Governance is the Foundation of Digital Sovereignty

Canada has spent decades ceding control of the digital economy to foreign private actors. Without a comprehensive governance framework, billions in new public spending on “sovereign” AI infrastructure will fail to deliver real sovereignty — and that the window to act is now.

Compute spending without governance is money wasted. Canada must build the policy and institutional foundations first.

Key Takeaways

1. Where data is physically stored matters less than who owns the infrastructure and what laws they answer to. Under the U.S. CLOUD Act and FISA, American cloud providers can be compelled to hand over Canadian data regardless of where it sits.
2. Peer nations treat data regulation, IP protection, procurement, and technical standards as tools of national industrial policy and global competition. Canada treats them as neutral ground.
3. Canada ranks last in the G7 at converting R&D into commercialized products — our ideas succeed abroad, not at home.
4. A governance-first strategy requires three pillars: stronger legislation, modern public-interest institutions, and sovereign compute infrastructure.

Foundations of Digital Sovereignty will present a blueprint for building a meaningful strategy for sovereignty, ownership and prosperity in the digital economy:

• How technical standards and international frameworks can be used strategically to advantage Canadian firms
• Why Canada needs a national institution for IP protection and research commercialization
• Privacy legislation and sovereign data institutions, including a national data trust
• The national security risks of Canada’s dependence on foreign cloud hyperscalers
• A procurement-led strategy for growing domestic cloud capacity
• Antitrust enforcement, regulatory tools, and blocking statutes as sovereignty instruments
• A proposed Crown corporation to build and operate Canada’s sovereign compute infrastructure

Introduction

For roughly the past 40 years, the global economy has been undergoing a fundamental shift. We have moved from a world dominated by supply chains of tangible goods, to a world where intangible assets are the key driver of economic growth.

Canada has largely failed to respond to this evolution.

Most of the thorny problems that Canada faces today are a product of this central trend: Canada has surrendered governance and ownership of the digital realm. Indeed, we have allowed private actors — mostly foreign —  to shape the rules of the digital economy, weakening Canadian sovereignty and giving rise to a litany of downstream problems that now characterize the digital economy.

Privacy loss, fraud, low productivity growth, inescapable and compelling propaganda, polarization, child mental illness, cybersecurity risks, monopoly power, wealth inequality, and even democratic erosion are all downstream outcomes of Canada’s fundamental failure to build institutions and governance structures that assert sovereign control over the digital realm.

What’s more, this trend is now being supercharged by artificial intelligence (AI) technology. Foundational elements of AI technology were incubated in Canada, but due to our inattention to the realities of how value is created and captured, it was primarily American firms like OpenAI, Google, Microsoft and Anthropic that have successfully commercialized AI tools. We excelled at developing the underlying technology, but failed to design and deploy meaningful governance models.

Today, the Canadian government is already deploying billions of dollars as part of a Sovereign AI Compute Strategy, and as a country we are being asked to do even more to build up sovereign compute capacity.1 Policy advocates and corporate interests say Canada must do this to compete in a global AI race where we are already barely playing catch up. We are being told that Canada can leverage valuable data sources like public health records and financial data in order to assert a competitive advantage. But the solutions being put forward generally just amount to further reliance on foreign multinationals, with superficial claims of sovereign control

In order to assert meaningful digital sovereignty and capture the economic benefits for Canada, we must do the hard work of developing an overarching governance framework. Otherwise, the billions of dollars we spend on Canadian-resident compute capacity will do little to meaningfully strengthen Canadian sovereignty in the ways we care most about — bolstering economic prosperity, protecting privacy and the ability to govern society in accordance withCanadian values.

Investing in more computational capacity must be built on top of the foundation of a broader sovereignty strategy that affirms, protects and reclaims the value of data and information.

A framework for governing AI, data and the intangible economy in the national interest will start with:

• Developing Better Legislative and Policy Instruments
• Building Modern Public-Interest Institutions
• Securing Sovereign Compute Infrastructure

Before we blindly spend billions more on “sovereign” compute capacity, Canada must have clear governance and policy infrastructure in place to ensure that the economic value created by those data centres is held by Canada and governed by Canadian values.

And just as importantly, we need corresponding institutions in place to ensure that we are meaningfully governing the use of AI technology being deployed in Canada — regardless of whether it is running on sovereign Canadian infrastructure or not.

