In fall 2025, the Government of Canada published its Digital Sovereignty Framework, which defines it as “the ability of the GC to exercise autonomy over its digital infrastructure, data and intellectual property.” This is not an abstract concept reserved for geopolitical debates. It is an operational, strategic, and financial issue that affects every public, parapublic, and private organization in Quebec.
And the signals are clear: the model of delegating everything externally without building internal capabilities has reached its limits.
A Quebec Reality: Twenty Years of Ignored Warnings
The problem is not new. As early as 2006, the Quebec Auditor General found that the share of IT labour spending paid to private suppliers had grown from about 29% to 47% over twenty years, and established that certain IT activities should be performed primarily by departmental staff.
In 2011, the VGQ found that 52% of IT labour spending in departments and agencies went to external resources, compared with 8 to 24% for provincial and state governments elsewhere in the world, according to Gartner data, and that vacant strategic positions were increasingly entrusted to them. An external resource then cost $400 to $950 per day, versus $215 to $475 in-house. In 2012, its audit of IT professional services contracts added that “frequent reliance on outsourcing can, over time, lead to the stagnation of internal expertise, or even its loss” (our translation). The contracts reviewed had received an average of 1.9 compliant bids, and follow-on work went to the previous supplier in 18 of 25 cases.
As the SPGQ summarizes: “the Quebec Auditor General has been raising concerns about outsourcing for the past 20 years” (our translation). Twenty years of warnings, and yet, the situation has only worsened.
In Canada: A Framework That Names the Real Issues
The federal framework highlights challenges related to jurisdictional complexity, reliance on global suppliers, evolving cyber security risks, and internal capacity. They resonate directly with the reality of our organizations:
- Reliance on global suppliers: when supply is concentrated among a few large providers, the organization's room to manoeuvre shrinks.
- Insufficient internal capacity: organizations have limited ability to design, manage, and secure complex digital systems in-house.
- Supply chain vulnerabilities: dependency on global suppliers exposes organizations to security risks beyond their direct control.
- Jurisdictional complexity: foreign laws such as the U.S. CLOUD Act allow authorities to request access to information, so using a Canadian supplier or storing data in Canada does not guarantee it is beyond the reach of foreign courts.
The Digital Sovereignty Framework puts it plainly: “The GC can fully maintain legal control only when it delivers services itself or works with providers that operate entirely under Canadian jurisdiction.”
The Hidden Cost of Dependency: Billions in Overruns
Technology sovereignty is not just a matter of principle, it is a matter of billions. Federally, the Phoenix pay system , whose initial development cost $309 million, has an estimated internal cost of about $4.8 billion over a decade according to CBC News; some 483,130 employees received an overpayment. In Quebec, according to the Gallant Commission report, the portion of the SAAQ's CASA contract allocated to Release 2 (SAAQclic) rose from $81 million in 2017 to $329 million in 2023. The RENIR network: from $144 million to over $350 million, while in 2020, 78% of emergency responders were not using it.
This is not an accident, it is a pattern. According to the Parliamentary Budget Officer, in 2022-23, task-based IT contractors cost 22% to 25.7% more than equivalent public servants in the four departments analyzed. And according to the Professional Institute of the Public Service of Canada, from 2011 to 2018, “the final cost of an IT consultant is more than double the cost of the original contract” on average.
When code does not truly belong to the organization, when it was developed by external teams without knowledge transfer, without adequate documentation, without aligned architectural standards, costs explode silently. And the bill always arrives eventually.
The Shift Toward Sovereignty Has Begun
The movement is no longer theoretical. In February 2026, the Gallant Commission recommended creating a “centralized entity specialized in state digital transformation” with the expertise needed to “reduce dependency on consultants and external firms” (our translation). It also recommends capping IT project costs below $50 million (with Cabinet able to grant exemptions) and limiting IT professional services contracts to less than five years.
The SFPQ, which welcomed the report, sees it as confirming a recurring shortage of in-house IT resources across the public service, and the resulting dependency on private firms.
At the same time, Quebec published its Digital Sovereignty Policy Statement, which aims to “strengthen Quebec's technological autonomy and reduce its dependency on foreign suppliers” (our translation) by expanding the use of open-source software, supporting custom-built solutions, and building strong local digital expertise and capacity.
The Levers to Take Back Control Exist
One of the historical arguments against technology insourcing was the complexity of governing internal development. That argument no longer holds, federal and provincial policies confirm it.
The federal government, in its Open First Whitepaper, acknowledges that vendor lock-in is both a “technical handicap” and an “economic handicap,” and that “the lack of an interoperability framework and open standards accepted by the provider poses a significant risk to the sustainability of the solution.” The Government of Canada Digital Standards call on departments to “use open standards and solutions.”
Policy as Code allows organizations to encode these governance, security, and compliance rules directly into development pipelines. Instead of manually checking whether a deployment meets standards, after the fact, automated guardrails validate it before every production release.
This is the end of the false dilemma between speed and governance. With the right frameworks in place, your internal teams can innovate faster than external teams, because they understand your business context, your technical debt, and your regulatory constraints.
What Technology Sovereignty Really Means
Technology sovereignty does not mean doing everything alone. As the Government of Canada's Digital Sovereignty Framework defines it, sovereignty is “the ability of the GC to exercise autonomy over its digital infrastructure, data and intellectual property.” The Quebec government adds that this sovereignty aims to “reduce a government's dependency on foreign companies” (our translation). The viable approach is managed interdependence: diversifying suppliers, demanding interoperability, and above all, building the internal capacity to understand, evaluate, and direct your own technology trajectory, otherwise, as a Carleton University professor told The Hub, a capacity gap “must be fed by consultants, which essentially means the building of a shadow bureaucracy”; and with constant turnover in IT staff, “very few competencies remain.”
In practice, this means:
- Audit your current dependency: identify areas where you could not switch providers without prohibitive costs or delays. This is the starting point of any sovereignty strategy.
- Verify deliverables continuously: beyond Policy as Code frameworks, ensure independent, real-time verification that deliverables, internal or external, meet contractual commitments and organizational standards.
- Require independent technical validation: ensure that an objective external perspective validates the soundness of your technology choices and dependencies, free from conflicts of interest.
- Insource progressively: start with the most strategic and well-understood functions, then gradually expand the internal perimeter, including independent validation at each phase.
The V.I.A. Approach: Technology and Independence
At V.I.A. Solutions, we validate the technical soundness of your technology choices and dependencies, and we equip your independence.
The independent technology audit reviews the proposed architecture and selected technologies before signing, dependencies included (vendor lock-in, proprietary APIs, closed technologies), compares deliverables with what was promised at every milestone, and provides an objective assessment before a renewal or renegotiation.
The Transparence platform, designed for Quebec, its laws and its need for digital sovereignty, ensures continuous rigor: measurable requirements from scoping onward, deliverable validation before payment, real-time tracking and a dated, signed record of every action, which makes verification easier.
Finally, our Sovereign AI Lab develops AI tools that run in a local environment (specialized agents, meeting transcription, task organization), so you remain in control of your data.
The question is no longer whether your organization should master its technology destiny. The question is: how long can you afford to wait before getting started?
Updated on