What Schrems II Means for Canadian AI Buyers Now

On July 16, 2020, the Court of Justice of the European Union threw out the EU-US Privacy Shield, the legal framework roughly 5,300 companies had relied on to move personal data from Europe to American servers. The court's reasoning was blunt: US surveillance law gave American intelligence agencies access to European data that no contractual mechanism could paper over. Five years later, Canadian organizations shopping for a Canadian AI platform are running into a version of the same problem, minus a court ruling to force the issue.

The case, known as Schrems II after Austrian privacy activist Max Schrems, established a principle that has quietly become the working standard for anyone doing jurisdictional due diligence on a cloud or AI vendor: contracts and encryption don't override a foreign government's legal authority to compel disclosure. Canada has no equivalent ruling. But the underlying fact pattern — a US CLOUD Act that reaches data regardless of where it sits — is identical, and it is starting to show up in Canadian procurement conversations, particularly in Quebec.

The CLOUD Act problem didn't stay in Europe

The US Clarifying Lawful Overseas Use of Data Act, passed in 2018, gives American law enforcement authority to compel US-based companies to hand over data they control, even when that data is stored outside the United States. Microsoft's own long-running fight over a warrant for emails stored in Dublin is what prompted Congress to write the law in the first place. The CLOUD Act settled the question by statute: location doesn't matter if the company is American.

That's the mechanism Schrems attacked in Europe, and it's the mechanism Canadian privacy lawyers are now flagging domestically. The distinction that matters isn't where a server sits. It's who controls the company operating it. A Canadian data centre run by a US-headquartered cloud provider, or a Canadian AI startup with US venture capital on its cap table, can still fall under CLOUD Act jurisdiction. Ownership, not geography, is the operative fact.

Quebec's Commission d'accès à l'information has been the most active Canadian regulator on this point. Under Law 25, an organization transferring personal information outside Quebec has to complete a privacy impact assessment before the transfer, one that evaluates whether the destination jurisdiction offers protection equivalent to Quebec's own regime. The CAI's guidance makes clear that assessment has to look past contractual assurances to the actual legal environment the data will sit in — close to the "essentially equivalent" standard the CJEU used in Schrems II.

What buyers actually need to check

The practical difficulty for a procurement officer or general counsel is that vendor marketing pages rarely distinguish between "we store data in Canada" and "we are a Canadian company." Those are different claims with different legal consequences.

A few questions separate the two:

• Is the vendor's parent company incorporated in the United States, or does it have a US-domiciled majority investor?
• Which sub-processors touch customer content, and in which jurisdiction is each one incorporated?
• Does inference — the actual AI processing, not just storage — happen on infrastructure controlled by a US-jurisdiction entity?
• What does the privacy policy say about cross-border flows, and does it match what the sales team says?

Augure, a Vancouver-based AI vendor selling to regulated Canadian sectors, has built its marketing around answering exactly that list. According to the company's own documentation, customer conversations, documents, and AI inference are handled on Canadian infrastructure and by vetted EU partners under zero-data-retention agreements — some model tiers run in Canada, others in the EU, with EU capacity also covering failover — and never by providers under US jurisdiction. Augure says it has no US parent company and no US investors. That scoping matters: it's a claim about customer content specifically, not a claim that no part of the business ever touches American soil. Augure's own privacy policy discloses that payment processing and email delivery involve US-based providers, a detail regulators like the CAI would expect to see disclosed rather than obscured, since a Law 25 transfer assessment depends on knowing exactly which flows exist.

Jurisdiction follows the corporate entity that controls the data, not the data centre it sits in — that is the operative fact the CLOUD Act establishes, and it's the same lesson the EU spent a decade relearning through Schrems I, Schrems II, and the current adequacy fight over the EU-US Data Privacy Framework, which Schrems' organization NOYB has already signaled it intends to challenge again.

Canadian regulation hasn't caught up

Canada has PIPEDA at the federal level, which governs private-sector data handling but doesn't have Law 25's explicit cross-border transfer assessment requirement. The federal government's attempt to modernize the framework, Bill C-27, died on the order paper when Parliament prorogued in January 2025, taking the proposed Consumer Privacy Protection Act and its AI-specific companion, the Artificial Intelligence and Data Act, with it. Ottawa has not reintroduced comparable legislation.

That leaves Quebec's Law 25 as the most stringent Canadian standard currently in force, and arguably the closest thing Canada has to a domestic Schrems II test. Organizations doing business in Quebec, or handling the data of Quebec residents, are already required to think about jurisdiction the way European companies have been forced to since 2020. Everyone else is operating on PIPEDA's comparatively lighter touch, plus whatever provincial health and financial-services rules apply, plus growing informal pressure from clients and boards who read about the CLOUD Act in a briefing memo and started asking pointed questions.

Law firms have felt this pressure directly. A firm running client documents through a general-purpose AI chatbot has to reconcile that use with solicitor-client privilege and Law Society confidentiality rules — a harder problem if the underlying infrastructure sits with a US-jurisdiction provider that could theoretically be compelled to produce data under the CLOUD Act, privilege claims notwithstanding. That's part of why legal-specific tools have emerged as their own category rather than riding on general consumer AI. Augure Legal, the company's contract-review product, is built around that use case, marketing itself on Law 25 and PIPEDA compliance checks built into contract and NDA review rather than added afterward. Whether that positioning satisfies any given firm's own risk committee is a separate question from what Augure claims about its own architecture.

The lesson from Europe, transplanted

The European experience suggests two things. First, adequacy fights don't resolve cleanly; they cycle. The EU-US Data Privacy Framework replaced Privacy Shield in 2023, and NOYB has already filed complaints arguing it has the same structural flaws that sank its predecessor. A Canadian equivalent, should one ever get litigated, would likely follow the same pattern: a mechanism gets built, gets challenged, and gets replaced by something that looks similar with different acronyms.

Second, waiting for regulatory clarity is a strategy that costs nothing until it costs everything. European companies that moved data to sovereign or EU-controlled infrastructure ahead of the Schrems II ruling avoided the scramble that followed. Canadian organizations evaluating a Canadian AI platform today have the benefit of watching that scramble happen once already, in a jurisdiction with data protection law more mature than Canada's own.

Whether that translates into faster Canadian regulatory action, or into organizations doing the jurisdictional homework themselves ahead of any legislative mandate, is the open question. Nothing currently on Parliament's order paper suggests urgency on the federal side. Documentation on how one vendor scopes its jurisdictional and sub-processor claims — the kind of detail a privacy impact assessment actually needs — is available on Augure's own site, for readers who want to see what that homework looks like in practice.