Data Residency is Not the Primary Sovereignty Issue

Compute is the physical infrastructure that allows the digital economy to operate. And it can be tempting for policymakers to focus on the physical equipment, as a way to simplify matters.

Unfortunately, this approach is often misguided.

We have seen a long history of this misguided approach when it comes to Canadian data residency requirements. Essentially, data residency laws stipulate that Canadian government data must be stored in cloud infrastructure that is built on Canadian soil.

However, the U.S. CLOUD Act and FISA both permit the United States government to demand data from American cloud service providers — even if the data is not stored on U.S. soil. Microsoft in testimony to the French Senate confirmed that it would not be able to refuse handing over data to the U.S. government — regardless of where the data was physically stored.

Put simply: When it comes to sovereignty, where the physical infrastructure is located matters less than who owns the infrastructure and what laws they are subject to.

We see something similar when it comes to “sovereign” compute capacity. In the global artificial intelligence boom, one of the major constraints for companies is computation capacity.

Policymakers worry that without access to “sovereign” compute capacity, Canadian companies will be at the mercy of multinational cloud service providers.

Faced with pressure to keep Canada in the global AI compute race, we’ve seen the government respond by stepping in directly with programs to try and build compute capacity to provide strategic access for Canadian researchers and firms.

In the 2024 budget, the federal government allocated $2 billion to the Canadian Sovereign AI Compute Strategy. Months later, the government announced a $240 million plan to support Cohere, a Canadian generative AI company. But in reality, the deal was essentially government money helping Cohere to secure computing capacity in a data centre being built in Cambridge, Ont.

However, the data centre was owned and operated by CoreWeave, a foreign firm.

Even when data centres or AI firms are located in Canada, without clear, democratically established rules, those firms will default to writing their own. That means operational policy will continue to follow corporate
incentives and foreign regulations rather than the Canadian public interest.

In the two years since the Canadian Sovereign AI Compute Strategy was published, the pressure to secure sovereign Canadian compute capacity has only intensified. However, in those same two years, the government’s proposed privacy and data reform legislation is once again stalled in Parliament.

Examples from other jurisdictions show that many different arrangements of compute ownership and location are possible in a sovereign compute strategy. But in order for a country to thrive in the 21st century
economy, a robust governance layer must exist over the infrastructural layer of compute.

In particular, the governance of data is essential to successfully governing compute — both in terms of protecting data from misuse and mobilizing data for use in the public interest. Simply owning compute infrastructure is not enough; there needs to be an ability to govern inputs, outputs, operation and use cases associated with compute, and to ensure the retention of value produced by using that compute.

Canada’s Failed Opportunity

Other countries have designed new regulatory frameworks to guide investment and acceptable behaviour by market participants. Those same frameworks create the conditions to help mitigate the downstream harms of digital systems.

By comparison, Canada has naively assumed that if we simply support research and development, good things will happen. Unfortunately, good things have not happened.

Canada has done a poor job of capturing the value-added economic activity created by our investments in research and development and intangible assets. As a country, we’ve invested heavily in research and development at the university level. We have one of the strongest and most dynamic research ecosystems in the world. That system makes new discoveries and invents new technologies regularly, but we rank lowest in the G7 when it comes to turning innovation inputs like R&D into innovation outputs like commercialized products and value-added exports.

In Canada, our main strategy has been to invest heavily in research and development at the post-secondary level and hope that the inventions created will magically be built into strong Canadian companies with commercialized innovations and IP ready to sell to a globalized world. Instead, successive Canadian governments have worked very hard to attract foreign companies to operate in Canadian communities and partner with Canadian research institutions. But we have a commercialization problem.

Canada is, famously, the country that incubated the researchers who ultimately made breakthroughs that led to the development of modern artificial intelligence technology. The man venerated as the godfather of AI, Geoffrey Hinton, was ultimately hired by Google. More to the point, in spite of significant AI talent incubated at Canadian universities, the biggest companies commercializing AI are almost all American.

It’s not that our ideas don’t become successful products, the problem is that the patents and other intellectual property is often registered to foreign firms and in other countries where the value add is captured by someone else. In many cases, government funded research is never even commercialized or turned into IP, novel discoveries are simply published as academic papers, and then left for any reader anywhere on earth to find.

The most successful countries in the digital age — countries like the USA, China, Germany and South Korea — have industrial policies to support development and commercialization of sovereign technology and economic development. Israel recognizes the value of public research and domestically developed IP, to the point that the country imposes export controls and requires repayment when valuable IP is acquired by foreign companies.

