An “enterprise” AI assistant subscription does not make your data sovereign

Monday, 8:30 a.m. The managing partner of a 20-person tax firm announces that the firm has bought the enterprise version of a major AI assistant. Her email to the team ends: “Our data is protected. It’s in Canada.” At 9 a.m., a technician drops a client file into it.

The first sentence is partly true. The second confuses three questions: where the data is stored, where the model reads it, and which law applies to whoever receives it. The subscription can settle the first, handles the second poorly and does not touch the third.

Moving from a consumer tool on a personal account to a major provider’s enterprise offer is real progress. In general, you get:

• a contract, and no training of the models on your prompts and documents;
• admin controls: who has access, which features are allowed;
• retention settings for the history;
• enterprise sign-in, with accounts you manage;
• logs for audits and for searches after an incident.

Microsoft documents these protections for Microsoft 365 Copilot, which its documentation now calls Microsoft Copilot. Prompts, responses and data accessed through Microsoft Graph (emails, documents) are not used to train foundation models. The assistant only shows what the user is allowed to see; the history, encrypted at rest, can be subject to retention policies and retrieved during an audit.

Storage is covered too: for an organization signed up in Canada, Microsoft has committed since March 1, 2024 to storing the content of Microsoft 365 Copilot interactions at rest in Canada.

These protections govern what the provider does with your data, not who receives it or which law the provider answers to.

1. Where the model computes

Storing is not processing. To answer, the model reads the prompt and the attached documents: that is inference. For Microsoft 365 Copilot, Microsoft says so: calls to the model go to the closest data centres in the region, but can go to other regions during high utilization periods, and queries from customers outside the European Union may be processed in the United States, the European Union or elsewhere.

In-country processing has been announced, on a date that has moved: planned for Canada in 2026 in the November 4, 2025 announcement, it was pushed back to 2027 by a note dated April 3, 2026. As of October 29, 2026, the interactions of an organization signed up in Canada are therefore stored there, but may be processed elsewhere. And the announcement covers only the large language models Microsoft hosts in Azure.

2. In Azure, the deployment type decides

If you build your own application on the language models offered in Azure (Microsoft Foundry), you choose a deployment type for each model. Data at rest remains in the designated Azure geography; inference, however, takes place:

• globally, in any Azure region: the type Microsoft recommends starting with, the first to receive new models, at the lowest cost;
• in a data zone, within a zone Microsoft defines (United States, European Union or Asia Pacific), with no Canadian zone;
• regionally, within the chosen Azure geography, with possible movement between its regions for operational purposes.

Canada has two Azure regions: Canada Central, in Toronto, and Canada East, in Quebec City. Regional types arrive last, with no promised date. As of October 29, 2026, regional pay-as-you-go deployments in Canada offer only two text-generation models (2024 and 2025 versions, in Canada East); reserved capacity offers more, in both regions, but no 2026 version. An Azure Policy rule can then block global types.

3. The law that applies to the provider

Here, residency changes nothing. Since March 23, 2018, the US CLOUD Act has made clear that the preservation and disclosure obligations of a provider of electronic communication or remote computing services cover customer data in its possession, custody or control, whether that data is located within or outside the United States (18 U.S.C. § 2713).

The Government of Canada acknowledges this in its white paper on data sovereignty: in the public cloud, its data is entrusted to a third party that may be subject to the laws of a foreign country, even if the data resides in Canada. It names first the US Foreign Intelligence Surveillance Act (FISA), under which an organization subject to US law can be compelled to turn over data under its control, regardless of location and without notifying Canada. Its conclusion: “Data residency does not mitigate against the application of foreign laws.” The Office of the Privacy Commissioner of Canada is just as clear in its 2009 guidelines: no contract can override the laws of a foreign country.

