When the AI for All strategy commits to "Sovereign Foundations" as one of its six pillars, and when Bell, Telus, Cohere, and a growing list of Canadian…

When the AI for All strategy commits to "Sovereign Foundations" as one of its six pillars, and when Bell, Telus, Cohere, and a growing list of Canadian companies use "sovereign AI" or "sovereign cloud" as marketing language, they are using a word that means at least three different things. The English noun "sovereignty" does considerable work in the AI conversation, and the work it does is often invisible because the same word is doing it across very different conceptual layers. Chapter 1 introduced the three senses briefly. This chapter goes deep on each one and tests them against each other: National sovereignty — whether Canadian data, Canadian models, and Canadian AI infrastructure are under Canadian rather than foreign (mostly American, increasingly Chinese) jurisdiction. Personal sovereignty — whether individuals retain meaningful control over how their data, their likenesses, and their decisions are shaped by AI systems. Indigenous data sovereignty — whether Indigenous peoples retain ownership, control, access, and possession of data about themselves, their communities, their lands, and their knowledge. These are not the same question. A "sovereign cloud" deployment from Bell or Telus answers the first one, partially. It does not answer the second or third. A creator-side push for likeness rights answers the second one, partially. It does not address the first or third. The First Nations Information Governance Centre's OCAP® Principles and Inuit Tapiriit Kanatami's National Inuit Strategy on Research answer the third, in frameworks that predate and exceed the current AI debate.  You will leave this chapter with: clear working definitions of all three sovereignty layers; the FNIGC OCAP, ITK NISR, and GIDA CARE frameworks understood as primary documents, not summaries; the CLOUD Act and other foreign-jurisdictional mechanisms that constrain Canadian national sovereignty in practice; the test for what "sovereign AI" claims actually deliver versus what they imply; and the structural finding from Chapter 8 — that a majority of energy-transition-mineral projects sit on or near Indigenous and peasant lands — placed where it does sovereignty work rather than environmental work, but is the same underlying fact. ---

National sovereignty — the CLOUD Act problem

When Bell, Telus, or the federal government uses "sovereign cloud" or "sovereign AI," the most concrete version of the claim is national: that Canadian data being processed on Canadian infrastructure is subject to Canadian law rather than the laws of a foreign jurisdiction. This sounds straightforward. It is not.

The CLOUD Act is the structural reason it isn't. The Clarifying Lawful Overseas Use of Data Act was signed into US law in March 2018. It establishes that US-based corporations must provide stored data in their possession, custody, or control to US law enforcement when properly compelled, regardless of where in the world the data is physically located. A US warrant served on Microsoft, Amazon, Google, or any other US-headquartered corporation requires those companies to produce data stored on their servers in Canada, Germany, Ireland, or any other foreign jurisdiction, unless an explicit agreement between the US and the data-holding country provides an alternative mechanism.

The implication for Canadian "sovereign cloud" claims is direct. A Canadian government department storing sensitive data with AWS Canada (Central) in Montréal, Microsoft Azure in Toronto, or Google Cloud in Toronto is storing data with US-headquartered corporations subject to the CLOUD Act. The data is physically located in Canada. The corporation holding the data is American. A US warrant, served under appropriate domestic process, requires that corporation to produce the data. The Canadian government's contracts with those providers can attempt to manage notification requirements and procedural protections, but the underlying jurisdictional reality is set by US statute.

🧌 GOBLIN CHECK — "The server is in Montréal" is a statement about geography. The CLOUD Act is a statement about custody. When an American company holds your data, the map that matters isn't the one with provinces on it — it's the org chart. The goblin keeps both maps, and trusts the org chart.

None of this is hidden. It sits in the contracts and in the legal commentary, and it is the structural reason every serious Canadian AI sovereignty conversation eventually returns to the question of Canadian-controlled infrastructure. The 2018 CLOUD Act is the document that made "sovereign cloud" something other than a marketing slogan, because it made the alternative (US hyperscaler-hosted Canadian data) explicitly subject to US legal reach.

