Your cloud contract just got political

DIGITAL SOVEREIGNTY VS TRUMP

By David Potter

February 26, 2026


Photo by Harold Mendoza on Unsplash

A U.S. diplomatic cable does not usually land on a Canadian board agenda. This one might.

On Feb. 25, Reuters reported that the U.S. instructed its diplomats to push back against foreign “data sovereignty” measures it views as barriers to American technology companies.

On the same day, CNN reported that OpenAI had detailed how a Chinese law enforcement agency used ChatGPT as part of an intimidation operation targeting dissidents and foreign officials.

In other words, a U.S.-based AI company shared a behind-the-curtain look at how their platform is being used by a foreign government agency.

I’m not defending the Chinese use, but if you were trying to script a case study in geopolitical irony, you would struggle to time it better.

If nothing else, it’s a reminder to Canadian organizations making infrastructure decisions (and those developing the government’s AI strategy) that these decisions can have real consequences.

Residency is not sovereignty

To understand what this means for your organization, start with a basic distinction. Data residency and data sovereignty are not the same thing.

Residency answers where the server sits. Sovereignty answers who can access the data and under what law.

Under the U.S. CLOUD Act, American companies can be required to produce data in their possession, custody, or control, even if that data is stored abroad.

If your provider falls under that law, the questions shift.

Who controls the encryption keys? Who can be compelled to hand over information? Would your organization know if they were?

At the federal level, Bill C-27 was intended to modernize Canada’s private-sector privacy law and introduce the Artificial Intelligence and Data Act.

The bill died when Parliament was prorogued in January, leaving Canada without an updated national privacy and AI framework. Companies have been setting their own standards in its absence.

Quebec’s Law 25 has emerged as the most rigorous privacy standard in North America.

The legislation aligns closely with the European Union’s GDPR and has extraterritorial scope. If you handle the personal data of Quebec residents, you are subject to it, regardless of where your company is based. It requires privacy impact assessments for cross-border transfers and carries penalties that can reach into the tens of millions of dollars.
Trade enters the picture

The Canada-United States-Mexico Agreement, better known as CUSMA (or USMCA as the U.S. likes to call it), already governs part of this debate.

It’s digital trade chapter limits a country’s ability to require companies to localize computing facilities as a condition of doing business, subject to narrow public policy exceptions. It also protects cross-border data transfers for business purposes.

The agreement comes up for mandatory review on July 1, 2026. If Canada, the U.S., and Mexico do not agree in writing to extend it, the pact moves into annual review and could expire in 2036.

That places digital infrastructure decisions inside a trade framework that is being actively reviewed.

In February, Bell announced a partnership with Toronto-based AI firm Cohere to deliver Canadian-built AI infrastructure for business and government. This contract may still be in place while the CUSMA review shapes the next phase of North American trade policy.

The offering combines Bell’s national network and data centre footprint with Cohere’s enterprise models, allowing organizations to run generative AI workloads on infrastructure located in Canada and operated under Canadian law.

For some organizations, that structure answers practical questions about legal exposure and regulatory compliance. For others, integration with global platforms remains the priority.

Those approaches reflect different risk calculations.

Making decisions while the ground shifts

Canadian leaders are being asked to accelerate AI adoption while trade rules are under review, federal legislation remains unfinished, and the government’s AI strategy has yet to be released.

The context in which companies are operating is nothing if not complex.

Some firms will prioritize global scale and integration, whileothers will prioritize tighter jurisdictional control. Each path carries implications for audit readiness, vendor relationships, and long-term exposure.

However this plays out, it seems safe to say that leaders should avoid journaling about their decision-making on ChatGPT, unless they want to read about it on CNN (or in Digital Journal).

Final shotsData governance now sits inside trade law, privacy enforcement, and AI deployment at the same time.

CUSMA’s digital trade rules, Quebec’s Law 25, and the absence of a federal AI framework are shaping infrastructure decisions being made today.

AI adoption is accelerating while the jurisdictional framework around it is still evolving.



Written ByDavid Potter
David Potter is Senior Contributing Editor at Digital Journal. He brings years of experience in tech marketing, where he’s honed the ability to make complex digital ideas easy to understand and actionable. At Digital Journal, David combines his interest in innovation and storytelling with a focus on building strong client relationships and ensuring smooth operations behind the scenes. David is a member of Digital Journal's Insight Forum.