Canada has been talking about this for the better part of a decade. The United Kingdom switched on open banking in 2018. Australia, Brazil and others followed. Canada spent years in consultations, advisory committees and interim reports, and the framework changed regulators partway through. Now the law is done, draft rules are out, and the remaining question is mostly about timing.

Here’s what the framework actually does, where it stands in the fall of 2026, how it compares with the U.K. and the U.S., and what it will change for consumers and the fintech startups building on it.

The problem it’s meant to fix

If you’ve ever connected a budgeting app, a tax tool or a lender’s income check to your bank account, you’ve probably used screen scraping. You type your bank username and password into a third-party app, and that app logs in as you to read your transactions.

It works, but it’s a terrible design. You’re sharing your full credentials, which often gives the app far more access than it needs. Your bank can’t tell the difference between you and the app. And sharing your password may affect your protection under your bank’s fraud policies. When the government laid out its plans in Budget 2024, it estimated that about nine million Canadians were sharing credentials this way.

Open banking replaces that with application programming interfaces, or APIs. Instead of handing over a password, you authorize a specific app to receive specific data, for a specific period, through a secure connection your bank controls. You can revoke it. The app never sees your password.

How Canada got here: a short timeline

Canada’s version is officially called “consumer-driven banking,” and its path has been winding. The key steps:

1. April 2024: Budget 2024 commits to a framework with one national technical standard, mandatory participation for the largest retail banks, and oversight by the Financial Consumer Agency of Canada (FCAC).
2. June 2024: The first part of the Consumer-Driven Banking Act becomes law through the 2024 budget bill. In early July, the FCAC welcomes its new mandate and gets $1 million for a public awareness campaign.
3. Fall 2025: Budget 2025 moves oversight from the FCAC to the Bank of Canada and fills in the rest of the framework, including accreditation, liability and a screen-scraping ban. The implementing bill, C-15, is tabled on November 18, 2025.
4. March 26, 2026: Bill C-15 receives Royal Assent, completing the Consumer-Driven Banking Act.
5. June 27, 2026: Draft regulations are published for a 60-day comment period ending August 26.

The regulator switch is worth pausing on. Originally, the FCAC, which already supervises banks’ consumer obligations, was going to run the system. Budget 2025 handed the job to the Bank of Canada instead, which also oversees retail payment providers. Forbes reported that the government set aside $19.3 million over two years for the Bank’s new role. The government’s published materials don’t spell out a reason, but putting data sharing and payments under one supervisor makes sense if Canada eventually wants open banking to move money, not just read balances.

What the framework actually requires

Between the Act and the draft regulations, the shape of the system is now fairly clear.

Who has to participate

The largest retail banks must take part, based on a retail volume threshold set by the Minister of Finance. In practice, observers expect that to mean the Big Six: RBC, TD, BMO, Scotiabank, CIBC and National Bank. Credit unions, provincially regulated institutions and fintechs can join voluntarily if they meet the accreditation requirements. The Bank of Canada will run the accreditation process and maintain a public registry of approved participants.

What data is covered

The scope includes deposit accounts, payment products, investment accounts (registered and non-registered) and lending accounts. It does not include “derived” data, meaning the analysis banks create from your raw data, such as internal credit scores or spending categories.

The fine print in the draft rules

The proposed regulations add specific obligations, as summarized by Canadian data company Flinks and law firm commentary:

• Banks’ data-sharing systems must be available at least 99.5% of the time each month.
• Consumers can request at least 24 months of transaction history.
• Consent lasts a maximum of 12 months before it has to be renewed.
• Participants must keep records for five years.
• Penalties reach up to $10 million for participating entities.

Who pays when something goes wrong

This is the part consumers should care about most. Under the Act, you aren’t liable for a financial loss caused by sharing your data inside the framework unless you were grossly negligent with your login credentials. Institutions are responsible for breaches of their own security safeguards. And screen scraping becomes an offence once the framework is fully operational.

So when does it launch?

Here’s the honest answer: not yet, and nobody has committed to a firm date.

In March 2026, the Bank of Canada said it would be “premature and ill-advised” to set a launch date before the full scope of the work was understood, Open Banking Tracker reported. A summary of the Bank’s July 2026 advisory committee meeting gives the clearest picture so far:

• Final regulations are targeted for late 2026 or early 2027.
• Obligations are expected to start roughly a year after that, beginning with deposit and payment accounts.
• Lending and investment accounts follow in later phases, over a timeline that could stretch 18 months or more.
• The technical standards body, which will set the actual API specifications, still hadn’t been named as of that meeting. An earlier Bank of Canada planning note had expected that decision in spring 2026.

Read together, that points to banks being required to share basic account data sometime in 2027 or 2028, with the full scope arriving later. “Write access,” which would let apps initiate payments or switch accounts on your behalf, is a second phase. Budget 2025 committed to 12 to 18 months of policy work on it, and industry observers link its timing to Payments Canada’s Real-Time Rail, a new instant payment system whose own launch timing remains uncertain.

How Canada compares with the U.K. and the U.S.

The U.K.: proof it can scale

The British system started in January 2018 with nine big banks forced to open up by a competition ruling. By July 2025 it had 15.16 million users, nearly one in three adults. In July 2026, Open Banking Limited said the system had passed one billion payments and 100 billion API calls. In June 2026 alone there were about 40 million open banking payments, including 7.7 million variable recurring payments, a feature that lets you authorize a merchant to pull flexible amounts within limits you set.

The lesson from the U.K. is that payments, not data, are where the real consumer value showed up. Paying a tax bill or topping up an account directly from your bank, without a card, is the use case that took off.

The U.S.: stuck in court

The American story is a cautionary one. The Consumer Financial Protection Bureau finalized its personal financial data rights rule in October 2024, with the largest institutions originally due to comply by April 1, 2026. Banks sued. In August 2025 the CFPB said it would reconsider the rule, including whether banks should be allowed to charge fees for data access. On October 29, 2025, a federal court in Kentucky stayed the compliance dates. The CFPB’s 2026 regulatory agenda still lists the reconsideration as planned work.

Canada’s approach looks slow next to the U.K., but it has one advantage over the U.S.: the core rules are written into statute, which makes them harder to unwind with a change of government or a lawsuit.

What changes for consumers

When the system goes live, the day-to-day changes should be modest but meaningful:

• No more password sharing. Connecting an app will look more like “Sign in with your bank,” where you approve specific data on your bank’s own screen.
• Clearer control. You’ll be able to see which apps have access and revoke it. Consent expires after at most a year.
• Better protection. The liability rules mean you’re not on the hook for losses within the framework unless you were grossly negligent.
• Easier switching, eventually. Once write access arrives, moving accounts or paying directly from your bank should get simpler.

If you’re making a big financial decision based on a new app or service, it’s worth checking with a financial adviser, and confirming that the provider is accredited once the Bank of Canada’s registry is live.

What changes for fintech startups

For Canadian fintechs, the framework is both a gift and a compliance project. The upside is reliable, standardized access to data from every major bank, without fragile scraping scripts that break whenever a bank redesigns its login page.

The costs are real, though. Startups will need accreditation, insurance or comparable financial guarantees, security controls and record-keeping that meets the Bank of Canada’s standards. Some may rely on accredited intermediaries rather than connecting directly. And derived data stays out of scope, so fintechs will need to build their own analytics on top of raw transactions.

Founders should also plan for the gap. Screen scraping won’t be banned until the framework is fully operational, but building a business on it now means building on something with an expiry date. The practical move is to design for API access from the start and treat scraping as a temporary bridge. Given how much is still in draft, a conversation with a lawyer who knows financial regulation is worth having before you lock in an architecture.

The bottom line

After years of delay, Canada now has a law, a regulator and draft rules for open banking. What it doesn’t have is a technical standard or a launch date, and the realistic window for mandatory data sharing has slid into 2027 and beyond. The U.K. shows the payoff can be large, especially once payments are included. The U.S. shows how easily it can stall. Canada’s statute-first approach should make the eventual system durable. The challenge now is getting it built before another round of apps and consumers settles into the password-sharing habit for good.

Sources and further reading

• Department of Finance: Budget 2024, Canada’s framework for consumer-driven banking
• Department of Finance: Budget 2025, Canada’s framework for consumer-driven banking
• FCAC: FCAC welcomes new mandate to oversee Canada’s Consumer-Driven Banking Framework
• DLA Piper: The new Consumer-Driven Banking Act explained
• Substance Law: Canada releases proposed consumer-driven banking regulations
• Flinks: Open banking in Canada, draft consumer-driven banking regulations
• Bank of Canada: Consumer-driven banking advisory committee summary, July 21, 2026
• Bank of Canada: Discussion note on deliverables and dependencies, May 12, 2026
• Open Banking Tracker: Open banking Canada, what’s coming in 2026 and 2027
• Forbes: Open banking now launching in Canada
• Open Banking Limited: Open banking surges to 15 million UK users
• Open Banking Limited: Open banking surpasses one billion payments and 100 billion API calls
• CFPB: Required rulemaking on personal financial data rights
• Federal Register: Personal financial data rights reconsideration
• CFPB: Personal financial data rights compliance resources

The post Open Banking in Canada: Where Consumer-Driven Banking Stands Now appeared first on VeryRite.

That sequence tells you most of what you need to know about making money from open source. The code is free, the value is real, and the tension between those two facts never quite goes away. Every company in this space is trying to answer the same question: if anyone can download your product, what exactly are customers paying for?

The answers have changed a lot over three decades. Here is how the main models work, who has made them work, and why the licensing fights of the last few years matter to anyone building a startup on open code.

Model one: sell the support, not the software

Red Hat is the original proof that a company can give its product away and still get rich. Its business was never about selling Linux. It sold subscriptions that bundled certified, tested releases with patches, security updates and someone to call when a server fell over at 3 a.m.

The model worked spectacularly. In fiscal 2012, Red Hat reported revenue of $1.13 billion, and then-CEO Jim Whitehurst described it as the first pure-play open-source company to pass the billion-dollar mark. Subscriptions made up about 85% of that revenue. Seven years later, IBM bought the company for about $34 billion, closing the deal in July 2019.

The support model has a weakness, though. If the code is truly open, someone else can rebuild it and offer it for free. For years, CentOS did exactly that with Red Hat Enterprise Linux. In June 2023, Red Hat stopped publishing RHEL source code openly and limited public releases to CentOS Stream, The Register reported, which made life much harder for rebuild projects like Rocky Linux and AlmaLinux. Red Hat framed it as a focus on Stream. Critics saw a company protecting its moat. Both readings can be true.

Model two: open core

Open core is the most common model among venture-backed open-source startups. The basic product is open source. Features that large organizations need, such as advanced security, audit logs, single sign-on and compliance reporting, live in a paid edition.

GitLab is the textbook example, and it’s unusually candid about how it decides what to charge for. Co-founder Sid Sijbrandij has described a “buyer-based” approach: features aimed at individual contributors are open source, while features that managers, directors and executives care about go into progressively more expensive tiers, as the company explained in a 2018 post. A developer gets everything needed to write and ship code. The head of security pays for the dashboard.

It works. GitLab reported fiscal 2026 revenue of $955.2 million, up 26%, with 1,456 customers paying more than $100,000 a year.

