIA Vera CPU line targets agentic AI orchestration, memory, and tool calling workloads
  • Forecast signals compute demand is broadening beyond GPU training into general purpose CPU inference and orchestration
  • Underscores continued NVIDIA assumption that China remains a material AI compute market

Enterprise Impact: Enterprise architecture teams should plan agentic AI deployments with explicit CPU sizing for orchestration, memory, and tool calling, not only GPU sizing for model inference. Procurement should account for export control exposure and supply chain jurisdiction in multi year compute commitments. Boards should expect AI compute supply chain risk, including chip provenance, export control compliance, and second source availability, to remain a recurring agenda item through 2026 and 2027.

Source: CNBC
Cybersecurity
EnterpriseAICybersecurity

Verizon 2026 DBIR: Vulnerability Exploitation Overtakes Stolen Credentials as Top Breach Entry Point, AI Compressing the Defender Window From Months to Hours

Verizon released the 2026 Data Breach Investigations Report on May 19. For the first time in 19 years, vulnerability exploitation has overtaken stolen credentials as the top breach entry point: 31% of breaches now start with vulnerability exploitation versus 13% from credential abuse. Verizon attributes the shift in part to AI compressing the disclosure to exploitation window from months to hours. Median time to fully patch worsened to 43 days, and organizations remediated only 26% of CISA KEV vulnerabilities. Ransomware grew to 48% of breaches.

  • Vulnerability exploitation at 31% of breaches overtakes credential abuse at 13% for the first time in 19 years
  • Median time to full patch worsened to 43 days; CISA KEV remediation rate at 26%
  • Ransomware grew to 48% of breaches from 44% in prior year
  • AI cited as a primary accelerator of the disclosure to exploitation window

Enterprise Impact: Enterprise CIO and CISO functions should treat vulnerability management cycle reliability, exposure inventory completeness, and CISA KEV remediation discipline as first order operating metrics for 2026, not background hygiene. Procurement should expect customer due diligence, federal procurement, and cyber insurance reviews to harden against the new DBIR baseline. AI adoption cannot sit outside vulnerability management, patching, access controls, and supply chain risk; that framing now has 19 year DBIR evidence behind it.

Source: Verizon
Global Technology & Policy
EnterpriseAIQuantum

France Announces €1.5B for Quantum Computing and Microelectronics Under France 2030, Following US $2B Quantum Equity Stake Move

French President Emmanuel Macron announced on Friday May 22 an additional €1 billion for France's quantum strategy and €550 million for microelectronics, totalling €1.5 billion under the France 2030 initiative. The announcement, made at the CEA supercomputing centre in Bruyères le Châtel, follows the Trump administration's plan to take $2 billion in equity stakes across nine quantum computing companies. Macron framed the announcement as a competitive move: governments are treating quantum and advanced semiconductors as strategic national infrastructure, not commercial verticals.

  • France committing €1B to quantum strategy plus €550M to microelectronics, total €1.5B announced May 22
  • Investment falls under the France 2030 industrial initiative
  • Follows US plan to take $2B in equity across nine quantum computing companies
  • Frames quantum and advanced semiconductors as strategic national infrastructure

Enterprise Impact: Boards and CTO offices should recognize that compute, chip supply, and post quantum cryptography readiness now sit inside national industrial policy in major economies. Canadian organizations should expect federal procurement and customer due diligence to probe post quantum cryptography roadmaps and quantum safe migration plans through 2026 and 2027. Architecture teams should add quantum safe cryptography evaluation to security roadmap work even if production migration is years out. ISO/IEC 27001:2022 A.8.24 use of cryptography and NIST post quantum cryptography guidance apply.

Source: France 24
EnterpriseAIRegulation

London Metropolitan Police Cleared by Court to Expand Live Facial Recognition Across All London Boroughs, Civil Liberties Concerns Remain Material

London's Metropolitan Police won a judicial review on May 14 affirming its Live Facial Recognition policy as compliant with human rights law, clearing the way for expansion across all London boroughs. The Met cites approximately 2,500 wanted arrests since the start of 2024 as evidence of effectiveness. Civil liberties campaigners maintain that expansion has occurred without adequate accountability, with 10 individuals falsely flagged by the system, eight of whom were Black. In 2025 the Met deployed LFR roughly every 1.58 days; the new strategy expands frequency and coverage.

  • Met Police won judicial review May 14, court ruled LFR policy compliant with human rights law
  • Expansion now planned across all London boroughs
  • Approximately 2,500 wanted arrests claimed by the Met since start of 2024
  • 10 false positive identifications recorded, with 8 of those individuals Black, sustaining bias concerns

Enterprise Impact: Organizations deploying or evaluating biometric AI should treat the London expansion as a practical case study on bias risk, lawful basis, transparency, proportionality, oversight, and public trust. ISO/IEC 42001:2023 and ISO/IEC 23894 AI risk management guidance apply, as do the requirements emerging under the EU AI Act for high risk biometric identification systems. Canadian organizations should anchor any biometric AI deployment on the Office of the Privacy Commissioner of Canada guidance, ISO/IEC 42001 controls, and documented disparate impact testing before production.

Source: Biometric Update
View all insights
Previous Reviews

Get the Weekly Briefing

AI & technology analysis delivered to your inbox every Monday. No noise, no hype — just what matters.