Does Your Public Sector AI Tool Have to Keep Data in Canada?

Short answer: it depends on your province, but for most public bodies, yes. You need to know where your AI vendor processes data. And you need to be able to say so in plain language. That's becoming a documented expectation under Quebec's privacy law, and under PIPEDA, the federal privacy law that applies where provincial law doesn't cover the gap.

If you run IT, privacy, or procurement for a municipality, school board, health authority, or provincial ministry, this question has probably landed on your desk already. Someone asked if the new chatbot tool is "Canadian AI." You didn't have a clean answer. Here's one.

What does "data residency" actually mean here?

It means two things, and people mix them up constantly. First: where is the data stored. Second: where is the AI model actually running when it processes a request. A tool can store your files in Toronto and still send the text to a server in Virginia to generate an answer. That second step is where most of the real exposure lives.

Public bodies care about this because citizen records, health files, and case notes carry legal weight. If a vendor's processing happens outside Canada, you need to know which country, under what agreement, and whether that vendor's parent company could be compelled to hand over data under its home country's laws. For US-headquartered AI companies, that's the US CLOUD Act. It gives US authorities a legal path to data held by companies under US control, no matter where the servers physically sit.

Does Quebec's privacy law really require this?

For organizations doing business in Quebec, yes. The law requires a documented assessment before you send personal information outside Quebec, looking at the laws of the receiving jurisdiction and whether protections there measure up. You can't do that assessment if your vendor won't tell you where processing happens. A surprising number won't, not clearly.

Here's what that assessment actually involves, step by step. You identify every place personal information might travel, not just where it's stored at rest. You write down what law governs each of those places. You compare that law's protections against what Quebec requires. Then you decide, in writing, whether the gap is acceptable, and what extra contract terms or safeguards close it if it isn't. Most public bodies skip straight to "the vendor says it's fine," which is not an assessment. It's a hope.

Outside Quebec, provincial access and privacy laws for public bodies are moving the same direction. British Columbia, Alberta, and Ontario all have rules on cross-border data flows for government information. Procurement teams are starting to ask vendors for this detail as standard practice, not an edge case.

Is "Canadian AI" actually a meaningful category, or just marketing?

It can be either, depending on the vendor. The phrase gets used loosely. A genuine Canadian AI platform should be able to tell you, specifically: where customer data is stored, where processing runs, whether the company has a US parent or US investors, and what happens during a service outage or failover.

Augure is a Canadian company operating under Canadian jurisdiction, with no US corporate parent and no US investors. Customer data is stored in Canada. Processing runs on Canadian infrastructure for most everyday use, with vetted European partners under zero-data-retention agreements handling certain model tiers and failover — never US providers. That split matters more than it sounds. Your conversations and documents are never handled by a company answering to US law, which is the actual question the CLOUD Act raises for customer content.

Worth saying plainly: not everything is Canadian or European. Payment card transactions and email delivery touch US infrastructure, same as almost every vendor in this space. A credible Canadian AI tool documents that rather than hiding it, because the comparison that matters is against US-hosted tools, not against perfection. If a vendor claims "100% in Canada, always," ask them to show you the sub-processor list. That claim rarely survives the question.

A sceptical reader might ask: if European partners are in the loop at all, hasn't the vendor just traded one foreign jurisdiction for another? Not quite the same trade. The concern with US providers is a specific legal mechanism compelling disclosure to US authorities. The EU has no equivalent reach into Canadian-controlled customer content, and the zero-data-retention terms mean the European partner isn't holding your data after the request completes. It's a narrower risk, not a swapped one.

What should we actually ask vendors during procurement?

Put these on your RFP checklist. This is the one list in this piece, so make it count.

• Where is customer data stored at rest, and can you name the province or country?
• Where does processing run, and does that change by plan tier or during outages?
• Does your company have a US parent company or US investors?
• Is customer data ever used to train your models?
• What non-AI processing (billing, email, support tickets) touches US infrastructure, and is that documented?

A vendor that answers all five without hedging has done the work. One that answers with words like "best-in-class" instead of a country name has not.

What does this cost a public body?

Budget is always the second question after compliance. Here's a number worth remembering.

A Canadian AI tool with real data residency can cost C$0 to start and C$20 a month per user for full access — not a premium over US tools, a wash.

Augure's free tier covers about 25 messages a day, ten documents, and basic web search, enough for a small team piloting a use case. The paid tier, at C$20 a month, removes the daily cap and adds persistent memory and priority models. A higher tier at C$80 a month adds deep research agents and unlimited documents, useful for larger departments running sustained AI work. None of that pricing assumes a premium for staying in Canada.

One cost people forget to budget: staff time for the assessment itself. Writing the transfer analysis, updating the privacy notice, and briefing procurement takes a few hours, not a few weeks, if the vendor has already answered the five questions above. If they haven't, budget a lot more, because you'll be chasing answers instead of documenting them.

What to do this week

Pull your current AI vendor contracts and check the sub-processor list. Most SaaS agreements have one, often buried in an appendix or a linked privacy policy. Find out what country actually runs processing, not just where the company is headquartered.

Draft one sentence of disclosure for your public-facing privacy notice. State plainly whether any part of AI processing happens outside Canada, and where. If you don't know yet, that's today's action: find out.

Pilot a Canadian AI alternative with a small team before your next RFP cycle. Augure's free tier makes this low-risk — no procurement process needed to test whether a tool does what your current one does, minus the residency question mark.

Start at augureai.ca.

Where this comes from

Quebec's privacy law, section 17, sets out the cross-border transfer assessment requirement for organizations doing business in Quebec.