ALIGNMENT — whose law runs the server? "The data lives in Canada" feels like an answer. The real question is the follow-up: whose law can reach it? A server in Montréal owned by a US company can still be compelled under US law. Location is one layer of sovereignty; control and jurisdiction are the layers that usually decide who wins.

Canadian-controlled alternatives. Bell, Telus, and other Canadian telecommunications incumbents market their cloud services on the basis that as Canadian corporations under Canadian jurisdiction, they are not subject to CLOUD Act compulsion in the same way. This is true in practice: a US warrant served on Bell Canada does not have the same compulsory force as one served on Microsoft. Canadian government departments seeking the strongest jurisdictional control over sensitive data have increasingly turned to Canadian-headquartered providers for this reason.

But the picture is more complicated than the marketing implies. Most Canadian-controlled cloud and AI providers operate substantially on US-headquartered hardware, US-licensed software, and US-headquartered chip supply chains. Canadian telecom data centres, Bell's included, run on the industry's standard global supply chain: hardware fabricated largely in Taiwan, software licensed from US corporations. Cohere's models are trained on NVIDIA GPUs (US-headquartered) and historically deployed in part through Oracle Cloud (also US-headquartered and a Cohere investor). The underlying substrate is American even when the corporate ownership is Canadian. Whether that substrate exposes Canadian users to foreign-jurisdictional reach in the way the CLOUD Act does for hosted data is a more complicated legal question: generally no, but with edge cases involving software updates, chip firmware, and supply-chain access.

The BC + AI line from Chapter 5 returns here with practical force. "Sovereignty is not achieved by putting a maple leaf on the invoice." A Canadian-headquartered corporation can hold a Canadian government's AI contract while operating on substantially American infrastructure, American chips, American capital, and American software. The corporate jurisdiction is Canadian. The dependency underneath it is not. National sovereignty in AI requires both, and currently, by the count of any honest mapping of Canadian AI corporate dependencies, Canada has the first but is some distance from the second.

---

Personal sovereignty — the consent and likeness layer

If national sovereignty is the question of which government's law governs your data, personal sovereignty is the question of whether you, as an individual, retain meaningful control over how AI systems use your data, your image, your voice, your work, and your decisions. The conversations are connected but not the same: a Canadian-controlled cloud could host an AI system that violates personal sovereignty just as readily as an American-controlled cloud.

Three distinct domains where personal sovereignty intersects AI directly:

Consent for AI training. When OpenAI trained ChatGPT, Anthropic trained Claude, Google trained Gemini, and Meta trained Llama, those companies used training data (text, images, code) that was collected from the public internet, from books, from creative works, and from material whose authors had not been individually asked for permission and had not received compensation. The Canadian newspapers' lawsuit against OpenAI (filed November 2024) covers approximately 16.1 million owned and licensed works at issue. Whether the underlying practice constitutes copyright infringement under Canadian law is contested. The ISED consultation closing January 2024 collected substantial expert disagreement, including arguments from Carys Craig (Osgoode/York) and Michael Geist (Ottawa) for a text-and-data-mining exception that would make training without permission lawful under Canadian copyright. We'll work through this in Chapter 11. The personal-sovereignty question here is: do you have meaningful control over whether your writing, your art, your code, your photographs are used to train commercial AI systems? As of this writing, the answer for most Canadians is no: the practice has occurred, the legal remedy is being adjudicated, and there is no opt-in regime currently functioning at scale.

Name, Image, Likeness rights. When ACTRA (the Alliance of Canadian Cinema, Television and Radio Artists, 28,000+ members) surveyed its members in 2023, 98% of respondents reported concern about the potential misuse of their name, image, and likeness rights, and 93% expected AI to eventually replace human actors in certain roles. The January 2025 Independent Production Agreement ratified between ACTRA and Canadian producers was the first Canadian collective agreement with explicit AI provisions — prohibiting use of a performer's recordings to "simulate or alter a Performer's voice or likeness; to create any synthesized performance or 'digital double'; or for machine learning." This is personal sovereignty at the level of one specific worker domain. The broader version, whether ordinary Canadians have any legal recourse when their likeness is used in an AI-generated image, is mostly unaddressed in current Canadian law, except where the use is sexualized (Bill C-16, December 2025 — see Chapter 13).