The hard part of open core is the line itself. Put too much in the free edition and nobody pays. Put too little and the community drifts to a competitor or a fork. In practice, that line is a permanent negotiation rather than a one-time decision, and it shifts as competitors and customer expectations change.

Model three: run it for them

The most successful model of the last decade is also the simplest to explain. Most companies don’t want to operate a database or search cluster themselves. They want someone else to handle backups, scaling, upgrades and uptime. So open-source companies sell a managed cloud service.

MongoDB shows how far this can go. Its Atlas cloud service made up about 76% of subscription revenue in fiscal 2026, bringing in $1.81 billion of the company’s $2.46 billion total, according to its March 2026 results. Atlas grew 29% year over year and had more than 63,900 customers.

There’s a Canadian example of a hybrid approach in Toronto-based Tailscale. Its client software is open source, but the coordination server that runs its managed network is closed, the company says. It even supports Headscale, a community-built open-source alternative to that server, for people who want to host everything themselves. In April 2025 Tailscale raised a US$160 million Series C at a US$1.45 billion valuation, BetaKit reported.

The catch: someone bigger can host it too

The hosting model has an obvious vulnerability. If your code is under a permissive licence, Amazon, Google or Microsoft can offer it as a managed service on their own clouds, with their own billing relationships and sales teams. That’s legal. It’s also, from the original company’s point of view, a nightmare. This single problem is behind almost every major licensing fight of the past eight years.

The licence wars

Starting in 2018, a string of well-known companies moved away from traditional open-source licences to “source-available” terms that block cloud providers from offering competing services. Here’s a short timeline of the big ones:

MongoDB wrote the playbook. Its Server Side Public License, announced in October 2018, requires anyone offering the software as a service to open-source the code they use to run that service, or buy a commercial licence. The company argued that cloud vendors were capturing the value while contributing little back.

The Open Source Initiative, which maintains the official definition of open source, disagreed sharply. In a 2021 statement, its board said the SSPL fails the definition because it discriminates against a field of endeavour, and called marketing SSPL software as open source “deception, plain and simple.”

HashiCorp and the OpenTofu fork

HashiCorp’s August 2023 switch to the Business Source License allowed most users to keep using Terraform for free, but barred vendors from building competing products on future releases. The company pointed out that Couchbase, Cockroach Labs and others had made similar moves.

The response was fast. A group of infrastructure companies, including Gruntwork, Spacelift, env0, Scalr and Harness, forked the last open version and, in September 2023, the project joined the Linux Foundation as OpenTofu with backing from more than 140 organizations. Then IBM, already Red Hat’s parent, announced the HashiCorp deal in April 2024 and completed it in February 2025 after U.S. and U.K. regulatory reviews. IBM’s pitch was about pairing Terraform with Red Hat’s Ansible automation, not about licences.

Elastic and Redis come back, sort of

The most interesting twist is that two of the companies that left open source have partly returned. In August 2024, Elastic founder Shay Banon announced that Elasticsearch and Kibana would be available under the AGPL, an OSI-approved licence, alongside the existing options, InfoQ reported. His reasoning was that the open-source label removes doubt for users.

Redis followed in 2025. Its March 2024 move away from the BSD licence had triggered the Valkey fork, backed by AWS, Google, Oracle and others. With Redis 8, the company added AGPL as an option, and original creator Salvatore Sanfilippo returned to the project. CEO Rowan Trollope acknowledged the OSI was never going to approve the SSPL, The Register reported.

Why AGPL? It’s a real open-source licence, but it has teeth. Anyone who modifies AGPL software and offers it over a network must share their changes. Big cloud providers generally avoid it, which gives the original company much of the protection it wanted without the reputational cost of leaving open source.

What the licence fights actually taught us

Looking back, a few lessons seem fairly clear:

• Forks are a credible threat. OpenSearch, OpenTofu and Valkey all attracted serious corporate backing. When a project is critical infrastructure, the community and the cloud providers can and will carry on without you.
• Licence changes don’t kill businesses. MongoDB kept growing after its switch, and HashiCorp still found a buyer at a healthy price. Customers paying for a managed service are mostly buying convenience, not a licence.
• Trust is the real cost. Developers remember. When Redis returned to an open licence, InfoQ noted that many practitioners still felt the damage to trust could not be fully repaired.
• Contributor agreements matter. Companies could relicense because they held copyright over contributions. Projects run by foundations can’t be relicensed that way, which is part of why forks land there.

Advice for founders building on open source

If you’re starting an open-source company in Canada or anywhere else, the most useful thing you can do is decide on your business model before you choose a licence, not after. Changing licences five years in is possible, as these examples show, but it’s expensive in ways that don’t show up on a balance sheet.

A few practical questions to work through early:

1. Who pays, and for what? Individual developers rarely pay. Their bosses’ bosses do, for security, compliance, reliability and convenience.
2. Can you run it better than anyone else? A managed service is now the default way to earn revenue, and it’s hard for a cloud giant to beat the people who wrote the code on depth of expertise.
3. Is a copyleft licence like AGPL a better fit than a permissive one? It can discourage free-riding without leaving the open-source tent.
4. What happens to contributors’ rights? Contributor licence agreements are a legal decision with community consequences, so get proper legal advice before you set one up.

Our view is that the industry has settled into a rough equilibrium. Open source gets you adoption. A managed cloud product or carefully drawn enterprise tier gets you revenue. And the licence should be chosen for the long haul, because the HashiCorp and Redis stories show that the community will hold you to whatever promise it thinks you made on day one.

Sources and further reading

• IBM Newsroom: IBM completes acquisition of HashiCorp
• SiliconANGLE: IBM completes $6.4B HashiCorp acquisition following regulatory approvals
• HashiCorp: HashiCorp adopts Business Source License
• The New Stack: Linux Foundation joins OpenTF to fork Terraform into OpenTofu
• Red Hat: Fourth quarter and fiscal year 2012 results
• IBM: IBM completes acquisition of Red Hat
• The Register: Red Hat limits RHEL source releases to CentOS Stream
• GitLab: Monetizing and being open source
• GitLab: Fiscal 2026 fourth quarter and full-year results (SEC filing)
• MongoDB: Fiscal 2026 fourth quarter results (SEC filing)
• MongoDB: New Server Side Public License announcement
• Open Source Initiative: The SSPL is not an open source license
• InfoQ: Elastic returns to open source with AGPL
• The Register: Redis returns to open source with AGPL licence
• InfoQ: Redis switches to AGPL with Redis 8
• Tailscale: Open source at Tailscale
• BetaKit: Tailscale secures $230 million CAD Series C

The post How Open-Source Companies Actually Make Money appeared first on VeryRite.

That small farce captures where the remote work debate has landed in Canada. Employers in Ottawa, on Bay Street and at Queen’s Park have mostly decided the question. The evidence, though, has not moved in the same direction as the mandates. The best research we have says something more specific and, frankly, more useful than “the office is back” or “remote is the future.”

So let’s set the memos aside for a moment and look at what the studies, the statistics and the job postings actually show.

The study everyone cites, and what it really found

If you’ve read anything about hybrid work in the last two years, you’ve probably seen a reference to the Trip.com experiment. It’s worth knowing the details, because they matter more than the headline.

Stanford economist Nicholas Bloom and two co-authors, Ruobing Han and James Liang, ran a randomized controlled trial on 1,612 university-educated employees in engineering, marketing, accounting and finance at the travel company’s Shanghai offices. Starting in 2021, employees with odd-numbered birthdays could work from home on Wednesdays and Fridays; everyone else stayed in the office five days a week. The results were published in Nature in June 2024.

The headline numbers:

• Quits fell by a third. Attrition was 4.8% in the hybrid group versus 7.2% in the office group. The drop was largest for women, non-managers and people with long commutes.
• Performance didn’t budge. Over up to two years of reviews, the researchers found no difference in performance ratings or promotion rates. Software engineers wrote about as much code either way.
• Managers changed their minds. Before the trial, managers predicted hybrid work would cut productivity by 2.6% on average. Afterward, their estimate was a 1% gain.

Stanford’s own write-up called the result a “win-win-win” for the company, its workers and shareholders, since lower turnover saves real money on hiring and training. Two caveats are worth keeping in mind. The study covered university-educated office staff at one firm, and it tested two home days a week, not three or four. It says very little about fully remote work.

Fully remote is a different animal

This is the distinction that gets lost in most arguments. The Nature paper itself notes that earlier research on fully remote arrangements found mostly negative effects on productivity. In a 2023 review for the Journal of Economic Perspectives, Bloom, Jose Maria Barrero and Steven Davis put the productivity penalty of fully remote work at roughly 10%, as summarized by the American Enterprise Institute, while finding no measurable hit from hybrid setups.

The reasons are not mysterious. Fully remote work cuts down on the unplanned conversations where problems get solved quickly. It’s harder to learn by watching. One study cited in that review found junior engineers got about half as many code comments when their teams were fully remote rather than sitting together. A field experiment with data-entry workers in India found those working from home were 18% less productive, as Boston College’s Center for Retirement Research reported.

None of this means remote work is a failure. Fully remote firms save heavily on rent and can hire from anywhere, and for some jobs that trade is well worth a modest productivity dip. But it does mean that “remote” and “hybrid” should not be lumped together. The evidence for two or three home days a week is strong. The evidence for zero office days is mixed at best.

What Canadians are actually doing

Statistics Canada tracks where people work through the Labour Force Survey, and the trend line has been heading one way for four years. In May 2025, 17.4% of employed Canadians mostly worked from home, down from 18.7% a year earlier. That was the fourth straight annual decline since the pandemic low point for commuting in May 2021, when only 75.7% of workers commuted.

A few details from that release stand out:

• The share of workers who split their time between home and a workplace was about 10%. Among them, 44.7% spent at least half their hours outside the home, up from 43.0%.
• Ottawa–Gatineau saw the biggest jump among large cities. Its commuter share rose 9.5 percentage points to 76.0%, essentially level with Toronto at 76.1%. That’s the federal three-day rule from September 2024 showing up in the data.
• Toronto had the longest average commute among major cities, at 34.9 minutes, according to Benefits and Pensions Monitor’s coverage. Transit riders averaged 44 minutes.

The job market is moving the same way. Robert Half’s analysis of more than 48,000 Canadian postings in the second quarter of 2026 found 84% were fully on-site, 13% hybrid and just 3% fully remote. Technology and marketing roles were the most flexible, at about 20% hybrid or remote combined.

For comparison, the American numbers have flattened rather than fallen. Bloom’s WFH Research project, which surveys U.S. workers monthly, found that about 26% of paid workdays in August 2026 were worked from home, a level that has been fairly stable since 2023. Among full-time U.S. employees, 12% were fully remote, 26% hybrid and 62% fully on-site.

The mandates: who’s asking for what

Canada’s biggest employers have converged on a fairly aggressive standard. Here is roughly where things stand as of fall 2026:

The federal government’s common hybrid work model page confirms the four- and five-day rules. Its stated rationale, repeated in a Treasury Board question period note, is that working together on-site is essential “during this pivotal moment.” Federal unions have filed unfair labour practice complaints and policy grievances. The Professional Institute of the Public Service of Canada called the February announcement a matter of “optics,” CP24 reported.

