Hand this bid to your operations lead before your CTO opens it. Shared Services Canada’s AI governance challenge, posted October 30, 2026 through Innovative Solutions Canada, offers up to $2 million to a Canadian small or mid-size firm, and most of its points reward running a project of up to 20 months well, not clever code.
That matters for any Canadian company selling AI governance software, whether it is a five-person shop in Waterloo or a 200-person firm in Montréal. The challenge closes December 22, 2026 at 2 p.m. Eastern. Seven weeks feels like plenty. It is not much if the first three go to a proposal for a product that cannot yet do the one thing SSC cares about most.
What does Shared Services Canada want from the AI governance challenge?
SSC wants software that keeps track of every AI system a department runs and tells staff when a rule change means a system needs another look. The challenge notice says current tools lean on manual work to read new requirements and apply them system by system.
In plain terms, the essential outcomes ask for a register of AI systems that stays matched to Canadian rules, flags which systems a change touches, and connects to other tools through open, documented interfaces. Departments must control residency, retention, access and deletion themselves, without calling the vendor. Every finding has to name the requirement, the evidence, the result and a confidence measure, and a human reviewer can accept, reject or edit it with a logged history.
The notice also names the floor for those assessments: the Policy on Service and Digital, the Directive on Automated Decision-Making, the Algorithmic Impact Assessment, the federal AI Strategy and its ethics guidance. That directive says it is reviewed every two years. So the rules a tool checks against will move during the contract, which is the whole point. We covered why that directive keeps a person on the final call for higher-impact systems earlier this week.
Who can bid, and who should sit this one out?
A for-profit Canadian company with 499 or fewer full-time equivalent staff can bid if its research happens in Canada and at least half of its pay, its staff and its vice-presidents and up are based here. The bigger filter is maturity. Only Phase 2 proposals are accepted, and the product must already sit between readiness levels 5 and 9.
On the program’s readiness scale, level 5 means semi-integrated parts validated in a simulated environment, so the product already runs somewhere that looks like real work. The notice fails proposals that only restate a level’s definition, and it fails “good engineering” that would ship in your next release anyway. If your governance product is still a slide deck and a Figma file, this is the wrong door. Count the affiliates, too. The staff and pay tests include parent companies and subsidiaries inside or outside Canada, so a Canadian arm of a large foreign group should check before anyone writes a page.
Where do the 130 points actually sit?
More than half of the points go to running the project, not to the technology. The plan, the team, the two risk sections and financial controls add up to 70 of 130. The technology questions, advance on the state of the art plus the optional extras, top out at 30. You need 65 to be considered at all.
Read that chart as a staffing note. A firm can earn every technology point and still need 35 more from the sections a founder tends to rush on the last night. The plan table, the named team, the human resources and supply risks, who signs off on spending: that is operations work. So is inclusivity, worth 20 points on its own. A firm registered on the Indigenous Business Directory, or a Modern Treaty or land claim business list, gets the full 20 on that question.
Run the rule-change drill before anyone writes a page
The cheapest way to know whether to bid is to make your product do the hardest essential outcome, on purpose, this week. Change one rule and watch what happens. If the tool cannot show which systems that change affects, with a finding a reviewer can trust, no proposal will fix it by December.
Here is the drill. It takes one person most of a day.
If it passes, you have the start of your answer to the feasibility question, with your own data. If it fails on one field, you have a real development gap to describe in the risk section. If it fails on most, keep the seven weeks for customers who are already paying. We made a similar case for keeping a plain company record of every AI system: the register is only useful if someone can show it working.
Is up to $2 million worth the bid for a small team?
For a firm that passes the drill, yes, with eyes open. Spread over 20 months, the ceiling works out to about $100,000 a month before taxes. SSC expects one or two contracts, can make partial awards, and says the notice does not commit Canada to award anything. Treat it as a strong maybe, not as revenue.
The honest counter-case is cost. A proposal at this level of detail takes senior people away from selling, and a 30-person firm feels every week of that in its pipeline. The upside is less about the money than the reference. A federal department running your tool across several teams, in both official languages, on Canadian-hosted infrastructure, is the kind of reference other public buyers, from provincial ministries to Crown corporations, tend to ask for. That is also why the operations lead matters. The buyers who come after SSC will ask the same questions SSC scores: who runs it, what can go wrong, and where the money went. Questions to the contracting authority must arrive in writing at least ten calendar days before the close, which points to December 12. Send yours early.
If you sell AI governance software in Canada, run the drill this week, then decide. A product that keeps AI systems maintained after launch is the product SSC is describing. A bid built around a demo nobody has stress-tested is the one most likely to stall below 65.
Frequently asked questions
When does the SSC AI governance challenge close?
December 22, 2026 at 2 p.m. Eastern time. It opened October 30, 2026. Written questions must reach the contracting authority no later than ten calendar days before the close, so send them by December 12.
How much funding does the AI governance challenge offer?
Up to $2,000,000 per Phase 2 contract, before applicable taxes, for up to 20 months. SSC expects one or two contracts, may make partial awards, and says the notice does not commit Canada to award any contract.
Can a startup with only an idea apply?
No. The challenge only accepts Phase 2 prototype proposals for solutions at technology readiness level 5 to 9. Basic research, and products described only by restating a readiness level, fail the mandatory screen.
Does the product need to work in French?
Bilingual English and French functionality is one of four additional outcomes. Those are scored together for up to 10 points rather than pass or fail, but a French interface is still worth building before you bid.
Where are the official rules for the challenge?
The Innovative Solutions Canada challenge page lists the outcomes and scoring, but the tender notice on CanadaBuys is the official source and takes precedence if the two differ.
Facts checked against the SSC challenge notice and the Directive on Automated Decision-Making on October 31, 2026. We have not used or tested any bidder’s product. More on putting AI to work in your company is on our AI for business hub.
