What Europe will ask Canada to prove

Canada and the European Union wrapped up their summit in Montréal on October 30 with a joint statement and a new name for the relationship, the Alliance for the Future.¹ The Prime Minister’s office says the two sides are working toward Canada becoming “the European Union’s first Associate Member”.² The joint statement puts it another way, and talks about defining “an ever-closer association of Canada to the EU, short of full membership itself” by the 2027 summit.¹ The part we kept coming back to is elsewhere in the statement. It promises joint work on the digital infrastructure behind AI, “from trusted and sovereign cloud and compute infrastructure to data, models, software and applications”, and says the two sides “will work towards mutual recognition” in three digital areas. The third one is cybersecurity.

“That is what sovereignty looks like,” the Prime Minister said of the alliance: “the freedom to live our lives as we choose, on our own terms.”²

Canada on the selling side

Up to now this series has mostly looked at Canada as a buyer, with a rulebook for what departments can accept and a qualification for who gets to sell them cloud. The SAFE news from the summit runs the other way. Canada joined SAFE in February, the first country outside Europe to do it.² SAFE is the EU’s €150 billion defence loan instrument, and National Defence says Canadian companies can now take part in SAFE contracts “with up to 80% Canadian content”.³ Two have already won work. Montréal’s Marconi Technologies is building tactical radios for Poland’s Cyber Command, and Galvion, announced at the summit, has a contract worth more than $44 million to supply military helmets to Latvia.²

Helmets are mostly a bill of materials, but Marconi describes the Orion X650 as a software-defined radio,⁴ so a lot of what it does comes from code compiled somewhere before it was ever loaded. That code has a supply chain of its own.

What SAFE asks

The eligibility rules are in Article 16 of the SAFE regulation.⁵ Contractors, and subcontractors supplying critical inputs, have to be set up and managed in the EU, the EEA or Ukraine, and nobody outside can control them. No more than 35% of the component cost can come from outside. Then there’s the second category of products, which covers air and missile defence, C4ISTAR systems, artificial intelligence and electronic warfare, among others. For those, the contractor has to be able to decide on the design of what it sells, and change it, without anyone outside imposing restrictions. That includes the legal authority to swap out or remove a component someone outside has restricted. Recital 21 gives the reason, and it’s a simple one. The armed forces buying this kind of kit shouldn’t find a third country limiting what they can do with it.

Partners outside the EU get in through an agreement. Under Article 17, each agreement sets its own terms on control, location and component cost, plus its own rules on design restrictions coming from countries outside the agreement.⁵ So a SAFE seller has to be able to say who holds the switch on its own design.

Below the parts list

We don’t know which SAFE category Marconi’s radio contract falls under. Neither the summit release nor Marconi’s own release says, and neither says what Canada’s agreement sets for design restrictions, so none of this is a reading of that contract. For any software-defined product, though, the design question goes below the parts list. Firmware gets built from source someone wrote, using compilers and libraries someone else maintains, on build machines that could be anywhere. It gets signed with keys somebody holds and kept current through an update channel somebody runs. Some of it may need a licence that checks in with a server before it’ll activate. Any one of those links can carry a restriction: an export control on a toolchain, a licence that can be pulled, a signing key the contractor doesn’t hold, an update channel run from outside the agreement.

Having the legal authority to swap a component doesn’t help much if you don’t know what’s in the build, or can’t rebuild it without the piece that has to go. That’s the list the previous note asked qualifying cloud companies to write, covering every link from the base image to the update channel. Each link gets marked by whether it can be held at home and, if it can’t, whether what it delivers can be checked without asking its owner. A SAFE bidder needs the same list with one more column, for the jurisdiction that could restrict each link.

Evidence a buyer can check

The statement doesn’t say what mutual recognition in cybersecurity would cover, so the terms aren’t written yet. Whatever they land on, it’s a lot easier to accept someone else’s assessment without redoing it when the evidence behind it travels with the product, and someone who didn’t produce it can check it without calling the supplier.

For software, each artifact carries provenance that ties it to the source and the build it came from, signed with keys the supplier holds. The buyer checks that inside its own boundary, offline, against keys it has pinned, and every deployment leaves a dated record that an assessor on either side of the Atlantic can read. An accreditor in Riga or Warsaw can then confirm the firmware in front of them is the build the supplier signed, and see where the supplier says it came from, without picking up the phone. The supplier can hold its own upstreams to the same test, where they publish provenance. It won’t catch everything. A poisoned library the supplier signed in good faith verifies just fine, and the record is how someone tracks it down afterwards.

For the next bid

In October, Canada’s own cloud qualification asked who owns a supplier and left the technology questions for later. SAFE is asking some of them now, through Article 16(11) and whatever design rules Canada’s agreement sets, and mutual recognition points at more. If you’re a Canadian company bidding into SAFE, you can write your list today. Every software link in the product goes on it, along with who controls the link and which country could restrict it. For the links you can’t swap out, the question is whether a European buyer can check what they deliver without asking whoever owns them.

Each SAFE loan comes with operational arrangements that set out the kinds of documentary evidence used to show the eligibility rules were met.⁵ For the software in a Canadian product, that evidence would start with the list.

Northfleet is a Canadian-incorporated vendor building the sovereign supply chain that wraps a customer-operated classified cluster: a deploy-time bundle protocol, attestation chain, and tamper-evident audit trail. The customer’s cleared engineering teams operate the cluster under their own keys. Northfleet holds no customer data and no customer signing keys. Its own tool belongs on a customer’s list like any other link, jurisdiction column included. Every release Northfleet ships carries provenance binding it to the source it was built from, which the customer can check without Northfleet’s participation. The architecture assumes the vendor can be compromised or compelled, so compelling Northfleet doesn’t produce a silent backdoor, though catching one depends on someone actually checking releases against their source.

If a SAFE bid has you writing that list, and part of what you deliver runs on Kubernetes inside a classified boundary, talk to us.