Ontario went further. Premier Doug Ford announced in August 2025 that provincial public servants would move to four days in October and five days in January 2026, citing mentoring and downtown foot traffic.

The banks moved together in 2025. RBC, TD, Scotiabank and BMO all set four-day expectations starting in the fall, CTV News reported. RBC had previously asked staff to be in the office “the majority of the time,” according to an employment law summary, with the bank framing in-person connection as core to its culture.

Do mandates match the evidence?

Here’s where we’ll offer an opinion. The research gives decent support for asking people to come in two or three days a week, especially early-career staff who learn by proximity. It gives much less support for four or five days, at least for knowledge work that already happens on laptops. The clearest measurable cost of strict mandates is attrition, and the Trip.com study suggests it falls hardest on the people employers often say they want to keep: women, mid-level staff and those with long commutes.

Leaders may have other reasons, of course. Downtown cores, commercial real estate exposure and simple management preference are real factors. They just aren’t productivity findings, and it would be more honest to say so.

The tools that actually matter

Every hybrid debate eventually turns into a software shopping list. In our experience, the specific apps matter less than how teams use them. Microsoft’s own data makes the point uncomfortably well. Its June 2025 Work Trend Index report found that the average worker is interrupted roughly every two minutes during core hours by a meeting, email or chat, about 275 times a day. Meetings after 8 p.m. were up 16% year over year.

A few practices tend to separate hybrid teams that work from those that just feel busy:

1. Anchor days. If people come in, they should come in on the same days. An office full of people on video calls with colleagues at home is the worst of both arrangements.
2. Write things down. Decisions recorded in a shared document or ticket survive the meeting. This matters more the more your team is spread out.
3. Protect focus time. Calendar blocks, quiet hours for chat and fewer recurring meetings do more than any new collaboration tool.
4. Design for the newest hire. Mentoring is where fully remote work struggles most, so make sure juniors get deliberate time with senior people, in person where possible.
5. Book desks honestly. If attendance is mandatory, the space has to exist. The federal rollout showed what happens when it doesn’t.

Measurement tools deserve a caution. Health Canada, for instance, uses a Workplace Presence Management Tool where managers record employees’ daily work locations. Tracking attendance is easy. Tracking output is hard, and only the second one tells you whether your policy is working.

What this means if you run a team

If you’re a manager or founder in Canada, the honest summary of the evidence looks like this. Hybrid work with a couple of home days does not hurt performance and measurably helps retention. Fully remote work can work but carries real costs in mentoring and speed, which you need to deliberately offset. Four- and five-day mandates are mostly a cultural and political choice, and the people most likely to leave over them are often the ones you can least afford to lose.

For smaller companies, there’s an opportunity here. With 84% of Canadian postings now fully on-site, a well-run two- or three-day hybrid policy is a genuine hiring advantage. If you’re changing your policy, it’s worth talking to an employment lawyer first, since existing contracts and past practice can affect what you’re allowed to require.

The office isn’t dead and it isn’t back. The data says the best answer for most knowledge workers is somewhere in the middle, and that the middle is cheaper to run than the alternatives once you count the people who walk out the door.

Sources and further reading

• Bloom, Han and Liang, “Hybrid working from home improves retention without damaging performance,” Nature (2024)
• Stanford SIEPR: Hybrid work is a “win-win-win” for companies and workers
• AEI: What we’re learning about work-from-home and productivity growth
• Center for Retirement Research at Boston College: Hybrid work is having more success than fully remote
• Statistics Canada, The Daily: Number of Canadian commuters increases for fourth straight year in 2025
• Benefits and Pensions Monitor: The end of work from home may be closer than expected
• WFH Research: Monthly updates (September 2026)
• Robert Half: Canadian remote work statistics and trends
• Government of Canada: Common hybrid work model
• Treasury Board Secretariat: Question period note on hybrid work in the public service
• CP24: Federal government to order public servants back to office four days a week
• CP24: Office space scarce as federal public servants return four days a week
• North Shore News (Canadian Press): Ontario public servants back to office five days a week
• CTV News: BMO employees to start working four days in office
• NewsChannel 9: Amazon tells employees to return to office five days a week
• Microsoft Work Trend Index: Breaking down the infinite workday

The post Remote, Hybrid or Back to the Office? What the Data Actually Says appeared first on VeryRite.

Those two events capture the tension at the heart of rural connectivity in this country. Satellite internet in low Earth orbit has done something decades of government programs couldn’t: it has made fast, usable internet available almost anywhere in Canada, from a cabin on the Gaspé to a farm near Swift Current. But the service most people use is owned by one American company, and Ottawa is now spending billions to build a Canadian alternative.

Here’s how the technology works, what the main players offer, what it actually costs, and the downsides that astronomers and space-safety experts keep flagging.

Why rural Canada needed something new

The federal government’s benchmark for acceptable home internet is 50 megabits per second down and 10 up. By that standard, Canada has made real progress: according to Innovation, Science and Economic Development Canada, access rose from 79 per cent of Canadians in 2014 to 93.5 per cent in 2022. The goal is 98 per cent by the end of 2026 and 100 per cent by 2030.

Averages hide the problem, though. ISED’s Universal Broadband Fund page, citing the CRTC’s latest monitoring data, says only 46 per cent of rural households and 35 per cent of First Nations households on reserves have access to 50/10 service, compared with nearly 99 per cent in cities. Running fibre to every farmhouse and remote community is slow and expensive. Even with a $3.225-billion Universal Broadband Fund and the CRTC’s own Broadband Fund, which reports $780.1 million awarded across 67 projects, the last few per cent are the hardest.

That’s the gap low Earth orbit satellites were built to fill.

How LEO satellite internet works

Traditional satellite internet uses a few large geostationary satellites parked about 36,000 kilometres above the equator. They stay fixed relative to the ground, which makes aiming a dish easy, but the round trip is so long that latency, the delay before data starts flowing, is painful for video calls and gaming.

Low Earth orbit (LEO) systems flip that model:

• Much lower altitude. Starlink’s satellites orbit at roughly 500 to 600 km, while Telesat’s Lightspeed will fly higher, at about 1,300 km, according to Global News. The shorter distance cuts latency dramatically.
• Thousands of satellites. Because each satellite races across the sky in minutes, you need a large constellation so another one is always overhead. Starlink had more than 10,000 satellites in orbit by mid-2026.
• Electronically steered dishes. User terminals use phased-array antennas that track satellites without physically moving.
• Lasers in space. Newer satellites pass traffic to each other with optical links, which lets service reach places far from any ground station, including the Arctic.

For Canadians, the hardware details matter. Starlink’s specification sheet for its Standard dish lists an operating range of minus 30 to plus 50 degrees Celsius and the ability to melt up to 40 mm of snow an hour, drawing an average of 75 to 100 watts. That’s fine for most of southern Canada, but anyone in a truly frigid spot should know where the rated limit sits.

The three constellations to know

Starlink

SpaceX’s service has a huge head start. According to its Wikipedia entry, Canada was the first country outside the U.S. to approve it, in November 2020, and the network had about 12 million subscribers worldwide by June 2026. By 2026, Global News reported that Starlink had become Canada’s sixth-largest internet provider, and iPhone in Canada put its Canadian subscriber base at more than 500,000. Global News described it as, for now, the only realistic solution for many rural and remote communities.

Telesat Lightspeed

Ottawa-based Telesat is building Lightspeed, aimed mainly at businesses, governments, telecom carriers and the military rather than individual households. The company says the constellation will reach an anticipated global in-service date in the first quarter of 2028, with 225 satellites planned. The satellites are built by MDA Space in Montreal, and Telesat has contracted 14 SpaceX Falcon 9 launches to put them up. Yes, Canada’s Starlink alternative depends on SpaceX rockets to get into orbit.

Public money is substantial. According to iPhone in Canada’s summary, it includes a $2.14-billion federal repayable loan for Lightspeed, $600 million to secure future broadband capacity, and a $2.3-billion military communications contract signed in August 2026 that added satellites to the plan. Telesat calls Lightspeed the largest space program in Canada’s history.

Amazon Leo (formerly Project Kuiper)

Amazon renamed Project Kuiper as Amazon Leo in November 2025. Its planned constellation is 3,236 satellites. After a July 2, 2026 Atlas V launch, Amazon said it had 396 satellites deployed and planned an initial service rollout later in 2026. Amazon hasn’t announced Canadian consumer availability or pricing that we could find, so for now it’s one to watch rather than one to buy.

What it actually costs

Pricing changes constantly, and promotions vary by region, so treat these as snapshots rather than quotes.

Those figures come from a May 2026 promotion for new customers that also waived hardware costs. Starlink itself cautions that speeds reflect network averages and aren’t guaranteed. Regular rates are higher once the promotion ends, so read the fine print. Portable “Roam” plans for cottages, RVs and boats are priced separately; in September 2026 Starlink began offering free Mini dish rentals to more Canadian residential subscribers.

A practical checklist before you sign up:

1. Check whether fibre or fixed wireless is planned for your area through a federal or provincial program. It may be cheaper long-term.
2. Confirm you have a clear view of the northern sky. Trees are the most common cause of dropouts.
3. Factor in power use if you’re off-grid or on solar.
4. Note the regular price after any promotion, and whether hardware is bought or rented.

The politics: Ontario’s cancelled deal

The sovereignty debate isn’t abstract. In November 2024, Ontario signed a $100-million deal with Starlink to connect about 15,000 northern households. After U.S. tariffs hit in 2025, Premier Doug Ford cancelled it. Global News later reported that Ontario would miss its goal of connecting all households by the end of 2025, pushing the target to 2028, partly because of the cancellation and partly due to construction delays. Government sources told Global News there was no viable satellite alternative.

That episode shows the bind. A foreign-owned network can be the fastest way to connect remote communities, and also a dependency that a government may later regret. As researcher Susan Skone told Global News, the concern is when a foreign provider can switch service off “at will.”

The costs we don’t see: astronomy and debris

Light pollution, of a new kind

Astronomers raised alarms early. In 2019 the International Astronomical Union warned that, with tens of thousands of satellites, wide-field surveys like the Rubin Observatory could see up to 30 per cent of 30-second twilight images affected by satellite trails. The IAU now runs a Centre for the Protection of the Dark and Quiet Sky to work with operators on reducing brightness and radio interference. For a country that prizes its dark rural skies, this isn’t only a professional astronomers’ problem.

Crowded orbits

The European Space Agency’s 2025 Space Environment Report counted about 40,000 tracked objects in orbit, including roughly 11,000 active payloads, and estimated more than 1.2 million debris fragments larger than one centimetre. ESA warns that, even with no new launches, debris would keep growing because fragmentations add pieces faster than they burn up. Intact satellites or rocket bodies now re-enter the atmosphere more than three times a day on average.

LEO operators argue that their low altitude is part of the solution: dead satellites fall back and burn up within years, not centuries. That’s true, and it’s a meaningful advantage over higher orbits. But it also means constant replacement launches, and a lot more hardware passing through the busiest shells of space.

