As the world rapidly develops, adopts and invests in artificial intelligence (AI) systems and infrastructure, “AI sovereignty” has emerged as a priority of the Canadian federal government. In this bulletin, we explain what AI sovereignty is and related AI considerations that may impact your organization
What Is AI Sovereignty?
“Canadian AI sovereignty” refers to Canada’s ability to control how AI tools, systems and technologies are developed, deployed, governed and secured within its jurisdiction. Fundamentally, AI sovereignty is concerned with:
- Who is developing and controlling AI systems
- What kinds of data are used or inputted into AI systems and where such data is stored or processed
- How AI systems are governed to ensure risks are mitigated and are safe for consumers in accordance with local laws and norms
- What infrastructure is in place to support and power these systems
Today, most foundational AI models (especially the market-leading models) are developed in the United States and China, which arguably limits Canadian influence over how any AI system that relies on a foundational model can appropriately respond to local legal norms. Given the risks created by AI, such as the proliferation of “hallucinations,” “deep-fakes,” and a lack of explainability, as well as the rapid adoption of AI technologies across multiple sectors and industries, there is increasing political and commercial interest in ensuring Canada has control over how these tools are used and developed at home, particularly during this time of geopolitical uncertainty.
What Is the Federal Government’s Canadian Sovereign AI Compute Strategy?
The Canadian Sovereign AI Compute Strategy (Strategy) is the Government of Canada’s plan to strengthen Canada’s position as a global leader in AI systems. The Strategy, which was announced in Fall 2025, involves private-sector investment through the AI Compute Challenge, which calls for proposals from commercial entities, industry and academia for AI-related projects. Additionally, significant funding will be allocated to building public supercomputing infrastructure, and the AI Compute Access Fund aims to provide funding to small- and medium-sized businesses in an effort to address barriers to the high cost of compute resources to support domestic AI research and development. Businesses developing AI tools and technologies may consider seeking additional funding through these initiatives.
What Is the Government’s “Digital Sovereignty Framework”?
In Fall 2025, the federal government released its digital sovereignty framework, which outlines how the Government of Canada exercises autonomy over its own data, systems and digital infrastructure to ensure government systems remain reliable, resilient and available in light of the reality that Canada operates in a globally interconnected digital world. The Government of Canada’s framework recognizes the challenges it faces with respect to digital sovereignty, including data and privacy concerns, information security and global technology market dependencies, and outlines current approaches and future considerations to address such challenges. For instance, Canada has indicated that it intends to strengthen contractual clauses regarding data access, data residency, disclosure and business continuity, particularly for those related to AI and machine-learning technologies. Private-sector businesses that work with the Government of Canada may wish to consider how these priorities may impact their services.
What Artificial Intelligence Laws Apply in the Private Sector?
There are currently no comprehensive Canadian laws aimed at specifically regulating the private sector’s use of artificial intelligence. However, existing privacy, intellectual property and consumer protection laws will apply to the use of AI. Additionally, several provinces have either passed or introduced legislation which regulates the use of AI in the public sector.
The previous federal government proposed the Artificial Intelligence and Data Act, which died on the order paper in January 2025 when Parliament was prorogued. Given the new federal government’s emphasis on investing in AI technologies and building infrastructure capacity, it is unlikely that a new comprehensive AI-specific legal framework will be proposed. However, we anticipate that privacy law reforms may address some AI-related risks by requiring organizations to disclose the use of AI, complete privacy impact assessments in certain circumstances and address risks associated with international transfers of personal information.
Private-sector organizations should continue to regularly review legislative proposals related to privacy law reform efforts.
What Are the Current Data Residency Requirements in Canada?
Private-sector privacy laws generally allow personal information to flow across borders; however, organizations must take reasonable steps to protect the information from unauthorized use and disclosure, including through appropriate contractual measures, assess risks that could jeopardize the integrity, security and confidentiality of the personal information shared, and be transparent about cross-border data transfers. The flow of other types of information, including confidential or trade secret information, may also be restricted pursuant to sector-specific laws or agreements between entities.
To stay ahead of the emphasis on AI sovereignty, businesses operating in Canada could consider implementing processes to conduct audits or assessments of the AI tools utilized in their services to ensure there is organizational understanding of how the AI tools work, including where the data involved will be processed.
To learn more, please contact one of the authors or any member of our Privacy & Data Protection group.
