Sovereign in Name: Data Centres and Digital Sovereignty

Three words that get used as one

Most of the confusion in this debate comes from collapsing three different things into a single word, “sovereignty.” They are not the same, and the gap between them is exactly where Canada’s problem sits. So define them up front:

• Data residency is about location. It means the bytes physically sit on servers inside Canada. It is a storage fact, and it is the weakest of the three.
• Sovereign compute is about hardware. It means the physical AI infrastructure, the data centres, GPUs, and supercomputers, is located in Canada and, ideally, owned and governed here. This is the layer Ottawa is funding.
• Sovereign cloud is about control. It means the usable platform layer on top, the services firms actually deploy, train, and host on, operates under Canadian jurisdiction and outside the legal reach of a foreign state. This is the layer Canada does not yet have.

You can have all the residency and all the compute in the world and still not have sovereignty. That is not a rhetorical point. It is the finding of the government’s own policy documents.

The money went to compute

On the compute side, Canada has moved with real intent. In December 2024, Innovation, Science and Economic Development Canada announced the Canadian Sovereign AI Compute Strategy: about 2 billion dollars over five years, drawn largely from Budget 2024’s 2.4 billion dollar Securing Canada’s AI Advantage package. The strategy splits three ways:

• Up to 700 million for new or expanded private data centres, through the AI Compute Challenge.
• Up to 1 billion for AI-specific public computing infrastructure, accessible to Canadian researchers and innovators.
• Up to 300 million for the AI Compute Access Fund, helping small and medium-sized enterprises buy compute.

Budget 2025 layered on roughly 926 million more for sovereign public compute. And in January 2026, the government opened a separate call for proposals inviting operators to build sovereign, large-scale AI data centres exceeding 100 megawatts, with the reward being a memorandum of understanding to explore government-supported development. The direction of travel is unmistakable: Ottawa wants gigawatts of compute on Canadian soil.

The AI Compute Access Fund even carries a sharp sovereignty tilt in its fine print. It reimburses up to two-thirds of the cost of Canadian AI compute services but only one-half for non-Canadian services. And effective April 1, 2027, spending on non-Canadian compute becomes entirely ineligible for offset under the program. That is a deliberate nudge toward domestic capacity, written into the terms.

The cloud stayed American

Now the other side of the ledger. However much compute Canada builds, the layer that firms and governments actually use, the public cloud, is overwhelmingly foreign-operated.

In June 2026, the Canadian Anti-Monopoly Project reported that Amazon, Microsoft, and Google together control about 85 percent of Canada’s public cloud market. The commonly cited split is Amazon around 42 percent, Microsoft around 31 percent, and Google around 12 percent. One caveat worth stating plainly: those 42, 31, and 12 figures are market share, not a breakdown of anyone’s spending.

The dependence runs right through Ottawa itself. The Canadian Press reported in September 2025 that federal departments spent about 1.3 billion Canadian dollars on U.S. cloud services since 2021, most of it going to Microsoft. There is no public per-vendor dollar breakdown of that 1.3 billion, so it should be cited as a total, not sliced by provider. The government that is now funding sovereign compute is at the same time one of the larger customers of the very hyperscalers it is trying to build an alternative to.

The physical footprint reflects the same reality. The Canadian “cloud regions” that anchor much of this capacity are foreign-operated: AWS runs a Central region near Montreal and a West region in Calgary, the latter a roughly 4 billion Canadian dollar buildout with 950-plus staff, part of an estimated 17.9 billion U.S. dollar AWS commitment to Canada through 2037. Microsoft Azure and Google Cloud hold their own Canadian regions. These are in-country by residency and foreign by control.

Why residency is not sovereignty

Here is the legal core, and it is not our interpretation. It is Canada’s own.

The Treasury Board of Canada Secretariat published a white paper, “Data Sovereignty and Public Cloud,” in 2018. The government has since issued a current Digital Sovereignty Framework that supersedes it. Its blunt conclusion is that as long as a cloud service provider operating in Canada is subject to the laws of a foreign country, data residency does not prevent the application of those foreign laws. That framework names the specific instruments: the U.S. CLOUD Act and the Foreign Intelligence Surveillance Act, FISA. The government’s position is that encryption, contractual safeguards, and careful workload selection matter more for risk than where the server sits.