What rural Canadians should take from all this

If you live beyond the reach of fibre, LEO satellite internet is the best option most Canadians have ever had, and right now that mostly means Starlink. It works, it’s getting cheaper, and capacity is about to jump with the V3 satellites. Telesat’s Lightspeed matters for national security and for the telecom carriers and governments that will resell its capacity, but it isn’t designed as a direct consumer replacement, and it won’t be in global service before 2028. Amazon Leo could add real competition if it comes to Canada.

Our view: rural households should buy what works today while watching for fibre and fixed wireless projects funded in their area, which usually beat satellite on cost and reliability once they arrive. The bigger policy question, how much of the country’s connectivity should run through one foreign company’s network, is one Ottawa has clearly decided to answer. The bill for that answer is now well into the billions, and the satellites are still on the ground.

Sources and further reading

• ISED: High-speed internet for all of Canada
• ISED: Universal Broadband Fund
• CRTC: Broadband Fund
• Global News: Satellites are Canada’s next sovereignty frontier
• Global News: Ontario won’t meet rural broadband target
• Starlink: Standard kit specifications
• Wikipedia: Starlink
• Telesat: Europe’s first Lightspeed gateway
• Telesat: Named to the TSX30
• Amazon: Project Kuiper becomes Amazon Leo
• Amazon: Leo launch progress updates
• iPhone in Canada: Carney wants Canada off Starlink
• iPhone in Canada: SpaceX launches Starlink V3
• iPhone in Canada: Starlink’s $39 Canadian promotion
• iPhone in Canada: Starlink expands free Mini rentals
• International Astronomical Union: Statement on satellite constellations
• IAU Centre for the Protection of the Dark and Quiet Sky
• European Space Agency: Space Environment Report 2025

The post Satellite Internet and Rural Canada: Starlink, Telesat Lightspeed and the Real Costs appeared first on VeryRite.

For Canadian drivers who have watched their range shrink on a January morning in Winnipeg, that’s an eye-catching claim. It’s also a sign of how quickly the battery business is changing. Five years ago, the conversation was about one chemistry getting slowly cheaper. Today there are several competing recipes, prices have fallen below a threshold the industry once treated as the holy grail, and the geography of where batteries get made has turned into a political fight, including here at home.

This piece looks at what is inside today’s EV batteries, what’s coming next, what they cost, and how Canada’s own bet on battery manufacturing has fared.

Two chemistries run the market today

Almost every EV on the road uses a lithium-ion battery. The differences come mostly from the cathode, the positive electrode, and two families dominate.

NMC: nickel, manganese, cobalt

NMC cells pack more energy into the same weight and space, which is why they long powered premium, long-range vehicles. The trade-offs are cost and supply-chain baggage: nickel and cobalt are expensive, and cobalt mining carries well-documented ethical and geopolitical concerns.

LFP: lithium iron phosphate

LFP cells use iron and phosphate, which are cheap and plentiful. They are heavier for a given amount of energy, but they last for more charge cycles and are considered more thermally stable. Chinese manufacturers bet heavily on them, and the bet paid off.

According to the International Energy Agency’s Global EV Outlook 2026, LFP accounted for more than 55 per cent of EV batteries deployed worldwide in 2025, up from nearly half in 2024. Outside China the picture is very different: there, almost 80 per cent of batteries still used nickel-containing chemistries. The IEA also found that LFP packs were more than 40 per cent cheaper per kilowatt-hour on average than NMC.

What batteries cost now

BloombergNEF’s annual survey is the closest thing the industry has to an official price index. In December 2025, it reported that average lithium-ion pack prices fell 8 per cent to US$108 per kilowatt-hour. Packs for battery-electric vehicles averaged US$99, the second straight year under US$100. Stationary storage packs dropped to just US$70.

Context helps here. A year earlier, BNEF had recorded a 20 per cent drop to US$115/kWh in 2024, the steepest decline since 2017, driven by manufacturing overcapacity and the shift to LFP. The US$100 mark has long been cited as roughly where EVs can match gas cars on upfront price without subsidies.

Where you build matters a lot. BNEF’s 2025 numbers put average pack prices at US$84/kWh in China, US$121 in North America and US$131 in Europe. That gap is the single most important fact for anyone trying to build a battery industry outside China, and it hangs over every Canadian plant announcement.

One caution: the IEA noted that lithium prices in early 2026 were more than double what they’d been a year earlier, though still about 70 per cent below their 2022 peak. BNEF expected pack prices to fall again in 2026, but the era of easy declines may be ending.

Solid-state: closer, but still not in your driveway

Solid-state batteries replace the liquid electrolyte that shuttles lithium ions between electrodes with a solid material. The promise is higher energy density, faster charging and lower fire risk. The problem has always been manufacturing them at scale and at a reasonable price.

2026 has brought real movement, mostly in China and mostly in a halfway form:

• Semi-solid-state is already on sale. SAIC’s MG 4X opened pre-orders in China in May 2026 starting at 99,800 yuan, with an optional 64.2 kWh semi-solid pack. Electrek reported that the design cuts liquid electrolyte to about 5 per cent, and that SAIC planned to bring the technology to Europe by the end of 2026.
• All-solid-state is targeting 2027. BYD says it will launch its first EV with all-solid-state cells in limited numbers in 2027, with mass production around 2030. CATL, Geely and Changan are aiming for similar timelines.
• Western players are partnering up. QuantumScape opened its Eagle Line pilot facility in 2026 and signed Honda as its second major automaker partner after Volkswagen.

Our read: expect solid-state cells first in luxury models and in small numbers before the end of the decade. For a typical buyer, the battery in a 2027 or 2028 EV will almost certainly still be conventional lithium-ion.

Sodium-ion: the cold-weather wildcard

Sodium is far more abundant than lithium, and sodium-ion cells avoid lithium, nickel and cobalt entirely. Their weakness has been energy density. CATL’s Naxtra cells reach about 175 Wh/kg, close to LFP territory, and the company said in April 2026 it aims to match LFP within three years.

Sodium-ion is still tiny. The IEA put global sodium-ion manufacturing capacity at just over 1 per cent of lithium-ion’s and noted ranges of up to about 350 km, well short of typical lithium-ion EVs. But its best early market may be stationary storage: Electrek reported in April 2026 that CATL had landed a 60 GWh sodium-ion order for energy storage.

For a country with long, brutal winters, the cold-weather numbers are the part to watch. If they hold up in independent testing, sodium-ion could make a cheap second car or a city runabout far more practical in places like Saskatoon or Sudbury.

Canada’s battery bet: a mixed scorecard

Canada spent the early 2020s trying to turn its critical minerals and auto sector into a battery supply chain. The ambition was real, and so was the money. By mid-2025, The Logic counted $52.5 billion in federal and provincial support earmarked for the EV industry, and warned that more than $32 billion of $46 billion in major projects were delayed or in serious trouble.

Northvolt Six: the project that collapsed

The most painful case is Northvolt’s planned $7-billion gigafactory in Saint-Basile-le-Grand and McMasterville, southeast of Montreal. Announced in 2023 with major provincial and federal support, it was meant to produce 60 GWh of cells a year. Then the Swedish parent filed for bankruptcy in March 2025.

Here is where things stand, based on the reporting we could verify:

• In September 2025, Quebec ended its financing of the project and acknowledged a $270-million loss on its investment in the Swedish parent.
• Days later, a Quebec judge placed Northvolt’s North American subsidiary under creditor protection. Global News reported that the province had recovered about $200 million from frozen accounts and that the court authorized steps toward the sale or repossession of the land. U.S. firm Lyten, which bought most of Northvolt’s European assets, had expressed interest, but Quebec declined to provide the additional funding its different plan required.
• In June 2026, Quebec’s auditor general concluded that the province’s battery investments were poorly planned, lacking clear objectives and timelines. Of 11 companies that received a combined $2.2 billion in authorized aid, four had sought creditor protection.

NextStar Energy: built, but changing shape

Windsor’s NextStar Energy plant, originally a joint venture of Stellantis and LG Energy Solution, is the success story so far, if a complicated one. It is Canada’s first large-scale battery manufacturing facility, with more than $5 billion invested. In February 2026, the partners announced that LGES would buy Stellantis’s 49 per cent stake and take full ownership, subject to approvals. The plant, with more than 1,300 workers at the time, will expand into energy storage systems while Stellantis remains a customer.

That pivot tells you something. With EV demand in North America softer than expected, a battery plant that can also serve the booming grid-storage market is a much safer asset.

The rest of the map

Other projects are in varying states. Volkswagen’s PowerCo plant in St. Thomas, Ontario, was still moving forward and hiring in mid-2025, according to The Logic, while Honda’s planned Ontario investment had been paused. Industry Minister Mélanie Joly has argued that Canadian-made batteries could also serve defence uses, telling The Logic in 2025 that “Battery is about storage” whether it’s in a car or a submarine.

What it means for buyers

If you’re shopping for an EV in Canada over the next couple of years, the chemistry question is worth a few minutes of homework:

1. Ask which chemistry you’re getting. Many automakers offer LFP in standard-range trims and NMC in long-range ones. Read the owner’s manual’s charging advice for that specific pack, since recommendations differ by chemistry.
2. Weigh price against range. LFP’s cost advantage is real, but it stores less energy per kilogram, so compare winter range estimates rather than headline numbers.
3. Don’t wait for solid-state. Mainstream vehicles with all-solid-state packs are unlikely before the end of the decade.
4. Watch for sodium-ion in small cars and home storage. It may reach Canadian showrooms first in budget models or backup power systems.

Incentives, warranties and resale values vary by province and model, so check the details with your dealer and, for larger financial decisions, with a financial adviser.

The real story is diversification

The future of EV batteries is not one breakthrough chemistry replacing everything else. It’s a menu: cheap LFP for everyday cars and grid storage, high-nickel cells for long range, sodium-ion for cold climates and low-cost uses, and solid-state for premium vehicles once factories can make it affordably. Prices have already dropped to the point where batteries aren’t the main obstacle to affordable EVs, at least in China.

Canada’s challenge is that it tried to buy its way into the most competitive manufacturing business on earth just as prices collapsed and North American demand stalled. Northvolt’s failure was expensive. NextStar’s shift toward storage may be the more realistic template: build plants flexible enough to serve whatever the market needs, and lean on what Canada genuinely has in abundance, from critical minerals to clean electricity. That’s a less glamorous story than “Canada becomes a battery superpower,” but it’s one more likely to survive the next downturn.

Sources and further reading

• BloombergNEF: Lithium-ion battery pack prices fall to $108 per kilowatt-hour (2025)
• BloombergNEF: Battery pack prices see largest drop since 2017 (2024)
• International Energy Agency: Global EV Outlook 2026, electric vehicle batteries
• Electrek: First sodium-ion battery EV debuts
• Electrek: CATL launching sodium-ion batteries in EVs
• Electrek: CATL 60 GWh sodium-ion storage deal
• Electrek: MG 4X with semi-solid-state battery
• Electrek: BYD’s solid-state battery timeline
• Electrek: Honda and QuantumScape team up
• The Logic: Canada’s EV dream has become a nightmare
• The Logic: Made-in-Canada EV batteries could be repurposed for defence
• CTV News: Quebec ends funding for Northvolt
• Global News: Quebec judge declares Northvolt insolvent
• Global News: Quebec auditor on battery company investments
• Stellantis: LG Energy Solution to acquire full ownership of NextStar Energy

The post What’s Next for EV Batteries: Cheaper Chemistries, Solid-State Hype and Canada’s Mixed Bet appeared first on VeryRite.

