Platform
Solutions
Industries
  • Pricing
    • Resources
    Company
    Request a briefing Sign in
    Commentary 6 min read

    Canada's Sovereignty Posture vs. Reality

    Canada spent the week announcing sovereignty. It spent the decade buying the opposite. The gap is sitting in your inbox, unread.

    Canada had a big week for sovereignty. Mostly it announced some.

    On June 4, Prime Minister Carney launched "AI for All." Three principles: trust, opportunity, and sovereignty. AI is now critical infrastructure, ranked alongside energy and defence. The strategy borrows a build-partner-buy framework from the Defence Industrial Strategy — build at home, partner with allies, buy abroad only as a last resort. It sits on top of a $2-billion Sovereign AI Compute Strategy, a public supercomputer, and sovereign data centres going up in Rimouski. It is coherent, well-funded, and genuinely impressive.

    It is also describing a country that does not exist yet.

    There is a definition to go with it. Ottawa says digital sovereignty means Canadians' information is handled under Canadian laws, not rules set in another country. Good. Hold onto that sentence. We are going to need it shortly.

    The stack does not match the speech

    Open your Microsoft 365 tenant. That is the country that does exist.

    Most organizations never bought a workflow system. They bought email and called it a day. Approvals, sign-offs, escalations, the entire chain of who decided what and when — all of it lives in Exchange, because nobody ever built anywhere else for it to go. Exchange is not your filing cabinet. It is the engine the business actually runs on. SharePoint holds every contract and board deck you own. Teams is where the real decisions happen, in messages no one will ever export. More than eighty percent of Canadian cloud services run on foreign infrastructure. This is not the fringe of your stack. It is the floor.

    And the floor answers to Washington.

    The US CLOUD Act compels any US-incorporated company to produce data in its "possession, custody, or control," wherever the servers happen to sit. Microsoft is incorporated in the United States. Your Canada Central tenant is within Microsoft's control. The statute does not care where the building is. It cares whose company it is. Residency buys you a flag on the data centre and nothing behind it.

    Nobody is guessing at this. Asked before the French Senate, under oath, whether he could promise that data held in France would never reach US authorities, Microsoft France's legal director said no. Valid order, the company complies. Tidy.

    The better part is that Canada already knew. The government's own white paper on data sovereignty and the public cloud says, in writing, that cloud-stored data may be subject to the laws of other countries, and that Canada "cannot ensure full sovereignty over its data when it stores data in the cloud." Ottawa wrote the problem down, filed it, and kept buying the product.

    So hold that definition back up. Canadian law, and only Canadian law. The vendor says otherwise. The government's own paper says otherwise. The posture has a definition, the reality fails it, and both witnesses for the prosecution are sitting on Canada's side of the table.

    The department that should know better

    If this were only a corporate problem, it would be a risk memo and a footnote.

    The Department of National Defence runs its collaboration on Defence 365 — the same Microsoft platform, in a uniform. The department whose entire job is sovereignty conducts its daily business inside a system that has already told a foreign parliament whose law wins. Canada is drafting a build-partner-buy sovereignty strategy while its own defence files sit on buy-from-Washington infrastructure. Nobody involved appears to find this strange.

    The model layer, for good measure

    The timing is almost considerate.

    Copilot now reads across Exchange, SharePoint, and Teams and reasons over the lot. That reasoning does not necessarily happen in Canada — a document resident in Canada Central can be processed on US infrastructure, a cross-border transfer of the contents, every time you ask it to summarize a meeting.

    Two days before Canada declared AI a sovereign priority, the United States declared the model layer its property. The June 2 executive order sets up government inspection of frontier models before release and lets Washington help pick the "trusted partners" who get them early, to harden critical infrastructure. So the data is reachable, and the intelligence reading the data runs on a foreign government's release schedule. Both halves answer to the same capital. Neither sends Ottawa a copy.

    Even the gesture gets billed

    It improves. The US Trade Representative has flagged Canada's Sovereign Cloud Initiative as a procurement barrier in its 2026 trade estimate. Canada's modest attempt at sovereignty is now a trade grievance — filed as the country walks into a CUSMA review with no AI law on the books. The posture is not merely unmatched by the reality. It is being invoiced.

    You cannot legislate your way out of a verb

    Here is the line the strategy leaves out. "Possession, custody, or control" describes a fact, not a policy you can repeal. A sovereign supercomputer does not make your Exchange tenant sovereign. A national strategy does not change who can be served a subpoena for your SharePoint. Residency never did, and everyone selling it knew.

    Two things actually close the gap, and both are structural rather than rhetorical. The operator has to sit outside the foreign jurisdiction. And the operator has to hold nothing it could read even if compelled — zero-knowledge encryption, keys it never sees, stored shards that mean nothing on their own. That is the only arrangement where a foreign legal demand comes back empty. Posture is a press release. Sovereignty is an architecture.

    Until the architecture changes, the strategy describes the country Canada would like to be. The country it is keeps its mail, its contracts, its meetings, and its defence collaboration in a system that has testified, in a foreign parliament, that its first loyalty is elsewhere.

    The posture says Canadian law, and only Canadian law.

    The reality already took the other call.

    #DataSovereignty #DigitalSovereignty #CLOUDAct #AIforAll #SovereignCloud #Microsoft365 #ZeroKnowledge #CriticalInfrastructure #CanadianTech #AIGovernance

    Sources

    Originally published by Ross Norrie, founder of SkyeConnex, on LinkedIn.

    Published June 5, 2026 · More from the SkyeConnex blog

    Up next

    More from the blog

    Commentary 5 min read

    Sovereign Compute, Borrowed Data

    Canada released its national AI strategy last week. AI for All. Six pillars, nearly $200 billion in projected productivity, up to 250,000 new jobs, business adoption…

    Read the article →
    Continue reading
    Commentary · 3 min read

    CBC and CTV Say Canada's Cloud Market Is "Broken." They're Half Right.

    Bias Declaration: I founded SkyeConnex, a Canadian data-sovereignty company. I compete directly with the providers this…

    Read →     Threat · 2 min read

    A Better Question Doesn't Survive a Subpoena

    Bergson Lopes Rego published a piece in CDO Magazine called "The Data Sovereignty Illusion." Read it. The diagnosis is…

    Read →     Commentary · 5 min read

    Have You Ever Wondered Where Your Data Goes in the Cloud?

    You upload the quarterly numbers. A little spinner turns. "Saved to the cloud." Reassuring phrase, the cloud. Sounds…

    Read →