Algorithmic decisions about you. When an AI system is used to screen your job application, evaluate your loan, set your insurance rate, or determine your eligibility for a public service, the personal-sovereignty question is whether you have a right to know it happened, to challenge it, to receive an explanation, and to access human review. The CUPE Senate submission of March 2026 (Chapter 16) explicitly demands these as legislative requirements: notification when an algorithmic system was used; explanation of the result; human review and appeal mechanism. Ontario's Working for Workers Act, effective January 1, 2026, requires employers with 25+ employees to disclose whether AI is used in screening job applicants: the first mandatory Canadian AI-employment disclosure rule. The broader regime CUPE proposes does not currently exist federally. AI for All does not commit to it.

GOBLIN FACTS — count the mandatory rules; it won't take long. As of January 1, 2026, Ontario's Working for Workers Act requires employers with 25 or more staff to disclose when AI is used to screen job applicants. That is the one mandatory AI-employment disclosure rule in the country. Personal sovereignty, measured in statutes you can actually invoke, is currently a list of one.

The personal sovereignty question doesn't have a single legislative fix the way the national sovereignty question has the (partial, contested) fix of Canadian-controlled infrastructure. It's a layered question that touches consent, compensation, disclosure, appeal, and the legal definition of what counts as a decision that affects you. The Canadian conversation on these issues is significantly behind the European Union (where the AI Act provides a comprehensive risk-classification regime including explicit personal protections), and modestly behind the United Kingdom and Australia (where deepfake-specific legislation provides narrower but operational protections). It is roughly at the same level as the United States, where federal AI regulation is mostly absent and state-level patchwork (Tennessee ELVIS Act, California AB 1836/2602, Texas TRAIN Act) provides uneven protection.

---

Indigenous data sovereignty — the deeper layer

The third sense of sovereignty is the one with the longest established framework and the deepest theoretical grounding, and it is the one the federal AI strategy is most clearly silent on.

A note on what this section is and is not. The guide is not Indigenous-led writing. The chapter cannot speak on behalf of Indigenous peoples or summarize a position on their behalf. What it can do, and what it tries to do, is present three primary documents from three different Indigenous-led organizations, in those organizations' own framings, with the chapter's role being to translate the operational implications for Canadian AI policy. Readers who want to engage Indigenous data sovereignty seriously should read the primary documents directly. Links are in the Sources appendix.

The FNIGC OCAP Principles. The First Nations Information Governance Centre (FNIGC) is the national First Nations data governance organization in Canada, holding a mandate from the Assembly of First Nations Chiefs-in-Assembly. In 2023, FNIGC marked twenty-five years of the OCAP Principles, first established in 1998: First Nations Ownership, Control, Access, and Possession of data about themselves, their communities, their lands, and their knowledge. The framework is documented at <https://fnigc.ca/ocap-training/> and through the formal OCAP training and certification program FNIGC operates.

In FNIGC's own framing, OCAP is "a set of standards that establish how First Nations data should be collected, protected, used, or shared." The four principles, in operational terms:

Ownership: First Nations communally own information in the same way that a person owns their personal information.
Control: First Nations have the right to control all aspects of research and information management processes that impact them.
Access: First Nations must have access to information about themselves and their communities.
Possession: First Nations physically hold the data about themselves.

OCAP applies First Nations data, by First Nations definition of what data is about First Nations. This includes (but is not limited to) health data, demographic data, cultural data, knowledge data, environmental data, and increasingly, training data used by AI systems where First Nations material is included. When a large language model is trained on text that contains First Nations content, when an image generator is trained on photographs that include First Nations people or sites, when a recommendation system processes data about First Nations users: these are OCAP questions, not just legal-compliance questions.

The federal government has, in some contexts, formally adopted OCAP for federally-collected data on First Nations. The current AI for All strategy does not commit to applying OCAP to federally-funded AI training, federal AI procurement, or federal AI deployment that processes First Nations data. That gap is one of the chapter's central findings, and it is one the guide will not soften.