That is the right to repair movement in its most concrete form: a law that changes what happens when your phone dies in year two. For most of the smartphone era, the answer was simple and expensive. You paid the manufacturer’s price, went to an authorized shop, or bought a new device. Independent repairers were locked out by glued batteries, unavailable parts and software that refused to recognize a replacement screen.

Over the past five years, that has started to shift, in Brussels, in a growing list of U.S. state capitals, in Ottawa and in Quebec City. This guide explains what the movement wants, what has actually become law, and how it should change the way you shop for your next phone or laptop.

What “right to repair” actually means

The phrase covers a bundle of demands rather than a single rule. Advocates generally want four things:

• Parts: genuine replacement components sold to anyone, at fair prices, for a reasonable number of years.
• Information: repair manuals, schematics and diagnostic software available to independent shops and owners, not just authorized dealers.
• Tools: the specialized drivers, jigs and software keys needed to finish a repair.
• No digital locks against repair: an end to “parts pairing,” where a device’s software flags or disables a replacement component because it wasn’t installed through the manufacturer’s system.

The movement started with farmers and car owners, and some of its biggest wins still come from there. In July 2026, iFixit reported that John Deere had settled an antitrust case brought by the U.S. Federal Trade Commission and five states over repair access. But consumer electronics is where most Canadians feel it.

Europe sets the pace

The European Union has done more than any other jurisdiction, mostly by regulating product design rather than just repair access.

Phones and tablets built to last

Since June 20, 2025, smartphones and tablets sold in the EU have had to meet new ecodesign rules. The European Commission says manufacturers must keep key spare parts available for at least seven years after a model leaves the market, deliver them within five to 10 working days, and provide operating system updates for at least five years after the last unit is sold. Batteries must survive at least 800 charge cycles while keeping 80 per cent of their capacity. A new label grades each device from A to E for repairability.

The Right to Repair Directive

The broader Right to Repair Directive (EU) 2024/1799 had a transposition deadline of July 31, 2026, meaning member states were required to write it into national law by then. It obliges manufacturers to repair certain products, including smartphones, within a reasonable time and for a reasonable price, adds a 12-month extension to the legal guarantee when a consumer chooses repair over replacement, and bans contract terms, hardware or software techniques that unnecessarily obstruct repair. A pan-EU platform to find repairers is due in 2027.

Replaceable batteries are coming back

The next deadline is EU Battery Regulation 2023/1542, which requires user-replaceable batteries in many portable devices from 2027. iFixit noted in July 2026 that Nintendo and Amazon were already shipping EU models of the Switch 2 and Kindle with batteries owners can swap. Those design changes tend to leak into other markets, including ours, because it’s cheaper to build one version of a product than two.

The American patchwork

The United States has no federal right to repair law for electronics, but the states have been busy. The U.S. Public Interest Research Group calculated that by January 2026 about a quarter of Americans lived in a state with some right to repair protection, rising to at least 35.5 per cent by fall 2026 once Connecticut and Texas rules took effect.

New York’s law is a cautionary tale. Governor Kathy Hochul signed it in December 2022 with last-minute amendments that, as PhoneArena reported, let manufacturers sell bundled assemblies rather than single components and exempted passwords and security codes. Advocates called it badly watered down.

California’s SB 244, signed in October 2023, went further on duration. Minnesota’s Digital Fair Repair Act is broad, though it excludes game consoles, cars, farm equipment and medical devices. Oregon, as Engadget reported when it was signed in March 2024, became the first state to bar manufacturers from using software to block or degrade independently installed parts.

Canada’s approach: copyright, competition and Quebec

Canada has moved on three fronts at once, and the federal pieces are easy to miss because they live inside laws most people never read.

Copyright: Bills C-244 and C-294

Until recently, breaking a digital lock on a device, even one you owned, could violate the Copyright Act. On November 7, 2024, two private members’ bills received royal assent and changed that. As Torys explains, Bill C-244 lets owners and third-party repairers circumvent technological protection measures for the sole purpose of diagnosing, maintaining or repairing a product. Bill C-294 allows circumvention to make a device or program interoperable with another.

Those are real wins, but limited ones. Writing for Dalhousie University, law professor Anthony Rosborough, a co-founder of the Canadian Repair Coalition, argued that further reforms are still needed in provincial consumer protection and federal competition law, and in rules requiring products to be designed for repair. The copyright changes make repair legal; they don’t make it easy.

Competition law: Bill C-59

The second front is the Competition Act. Amendments that took effect on June 20, 2024, explicitly recognize “means of diagnosis or repair” under the refusal-to-deal provisions. The Competition Tribunal can now order a supplier to make parts, tools or diagnostic information available on appropriate terms. Expanded private access, which lets affected businesses bring cases themselves, began on June 20, 2025. Ottawa also consulted on durability, repairability and interoperability in the summer of 2024.

Quebec’s Bill 29

Quebec has gone furthest, using consumer protection law. Bill 29 bans planned obsolescence techniques and was designed to come into force in stages. Since October 5, 2025, rules on availability of replacement parts, repair services and maintenance information have applied. According to Osler, those obligations include diagnostic software and updates, and repairs must be possible at a price that doesn’t discourage consumers. Penalties can reach five per cent of a company’s worldwide turnover. The new warranty of good working order arrived a year later, on October 5, 2026.

How repairable are today’s phones?

iFixit, the repair parts and guides company that has become the movement’s loudest voice, scores devices from 0 to 10 based on how easy they are to open, how much adhesive is used, whether the battery can be reached quickly, and whether the maker sells parts and publishes manuals. Its current smartphone scores look like this for recent models:

• Fairphone 6: 10 out of 10
• iPhone 17 Pro and iPhone Air: 7
• Google Pixel 10: 6
• Samsung Galaxy S25 Ultra and S25 Edge: 5
• Samsung Galaxy Z Fold 7 and Nothing Phone 3: 3

We find the Apple numbers the most telling. Not long ago, iPhones were the poster child for unrepairable design. A seven is not a perfect score, but it suggests that regulatory pressure plus the threat of a bad label can move even the most controlling manufacturers. iFixit itself cautions that its methodology changes over time, so treat the scores as indicators rather than lab measurements.

What this means when you buy a phone or laptop

Repairability is now something you can shop for. A few practical habits help:

1. Check the score before you buy. Look up the iFixit score, and if you’re comparing a model also sold in Europe, check its EU repairability grade.
2. Ask about the battery. Batteries are the part most likely to wear out. A phone where the battery is reachable without heat guns and solvent will cost far less to keep alive in year four.
3. Look at software support. A repairable device is only useful as long as it gets security updates. Check how many years of updates the manufacturer promises.
4. Know your warranty. If you live in Quebec, the three-year good working order warranty applies regardless of what the salesperson’s extended plan says. Elsewhere in Canada, provincial rules vary, so it’s worth checking with your provincial consumer protection office or a lawyer if a dispute arises.
5. For laptops, check the RAM and storage. Soldered memory and drives can’t be upgraded or swapped when they fail. Some business laptops and repair-focused brands still use standard, replaceable parts.

The road from legal to practical

The right to repair has moved from a fringe cause to written law in less than a decade. Europe is regulating design itself. U.S. states are forcing parts and manuals onto the market, and a few are tackling parts pairing. Canada has cleared the legal underbrush with copyright and competition changes, while Quebec has shown what a province can do with consumer protection law.

The gap that remains, here and almost everywhere, is between being allowed to repair something and being able to do it affordably. That’s where the next fights will be: parts pricing, software locks and whether other provinces follow Quebec. Until then, the most effective lever most of us have is the one at the checkout. Buy the device that’s easier to fix, and the market will notice.

Sources and further reading

• Gowling WLG: New Quebec consumer protection regulation takes effect
• McCarthy Tétrault: Quebec releases final regulations on repair and replacement obligations
• Osler: What you need to know about Quebec’s Bill 29
• Torys: Circumvention of technological protection measures through repair exception
• Dalhousie University: Updates to Canada’s Copyright Act and the right to repair
• Baker McKenzie: Bill C-59 and Competition Act reform
• ISED: Right to repair consultation document
• European Commission: New EU rules for durable, repairable smartphones and tablets
• Lewis Silkin: What the Right to Repair Directive means for business
• iFixit: Kindle and Switch replaceable batteries show EU laws are working
• iFixit: John Deere settles with the FTC
• iFixit: Smartphone repairability scores
• U.S. PIRG: More than one-quarter of Americans covered by right to repair
• PhoneArena: New York passes the Digital Fair Repair Act
• GSMArena: California enacts Right to Repair Act
• Minnesota Attorney General: The right to repair in Minnesota
• Engadget: Oregon’s right to repair bill is now law

The post The Right to Repair Movement: What the New Laws Mean for Your Next Phone or Laptop appeared first on VeryRite.

Numbers like that explain why a component most people never see now shows up in trade deals, tariff schedules, parliamentary hearings and military planning. A modern economy runs on chips the way an older one ran on oil, and the supply of the best chips comes from a few square kilometres of an island that Beijing claims as its own. Add a single Dutch company that builds the only machines capable of printing the most advanced circuits, and you have a supply chain with a handful of chokepoints that every major government is now trying to own, guard or squeeze.

This piece walks through how that happened, what the United States and its allies have done about it, and where Canada fits. Our country isn’t a chipmaking power, but it holds a few cards that matter more than most Canadians realize.

Why Taiwan sits at the centre

TSMC pioneered the “pure-play foundry” model in the late 1980s: it manufactures chips that other companies design. Apple, Nvidia, AMD and Qualcomm draw the blueprints; TSMC builds them. Over three decades, that division of labour turned into a near-monopoly on the hardest part of the process.

The leading edge is where the concentration is most extreme. In its second-quarter 2026 results, TSMC said 3-nanometre chips accounted for 30 per cent of its wafer revenue and 5-nanometre for another 33 per cent. Altogether, technologies at 7 nanometres or smaller made up 77 per cent. Those are the processes used for AI accelerators, flagship phone processors and high-end laptop chips. Quarterly revenue hit US$40.2 billion.

For years, the uncomfortable truth in Washington was that the United States designed most of the world’s advanced chips but built almost none of them. A 2024 report from the Semiconductor Industry Association and Boston Consulting Group put America’s share of global capacity for logic chips below 10 nanometres at zero in 2022. The same report projected that share could reach 28 per cent by 2032 if announced investments held.

That gap is the “Taiwan risk” in a sentence. A blockade, an earthquake or a war in the Taiwan Strait would not just hurt one company. It would stall production of everything from data-centre servers to cars.

ASML and the machine nobody else can build

If TSMC is the factory, the Dutch firm ASML makes the most important tool inside it. ASML is the only company that sells extreme ultraviolet (EUV) lithography systems, the machines that print the finest features on modern chips.

The engineering is borderline absurd. According to ASML’s own product pages, a carbon dioxide laser fires two pulses at a falling droplet of tin, vaporizing it into a plasma that emits light at a wavelength of 13.5 nanometres. That happens up to 50,000 times a second. Because EUV light is absorbed by almost everything, including air and glass, the whole optical path sits in a vacuum and uses multilayer mirrors instead of lenses.

