Cohere Is Canadian. That Fact Alone Won't Fix Your Compliance Problem

Cohere raised its Series D in 2024 at a valuation north of $5 billion, and its head office sits on King Street West in Toronto. Those two facts get repeated constantly in Canadian AI procurement conversations, usually as shorthand for "this vendor is safe to use." They are not the same claim, and conflating them is where a lot of compliance reviews go wrong.

Cohere is, by any reasonable definition, a Canadian AI company. It was founded by former Google Brain researchers in 2019, it is headquartered in Toronto, and it has become the most visible name in the country's AI sector — the one federal officials point to when they want to argue Canada can compete with Silicon Valley on foundation models. What's worth examining is what "Canadian company" actually buys an organization trying to satisfy Quebec's Law 25 or the federal Personal Information Protection and Electronic Documents Act. Something, but less than procurement teams often assume.

The Headquarters Question Isn't the Compliance Question

A company's country of incorporation tells a reader where its board meets and where its taxes get filed. It does not tell a reader where customer data is stored, where inference happens, or which sub-processors touch that data along the way.

This distinction matters because Law 25, Quebec's private-sector privacy law that finished its staged rollout through 2023 and 2024, imposes specific obligations around cross-border data transfers: organizations must assess the legal framework of the destination jurisdiction before personal information leaves the province. PIPEDA, the federal law that applies everywhere Quebec's statute does not, takes a similar accountability-based approach — an organization stays responsible for personal information it hands to a third party, wherever that third party happens to be incorporated.

Cohere's enterprise documentation states that customer data can be processed in multiple regions depending on deployment, and the company offers deployment options including its own cloud, Amazon Web Services, and on-premises installations for large customers. A Toronto-headquartered company can still route inference through Virginia. Incorporation and infrastructure are separate questions, and a compliance officer who only checks the first one has done half a review.

That gap has a concrete cost, and it is not hypothetical. Under Law 25, an organization that transfers personal information outside Quebec without having conducted and documented what the statute calls a privacy impact assessment for that transfer is exposed to administrative monetary penalties on its own account, separate from anything the vendor did wrong. The vendor's infrastructure choice becomes the customer's compliance gap. A procurement team that signs a contract with a Canadian-incorporated AI vendor, skips the sub-processor review because the letterhead said Toronto, and later discovers inference ran through a US region has not caught the vendor in a lie — Cohere's documentation disclosed the multi-region processing plainly enough. The team failed to read its own disclosure obligation into that fact before the contract was signed, and the CAI has said in guidance on cross-border transfers that this documentation burden sits with the organization doing the transferring, not with the vendor whose infrastructure it used.

What The CLOUD Act Actually Reaches

The US CLOUD Act lets American law enforcement compel data disclosure from providers subject to US jurisdiction, regardless of where the underlying servers physically sit. This is the detail that gets lost in "our vendor is Canadian" arguments. Jurisdiction attaches to corporate control and operational structure, not to a mailing address.

A Canadian-incorporated company with a US parent, US majority investors, or infrastructure contracts with US cloud providers can still create CLOUD Act exposure for customer data, because the exposure follows the corporate and infrastructure chain, not the letterhead. This is not a claim about Cohere specifically — the company has not published a full account of its corporate ownership structure or investor cap table in a way that settles the question either way. It is a structural point about how the CLOUD Act works, and it applies to any AI vendor a Canadian organization is evaluating, headquartered here or not.

The CLOUD Act's reach follows corporate control and infrastructure jurisdiction, not where a company's head office happens to be.

A skeptical reader might point out that this cuts both ways: a vendor with no US parent and no US infrastructure for customer content can still get compelled to hand over data by a Canadian court order, a CAI investigation, or a warrant under Canadian law, and nothing about avoiding the CLOUD Act changes that. That's correct, and it's worth saying plainly, because "not subject to the CLOUD Act" sometimes gets marketed as though it meant "not subject to any compelled disclosure." It doesn't. It means one specific American legal mechanism doesn't reach that data through a US-controlled provider. Canadian legal process reaches it the way Canadian legal process reaches any company operating here, and that's a different — and unavoidable — fact of doing business in a regulated jurisdiction at all.