The ITK National Inuit Strategy on Research (NISR). Published in 2018 by Inuit Tapiriit Kanatami (ITK), the national Inuit representational organization for the over 65,000 Inuit in Canada (concentrated across Inuit Nunangat: Nunatsiavut, Nunavik, Nunavut, and the Inuvialuit Settlement Region). NISR is available at <https://www.itk.ca/wp-content/uploads/2018/04/ITK_NISR-Report_English_low_res.pdf>. ITK President Natan Obed has been the framework's most prominent public voice.

The NISR's framing is sharper than its OCAP counterpart, and worth quoting in its original language because the framing matters:

"Research has largely functioned as a tool of colonialism, with the earliest scientific forays into Inuit Nunangat serving as precursors for the expansion of Canadian sovereignty and the dehumanization of Inuit. Early approaches to the conduct of research in Inuit Nunangat cast Inuit as either objects of study or bystanders."

The NISR identifies five priority areas: (1) advancing Inuit governance in research; (2) enhancing the ethical conduct of research; (3) aligning funding with Inuit priorities; (4) ensuring Inuit control over data; and (5) building research capacity within Inuit Nunangat. The fourth priority is the direct data-sovereignty pillar, but the framework treats all five as integrated rather than separable.

A crucial honest note. The NISR was published in 2018, predating the contemporary generative-AI conversation. It establishes the framework of Inuit data sovereignty in principle that applies directly to AI training data on Inuit communities, but ITK has not yet published a specific position on AI as of this writing. The guide is applying NISR's principles to the AI conversation, not citing ITK's explicit position on AI. If ITK publishes AI-specific material in the future, the guide should update.

The GIDA CARE Principles. The Global Indigenous Data Alliance (GIDA) is an international Indigenous data sovereignty network that includes Indigenous-led organizations from Aotearoa New Zealand (Te Mana Raraunga, the Māori Data Sovereignty Network), the United States (US Indigenous Data Sovereignty Network), and other jurisdictions. The framework is at <https://www.gida-global.org/careprinciples>.

The CARE Principles for Indigenous Data Governance are: - Collective benefit: Data ecosystems shall be designed to enable Indigenous Peoples to derive benefit. - Authority to control: Indigenous Peoples' rights and interests in Indigenous data must be recognized. - Responsibility: Those working with Indigenous data have a responsibility to nurture respectful relationships. - Ethics: Indigenous Peoples' rights and well-being should be the primary concern at all stages of the data life cycle.

CARE was explicitly designed as a complement and counterweight to the FAIR Principles (Findable, Accessible, Interoperable, Reusable) that dominate the open-data movement in academic and government science. The open-data movement has tended to treat data as a public good that should flow freely. CARE makes the case that for Indigenous data, who the data flows to and how matters as much as whether it flows. The 2024 GIDA communiqué "CARE Directs Us Home" is the most recent formal update.

Tahu Kukutai (Te Mana Raraunga, Aotearoa) is one of the most-cited international Indigenous data sovereignty scholars and a lead author on the CARE communiqué. Her work, alongside the broader Te Mana Raraunga community, provides the most developed academic literature on Indigenous data sovereignty as a global concept.

---

How the three frameworks interact — and what they all share

The three frameworks (OCAP for First Nations, NISR for Inuit, CARE internationally) are not the same framework. The differences are meaningful and the guide should not collapse them.

OCAP is the most operationally specific, organized around the four principles (Ownership, Control, Access, Possession). It is the framework with the most formal Canadian government engagement: multiple federal departments have adopted OCAP in specific contexts for First Nations data collection, and OCAP-certified researchers are required for some federally-funded First Nations health research.

NISR is the most structurally comprehensive, treating data sovereignty as one of five integrated research-system priorities rather than as a standalone data framework. It is the framework most directly grounded in anti-colonial analysis of the research relationship itself.

CARE is the broadest internationally, designed to be portable across Indigenous communities globally and to interoperate with the open-data movement rather than to operate alongside it.

