Thank you very much. It's good to see you, Ms. Vandenbeld. Thank you for the question.
Indeed, parliaments are very unique institutions. I think the introduction of AI is at different levels. It is about the introduction of AI in the functioning of a parliament, but it's also about the role of a parliament in overseeing the policies and the legislation with regard to the introduction of AI to society as a whole and to the public sector as such. I think that is a main difference.
The second thing I would say is that the introduction of AI in a parliament is very much a change process. It's not a tech project. We should not consider the introduction of AI as something that has to do with IT only or procurement. It is really about an institutional change process. It means that in deploying tools without addressing the underlying issues of data quality, governance, skills and also organizational culture, the results and the gains will be marginal and could even undermine trust.
I would say that effective change in a parliament with regard to AI is very much about establishing cross-parliamentary governance bodies, establishing a parliamentary consensus on the introduction of AI—and consensus among the different parties but also consensus between the political level and the administrative level—and also establishing what I would call continuous learning rather than one-off training.
Indeed, as was mentioned before, the development of AI is going very fast, so it is really about institutional learning. We have been developing quite a number of tools around that, including some AI guidelines for parliaments—initially drafted in English and now translated into 10 languages. That was also quite a unique experience, discussing it in so many different parliamentary contexts. Some parliaments are still at the level of digitalization, and others are very much on the AI trajectory. I think that, in Canada, you're very much ahead of the game on that.
There are also very serious risks, which we haven't really grasped yet. There is the risk very briefly mentioned with regard to cybersecurity. I mean, when we speak about cybersecurity, it's like a time bomb. Cybersecurity, for Parliament, is like a time bomb that, with AI, is put on high alert. Before, a cyber-attack was something that a highly skilled IT person would be able to do after months or weeks of preparation. Now, cyber-attacks are happening on a daily basis against parliamentary infrastructure. We've seen that in a number of countries, a number of parliaments: Estonia, the German Bundestag, the U.K. Parliament, the Norwegian parliament and, of course, the Ukrainian parliament. This is a very worrying trend.
The head of cybersecurity in one European parliament told me that the parliamentary infrastructure is being attacked approximately 25,000 times a day, and then you have three or four ICT officers who are trying to protect the infrastructure. It's not just the email addresses or the phone numbers of the members of Parliament—the attacks go farther. The attacks go through the legislative database. When legislation is published, it's not being printed on paper: Is that not right? That's how it was published before. Publication of legislation, after months of debate and after proclamation, is then being published online. Now, what does it mean being published online? It's on a portal. If AI systems are being used to change the text of the legislation as it is published online, then, of course, AI is playing its most destructive role in the legislative process.
You, as members of Parliament, can debate policies and legislation and vote, but is the text you see on the screen really what you have voted for? I think that the question of cyber-protection of the legislation, as published online, is a critical issue, which at the moment is really underestimated. That's why the issue of the use of AI by malign actors looking for the weakest points in a state infrastructure and usually the offices of prime ministers—