The newest generation, called High-NA EUV, can print features with a resolution of 8 nanometres. It is also staggeringly expensive. Bloomberg reported in April 2026 that each machine costs upwards of €350 million, and that TSMC, ASML’s biggest customer, does not plan to adopt the tools through 2029 to keep costs in check. That’s a fascinating twist: even the monopolist’s best customer has limits.

ASML’s business is booming anyway. The company reported 2025 sales of €32.7 billion and net income of €9.6 billion, with a backlog of €38.8 billion at year end and 2026 sales guidance of €34 billion to €39 billion.

Why one supplier is a policy lever

Because no one else can build an EUV machine, deciding who gets one is effectively deciding who can make leading-edge chips. EUV exports have been restricted since 2019. In March 2023 the Netherlands went further, adding ASML’s most advanced deep ultraviolet (DUV) immersion systems to its export-licence regime, following an agreement among the United States, Japan and the Netherlands. A monopoly in a supply chain is a vulnerability for buyers, but for the government that hosts it, it becomes a lever.

The CHIPS Act: from grants to equity stakes

Washington’s answer to the Taiwan problem was the CHIPS and Science Act, signed on August 9, 2022. It appropriated about US$52.7 billion, including roughly US$39 billion in manufacturing subsidies, plus a 25 per cent investment tax credit for chipmaking equipment.

The money worked, at least in drawing announcements. TSMC has expanded its Arizona commitment to US$165 billion, covering six wafer fabs and two advanced packaging plants over time. Its first Arizona fab began production in 2025, with a second slated for the second half of 2027.

Under the second Trump administration, the program changed character. In August 2025, Intel announced that the U.S. government would take a 9.9 per cent stake in the company, buying 433.3 million shares at US$20.47 each. The US$8.9 billion purchase was funded by CHIPS grants Intel had been awarded but not yet received, plus money from a defence-related program called Secure Enclave. A subsidy program had quietly become a sovereign investment fund.

Trade policy has been pulled in too. In January 2026, the United States and Taiwan signed an agreement under which Taiwanese firms committed US$250 billion in direct investment plus US$250 billion in credit guarantees, in exchange for a 15 per cent cap on most U.S. tariffs and preferential treatment for chips imported by companies building American capacity. As of Baker McKenzie’s January summary, the deal still needed approval from Taiwan’s legislature.

Export controls: the stick

The other half of the strategy is denial. Since 2022, the U.S. Commerce Department has steadily restricted the sale of advanced AI chips and chipmaking tools to China, and has leaned on allies to do the same.

The line has not moved in one direction only. In January 2026, Commerce’s Bureau of Industry and Security shifted licence reviews for certain high-end chips bound for China, including Nvidia’s H200, from a presumption of denial to case-by-case. The conditions are strict: third-party testing in the U.S., a cap on exported compute relative to American shipments, and know-your-customer obligations for buyers. A 25 per cent Section 232 tariff on certain advanced chips was imposed at the same time.

Easing on paper didn’t mean sales in practice. In February 2026, the top U.S. export enforcement official told a House committee that Nvidia had not yet sold any H200s to China.

Beijing’s counter-levers

China has chokepoints of its own, mostly in raw materials. Gallium and germanium are small-volume metals used in compound semiconductors, radar, fibre optics and infrared sensors, and China dominates their refining. Beijing restricted their export in 2023 and banned shipments to the United States in December 2024. In November 2025 it suspended that ban until November 27, 2026, which means the question of whether it returns is only weeks away as we write this.

The Nexperia affair showed how quickly this can spill into everyday industry. In September 2025 the Dutch government took de facto control of the Chinese-owned chipmaker over concerns about technology transfer; Beijing responded by blocking exports from Nexperia’s Chinese operations, squeezing automakers that depend on its basic components. These aren’t cutting-edge AI chips. They’re the cheap, boring parts that cars can’t ship without.

Where Canada fits

Canada has no leading-edge fab and isn’t likely to get one. But “chips” isn’t one industry, and several Canadian assets matter more than the headlines suggest.

Packaging in Bromont

IBM’s plant in Bromont, Quebec, opened in 1972 and is described as the largest semiconductor packaging operation in North America. Packaging, the step that protects a chip and wires it to the outside world, has become a bottleneck for AI hardware. In 2025, Ottawa committed a further $210 million from its Strategic Innovation Fund toward advanced packaging there, on top of earlier federal and Quebec support, as part of IBM’s plan to spend $1 billion over five years.

Compound semiconductors in Ottawa

The National Research Council’s Canadian Photonics Fabrication Centre is, by its supporters’ description, the only end-to-end, pure-play compound semiconductor foundry in North America. In May 2026, Industry Minister Mélanie Joly announced plans to spin it off into a commercial entity, BetaKit reported. Ottawa has invested more than $115 million in the facility since 2021.

Critical minerals

This may be Canada’s strongest hand. In July 2026, Teck Resources, the Canada Growth Fund and Natural Resources Canada signed an agreement to expand germanium and antimony output and add gallium capacity at Teck’s Trail smelter in British Columbia, with the Growth Fund investing up to $400 million and the government taking offtake rights. Internationally, Canada launched what is now the Critical Minerals Resilience and Production Alliance at the 2025 G7 summit in Kananaskis; it has announced more than 69 partnerships and investments since.

Controls and the missing strategy

Canada also takes part in the export-control side. In 2024, Ottawa added quantum computers, gate-all-around transistor technology and related chipmaking equipment to its Export Control List. In June 2026, it signed a semiconductor cooperation declaration with Germany.

What Canada still lacks is a stand-alone national chip strategy. In December 2025, a group including Canada’s Semiconductor Council and CMC Microsystems urged Ottawa to fund more R&D, buy Canadian-made chips and subsidize packaging facilities. That call remains unanswered in any comprehensive way.

What to watch next

• November 27, 2026: the expiry of China’s suspension on gallium and germanium exports to the U.S.
• Arizona’s second fab: whether TSMC hits its 2027 target for more advanced production on U.S. soil.
• High-NA adoption: if TSMC holds off until after 2029, rivals willing to pay for the tools could try to close the gap.
• Ottawa’s next move: whether the photonics spin-off and Trail investment become part of a broader plan.

The real lesson for Canada

The chip contest is often framed as a race to build the most advanced factory. That framing misses how the supply chain actually works. Power accrues to whoever controls a chokepoint, whether it’s a Dutch lithography machine, a Taiwanese process recipe or a Chinese refinery for an obscure metal.

Canada will never out-subsidize Washington or out-build Taiwan. In our view, it doesn’t need to. A country that can reliably supply germanium and gallium, package chips at scale in Quebec and run a sovereign compound semiconductor foundry in Ottawa has something allies need. The risk is treating those assets as scattered industrial grants instead of a deliberate strategy. In a world where chips are geopolitics, being a dependable supplier of the unglamorous parts is a form of leverage, and it’s one Canada can actually hold.

Sources and further reading

• Focus Taiwan: TSMC’s global foundry market share hits record (TrendForce data)
• TSMC: Second quarter 2026 results
• Semiconductor Industry Association: Emerging Resilience in the Semiconductor Supply Chain
• ASML: EUV lithography systems
• Bloomberg: TSMC says ASML’s latest chipmaking gear is too pricey to use
• eeNews Europe: ASML 2025 results
• Intel: Agreement with the Trump administration
• Manufacturing Digital: Inside TSMC’s US$165bn U.S. investment
• Baker McKenzie: U.S. and Taiwan finalize trade agreement
• Willkie Farr & Gallagher: BIS paves the way for chip exports to China
• Fastmarkets: China suspends export prohibition on gallium, germanium and antimony
• BetaKit: Ottawa plans to spin off federal semiconductor facility
• Teck, Canada Growth Fund agreement on Trail strategic metals
• Government of Canada: Critical Minerals Resilience and Production Alliance
• The Logic: Semiconductor groups call for national chip strategy

The post Why Computer Chips Became Geopolitics, and Where Canada Fits appeared first on VeryRite.

That’s a lot of money for machines that still can’t do much useful work. Yet the past two years have produced real technical progress, especially on the field’s hardest problem: errors. Meanwhile, governments have quietly started replacing the encryption that a future quantum computer could break.

Here’s where things stand in the fall of 2026: what a qubit is, what the big error-correction results actually showed, who the Canadian players are, and why your IT department should care about post-quantum cryptography even if you never touch a quantum computer.

Qubits, without the hand-waving

An ordinary computer stores information in bits, each of which is either 0 or 1. A quantum computer uses qubits. A qubit can be put into a superposition, a state that carries some amount of 0 and some amount of 1 at once, until you measure it and it settles into one or the other.

The popular line that a quantum computer “tries every answer at the same time” is misleading. What makes qubits powerful is how they combine. Qubits can be entangled, so their states are linked in ways classical bits can’t be, and a well-designed quantum algorithm uses interference to make wrong answers cancel out and right answers reinforce, a bit like noise-cancelling headphones. That only works for certain kinds of problems: simulating molecules and materials, some optimization tasks, and, famously, factoring large numbers.

The catch is fragility. Qubits are disturbed by heat, vibration and stray electromagnetic noise. Each operation has a small chance of going wrong, and those errors pile up quickly. Companies build qubits in very different ways, and each approach has its own trade-offs:

• Superconducting circuits, chilled to near absolute zero (Google, IBM, and in a different form Nord Quantique and D-Wave).
• Trapped ions, individual charged atoms held by electromagnetic fields (Quantinuum).
• Photons, particles of light travelling through chips and optical fibre (Xanadu).
• Spins in silicon, tiny magnetic properties of defects in a silicon chip, linked by light (Photonic).

Error correction: the milestone that mattered

The fix for fragile qubits is quantum error correction. Instead of trusting one physical qubit, you spread a single “logical” qubit across many physical ones and constantly check for mistakes without destroying the information. The theory has been around since the 1990s. The problem was that adding more qubits also added more opportunities for error. Unless each physical qubit is good enough, crossing a quality bar known as the threshold, bigger codes make things worse rather than better.

Google’s Willow

In December 2024 Google announced Willow, a 105-qubit superconducting chip. The headline result, published in Nature, was that as Google grew its logical qubit from a 3-by-3 grid of physical qubits to 5-by-5 and then 7-by-7, the error rate was cut in half at each step. That’s what “below threshold” means in practice: scaling up finally made things better. Google described it as a goal the field had pursued for nearly 30 years.

Willow also ran a benchmark called random circuit sampling in under five minutes, a task Google estimated would take a leading classical supercomputer about 10 septillion years. That number got the headlines, but the benchmark has no practical use. In October 2025 Google followed up with something closer to useful: an algorithm called Quantum Echoes, which ran about 13,000 times faster on Willow than on classical supercomputers and was applied, with UC Berkeley researchers, to studying the structure of two molecules.

Others closing in

• IBM laid out a roadmap in June 2025 to deliver a fault-tolerant machine called Starling by 2029, with 200 logical qubits able to run 100 million operations. It’s betting on a family of codes called qLDPC, which IBM says cut the overhead of error correction by roughly 90 per cent.
• Quantinuum launched its Helios trapped-ion system in November 2025 with 98 physical qubits and a two-qubit gate fidelity of 99.921 per cent, and reported running 48 error-corrected logical qubits.