What they all share, at the level of principle: Indigenous peoples retain rights and interests in data about themselves, their communities, their lands, and their knowledge. These rights are not subordinate to general "public interest" arguments for open data. The control these rights imply is not the same as ordinary individual privacy: it is collective, organized at the level of nations and peoples, and it is governance rather than just protection.

EXAMPLE — water rights, not a water bottle. Your own privacy is a water bottle: yours to open, share, or sell. Indigenous data sovereignty works more like a community's water rights — held collectively, governed at the level of a nation, and not something any one person can sign away on a terms-of-service screen. That's why it doesn't reduce to individual consent, and why a checkbox can't deliver it.

What they all share, at the level of the AI conversation: training data is data. When AI models are trained on material that includes Indigenous content (and most large language models, large image generators, and broad multimodal models are, because they are trained on the internet), the training is a use of Indigenous data. The frameworks ask whether that use occurred with Indigenous ownership, control, access, possession, collective benefit, authority, responsibility, and ethics. The current state of foundation-model training is that no developer has documented asking those questions before the training was done.

This is not a position the guide is taking. This is the position the three frameworks take, in their own primary documents, applied to the obvious case of AI training data. A non-Indigenous-led guide cannot speak on behalf of these frameworks, but it can note that the practical implication is clear, and that no current Canadian AI policy framework, including AI for All, engages it.

A 2024 piece in Policy Options titled "AI threatens Indigenous data sovereignty and digital self-determination" made the framing question directly: "Will Indigenous data governance be meaningfully embedded or merely acknowledged in principle?" That is the question the chapter asks readers to carry through any future Canadian AI policy.

---

The Wonder Valley case study, revisited

Chapter 6 introduced the O'Leary/Greenview Wonder Valley project, and the correction the receipts forced: Sturgeon Lake Cree Nation is not a participant in the project but its principal challenger, in court as of June 2026 over the Crown's duty to consult. The chapter returns to Wonder Valley here because the litigation raises the sovereignty question at a layer Chapter 6 only opened.

Start with what the duty to consult is: a constitutional obligation, rooted in section 35 of the Constitution Act, 1982 and developed through the Haida Nation jurisprudence, requiring the Crown to consult, and where appropriate accommodate, when Crown conduct may adversely affect Aboriginal or treaty rights. It is not a courtesy, and it is not a stakeholder-engagement best practice. It is the legal floor. Sturgeon Lake Cree Nation's position is that announcing and advancing a multi-gigawatt project in Treaty 8 territory without consultation fell below that floor.

The OCAP/NISR/CARE frameworks of this chapter sit above that floor: they ask who governs data, and data governance presupposes the relationship that consultation establishes.

Had Wonder Valley proceeded with consultation, or with the equity participation that early coverage imagined, this chapter's questions would still apply: a data centre on or near First Nations territory is not automatically processing First Nations data, and even a Nation's stake in a facility would not, by itself, confer OCAP-style governance over what tenants process there. Those layered questions remain live for every future project. On Sturgeon Lake Cree Nation's account, now before the court, Wonder Valley shows Canada failing at the layer beneath all of them: the land itself.

The read of Wonder Valley as a sovereignty case study, on the documented record: it is the test case for whether "sovereign AI" rhetoric and section 35 obligations can occupy the same country. A federal strategy launched its sovereignty pillar the same week a First Nation argued in court that the most basic consultation duty had been skipped on the flagship project. Whichever way the court rules, that juxtaposition is the finding.

The fuller case for Indigenous data sovereignty in AI infrastructure, applied at the layer that matters, would require contractual or policy mechanisms ensuring that data processed at facilities like Wonder Valley is subject to OCAP/NISR/CARE governance where applicable, that Indigenous communities have rights over training data about them regardless of where the training occurs, and that federally-funded AI development cannot use Indigenous training data without engaging the relevant frameworks. None of these mechanisms currently exists in Canadian federal policy. AI for All does not commit to creating them.