The mechanism is the CLOUD Act itself. Passed in 2018, it clarified that U.S. providers must disclose data within their “possession, custody, or control,” regardless of where that data is physically stored. So a dataset held in a Toronto data centre, on hardware operated by a company subject to U.S. law, remains reachable by U.S. legal process. Switching to a Canadian provider does not fully escape the architecture either, if that provider has U.S. operations, U.S. investors, or U.S. customers that pull it into American jurisdiction.

And the reach is not uniquely American. As the ITIF has noted, an Ontario court compelled a French provider, OVHcloud, to disclose data stored in France through its Canadian subsidiary. Canada is not merely subject to extraterritorial reach; it exercises it. The lesson is that jurisdiction follows the operator and its corporate connections, not the map coordinates of the disk.

The layer nobody funded

Put the two sides together and the gap becomes obvious. Ottawa is funding sovereign compute, the hardware. Foreign firms own the sovereign cloud question, the control layer. And a Canadian firm that wants to build and run an AI product still, in practice, reaches for AWS, Azure, or Google Cloud, because that is where the usable, enterprise-ready platform lives.

The Centre for International Governance Innovation put this precisely in April 2026: it called the 2 billion dollar compute strategy a meaningful start but warned that Canadian firms lack a sovereign, enterprise-ready cloud on which to host, train, and deploy models under Canadian jurisdiction. Raw compute and data centres are not the same as a cloud layer a business can actually deploy on. You can pour concrete and rack GPUs and still leave the sovereignty question untouched, because sovereignty lives in the software and legal layer above the metal.

There are genuine domestic efforts. Canadian-owned operators like QScale, building a 142 megawatt campus in Lévis, Quebec on roughly 100 percent renewable Hydro-Québec power, add real domestic sovereign compute capacity, and TELUS is among the Canadian players investing in sovereign AI infrastructure. The National AI Strategy leans on exactly this hope, noting that while current offerings are “largely foreign-owned and controlled,” recent Canadian investments are starting to mature a market long dominated by the hyperscalers. But maturing a market is a decade-long project, and the strategy itself estimates Canada will need about 5.5 gigawatts of AI compute for commercial players by 2030, much of it expected to be delivered by those same foreign hyperscalers.

The takeaway

Canada’s sovereign AI push is real, and on the compute layer it is moving. But a country does not become digitally sovereign by counting the megawatts of data-centre capacity inside its borders. Three effects sit at the heart of the gap:

1. The funding, roughly 2 billion dollars plus a Budget 2025 top-up, targets compute and public supercomputing, not the usable cloud platform layer firms deploy on.
2. The cloud market that actually gets used is about 85 percent American, and Ottawa itself spent roughly 1.3 billion Canadian dollars on U.S. cloud since 2021.
3. Under the CLOUD Act and FISA, and by the government’s own admission, a Canadian address does not put foreign-operated data beyond foreign legal reach.

Sovereignty is a property of control, not of location. Until Canada builds a cloud layer that firms can actually deploy on under Canadian law, a data centre in Toronto or Calgary can be entirely Canadian in residency and still hold data that is not, in the sense that matters, Canadian-controlled. Funded compute, missing cloud. That is the honest state of digital sovereignty in Canada today.

Frequently asked questions

Sources

Primary and reputable secondary sources: Innovation, Science and Economic Development Canada (the Canadian Sovereign AI Compute Strategy, the AI Compute Access Fund program guide, the January 2026 call for sovereign data centres over 100 MW, and the National AI Strategy); the Treasury Board of Canada Secretariat (the 2018 “Data Sovereignty and Public Cloud” white paper and the current Digital Sovereignty Framework naming the CLOUD Act and FISA); the Canadian Anti-Monopoly Project via the Canadian Press, Global News, BNN Bloomberg, and Canada’s National Observer (the 85 percent cloud-market figure); the Canadian Press (the roughly 1.3 billion dollar federal U.S.-cloud spend); the Centre for International Governance Innovation (the sovereign-cloud gap and Budget 2025 top-up); the Information Technology and Innovation Foundation and the Balsillie Papers (CLOUD Act analysis and the OVHcloud case); and Amazon Web Services and QScale (Canadian cloud-region and campus details). Dollar figures are Canadian unless noted.