In June 2026 the Government of Canada launched AI for All, a national AI strategy built on three pillars — trust, opportunity, and sovereignty. The sovereignty pillar commits to building "the foundations of sovereign Canadian AI: compute, cloud, connectivity, data, and talent so Canadian researchers, businesses, and public institutions can build and adopt AI on Canadian terms."
That policy has already started reshaping procurement. RRDC helps Canadian organizations understand what it actually requires — and land workloads that satisfy it.
Canada's national AI strategy explicitly frames foreign control of AI infrastructure as a risk to be addressed. The strategy commits to investing in sovereign compute and cloud infrastructure, to using government procurement as a strategic anchor customer for Canadian champions, and to a newly formed Sovereign Technology Alliance with international partners.
Beneath the federal strategy, procurement practice has already moved. Data residency language now appears in the majority of Canadian government RFPs. Health Canada guidance requires Canadian data residency for platforms handling regulated health information. Alberta's Sovereign Compute Environment procurement requirements go further and exclude vendors subject to the U.S. CLOUD Act outright. Ontario and British Columbia have added sovereignty assessments to vendor qualification.
If you sell to, partner with, or are regulated by any level of Canadian government, this is no longer a theoretical conversation.
Most vendors conflate these two deliberately. Procurement officers and privacy counsel do not. If you take one thing from this page, take this.
The physical location of the servers holding your data. "Our Canadian region is in Montréal" is a residency claim. It is straightforward to satisfy and every major hyperscaler can do it.
What it answers: where is the data?
Which legal jurisdiction has authority to compel disclosure of your data. This is determined by the corporate structure of the provider, not the geography of the disk.
What it answers: who can be ordered to hand it over?
Under the U.S. CLOUD Act, a U.S.-headquartered provider can be compelled to produce data it controls regardless of where that data physically resides. Canadian servers operated by a U.S. parent satisfy residency. They do not necessarily satisfy sovereignty.
A Canadian-incorporated provider operating under Canadian law offers a legal guarantee that a U.S.-headquartered provider with Canadian servers cannot — regardless of what the privacy policy says.
The distinction Canadian procurement has started scoring against.On a 30-minute discovery call we establish which obligation you are actually under. Federal procurement? Provincial? Sector regulator? Contractual commitment to a customer? Each carries a different bar, and the difference between "residency is sufficient" and "jurisdiction must be Canadian" changes the entire architecture.
Most organizations we talk to have never had that question answered precisely. They have a vague sense that data should stay in Canada and a cloud contract that partially addresses it.
Within 48 hours you receive a written assessment: which workloads carry a sovereignty obligation, what your current architecture actually satisfies, where the gaps are, and what it would cost to close them on private dedicated infrastructure inside Canada.
If your current hyperscaler arrangement already satisfies your obligation, we will tell you that and you can stop reading. We would rather be right than win the engagement.
Federal, provincial, and municipal bodies subject to procurement rules that now score Canadian jurisdiction. If you are responding to RFPs, sovereignty language is likely already in them.
If your platform handles government data, your customer's obligation becomes your requirement. Demonstrating Canadian jurisdiction is increasingly a condition of the deal, not a differentiator.
Health Canada guidance requires Canadian data residency for platforms handling regulated health information. Provincial health authorities layer further requirements on top.
OSFI-regulated institutions operate under third-party risk and technology-risk guidance that treats concentration in foreign-controlled infrastructure as a material risk to be managed.
Organizations pursuing federal AI funding, participating in AI Missions, or positioning as Canadian AI champions have a strategic reason to run on infrastructure that reads as sovereign to a program officer.
Enterprise customers increasingly write residency and jurisdiction requirements into master service agreements. Your obligation may already exist inside a contract you signed.
Sovereignty claims are easy to make and hard to substantiate. Buyers in this space — procurement officers, privacy counsel, compliance leads — know the difference and will ask hard questions. So here is our position.
We will tell you exactly which obligation applies to you, in writing, with the specific regulation or procurement clause named. That analysis is free and it is yours to keep whether or not you work with us.
We will tell you precisely what the infrastructure we represent does and does not satisfy for your specific obligation — including the corporate structure question, because on a strict sovereignty reading that is the question that decides it.
We will tell you when your existing setup is already fine. A meaningful share of organizations worrying about this have a residency obligation, not a jurisdiction obligation, and are already compliant.
Thirty minutes. We'll establish what applies to your organization, assess what your current architecture satisfies, and send a written analysis within 48 hours. No engagement fee.
Or email sales@rrdc.cloud
RRDC