---

The Owen et al. extraction geography, doing sovereignty work

Chapter 8 introduced the structural finding from Owen et al. (2023): 54% of the world's energy-transition-mineral projects sit on or near Indigenous peoples' lands — 69% including peasant lands — and 62% of those are in high-water-risk locations. The finding did environmental work in Chapter 8. Here, it does sovereignty work.

If the physical substrate of AI (the cobalt, lithium, coltan, gallium, copper, tungsten, germanium, and rare earths inside every GPU, every server, every networking switch, every backup power system) is produced through extraction projects that disproportionately sit on or near Indigenous land, then the sovereignty question for AI is not bounded by national borders. Canadian AI built on Canadian land using American chips that contain cobalt mined in Indigenous-controlled regions of the Democratic Republic of the Congo, lithium extracted from Indigenous lands in Bolivia, or rare earths mined in Indigenous-held lands in northern Canada itself, is an AI infrastructure whose sovereignty implications extend through the entire extraction supply chain.

A Canadian "sovereign AI" claim that does not engage the extraction geography is sovereign only at one layer. It can be national-sovereign while remaining extraction-blind, and the OCAP/NISR/CARE frameworks, taken seriously, push the sovereignty conversation to cover both.

This is the chapter's hardest claim and the one most likely to be misread. It is not saying that Canadian AI cannot proceed because of global extraction. It is saying that an honest sovereignty conversation has to engage the question of whose land the substrate of the AI was extracted from, on what terms, with what compensation, with what environmental and human consequences, and whether the Canadian AI built on that substrate participates in or perpetuates the extraction. The conversation in the rest of the world, including ongoing work at the UN Permanent Forum on Indigenous Issues, the Indigenous Environmental Network, and the academic literature on transition-minerals justice, engages this. The Canadian AI conversation, at the federal-strategy level, mostly does not.

The Lewis/Whaanga/Yolgörmez Abundant Intelligences framework introduced in Chapter 1 connects to this directly. Their argument, that AI's foundational assumptions are extractive, scarcity-oriented, and indifferent to the question of what intelligence is for and whose intelligence counts, is not just an ethics critique. It is a structural critique that bears on the sovereignty question because the extraction geography is the physical expression of the structural assumptions. Building AI that doesn't presuppose extraction requires both new computational practices and new material practices. The Abundant Intelligences researchers, in their concrete work (the Hua Ki'i Hawaiian-language object recognition prototype, Suzanne Kite's Lakota hardware-building protocol, the broader Indigenous Protocol and AI Position Paper 2020), are working at both layers.

---

What "sovereign AI" claims actually deliver — a working test

Putting the three sovereignty layers together, the chapter can close with the working test the guide asks readers to apply to any "sovereign AI" claim they encounter, whether from Bell, Telus, Cohere, the federal government, or any other Canadian AI actor.

When the claim is made, ask:

National layer. Whose corporate jurisdiction holds the data? Whose contracts govern the service? What foreign-jurisdictional reach (CLOUD Act, equivalent statutes) applies to the providers in the supply chain? Where are the chips manufactured, where is the software licensed, where is the capital sourced?

Personal layer. What consent did the people whose data is being used give? What compensation? What right to opt out? What disclosure when AI is used in decisions about them? What appeal? What recourse for likeness use?

Indigenous layer. Are OCAP/NISR/CARE Principles engaged for any Indigenous data in training, processing, or deployment? Is there Indigenous governance over Indigenous content? Where were the materials extracted from, on what terms, with what consultation?

A "sovereign AI" claim that answers all three is currently rare. A claim that answers one is more common: Canadian-headquartered corporate jurisdiction is the most-commonly delivered version, the maple-leaf-on-the-invoice version, as Chapter 5's critique had it. The label is not unfair. A Canadian flag on a contract does not, by itself, address personal or Indigenous sovereignty, and the national sovereignty it provides is partial (the operational dependencies remain American), bounded (the chips and capital are not Canadian-controlled), and silent on extraction.

