EU-Canada Rapprochement: An Opportunity for Cybersecurity

On September 16, Ursula von der Leyen proposed that Canada become the first “associate member” of the European Union. This unprecedented status, which is not provided for in the treaties, has yet to be defined. What could the cybersecurity sector on both sides of the Atlantic gain from it?

During her State of the Union address, attended by Canadian Prime Minister Mark Carney, the President of the European Commission said she wanted to “work” with him “on the possibility of Canada becoming the EU’s first associate member”. Cybersecurity was among the areas she listed, alongside AI and quantum technologies. The following day, addressing the European Parliament, Mark Carney said he “welcomed this ambition” without dwelling on the label: what matters, he stressed to the press, is the substance. Donald Trump, for his part, had dismissed the idea as “ridiculous” on September 16 and threatened Europe with new tariffs if he considered it a hostile act. “Trump is the best salesman for sovereignty issues around the world,” jokes Mathieu Roseau, who heads Atos’s Canadian cyber resilience operations. The aggressive nature of Washington’s foreign policy, from tariffs to the idea of Canada becoming the “51st state”, appears to have accelerated the process. Guy Veilleux, co-founder and Head of Europe at Quebec-based software company Qohash, recently returned from Brussels, confirms: “I can tell you that there is a genuine desire for closer ties on both sides.” A French group established in Canada and a Canadian software company betting on Europe: both view the ongoing rapprochement very favourably.

From free trade to political alignment

Under the Comprehensive Economic and Trade Agreement (CETA), provisionally applied since 2017, almost all tariffs between the EU and Canada have been eliminated. Ursula von der Leyen recalled this in Strasbourg: trade in goods has increased by 75% in less than ten years. This unprecedented political status requires the agreement of all 27 EU Member States, but closer ties could quickly materialise through a series of sector-specific agreements and partnerships. The process is already underway. At the June 2025 summit, Brussels and Ottawa signed a security and defence partnership, and their joint declaration explicitly mentions cybersecurity and hybrid threats. In February 2026, Ottawa signed the agreement making Canada the first non-European country associated with SAFE: its companies can now compete for contracts financed by this €150 billion loan instrument, including in cybersecurity. In early March, the two sides opened negotiations on a digital trade agreement. Taken together, these agreements point to something more than a commercial relationship. “Beyond the free trade agreement that already exists between Europe and Canada, what we are seeing here is political alignment,” analyses Guy Veilleux. “Today, the geopolitical situation is forcing us to move away from a certain complacency, to diversify, and ultimately allowing us to evolve. That is a good thing.”

Sovereignty: Demand is taking shape

In Canada, Shared Services Canada, the federal government’s IT service provider, has launched a procurement process for a sovereign cloud that excludes suppliers subject to foreign laws allowing access to data without written consent, as permitted by the US CLOUD Act. Ottawa invoked the national security exception, which exempts these contracts from all its trade agreements, including CETA. On March 31, 2026, the Office of the United States Trade Representative (USTR) included this project in its annual report on foreign trade barriers. Mathieu Roseau sees the same concern among his Canadian clients: “Today, organisations want to control their data, critical applications and dependencies.” Guy Veilleux describes the same “political pressure to adopt sovereign solutions” in both Europe and Canada. However, for a Canadian customer, a European solution remains foreign, and vice versa. This is why Mathieu Roseau sees value in a common framework: “If this rapprochement between Canada and Europe becomes a reality, it will increase these organisations’ ability to choose and maintain control, both in Canada and in Europe.”

Atos has been present in North America for nearly twenty years and strengthened its position in Canada in 2021 with the acquisition of Quebec-based consultancy In Fidem. The group, which has identified Canada as a growth driver for 2025 and 2026, launched a global digital sovereignty offering on April 28: spanning consulting to operations, it covers cloud, data, AI and cybersecurity. “Atos has the ability to build an end-to-end sovereign solution for its clients,” emphasises Mathieu Roseau, who oversees the delivery of Atos cybersecurity services across North America. “Current developments confirm the value of being a French and European group with a presence in Canada.”

Since the summer of 2026, Guy Veilleux has been leading Qohash’s development in the European market from France: “We have decided to invest heavily and bet on the European continent.” Founded by former military personnel, the Quebec-based software company emerged from a simple observation: when it comes to data breaches, organisations have very limited visibility into how their employees access sensitive information. Its solution makes it possible to exercise this control directly within the working environment; according to Guy Veilleux, the data never leaves the customer’s environment, and Qohash never has access to it. “We can see very precisely where the information is at any given moment, but also where it was in the past. This enables organisations to conduct a risk analysis and then remediate the problem,” he explains. The manufacturing and defence sectors are showing the greatest interest.

A framework to build, investments to secure

For the sector, the question is not so much what the status will be called as what it will actually entail. Mathieu Roseau outlines the sequence: “Once there is a framework — which still needs to be defined and will become clearer — investment accelerates. And the more investment there is, the more innovation we can expect, and therefore a greater ability to open up markets and build together.” Opening up markets also requires the resources to gain visibility. Guy Veilleux observes: “The greatest difficulty is gaining visibility. We are competing with foreign companies, particularly American and Israeli ones, that receive massive funding and can therefore afford very large marketing budgets.” Mathieu Roseau sees this as one of the drivers of demand for sovereignty: “If the sovereignty narrative is gaining so much momentum today, it is because American players have access to capital that overwhelms everyone else. We need to help players emerge that can compete with them, or at least offer a credible alternative. That is what I would like to see, and Atos has the ability to do it.” He hopes to see the emergence of “Canadian-European champions”.

The EU-Canada summit, scheduled to take place in Montreal on October 29 and 30, should clarify the form this rapprochement will take. “More exchanges mean more investment, and I think cybersecurity will become part of this broader movement,” predicts Guy Veilleux. After Montreal, the cybersecurity community will gather from December 1 to 3 in Ottawa-Gatineau for Forum INCYBER Canada, its fifth Canadian edition and the first to be held in the capital region, with more than forty international delegations expected. “For us, events such as Forum INCYBER provide strong networks to develop our visibility,” emphasises the Qohash co-founder. An opportunity to assess, first-hand, how this rapprochement is taking shape for the cybersecurity ecosystems.