Our read: the error-correction problem has moved from “might be impossible” to “very hard engineering.” That’s a big shift, but useful fault-tolerant machines are still years away by the companies’ own timelines.

Canada’s quantum players

Canada punches above its weight in this field, and four companies show how differently people are attacking the problem.

D-Wave

Founded in 1999, D-Wave describes itself as the world’s first commercial supplier of quantum computers. Its machines are annealers, a specialized design aimed at optimization and simulation rather than general-purpose computing. It grew up as a Canadian company, but its corporate headquarters is now in Palo Alto, California, though it still lists a Canadian office. In May 2025 it made its Advantage2 system generally available, with more than 4,400 qubits. Earlier that year D-Wave published a paper in Science claiming its hardware simulated magnetic materials far beyond what classical supercomputers could manage. As insideHPC noted, not every researcher accepted that claim.

Xanadu

Toronto-based Xanadu builds photonic quantum computers, which encode information in light and can operate largely at room temperature. In January 2025 it unveiled Aurora, a 12-qubit modular system spread across four server racks, 35 photonic chips and 13 kilometres of optical fibre. Twelve qubits is small; the point was to show that the design can be networked and scaled. Chief executive Christian Weedbrook told BetaKit that about 85 per cent of the company’s 260-person team works in Toronto, and that the company intends to stay.

Photonic

Vancouver’s Photonic Inc. uses defects in silicon called T centres, which act as qubits that can also send and receive light. That lets separate chips be linked over optical networks, an approach the company calls “Entanglement First.” It works with Microsoft, offering access through Azure, and in September 2026 the two companies announced joint work on resource estimation using Photonic’s SHYPS error-correcting codes. The same month, Photonic, led by chief executive Don Mattrick, proposed Project VANGUARD, a semiconductor manufacturing facility in Canada worth up to $500 million to serve quantum, AI, aerospace and defence customers.

Nord Quantique

Sherbrooke, Que.-based Nord Quantique, founded in 2020, takes a different route to error correction. It uses superconducting bosonic codes, an approach designed so that each physical qubit can carry its own error protection, giving what the company describes as a one-to-one ratio of logical to physical qubits. In 2025 it was one of eleven companies selected for Stage B of the U.S. Defense Advanced Research Projects Agency’s Quantum Benchmarking Initiative. In May 2026 it announced a US$1.4-billion valuation after a $30-million round, and said it is targeting a useful fault-tolerant machine by 2030. It also received $16 million through the federal Quantum Champions Program.

Investors interested in any of these companies should remember that valuations in this sector rest heavily on future promises; it’s worth getting independent financial advice before buying in.

The encryption problem, and its fix

The most concrete reason quantum computing matters to ordinary organizations today has nothing to do with buying one. Much of the internet’s security, including RSA and elliptic-curve cryptography, relies on maths problems that a large, error-corrected quantum computer could solve.

How large? In May 2025, Google researchers Craig Gidney and Sophie Schmieg estimated that breaking 2048-bit RSA could take about a million noisy qubits running for roughly a week, a twentyfold drop from a 2019 estimate of 20 million qubits. No machine is anywhere close to that today, but the target keeps getting nearer from both directions.

There’s also a reason not to wait. Security agencies warn about “harvest now, decrypt later”: attackers can record encrypted traffic today and store it until they can break it. Medical records, legal files and state secrets that must stay private for decades are already exposed to that risk.

The NIST standards

On August 13, 2024, the U.S. National Institute of Standards and Technology published its first three post-quantum cryptography standards:

• FIPS 203 (ML-KEM), based on CRYSTALS-Kyber, for general encryption and key exchange.
• FIPS 204 (ML-DSA), based on CRYSTALS-Dilithium, the primary standard for digital signatures.
• FIPS 205 (SLH-DSA), based on SPHINCS+, a hash-based backup signature scheme.

A fourth standard based on the FALCON algorithm was planned to follow. In March 2025 NIST also selected HQC, which relies on error-correcting codes rather than lattices, as a backup to ML-KEM, with a final standard expected in 2027. NIST’s message to organizations was blunt: start integrating the new standards now, because the full transition will take time.

Canada’s timeline

Ottawa has set its own deadlines. The Canadian Centre for Cyber Security’s post-quantum migration roadmap, issued in June 2025, required federal departments to have initial migration plans by April 2026, to move high-priority systems by the end of 2031, and to finish all remaining systems by the end of 2035. Businesses that supply government, or that simply hold long-lived sensitive data, would be wise to plan on a similar schedule.

What to take from all this

Quantum computing in 2026 sits in an odd place. The science has passed genuine milestones, error correction above all, and Canadian companies are among the serious contenders. But no quantum computer yet does commercially valuable work that a classical machine can’t, and most credible timelines for that point to around the end of the decade.

For most organizations, the practical step isn’t buying quantum time. It’s taking an inventory of where you use encryption, asking your software and cloud vendors when they’ll support ML-KEM and ML-DSA, and putting post-quantum migration on the same multi-year plan as any other major upgrade. The quantum machines are still coming. The deadline for being ready for them has already been set.

Sources and further reading

• DatacenterDynamics: Xanadu has gone public (2026)
• BetaKit: Xanadu to go public on Nasdaq and TSX (2025)
• The Quantum Insider: Xanadu announces Aurora
• Google: Meet Willow, our state-of-the-art quantum chip
• Quantum Computing Report: Google’s Quantum Echoes
• IBM: Roadmap to Quantum Starling
• Quantinuum: Helios launch
• D-Wave: About the company
• D-Wave: Advantage2 general availability
• insideHPC: D-Wave Advantage2 and the supremacy debate
• Photonic Inc.: Resource estimation with Microsoft
• Photonic Inc.: Project VANGUARD
• Nord Quantique: US$1.4-billion valuation
• Google: Tracking the cost of quantum factoring
• NIST: First three post-quantum encryption standards
• NIST: HQC selected as fifth algorithm
• Canadian Centre for Cyber Security: PQC migration roadmap

The post The State of Quantum Computing in 2026: Qubits, Error Correction and Canada’s Contenders appeared first on VeryRite.

Arup confirmed in May 2024 that it was the victim. Its global chief information officer, Rob Greig, told CNN that the number and sophistication of attacks against the company had been “rising sharply in recent months.” Arup also said none of its internal systems had been compromised. Nobody hacked anything. They just persuaded a person.

That’s the uncomfortable shift. For years, the advice for suspicious emails was simple: pick up the phone, or ask for a quick video chat. Now the voice on the phone and the face on the screen can be faked too. This piece looks at how these scams work, what Canadian fraud data shows, and, most usefully, how individuals and businesses can verify a request before money moves.

Phishing didn’t go away, it got a voice

Deepfake scams are a new costume on an old crime. The Canadian Anti-Fraud Centre (CAFC) describes spear phishing as fraud that exploits existing relationships: a message that seems to come from your boss, your supplier or your company president asking for an urgent wire transfer or a change to payment details. What’s changed is the toolkit. A voice clone or a live video deepfake removes the last checks people relied on.

The ingredients are easy to find. In a March 2025 CBC story, Peter Warmka, a retired CIA officer and certified fraud examiner, said fraudsters need only three to five seconds of someone’s voice, which can come from a social media post. Executives give conference talks, appear in YouTube videos and record podcasts. Their voices are everywhere.

Recent cases, and the ones that failed

The Arup case is the best known, but it isn’t the only one. Several others are instructive precisely because they didn’t work.

WPP, May 2024

Scammers targeted WPP, the world’s largest advertising group, by setting up a fake WhatsApp account in the name of chief executive Mark Read and arranging a Microsoft Teams meeting. As TechInformed reported, citing The Guardian, they used a voice clone of Read together with YouTube footage of him, and impersonated him in the meeting’s chat. The goal was to get a senior executive to set up a new business and hand over money and personal details. Staff were suspicious, and the attempt failed.

Ferrari, July 2024

A Ferrari executive received WhatsApp messages, then a call, from someone who sounded like chief executive Benedetto Vigna, complete with his southern Italian accent, talking about a confidential acquisition. According to Fortune, summarizing Bloomberg’s report, the executive noticed slight mechanical intonations and asked the caller to name a book Vigna had recently recommended to him. The caller couldn’t, and hung up. One personal question beat a sophisticated attack.

Singapore, March 2025

A finance director at a Singapore company was contacted on WhatsApp by someone posing as the firm’s CFO, then joined a Zoom call in which deepfakes of the CEO and other executives appeared. A fake lawyer handled the paperwork. The director transferred about US$499,000. In this case the story ended well: the Singapore Police Force says it worked with Hong Kong police to recover the full amount within days. Its advice afterward was direct: businesses should set up protocols for staff to verify the authenticity of video calls from executives.

Beyond business

The same techniques reach far beyond corporate finance teams. In May 2025 the FBI warned that criminals were sending AI-generated voice messages impersonating senior U.S. officials to build trust before sending malicious links. And families are targets too, as the Canadian cases below show.

What Canadian fraud data shows

The CAFC’s figures for 2025, released during Fraud Prevention Month in March 2026, put reported fraud losses in Canada at $704 million, and $2.4 billion from 2022 through 2025. The centre estimates that only 5 to 10 per cent of fraud is ever reported, so the true cost is many times higher. The Acting Commissioner of Competition said in the same release that AI has given fraudsters powerful tools for convincing impersonations.

The CAFC doesn’t publish a separate “deepfake” category, which makes sense: a deepfake is a technique, not a type of fraud. But the categories it does track show where these tools fit. According to the centre’s 2025 top-10 summary:

Spear phishing, the category that covers impersonated executives and suppliers, was the second-largest source of reported losses despite relatively few reports. Each successful attack is expensive.

Deepfakes in Canadian scams

The CAFC issued a bulletin on deepfake fraud in July 2024, warning about fake videos of politicians, celebrities and news anchors promoting investment platforms. The human cost of those scams can be devastating. CP24 reported in June 2026 on an 86-year-old woman in Sault Ste. Marie who lost $900,000, including money from a mortgage on her condo, after seeing a fake video of Prime Minister Mark Carney endorsing a crypto platform.

Voice clones show up in the so-called grandparent or emergency scam. The CBC story mentioned above described an Oshawa, Ont., grandmother who heard what sounded like her grandson saying he’d been arrested and needed $9,000. A CIBC customer service agent flagged the suspicious transaction and the money never left her account. According to CAFC figures cited by CBC, Canadians lost nearly $3 million to this type of scam in 2024. Because so few frauds are reported, the real total is very likely higher.

How to verify a request before money moves

Spotting a deepfake by eye or ear is getting harder, and we’d argue it’s the wrong goal. The CAFC bulletin does list technical tells such as unnatural movements, mismatched audio and inconsistent lighting, and they’re worth knowing. But the more reliable defence is a process that doesn’t depend on judging whether a face looks real.