Countries that create the conditions for prosperity and sovereignty tend to look at data regulation, standards development, research and development, government procurement, defence policy, and intellectual property protection as different spheres for competition and control. Canada often treats these realms as neutral and democratic venues for co-operation, while other countries treat these systems as an opportunity to gain advantage.

Without a sharper strategy for governance and control, Canada’s effort to build sovereign compute will fail to capture the economic value that comes from cutting-edge technologies, and we will continue to relinquish
sovereign control through our own inattention.

Strategies for Sovereign Governance

While other countries have set strong rules and frameworks to both guide investment in developing domestic companies and the infrastructure they need, Canada has naively assumed that value-added activity would remain in country while ownership and commercialization happen elsewhere. Nothing could be further from the truth.

Creating and capturing value in the digital realm requires more than neutral rules. It requires the government to become the strategic partner in all relevant arenas.

Building sovereign Canadian compute infrastructure is one important dimension. However, the government must also create the conditions for economic success — commercializing high quality data and protectingprivacy, capturing the intellectual property created by innovation, and embracing standards that advantage Canadian companies.

Government must also be an anchor customer for promising Canadian companies to support them in scaling their technology. Moreover, when Canada is more front-footed about governance in the digital realm, it will put the government in a better position to mitigate harms. Governance efforts can take place both through upstream inputs like data usage, and also by monitoring downstream outputs, such as child mental health issues.

Looking at peer jurisdictions, we can see examples of how Canada can start creating the structures of digital governance needed to assert real sovereignty over compute and AI systems.

In the European Union, we have seen the government pass strong privacy and consumer protection legislation through the General Data Protection Regulations. These rules include provisions for greater autonomy over personal data,
restrictions on the collection of sensitive data, and interoperability and data portability requirements.

The EU AI Act  also imposes a number of requirements for how data can be used in the development and deployment of AI tools, particularly restricting the use of biometric data and facial recognition technology (EU AI Act, Article 5). Strong legislative foundations for AI and privacy protection are essential for governing data.

Along with effective protection for data, the EU also has legal frameworks in place to mobilize data for the purposes of research and commercialization for the public good — within the bounds of existing protections. The EU’s Data Governance Act seeks to enable secure and trustworthy data sharing and re-use to deliver benefits for citizens. The law also supports the development of Common European Data Spaces (CEDS) — essentially data exchange and storage platforms to support the public interest and with embedded governance frameworks — in strategic sectors.

In particularly sensitive domains like health data, regulations like the European Health Data Space Regulation protect personal data, while also enabling its secure reuse for research and innovation in the public interest. More broadly, the Open Data Directive encourages EU member countries to make data resulting from publicly funded research open and available for re-use by default. Estonia’s X‑Road model is an open-source data exchange platform connecting public and private sector databases, prioritizing work in the public interest and following the three requirements of interoperability, data integrity and privacy protection.

On the other side of the globe, we see a similar mindset. South Korea’s Data Accumulation Project, part of the Data Dam project, seeks to accumulate and open data for the purposes of AI training, and create valuable jobs in the process. European countries have also pursued statutes and other tools to impose strong controls on data and compute even when dealing with powerful monopolistic hyperscalers.

For example, Article 271 of the Swiss Criminal Code includes a blocking statute which in effect blocks the collection of evidence or information by foreign authorities for a foreign proceeding preventing the circumvention of applicable Swiss rules on criminal, administrative or civil proceedings. The Statute is particularly relevant in the context of banking since it makes it difficult for foreign insolvency offices to seek information on a debtor’s assets from Swiss Banks.

To achieve similar objectives, Israel’s government used contractual requirements for American cloud service providers — namely Google and AWS — to sidestep legal obligations for extraterritorial access to secure the sovereignty of government data.

A Blueprint for Canadian Digital Sovereignty

In 2025, the United States National Security Strategy explicitly articulated a geopolitical strategy that uses American technology platforms as an instrument of foreign policy and control. Taking a hard look at technology platforms and the terms of trade in the digital realm must be a top priority as Canada re-evaluates our relationship with the United States and our broader geopolitical strategy in a volatile world.

“The old relationship we had with the United States based on deepening integration of our economies and tight security and military cooperation is over,” Prime Minister Mark Carney declared in 2025.

Canada needs a stronger, and more comprehensive vision for governance of the digital realm. In subsequent chapters, Foundations of Digital Sovereignty will present a version of that comprehensive vision.

