Microsoft’s AI Agreement: Can It Truly Ensure Canada’s Digital Sovereignty?

Over the past year, few words have been abused as much as “sovereignty,” particularly in relation to Canadian digital policy and artificial intelligence. In early December, Microsoft promised to invest more than $7.5 billion over the next two years to build “new digital and AI infrastructure” in Canada. This investment is backed by a pledge that it will “stand up to defend” Canadian digital sovereignty.

Framing the investment in terms of protecting Canadian sovereignty isn’t incidental. Politically, countries are increasingly worried that tech companies based in the United States are vulnerable to pressure from the increasingly authoritarian government of President Donald Trump to turn over foreign citizens’ data, trade secrets, emails and any activity or metadata produced on their systems to the U.S. government.

If you’re wondering how investments in essential digital infrastructure from a U.S. company can help protect Canadian sovereignty, you’re not alone. It can’t and it won’t, for the simple reason that Microsoft — and other tech companies based in or that do business in the United States — are promising something that’s beyond their control to deliver.

Data sovereignty

Sovereignty, in its simplest terms, refers to the ability of a state to control what happens within its borders and what crosses those borders. It has other aspects, such as whether a state is recognized by other states, but at heart it’s about control.

In June 2025 testimony before a French Senate committee examining the issue of government procurement and digital sovereignty, Microsoft France’s director of public and legal affairs, Anton Carniaux, was asked if he could guarantee under oath that data could not be transmitted to the U.S. government without the French government’s approval. He replied: “No, I cannot guarantee that, but, again, it has never happened before.”

Carniaux’s response reminds us that the U.S., through its 2018 CLOUD Act, has claimed the right to exercise control over data collected by U.S. companies, even if it’s stored outside the country. In other words, American law explicitly requires that U.S. law takes precedence over other countries’ laws.

This is a clear infringement of any definition of sovereignty in terms of control. In response, Microsoft has promised to write “into contracts that Microsoft will challenge any government demand for Canadian data where it has legal grounds to.”

While meant to sound reassuring, Microsoft’s promise is less than it appears. Not only does their commitment leave it up to Microsoft and U.S. courts to determine the validity of any demand, but the law itself is only half of the problem.

Mass surveillance

The mass illegal surveillance of global communications by U.S. intelligence agencies, revealed by whistleblower Edward Snowden in 2013, was abetted by American tech companies. The U.S. National Security Agency collected vast amounts of data on people around the world, including non-American citizens, by tapping into internet firm servers.

American companies are uniquely beholden to pressure from the U.S. government. They depend on the government to negotiate favourable international agreements, and also as a major purchaser of their goods and services.

As research by York University criminology professor Natasha Tusikov has shown, the U.S. also engages in “shadow regulation,” putting pressure on private companies to fulfil government objectives that go beyond what’s required by law — even, as Tusikov discusses, pursuing policies that have been explicitly rejected by democratically elected legislatures.

All that happened before the Trump era. And given his clear contempt for the principle of sovereignty and American tech companies’ close ties with the government, U.S. abuse of the non-American data held by its tech companies is certainly a possibility.

Carney government vague about sovereignty

As misleading as Microsoft’s promises may be, it’s the Canadian government that’s playing the loosest with digital sovereignty talk. Prime Minister Mark Carney arguably won the federal election on his promise to protect Canadian sovereignty against a rapacious United States.

While the prime minister has promised a “Canadian sovereign cloud,” it is unclear what exactly this means. Evan Solomon, Canada’s minister in charge of promoting AI, has expressed openness to including U.S. companies like OpenAI (a Microsoft partner) in Canada’s sovereign cloud, indicating that it could include “hybrid models” with “multiple players.”

Solomon has also argued that “sovereignty does not mean solitude … we can’t look at AI as a walled-off garden. Like, ‛Oh, we cannot ever take money from X or Y.’”

It’s true that sovereignty is never absolute. The real world is much messier than a world divided into neat, discrete packages that the principle of territorial sovereignty implies. No community or state is fully self-sufficient.

We live in a global world of economic and social connections. Global governance involves a mix of domestic laws, international agreements and formal and informal cross-border working relationships. Countries benefit when they can draw on expertise and resources they lack at home.

But Microsoft’s and Solomon’s comments elide the deeper issue that come from focusing too much on abstract notions like “sovereignty.” Canada’s problem isn’t a loss of Canadian sovereignty in the abstract. It’s a U.S. that has violated Venezuela’s sovereignty, threatened others (including Canada) with annexation and is led by a president who has declared himself above international law.

Reasserting control

Sovereignty is about control. In the digital era, power lies with those who control the software and the data. Canada’s problem is that American companies control enormous swaths of Canada’s essential digital infrastructure, including emerging AI technologies and cloud services, but also email and the increasingly networked office software that underpin our entire society.

There’s a reason why France and Germany are collaborating on an alternative to Google Docs.

So long as the U.S cannot be trusted to respect domestic and international laws, companies based or working in the U.S are vulnerable to political pressure. This could potentially include capturing Canadians’ data for political and economic reasons, and cutting off our access to their products or limiting their functionality.

These hard facts about control, rather than abstract musings about sovereignty, should be our starting points for discussions about Canadian digital policy.