Adding it up. AI for All's "Sovereign Foundations" pillar is the strongest version of Canadian AI sovereignty that any federal government has committed to. It also delivers, at the working level, only one of the three sovereignty layers, and delivers that one only partially. The strategy could be substantially strengthened by explicitly committing to mandatory Indigenous data governance frameworks for federally-funded AI work, by establishing personal-sovereignty protections (notification, explanation, appeal, opt-out, likeness rights) in the regulatory regime that AIDA's failure left vacant, and by engaging the extraction geography as a sovereignty question rather than only an environmental question. Whether the strategy does any of these over the rest of its implementation is the policy story to watch.

---

Open-weight models — a partial sovereignty lever

There is a tool the sovereignty conversation usually skips, and it sits directly underneath the "no affordable domestic option" problem the leaked AI for All draft named in Chapter 5: open-weight models.

Most of the systems this guide has discussed are closed. GPT, Claude, and Gemini are reached only through an API: you send your text to a company's servers, the model runs there, and the answer comes back. You never hold the model; you rent access to it. An open-weight model is different in one specific, consequential way: the company releases the trained weights, the actual numbers that are the model (in Chapter 2's sense that the model is the data), for anyone to download and run on their own hardware. Meta's Llama, Mistral's models, and the Chinese lab DeepSeek's releases are the prominent examples. Canada's own Cohere has released open-weight models too, including its multilingual Aya family.

Why this belongs in a sovereignty chapter: an open-weight model can be run inside Canada, on Canadian-controlled infrastructure, without sending a single query to a foreign API. That speaks directly to the national-sovereignty problem from Section One. The data stays in the jurisdiction. No CLOUD Act reach attaches to a model running on a server you control. The leaked draft's complaint, that Canadian businesses "train and deploy models on foreign cloud platforms," which "sends Canadian money abroad" and "places sensitive data and intellectual property outside the country," has, in open weights, at least a partial technical answer that does not require Canada to build a frontier lab from scratch.

DeepSeek made this concrete in early 2025: a capable open-weight model, released by a non-American lab at a fraction of the assumed cost, briefly rearranged the industry's confidence that only a handful of well-capitalized US companies could field competitive AI. Whatever else it was, it was a live demonstration that the capability is more diffusible, and therefore more sovereign-able, than the closed-API incumbents' framing suggested. It is exactly the kind of event the working test in Section Seven exists to read.

🧌 GOBLIN CHECK — "Open" is one of the most oversold words in AI. Before you treat an "open" model as a sovereignty win, the goblin asks two questions: open weights or open data? (Almost always just weights — you can run it, you still cannot see what trained it.) And open licence, or open-with-an-asterisk? Read the licence before you read the press release. A model you can download but cannot legally deploy at scale is a brochure, not a lever.

The caveats matter here, because "open" is doing heavy lifting. "Open weights" is not "open source." The weights are released; the training data almost never is. So an open-weight model is still opaque on the question Chapter 3 said matters most: what is in the corpus. You can run it without the company; you still cannot audit what taught it. "Open" is also not always open. Several widely-called-open models ship with licences that restrict commercial use above a certain scale or forbid particular applications: a real constraint hiding under a friendly word, and exactly the kind of claim the bias-mapping method says to check rather than accept. And running a frontier-scale open model is not free: it still needs serious compute, which loops back to the data-centre and chip dependencies of Chapters 4 and 6. Open weights lower the foreign-dependency wall; they do not remove it.

So the honest placement is this. Open-weight models are a real, underused lever for Canadian AI sovereignty (a way to keep data and inference in-country without owning a frontier lab), and they are a partial lever, not a solution. The strategic question they pose for Canada is one AI for All does not squarely answer: whether the sovereignty bet should ride mainly on building closed national champions (the Cohere path) or also on systematically adopting and hosting open-weight models in the Canadian institutions, hospitals, and governments where the data must not leave. The two are not mutually exclusive. A serious sovereignty strategy would name both.

