What “sovereign AI” actually means for data residency

"Sovereign AI" is used to mean at least three different things: data stored in Canada, compute owned in Canada, and control that no foreign authority can reach. They are not the same guarantee, and a contract that delivers the first is often sold as the third.

Residency, jurisdiction, control

• Residency — where the data physically sits. A Canadian region of a global cloud provides this.
• Jurisdiction — whose law can compel access. A provider headquartered elsewhere may be subject to its home country’s production orders regardless of where the disk is.
• Operational control — who holds the keys, who can log in, and who patches the system. This is where most of the real risk lives.

Where AI adds new exposure

A conventional application stores data and returns it. An AI system also sends it somewhere to be processed. Prompts, retrieved passages and outputs pass through the model, and a hosted model API may log them, retain them for abuse monitoring, or process them in another region. A residency guarantee on the database says nothing about the inference call.

Fine-tuning adds a further question: the weights trained on your data are derived from it. Where they are stored, who can copy them, and whether the provider can use them are contract terms worth stating explicitly.

Matching architecture to classification

Unclassified and Protected A workloads can often run on a Canadian region with customer-managed keys and contractual limits on logging. Protected B usually needs stricter controls on the inference path and on administrative access. For classified environments the practical answer is an on-premise or air-gapped deployment, with the model running on hardware the institution controls.

Questions to ask any vendor

• Where does inference run, and is any prompt or output retained? For how long, and where?
• Which legal entities can access the environment, and under which country’s law are they organised?
• Who holds the encryption keys, and can the vendor operate the system without them?
• Can the system be deployed on our infrastructure if the classification requires it?

Sovereignty is not a label on a product. It is a set of answers to these questions, written into a contract and checkable in an audit.