First, we’ll look at the building blocks of digital sovereignty — Standards, Intellectual Property and Data.

Then, having established the foundational governance framework ideas for the digital realm, we will look at practical ideas for how Canada can build more sovereign digital systems, with strong governance embedded in the stack.

Chapter 2: Standards and International Frameworks

This chapter will examine the ways that other countries are able to use technology standards, international legal systems, trade agreements and other seemingly neutral systems to preference domestic firms and grow their own economies. In reality, these legal and technical frameworks can give competitive advantage to countries and companies, when they are used strategically.

By taking a more intentional and clear-eyed approach to technical standards, Canada can set our own terms for governance and technology development.

Chapter 3: Patents and Intellectual Property

Canada’s geopolitical rivals see intellectual property generation and protection as a national imperative. International metrics consistently show that Canada underperforms on research commercialization. In a world economy where value is primarily derived from intangible assets, Canada needs a national institution for protecting and promoting savvy IP strategy.

Chapter 4: Privacy and Data

Data is one of the main factors for economic productivity in the intangible economy. The best strategy is for a country to develop regulations to protect individual privacy, to prevent their data from being used in harmful ways, while also allowing proprietary data to be mobilized to provide economic value.

In this chapter we will look at privacy legislation, and ideas for sovereign institutions like a national data trust, to act as a steward for Canada’s proprietary data.

Chapter 5: Risks to Canada’s Cloud Infrastructure

Canada has neglected to assert strong governance in the digital realm, and that has put the country in a disadvantageous position. In the previous chapters we’ve looked at how stronger governance strategy has contributed to economic success for competitors. In this chapter we look at how Canada relies on foreign hyperscalers for cloud storage and computing infrastructure. This puts Canada in a subordinate position economically, but it also introduces direct national security risks — most notably from the US CLOUD Act, and the Foreign Intelligence Surveillance Act.

Chapter 6: A Strategy for Growing Domestic Cloud Capacity

Having established the risks posed by ungoverned cloud infrastructure, this chapter will explore how Canada can secure the necessary cloud access for government, research and businesses while ensuring governance and privacy.

This chapter will look at the government’s own cloud service needs, and how procurement can create anchor demand for growing the Canadian market for sovereign compute and cloud storage. With the right governance in place, the right technical standards, and a tiered approach to procurement, Canada can foster cloud infrastructure with a greater degree of governance, and greater economic benefits to Canada.

Chapter 7: Governance Tools for Canada’s Digital Sovereignty

Even with better legislation and stronger public institutions, Canada will remain vulnerable to foreign manipulation and interference, in particular by foreign tech giants. There are additional tools that Canada can use to assert control, without walling ourselves off from the world. Canada must aggressively develop and use tools that look outward and work to proactively protect itself in the international arena. Blocking statutes, trade negotiations, and antitrust enforcement can support Canada’s efforts to secure its cloud.

Chapter 8: Building Sovereign Compute

To actually build sovereign domestic compute enabled by stronger governance, Canada can take multiple paths including partnerships with private industry as long as there are strong controls in place. But some of this capacity will need to be built and operated by the government and maintained as a public option for cloud and compute. This is especially true for government services, strategic research, and championing Canadian businesses by providing a secure, reliable, accessible, and affordable option.

This chapter will propose and outline how a Canadian crown corporation can be created to build and administer Canada’s sovereign domestic compute capacity to meet these strategic needs, to invest in and develop next-generation compute to meet future needs rather than only trying to catch up with the current paradigm, and to ensure governance is embedded in these systems from the beginning.

Conclusion

The road ahead for Canada on digital sovereignty may seem daunting. The fact is that any serious effort to assert control and governance over the Canadian digital realm will be working to undo decades of inaction and complacency.

“The old relationship we had with the United States based on deepening integration of our economies and tight security and military cooperation is over.”
— Prime Minister Mark Carney, 2025

The good news is that Canada is already navigating a moment of geopolitical volatility and realignment, and Canadians are broadly supportive of substantial efforts to bolster our national sovereignty.

The time is right, and as we will see in the chapters ahead, Canada can borrow best practices from peer nations to develop best practices for digital sovereignty and governance. We can do this.

1. Innovation, Science and Economic Development Canada, “Canadian Sovereign AI Compute Strategy,” Government of Canada, last modified October 31, 2025, https://ised-isde.canada.ca/site/ised/en/canadian-sovereign-ai-compute-strategy.