In 2017, when ESDC first received the authority to proceed with this program, there was a requirement that when any project was initiated, as Treasury Board policy, you had to provide an estimate, in a rough order of magnitude, before you could even start the work.
In budget 2017, tied to that decision, an initial estimate of $1.8 billion was put forward. That was before any planning work started on the program, because we did not have the authority. Budget 2017 provided $12 million for initial planning work, and it was understood—and all the documentation submitted as part of that proposal was clear—that we had to do the detailed planning work to have any understanding of the costs.
As things have evolved since 2017, the costs have changed. There are three primary reasons for that evolution of costs.
First, we're dealing with 50- and 60-year-old systems. When we open those systems and code that were developed decades ago, there are things that we do not know. The documentation in the systems related to the coding and the infrastructure could not possibly have been known until we opened the hood. Unravelling that complexity and ensuring that we are doing it appropriately was critical.
Second, some scope of the program has changed as well. In particular, the migration of 14 ESDC call centres was not part of the initial scope. That has resulted in an additional change related to the overall scope and, as a result, the cost estimate for the program.
Third, cybersecurity costs have absolutely contributed to the increase in costs as well. In 2017, there were real cybersecurity issues. However, in 2026, with the advent of lots of new technologies, one of which is AI, the reality is that these present a new threat landscape. Therefore, that has resulted in additional cost estimates to ensure that these programs are adequately protected, from a cybersecurity perspective.