For businesses

1. Call back on a number you already have. Never use the phone number, meeting link or email address supplied in the request. Look it up in your own directory. This is the CAFC’s core advice for spear phishing, and it defeats nearly every variant.
2. Require two people for unusual payments. Any new payee, changed bank details or urgent transfer above a set threshold should need approval from a second person through a separate channel.
3. Treat secrecy as a red flag. Arup, WPP, Ferrari and the Singapore case all involved a “confidential” deal. Real executives rarely tell staff to bypass normal controls.
4. Agree on a verification question or code word. Ferrari’s executive used a personal question. A pre-agreed phrase for authorizing payments does the same job more reliably.
5. Slow down deliberately. Urgency is the attacker’s main weapon. Build in a short mandatory pause for out-of-pattern requests.
6. Brief the people most likely to be targeted. Finance, payroll and executive assistants should hear about these cases by name.

For families

• Set up a family safe word that a real relative in trouble would know.
• If you get a distressing call, hang up and call the person directly on the number you already have, as the CAFC recommends for emergency scams.
• Remember that, as the CAFC points out, the Canadian justice system doesn’t let anyone be bailed out with cash or cryptocurrency. Being told there’s a “gag order” and you mustn’t tell anyone is a classic warning sign.
• Be skeptical of any video of a public figure promoting an investment. Check whether a platform is registered with your provincial securities regulator before sending money.

If you’ve lost money, contact your bank right away, then report to local police and the CAFC at 1-888-495-8501 or online. For a larger business loss, it’s also worth speaking to a lawyer and your insurer promptly.

Trust the process, not the face

The lesson from the past two years isn’t that we should become paranoid about every video call. It’s that seeing and hearing someone are no longer proof that you’re dealing with them. The cases that ended well, at Ferrari, at WPP, at a bank in Ontario, all turned on someone pausing and checking through a channel the scammer didn’t control.

That’s cheap to build into a business or a family. Write down the rule, agree on a callback habit, and make it normal to say, “I’ll call you right back.” Anyone legitimate will understand. Anyone else will hang up.

Sources and further reading

• CNN: Arup revealed as victim of US$25 million deepfake scam (2024)
• TechInformed: WPP CEO targeted by deepfake scam
• Fortune: Ferrari foils deepfake attempt with a security question
• Singapore Police Force: Business impersonation scam funds recovered (2025)
• Malwarebytes: FBI warns of AI voice impersonation of officials
• Canadian Anti-Fraud Centre: Fraud Prevention Month 2026
• CAFC: Top 10 frauds of 2025 (PDF)
• CAFC: Bulletin on fraud using deepfakes
• CAFC: Spear phishing
• CAFC: Emergency scams
• CBC: Senior almost scammed with suspected AI voice cloning (2025)
• CP24: Ontario senior loses $900,000 in deepfake crypto scam (2026)

The post Phishing in the Age of Deepfakes: Voice Clones, Fake Video Calls and How to Verify appeared first on VeryRite.

Stories like that tend to get filed under “big company problems.” They shouldn’t be. KNP was a mid-sized haulage company, not a bank. And in Canada, the numbers suggest ransomware is something every owner-operator with a laptop and a customer list should think about.

This piece looks at how a typical attack unfolds, what Canadian government data says about the threat, a few real incidents, and a practical defensive checklist. It’s deliberately focused on protection. Nothing here is a substitute for advice from a qualified IT security provider or your lawyer, and we’d encourage any business that handles personal data to talk to both.

What the Canadian data says

The Canadian Centre for Cyber Security, part of the Communications Security Establishment, publishes a National Cyber Threat Assessment every two years. The 2025–2026 edition, released in October 2024, states plainly that “ransomware is the top cybercrime threat facing Canada’s critical infrastructure.” It also reports that the average ransom paid in Canada in 2023 was $1.13 million, an increase of almost 150 per cent in two years, and judges that ransomware actors will “almost certainly” escalate their extortion tactics over the following two years.

The Cyber Centre followed that with a dedicated Ransomware Threat Outlook 2025–2027. A few of its findings matter directly for smaller firms:

• Ransomware incidents known to the Cyber Centre grew by an average of 26 per cent a year from 2021 to 2024.
• The actors targeting Canada are judged to be “almost certainly opportunistic and financially motivated.” In plain terms, they go where the door is open, not just where the money is biggest.
• The groups it flagged as most active against Canadian targets in 2024 were Akira, Play and Medusa.
• Common ways in include unpatched software, stolen or weak credentials, phishing and exposed Remote Desktop Protocol connections.
• Generative AI is very likely helping criminals write more convincing phishing lures and speed up their operations.

Statistics Canada adds the business-level view. Its survey of cyber security and cybercrime for 2023 found about one in six Canadian businesses were affected by a cyber incident that year. Among them, 13 per cent identified ransomware. Most victims (88 per cent) did not pay, and of those who did, 84 per cent paid less than $10,000. Recovery costs across Canadian businesses hit $1.2 billion in 2023, roughly double the 2021 figure. Only about one in eight affected businesses reported the incident to police, so the real numbers are almost certainly higher.

That small-ransom detail is telling. Big-name attacks with seven-figure demands grab headlines, but many victims are small firms paying (or refusing to pay) amounts that are survivable for a bank yet ruinous for a dental office.

Small firms are hit disproportionately

International data points the same way. Verizon’s 2025 Data Breach Investigations Report, as summarized by The Record, found ransomware present in 88 per cent of breaches at small and medium businesses, against 39 per cent at larger organizations. The median ransom paid fell to US$115,000, and 64 per cent of victims refused to pay, up from 50 per cent two years earlier.

How an attack usually unfolds

You don’t need to understand the technical details to defend against ransomware, but it helps to know the broad shape of an incident, because each stage is a chance to stop it.

1. Getting in. Attackers rarely break through anything exotic. They log in with a stolen or guessed password, exploit a known flaw in an internet-facing device that hasn’t been updated, or trick someone into opening a malicious attachment.
2. Looking around. Once inside, they spend time mapping the network, finding the file server, the accounting system and, crucially, the backups.
3. Taking data. Many groups now copy sensitive files before doing anything visible. This sets up “double extortion”: pay or we publish your customer records.
4. Locking things up. They encrypt systems, often timed for a weekend or holiday, and try to wipe or encrypt backups so recovery is impossible.
5. The demand. A ransom note appears with a deadline. The Cyber Centre’s threat assessment notes that groups increasingly use countdown timers, contact victims’ clients directly, and publicly shame organizations to raise the pressure.

Notice how much depends on steps one and four. If attackers can’t get in easily, and if your backups survive, the whole business model weakens.

Real incidents worth learning from

London Drugs, 2024

In late April 2024, the B.C.-based retailer London Drugs temporarily closed its stores across Western Canada after what it first called an operational issue. The LockBit group later claimed responsibility and, according to TechRadar’s reporting, demanded $25 million. London Drugs said it was “unwilling and unable” to pay, confirmed that corporate files and some employee information were taken, and offered affected staff two years of credit monitoring. It’s not a small business, but the story shows how an attack spills over: closed pharmacies, worried employees, weeks of disruption.

A Toronto dental clinic, 2019

Closer to the scale of most Canadian businesses is the case reported by the Canadian Internet Registration Authority: a Toronto dental clinic where Ryuk ransomware encrypted 19 of 22 computers. The attackers demanded $165,000. The owner said he might have stretched to around $20,000, which CIRA noted was roughly half a dental assistant’s salary. The ransom was simply out of reach.

KNP Logistics, 2023

The KNP case from our introduction is the most sobering because of how ordinary the entry point was. One weak password and backups that the attackers could reach. Neither problem requires a big budget to fix.

A defensive checklist for small businesses

The Cyber Centre’s Baseline Cyber Security Controls for Small and Medium Organizations, aimed at organizations with fewer than 499 employees, explicitly takes an 80/20 approach: get most of the protection from a small set of habits. Combined with the U.S. #StopRansomware Guide from CISA, the FBI and partners, here’s what we’d prioritize.

1. Backups that attackers can’t touch

This is the single most important item. The Cyber Centre’s ransomware playbook recommends two or more backups stored offline and inaccessible from your network, kept in more than one location.

• Keep at least one copy disconnected or immutable, meaning it can’t be changed or deleted from your regular network or admin accounts.
• Back up what actually runs the business: accounting files, customer records, scheduling data, not just shared folders.
• Test restoring. A backup you’ve never restored is a hope, not a plan. The playbook suggests regular restoration drills, ideally monthly.

2. Multi-factor authentication everywhere it counts

Turn on MFA for email, remote access (VPN or remote desktop tools), cloud accounts, banking and any admin accounts. Where possible, use phishing-resistant options such as passkeys or hardware security keys rather than text-message codes.

3. Patch quickly, especially at the edge

• Turn on automatic updates for operating systems, browsers and office software.
• Pay particular attention to devices that face the internet: firewalls, VPN appliances, routers and remote access tools. These are frequent entry points.
• Retire equipment and software that no longer get security updates.

4. Close the doors you’re not using

Don’t expose Remote Desktop directly to the internet. Remove old user accounts when staff leave. Give people only the access they need; your receptionist doesn’t need admin rights.

5. Train people, briefly and often

The Ransomware Threat Outlook notes that only 22 per cent of Canadian businesses gave formal cyber training to non-IT staff. A short session on spotting phishing and a clear rule (“if in doubt, call to check”) costs very little.

6. Write a one-page incident plan

Decide in advance who you’ll call: your IT provider, your cyber insurer if you have one, your lawyer. Keep a printed copy, because your systems may be down. The Cyber Centre’s playbook says the first moves are to isolate infected machines, disconnect remote access and reset credentials.

If the worst happens

The Cyber Centre advises against paying, warning that payment doesn’t guarantee you’ll get your data back and may expose you to further demands. Whether to pay is ultimately a business and legal decision, which is another reason to involve your lawyer and insurer early. Either way, report it. The playbook directs victims to local police, the Canadian Anti-Fraud Centre and the Cyber Centre itself. Reporting matters: the Cyber Centre says it sent 336 pre-ransomware notifications to more than 300 Canadian organizations in 2024, warning them before attackers struck and helping avoid up to $18 million in losses.

The cheap things are the important things

What strikes us, reading through the government reports and the case studies, is how unglamorous the fixes are. KNP didn’t fall to some nation-state super-weapon. It fell to a guessable password and reachable backups. The Cyber Centre’s own conclusion is that basic cyber hygiene works.

If you only do two things after reading this, make them these: set up a backup that lives somewhere your network can’t reach, and test that you can restore from it; then turn on multi-factor authentication for every email and remote access account. Those two steps won’t make a small business invulnerable, but they change ransomware from a company-ending event into a very bad week.

Sources and further reading

• Canadian Centre for Cyber Security: National Cyber Threat Assessment 2025–2026
• Canadian Centre for Cyber Security: Ransomware Threat Outlook 2025–2027
• CSE news release: Ransomware Threat Outlook 2025 to 2027
• Canadian Centre for Cyber Security: Baseline controls for small and medium organizations
• Canadian Centre for Cyber Security: Ransomware playbook
• Statistics Canada: Impact of cybercrime on Canadian businesses, 2023
• The Record: Verizon DBIR 2025 ransomware findings
• CISA: #StopRansomware Guide
• Motor Transport: Weak password opened door to KNP attackers
• TechRadar: LockBit demands $25 million from London Drugs
• CIRA: Pain of ransomware impacts Toronto dentist

The post Ransomware and Small Businesses: How Attacks Happen and How to Protect Yours appeared first on VeryRite.