Canada Has an AI Strategy Now. Read the Data Fine Print

The Strategy Leads With Sovereignty

Prime Minister Mark Carney unveiled Canada's federal AI strategy in Toronto on June 4, 2026. The document is built around a single organizing idea, and that idea is sovereignty rather than safety or innovation. The strategy states plainly that Canada is currently "over-exposed to foreign economic and political powers," and the policy that follows is an attempt to claw some of that exposure back.

Evan Solomon, the minister of artificial intelligence and digital innovation, has called digital sovereignty "the most pressing policy and democratic issue of our time." That framing matters because it tells you what the government optimized for. The money goes to compute and adoption. The rhetoric goes to keeping Canadian data, Canadian models, and Canadian rule-making inside the border. For anyone buying software this year, that second part is the line that should change a procurement decision.

Where the Two Billion Goes

The headline number is more than 2 billion dollars in total funding, with a 700-million-dollar Compute Access Fund aimed specifically at small and medium enterprises. The Globe and Mail reported the total higher, at more than 2.3 billion dollars, with a large training component. Either way, this is a spending strategy first.

The targets are ambitious. The government projects up to 90,000 AI-related jobs and 250,000 new jobs through AI adoption by 2031, 200 billion dollars in economic growth, and a jump in business AI adoption from 12% to 60% by 2034. It promises free AI literacy training for all Canadians and dedicated training for 1 million post-secondary students.

The supply side is concrete. The plan includes a world-leading public supercomputer, data centres scaling to at least 100 megawatts, and an expanded Sovereign Technology Alliance with Germany. The throughline is physical capacity on Canadian soil, owned or controlled in ways that a foreign statute cannot easily reach.

Make the Laws Here, Store the Data Here

Carney gave the strategy its clearest sentence himself: "We will make the laws here and we will also grow our capacity here, our physical compute capacity, so that we can protect Canadians." Strip the politics out and that is a two-part instruction to the market. Make the rules domestically. Keep the data and the compute domestically.

The mechanism for the second part is a build-partner-buy framework, borrowed directly from the defence industrial strategy. Build what is strategic, partner where a trusted ally adds capacity, buy commodity capability off the shelf. Applied to AI, it is a sovereignty test dressed as a procurement model: before you adopt a tool, you ask where the data lives, who controls the contract, and which government can compel access.

For a solo or small firm, that test used to be a sophisticated-buyer luxury. The federal strategy just made it the default posture of the country. When the Prime Minister frames domestic compute as protection for Canadians, data residency stops being a feature you might pay extra for and starts being the baseline a serious vendor is expected to meet.

The Rulebook That Did Not Ship

The honest part of this story is what is missing. The strategy proposes new consumer-privacy legislation and modernized safety laws, but it provides no timeline and no specific measures. There is no AIDA successor and no replacement for the dead Bill C-27. The binding rulebook that a strategy of this size implies simply was not in the documents.

Critics noticed. Conservative deputy leader Melissa Lantsman said "the safety and the security that was promised in this is nowhere to be found in the documents." Coverage broadly described the strategy as lacking safety details. The job numbers carry their own caveat too: Signal49 Research, cited in the coverage, projected AI could cause 550,000 job losses by 2030, a counterweight worth holding next to the 250,000-job adoption claim, and one to read as a projection rather than a forecast anyone has banked.

The practical takeaway from the gap is the opposite of complacency. When a government signals direction without writing the rules, the obligation lands on buyers to set their own standard, because the standard the regulator will eventually impose is being foreshadowed in plain language right now.

Building the Posture In

This is the design bet behind SupaCorp. Entity management is one of the most personal-data-dense corners of a small firm's practice: incorporations, annual returns, minute books, registers, director home addresses, beneficial-ownership records, and client intake, all of it the kind of information a federal sovereignty strategy is built to keep onshore. A tool that handles that work cannot treat residency as an afterthought, because the regulator's direction of travel is already legible in the strategy.

So the posture is built in rather than bolted on. SupaCorp is Canadian-hosted with data residency and audit trails, multi-tenant with Postgres row-level security so one firm's records stay isolated from another's at the database level, and a flat fee per firm rather than a per-seat tax that punishes a growing practice. It runs incorporations, annual returns, minute books, and registers across Federal, Ontario, BC, Alberta, and Quebec jurisdictions, which is the multi-jurisdiction reality a Canadian small firm actually lives in.

The build-partner-buy logic in the federal strategy maps onto a buying firm directly. Build your compliance posture into the tools you adopt, partner with vendors who can show you where the data lives and produce an audit trail, and refuse to buy capability that cannot answer those questions. SupaCorp is the version of that argument for entity work: sovereignty-by-design, so the first matter does not start with a residency problem the firm has to solve under pressure later.

What to Watch

The signal to track is the privacy and safety legislation the strategy promised without dating. When a timeline appears, the soft expectation of data residency hardens into a written obligation, and the gap between sovereignty-by-design vendors and the rest stops being a preference and becomes a compliance line. Watch also whether the 700-million-dollar Compute Access Fund actually reaches small enterprises or pools at the top. The strategy made sovereignty the national default. The firms that already build to it will spend the next two years looking prescient instead of scrambling.