---

Which sovereignty you can actually claim

CHAPTER RECAP — you now have: - The three senses of sovereignty (national, personal, Indigenous) understood as three distinct conceptual layers that use the same English word. - The CLOUD Act as the structural reason national sovereignty in AI requires Canadian-controlled infrastructure rather than just Canadian-located US-corporate infrastructure. - Open-weight models as a real but partial sovereignty lever — downloadable weights (Llama, Mistral, DeepSeek, Cohere's Aya) run on Canadian-controlled infrastructure with no foreign API, answering part of the "no affordable domestic option" problem; with the caveats that open weights are not open training data, "open" licences can restrict use, and running them still needs compute. - The personal sovereignty layer mapped: training-data consent, name/image/likeness rights, and algorithmic-decision disclosure, with the current Canadian regulatory regime substantially behind the EU, modestly behind UK and Australia, roughly at parity with the US. - The FNIGC OCAP Principles, the ITK National Inuit Strategy on Research, and the GIDA CARE Principles as three distinct primary frameworks, each in their own framing, with the operational implication for AI training and deployment named but with the explicit caveat that the guide is not Indigenous-led and cannot speak on behalf of these frameworks. - Wonder Valley revisited on the documented record: non-consultation and active duty-to-consult litigation, not Indigenous participation — the test case for whether Canada's AI buildout answers to section 35. - The Owen et al. extraction geography placed where it does sovereignty work — the physical substrate of AI being drawn disproportionately from Indigenous land worldwide makes "sovereign AI" claims that ignore extraction sovereign only at one layer. - The working test for evaluating any sovereign AI claim: ask the three layers, ask what the claim actually delivers versus what it implies.

The next chapter (Chapter 10) takes the personal-sovereignty material from Section 2 and goes deeper on the privacy and surveillance dimensions of AI use — the federal AI Register's coverage and gaps, the workplace AI surveillance question that CUPE raised, the Quebec Law 25 framework, and the structural absence of comprehensive Canadian AI privacy regulation following AIDA's failure.

You can now read any future Canadian "sovereign AI" claim with the structural equipment to ask which sovereignty the claim is about, what it actually delivers, and what it leaves unaddressed. That equipment is more granular than the federal-strategy framing, and it lets you see what the framing is doing and what it isn't.

---

Bias label for this chapter: structural-political and conceptual analysis of the sovereignty layer of Canadian AI policy. Author lean: critical-engaged with national sovereignty claims that ignore foreign-jurisdictional reach and operational dependencies; explicit that the manual is not Indigenous-led and cannot speak on behalf of OCAP/NISR/CARE frameworks; reliant on primary-document representation rather than secondary summary for the Indigenous data sovereignty section; willing to name the federal strategy's silence on Indigenous data sovereignty as a specific empirical gap rather than as a rhetorical absence. Government framing (PMO, ISED, Solomon) treated as primary on what the strategy commits to and as leaning toward justification of those commitments. Indigenous-led primary documents (FNIGC, ITK, GIDA, Abundant Intelligences) treated as authoritative within their own frames. Corporate sovereignty marketing (Bell, Telus, Cohere) labelled and read accordingly.

Primary sources cited or relied on in this chapter: First Nations Information Governance Centre, OCAP Principles documentation and 25th anniversary materials (2024); Inuit Tapiriit Kanatami, National Inuit Strategy on Research (2018) and Implementation Plan (2018); Global Indigenous Data Alliance, CARE Principles for Indigenous Data Governance and "CARE Directs Us Home" communiqué (2024); Lewis, Whaanga & Yolgörmez, "Abundant intelligences: placing AI within Indigenous knowledge frameworks," AI & Society 40(1):2141–2157, 2024; Indigenous Protocol and AI Position Paper (2020); Policy Options "AI threatens Indigenous data sovereignty and digital self-determination" (May 2025); Owen, Kemp, Lèbre, Svobodova & Pérez Murillo, Nature Sustainability 2023; US CLOUD Act (Public Law 115-141); BC + AI "AI for All Has To Mean All of Us" (Krüg, June 5, 2026); CUPE Senate Brief (March 2026); Canadian newspapers v. OpenAI (Ontario Superior Court CV-24-00732231-00CL); ACTRA AI submission materials and 2025 Independent Production Agreement. Detailed citations in the Sources appendix.

---