Digital sovereignty in the AI era: taking back control of unstructured data before it controls your risk

In short:

Most organizations can’t say who has access to their sensitive data. AI agents now surface everything a user is allowed to see in seconds, putting overexposed files one prompt away. For public organizations, this is also a question of digital sovereignty: do you know where your data is, who can access it and who decides?

This question was at the heart of a panel at the Sommet international Cybersécurité et Souveraineté numérique on October 22, 2026. Mondata President Yves Eric Laliberté moderated the conversation with Yvan Fournier, Associate Deputy Minister and Government Chief Information Security Officer at Québec’s Ministère de la Cybersécurité et du Numérique (MCN), and Vaneck Duclair, Senior Director and Chief Information Security Officer at Investissement Québec.

Here are their answers to the questions on the agenda, edited for length and clarity.

AI amplifies risks that already exist

What is the most immediate challenge AI raises for unstructured data?

Vaneck Duclair: It isn’t necessarily new risk. It’s the amplification of risk that already existed. A file may have sat for years in a shared folder, with access that became too broad. Before AI, it was hard to find. Now it can be indexed, summarized, cross-referenced and surfaced to a user instantly. AI turns a silent governance weakness into an immediately exploitable risk.

Yvan Fournier: Government has made real progress on frameworks, classification and access controls. But documents, emails and collaboration spaces are created fast, copied, shared and kept long after they’re useful. So maturity can no longer be judged by whether a policy exists. It has to be measured by our ability to know what we hold, where it is, who can access it and how fast we can fix an exposure.

Three blind spots: inventory, access and accountability

What are the most worrying blind spots in the public sector?

Yvan Fournier: First, inventory. You can’t protect what you don’t know, and data is scattered across file shares, SharePoint, Teams, mailboxes and legacy systems. Second, access: data can be well protected technically and still exposed because a group is too broad, a permission was never removed or copies multiplied. Third, accountability: we may know where a document is and who can open it, yet not who should decide on its retention, classification or use by AI.

AI raises the urgency because it shrinks the time available. What stayed buried for years can now be found almost instantly. And data residency alone doesn’t guarantee sovereignty. Real control means deciding who accesses data, how it’s used and encrypted, and which technology dependencies limit our autonomy.

Vaneck Duclair: On paper, security or IT teams are responsible for an environment. But usually only the business line has the context to decide whether a document should be kept, who should access it or whether AI can use it. An organization that can’t explain where its sensitive information is and who can see it has theoretical sovereignty, not operational sovereignty.

From centralized control to shared responsibility

How do you make data owners accountable without paralyzing the organization?

Vaneck Duclair: The fully centralized model has reached its limits. The goal isn’t to shift the problem to the business; it’s to clarify roles. I see four conditions for success:

1. Assign clear ownership. Data without an owner quickly becomes risk without a decision-maker.
2. Keep decisions simple. Is this still needed? Should these people still have access? Can AI use it?
3. Build security into the workflow. A 20-page policy doesn’t change behaviour. Tools should flag sensitive data and excessive access, then propose a fix with minimal friction.
4. Measure results. Show that fewer sensitive documents are overshared and that anomalies get fixed faster.

Take a SharePoint site holding financial analyses and partner exchanges. Security can see it’s open to too broad a group, but can’t always tell who needs access. The business owner should get a simple view: here’s the sensitive data, here’s who has access, here’s what looks unusual. They confirm or remove access. That’s accountability: the right decision, with the right context.

Yvan Fournier: Distributed governance doesn’t mean different governance in every organization. It rests on a common foundation: clear roles, shared classification, minimum security measures and indicators. Centralize direction, standards and visibility; distribute the decisions that need business context; and automate what can be automated.

One lever to pull now

What is the one action that every public organization should prioritize?

Vaneck Duclair: Establish clear, measurable accountability for your most critical data. Don’t try to classify everything perfectly first. Start with personal, financial, strategic and employee data, and answer four questions: Where is it? Who can access it? Who owns it? Can AI use it safely?

Yvan Fournier: Start with a dynamic inventory of critical data and its access, then apply a consistent chain: discover, classify, protect, monitor. Understand your dependencies too: where data is processed, which laws apply and who controls the keys. Before deploying AI widely, get visibility into the data it will access. AI must accelerate the public mission, not our vulnerabilities.

Three takeaways

For Yves Eric Laliberté, three takeaways stand out:

1. Digital sovereignty starts with data governance. Knowing where your data is, who can access it and who owns it is a precondition for secure AI.
2. The centralized model has reached its limits. Data-owner accountability is a strategic necessity.
3. Lasting change comes from tooling, not just training. Security has to be built into the way people already work.