Day 1 Wrap-Up from ALL IN 2026: Three Themes That Defined Montréal
Day 1 at ALL IN 2026 made one point clear: enterprise AI has moved beyond experimentation, but production adoption still depends on control.
Across countless conversations in Montréal, we heard the same questions in different forms. Is the data ready? Who owns the workflow? Where does the model run? What happens when an agent takes an action that nobody intended? Which person approves a high-risk operation? Can the organization prove what happened afterward?
Three themes defined the day:
- AI is past the pilot phase, but production is still hampered.
- Sovereign AI is the future.
- Runtime governance is a hot topic.
Each theme connected directly to a Day 1 session and to the questions enterprise leaders are carrying back into their organizations.
1. AI is past the pilot phase, but production is still hampered
The room around the Agora session “Build vs. Buy: How Leaders Are Approaching the AI Model Decision in 2026” reflected a clear shift in enterprise thinking. The published panel included Jean-Sébastien Charest, CIO at BDC; Melisa Muraca of Sun Life; Kathryn Hume of the Vector Institute; and Chris Smith of AMD, moderated by Yvonne Lau of the Financial Post.
The conversation was not about whether enterprises should experiment with AI. That phase is over. Organizations are already testing models, building workflows, and connecting agents to business systems.
The harder question is why so many initiatives still stall before production.
In conversations throughout the day, the blockers were consistent:
- Data readiness: proprietary data remains fragmented, poorly classified, or difficult to expose safely.
- Integration: pilots work in isolated environments but fail when they must connect to systems of record.
- Evaluation: teams can demonstrate capability without proving reliability across real workflows.
- Ownership: responsibility becomes unclear when an agent operates across multiple business functions.
- Cost visibility: token, infrastructure, and workflow costs remain difficult to attribute.
- Control: organizations lack a deterministic answer when an agent attempts a consequential action.
Build-versus-buy decisions address some of these issues. A purchased platform may accelerate deployment. A custom stack may provide more control over data and infrastructure. An open model may change the cost structure or reduce provider dependency. A hybrid approach may combine all three.
But none of these sourcing decisions answers the runtime authorization question.
A model can be built internally and still have excessive permissions. A commercial platform can be deployed in a trusted environment and still allow an agent to reach the wrong operation. An open-source workflow can remain difficult to audit when no independent control evaluates the action before execution.
The distinction matters:
| Question | Build or buy answers | Governance must answer |
|---|---|---|
| Dependency | Which model, platform, or provider do you use? | Which policies apply when the agent acts? |
| Data | Where does context enter the workflow? | Where may context travel, and why may it be used? |
| Integration | Which tools and systems connect? | Which operation may execute in this specific situation? |
| Economics | What does the workflow cost to run? | What happens when cost or risk exceeds the permitted threshold? |
| Ownership | Which team operates the stack? | Which named person approves an exceptional action? |
This is where production becomes different from a pilot. A pilot demonstrates that an agent can complete a task. Production requires the organization to define what the agent may do, enforce that boundary, and produce evidence when the boundary is tested.
At LangGuard, that starts with mapping the complete action surface through SCOPE-MCP: every connected tool, every exposed operation, and every system of record the agent can reach. Runtime enforcement then evaluates the attempted action before the tool call executes.
The practical takeaway is direct: AI capability is no longer the primary question. Authorized operation is.
2. Sovereign AI is the future
The Forum session “The New AI Infrastructure Race: Energy, Data Centres, and Sovereignty” gave the second theme a clear operating context. The published discussion covered sovereign compute, data autonomy, data-centre resilience, energy supply, and supply-chain security.
The conversations around this topic went beyond data residency. Leaders were asking where AI runs, who controls the infrastructure, which jurisdiction governs the data, and whether the underlying supply chain can withstand disruption or political change.
That concern was reinforced by two announcements made at ALL IN on Day 1.
Canada and Germany announced roughly C$300 million in backing for Yoshua Bengio’s LawZero, including a partnership to establish dedicated sovereign compute infrastructure in Canada. The announcement connects advanced AI safety research with national control over the compute required to conduct it. LawZero’s announcement describes the commitment and the planned Canadian infrastructure.
Cohere also announced its combination with Germany’s Aleph Alpha. The companies framed the combined organization as a Canadian-German sovereign AI champion, with data and strategic control anchored on home soil. BetaKit’s coverage reports on the transaction and its focus on governments and highly regulated industries.