This is also where Augure's pitch differs from "we're Canadian too." Augure says it has no US corporate parent and no US investors, and that customer conversations, documents, and AI inference are handled without routing through US-jurisdiction providers — meaning the CLOUD Act's reach over US-controlled entities does not extend to that customer content specifically. Inference runs on Canadian infrastructure for some model tiers and through vetted EU partners under zero-data-retention agreements for others, including failover capacity, with none of it routed to US-based inference providers, according to the company. Some downstream functions — payment card processing, email delivery — do involve US-based services, a detail Augure discloses in its privacy policy rather than papering over. That disclosure matters more than it might sound like it should, because the honest answer to "does anything touch US infrastructure" is almost never a clean no for any SaaS company, and vendors who claim otherwise are usually the ones that haven't read their own sub-processor list.

Reading a Sub-Processor List Properly

The practical fix for the "is my vendor actually Canadian" question is not to trust the marketing page. It is to read the sub-processor disclosure, which most serious vendors publish and update when it changes.

A few things worth checking in that document:

• Where data is stored at rest, and whether that location is disclosed by region or left vague
• Where inference or processing actually happens, which can differ from storage location
• Whether any sub-processor is a US-jurisdiction company, and for what function
• Whether customer data trains the vendor's models, and whether that's opt-out or structurally prevented

Reading that list well is not a five-minute exercise, and it is worth naming what the process actually involves before treating it as a checkbox. It means pulling the sub-processor table, cross-referencing each entry against the vendor's own privacy policy for what function it serves, and then checking whether any entry changed since the last time counsel looked at it — most serious vendors update the list quarterly at minimum, some only on material change, and a stale review is worse than no review because it creates a paper trail suggesting diligence that didn't happen. For an organization with outside privacy counsel, that review typically runs a few hours of billed time per vendor, not a full engagement, unless the sub-processor list reveals something that needs a follow-up question to the vendor directly.

Cohere's own privacy documentation is reasonably detailed on data handling for its API products, and the company has said publicly that customer data submitted through its enterprise API is not used to train its models by default. That is a meaningful commitment. It is a different commitment from a jurisdictional guarantee, and organizations doing Law 25 assessments need to evaluate the two separately rather than letting one imply the other.

The Office of the Privacy Commissioner of Canada has been direct about this in its guidance on AI and privacy obligations: accountability for personal information doesn't transfer just because processing has been outsourced to a third party, and organizations remain on the hook for demonstrating they've assessed the risk. The Commission d'accès à l'information, which enforces Law 25 in Quebec, has taken a similar position in its published guidance on transfers outside the province — the organization doing the transferring carries the documentation burden, not the vendor.

Where Canadian AI Actually Has an Edge

None of this makes "Canadian AI" a meaningless label. It means the label answers one question, incorporation and jurisdiction of the parent company, and a compliance review needs answers to several others before it's finished.

A genuinely sovereign Canadian AI platform earns its positioning by stacking the answers to those other questions the same direction: Canadian data storage, Canadian or EU-only inference infrastructure with no US routing for customer content, no US ownership, and models built around Canadian regulatory context rather than retrofitted to it after the fact. That's a narrower claim than "we're a Canadian company," and it's the one that actually does compliance work.

Augure is one vendor making that narrower claim: Canadian data residency, inference split between Canadian infrastructure and EU partners under zero-retention agreements, no US corporate parent, and compliance frameworks for Law 25 and PIPEDA built into the product rather than assembled for a sales call. Its architecture supports a customer's own compliance work — it does not substitute for it. It is not the only option in the market, and a procurement team evaluating it should ask it the same sub-processor questions this piece just laid out for Cohere, because the answer should hold up to the same scrutiny.

Ask about incorporation, but do not stop there. Ask about the sub-processor table. Ask about inference location, not just storage location. Ask what happens on failover, because that is often where a vendor's real infrastructure commitments show up and where marketing pages get vague. A company being Canadian is a fact worth knowing. It is the beginning of a compliance assessment, not the end of one.

Organizations building out that assessment can find Augure's data handling and sub-processor documentation at augureai.ca.