Canada Tempers AI Aspirations with Data Sovereignty

//php echo do_shortcode('[responsivevoice_button voice="US English Male" buttontext="Listen to Post"]') ?> Ramping up AI and quantum computing is high on Canada’s agenda—but so is digital and data sovereignty.At Accelerated 2025, Canada’s national semiconductor symposium held in Vancouver late November, the role of semiconductors to bolster data sovereignty and security was front and center.Debjani Mukherjee, CEO of Spica Systems, said security must be embedded at every level of connected systems, but that the silicon architecture creator holds primary authority. “Security has to be embedded right in the chip to the cloud—the application.” Mukherjee said policies governing data access and control must be enforced directly within the hardware if the entire stack is to meet data sovereignty requirements. Sovereignty does not mean that data has to stay in one country. Mukherjee said raw data collected at the edge may stay there to be processed, especially when there are data residency concerns. But that data could also travel to the cloud, which is when it could cross borders. She said a trust-driven approach is required based on verified processes, collaborative partnerships and standardized controls. Mukherjee highlighted the need for organizations and countries to establish common standards for data sharing and protection, as well as distinguishing between sensitive and shareable data, negotiating relationships and protocols accordingly. “The way we move forward would be to have the right kind of certification.”She suggested that pilot projects for specific industries like mining would provide a means to test and implement data sovereignty strategies.Rob Putman, global manager for cybersecurity services at ABB Process Automation, said the path to data sovereignty is incremental and begins with pragmatic steps, such as properly categorizing and describing data elements and threat modeling, before moving to more complex issues like sovereignty. “What is the data? What are the sources of data? What is it used for? What impact do they have?”He cites third-party suppliers as weak links in the data sovereignty chain. “We’re not validating who’s coming into our systems and environments.” Industries like mining are particularly susceptible to this threat, Putman said, pointing out that a significant percentage of data breaches are linked to third-party contractors.Stuart Stein, founder and CEO of ConnSens Technologies, emphasized the importance of collaboration in data-sensitive environments. His company wants NDAs when working with partners. Those who will not sign one become a concern, he said.Maintaining data sovereignty is about preventing its theft, so government regulation, policies, certifications and other partnership agreements must be backed up by robust security technology the ensures encryption and redundancy, Stein said. “Redundancy at all levels is essential for planning and for responding to data breaches.”Redundancy must include communications infrastructure that moves data, he said. ConnSens is supporting telemedicine audio and video throughout remote areas of the U.S., and its systems can dynamically switch between different cell providers, different satellite providers and optical fiber based on the environmental circumstances. “We had to have redundancy of communication,” Stein said.If redundancy is essential for maintaining data sovereignty, then data sovereignty plays a role in maintaining operations, which is why Stein advocates for a “mission critical cloud” that includes any AI inference at the edge and the cloud that is necessary for keeping the business running.He said that does not mean data needs to be siloed. “It could stand to have less siloing if you can still have a secure AI.”Brian Jin, founder of Schemon, said it is important to understand existing laws that may affect data sovereignty. The CLOUD Act, for example, allows U.S. law enforcement to access data stored by U.S.-based technology companies, regardless of where the data is physically located.Data sovereignty also requires governance, Jin added. “Governance is not just about auditing; it has to be forward control.”Many organizations approach governance as a paper exercise and auditing what happened in the past, he said, but it needs include forward-looking questions—what are the allowable data flows? “Modern sovereignty is both questions.”Jin points out that Canada has limited infrastructure compared with its neighbor to the south, with fewer regional options and less access to specialized services, especially in AI and machine learning, so cloud availability affects infrastructure choices. This can be a challenge for startups as they can face enterprise-level compliance requirements.Data sovereignty has emerged as a core national priority in Canada, even as its own recently developed framework on digital sovereignty for government information says complete sovereignty is not possible. Instead, the recommendation is risk-based use of commercial cloud complemented by controls over jurisdiction, access and resilience.In early December 2025, Microsoft Canada announced it would invest roughly $5.4 billion into new Canadian digital and AI infrastructure over the next two years, which is part of a broader investment commitment made in 2023.Microsoft’s investment accompanies a five-point digital sovereignty plan for Canada that encompasses confidential computing, expanded data residency, sovereign landing zones for AI deployment and contractual protections designed to keep Canadian customer data under Canadian legal authority. It will also establish a “threat intelligence hub” in Ottawa, the nation’s capital.In the summer of 2025, Canada’s new appointed federal Minister of Artificial Intelligence and Digital Innovation, Evan Solomon, laid the core priorities of the country’s AI strategy, which include protecting privacy and data, as well as supporting sovereignty by building local infrastructure.