These developments point to a broader direction. Sovereign AI is moving from policy language into infrastructure, investment, corporate structure, and deployment strategy.
But sovereignty has a boundary that enterprises must define precisely.
Sovereign infrastructure answers where AI runs and who controls the jurisdiction. It does not answer what an agent may access or execute.
A model can run on sovereign compute and still access too many systems. Data can remain inside a trusted country while an agent uses it for an unauthorized purpose. A locally controlled platform can still modify a record, approve a payment, or invoke a privileged tool without the required separation of duties.
Sovereignty must extend to authorization.
For enterprise leaders, the control model has at least three layers:
- Infrastructure sovereignty: where the model, data, and compute operate.
- Context sovereignty: where proprietary data and decision authority may travel.
- Action sovereignty: which operations the agent may perform and who can approve exceptions.
LangGuard’s MCP Context Authorization perspective separates trusted paths from purpose boundaries. Trusted-path policies govern where context may travel. Purpose-boundary policies govern why that context may be used. Runtime action policies govern what the agent may do after it has reasoned over that context.
The final layer is essential. Without it, sovereignty protects the environment while leaving authority too broad.
The hard-edged takeaway from Day 1 is this: keeping AI on home soil is not the same as keeping AI within authorized bounds. Enterprises need both.
3. Runtime governance is a hot topic
The third theme emerged most clearly around the Agora session “The AI Cyber Battleground: Defense, Offence and Resilience.” The published panel included Jean Le Bouthillier of Qohash, Wendy J. Wagner of Gowling WLG, and Ralf Wintergerst of Giesecke+Devrient and Bitkom, moderated by Justin Ling of the Toronto Star.
The session’s published focus included evolving cyber threats, digital defense, deepfakes, digital identity, and organizational resilience. In our conversations throughout the event, those concerns repeatedly led to one operational question:
Who approves a high-risk agent action, and what evidence proves that approval occurred?
As agents take action across enterprise systems, cyber resilience becomes an authorization problem, not only a detection problem.
Detection identifies unusual behavior after or during an event. Authorization determines whether the action can execute in the first place. Monitoring explains what the agent attempted. Enforcement decides whether the tool call proceeds.
These controls are related, but they are not interchangeable.
- A security alert is not an authorization decision.
- A connection to a system is not permission to perform every operation it exposes.
- A log line is not a complete chain of custody.
- A post-incident review is not prevention.
- A risk score is not a deterministic policy outcome.
Consider an accounts payable agent that reads invoices, creates payment proposals, and submits approvals. If the agent created the proposal, a segregation-of-duties policy may prevent it from approving that same payment. If the amount exceeds a defined threshold, the action may require a named human approver. If the agent attempts to modify a vendor record outside its scope, the action should be blocked before the system of record changes.
That decision must occur before execution.
LangGuard Arbiter evaluates the action at that point and returns one of three outcomes:
- ALLOW: the action is within scope and policy.
- BLOCK: the action violates scope or policy and does not execute.
- ESCALATE: the action remains on hold until a named approver allows or denies it.
The decision is then recorded with the agent identity, user context, requested operation, policy applied, timestamp, outcome, and approver where applicable. This creates replay-ready evidence rather than a collection of disconnected log entries.
The result is targeted governance. Safe actions proceed automatically. Exceptional actions receive control. Only the operations that cross a risk, value, regulatory, or segregation-of-duties boundary create friction.
That distinction matters for production teams. Runtime governance does not mean putting a human in front of every agent action. It means placing a deterministic control at the point where the agent attempts to create business impact.
Not after the fact. Before execution. Not a signal. A decision.
Day 2 is next
Day 1 showed that enterprise AI is no longer waiting for a business case. The business case exists. The constraints now sit in production readiness, sovereign infrastructure, runtime authorization, approval, and evidence.
The three themes connect:
- Production adoption requires more than a working model.
- Sovereign AI requires more than local infrastructure.
- Cyber resilience requires more than detection.
You need to map the action surface, define the permitted scope, evaluate actions before execution, route exceptional operations to named approvers, and preserve evidence that can be replayed.
The LangGuard team is looking forward to Day 2 and remains available to meet at ALL IN in Montréal on September 16–17. We are available to discuss production blockers, sovereign AI requirements, runtime governance, approvals, least-privilege controls, and replay-ready audit evidence.