The risk is real, without being massive. In the second half of 2025, Microsoft received 190 law enforcement requests worldwide for enterprise customer accounts, and was compelled to provide information in 94 cases, 45 of them involving content. Among these requests, content related to three non-US enterprise customers, whose data was stored outside the United States, was provided to US law enforcement. And the law prohibits anyone who receives a FISA order from ever disclosing its existence, Microsoft notes.

In December 2025, Microsoft announced a contractual commitment to challenge government demands for Canadian government or commercial customer data “where we have a legal basis for doing so.” Challenging is not refusing.

4. Subprocessors and web search

Your contract is with one provider, but others may process your data. Microsoft publishes the list of its subprocessors, including third-party AI providers, and warns that some AI subprocessors are enabled by default: it is up to you to check their status. A so-called independent AI provider applies its own terms, outside Microsoft’s Data Protection Addendum, if an administrator turns it on.

Web search is another case: the assistant derives a few words from the prompt and sends them to the Bing search service, and for these queries Microsoft acts as a data controller, outside its Data Protection Addendum. Its own example: “We’re considering a possible acquisition of Fabrikam” produces searches on Fabrikam’s strategy and financials. Unless the administrator sets the policy, web search is generally available.

5. Terms that change

Not every model change gets a dedicated announcement, Microsoft writes: targeted notice is planned, in particular, when its contractual or data processing commitments are affected. An assessment carries a date, and has to be redone.

6. What your employees paste

An employee who pastes a client file into the assistant communicates it to the provider, subscription or not, and Law 25 governs that act. Without a subscription, it is shadow AI.

The Government of Canada defines data sovereignty as the right to control access to its digital information, subject only to Canadian laws, and data residency as its physical or geographical location. In between lie two more questions: where processing happens, and who has control.

Sovereignty is all four at once. The contract sometimes settles the first; the second depends on the product and the date; the third is beyond its reach; the fourth is negotiated, or built.

Classify first, then choose. Summarizing published case law or translating an already public protocol can go through a well-configured subscription. An individual’s tax file, a merger in preparation or clinical trial data call for a chosen region with written commitments, or an open model (one whose weights are published) installed on your premises.

Every prompt that contains personal information communicates it to the provider. Quebec’s private-sector privacy act allows this without consent if it is necessary for the mandate entrusted, under a written contract that specifies the protection measures, limits use to the mandate and prohibits keeping the information after the contract ends (s. 18.3).

Before communicating personal information outside Quebec, the business must also conduct a privacy impact assessment (PIA). It takes into account, in particular, the sensitivity of the information, its purposes, the protection measures and the legal framework of the State where it would be communicated (s. 17). Processed in the United States, or stored elsewhere in Canada by a US provider, the information remains exposed to US law: a risk to assess, since the list begins with “in particular.”

The communication may only proceed if the assessment establishes adequate protection, and it must be the subject of a written agreement that takes the assessment into account. The same applies when you entrust someone outside Quebec with collecting, using, communicating or keeping that information on your behalf.

Finally, people must be told, at the time of collection, that their information may be communicated outside Quebec (s. 8). A provider’s standard terms predate your assessment: document the setting or clause that mitigates each risk. The details: Law 25 and AI.

• Where is our data stored at rest, and is that written into the contract?
• Where does the model process it, even under heavy demand, and with what in-country processing commitment?
• Which law are the provider and its parent company subject to, and what does it do with a foreign order?
• Which subprocessors and features (web search, agents, other models) receive our data, and which are on by default?
• How long are the history, files and logs kept, and can we set those periods?
• Is our data used, in any way, to train or improve a model?
• How, and how quickly, will we be notified of a confidentiality incident?
• Can we export our data in a common format, and change model or provider without rebuilding everything?
• Do we have an audit right, or access to recent independent audit reports?
• Who holds the encryption keys, and what remains unencrypted during processing?

1. 1

   Take inventory

   List the assistants in use, with business or personal accounts, and what goes into them.

2. 2

   Classify the data

   Public, internal, confidential, personal information: each category gets its permitted options.

3. 3

   Configure the tool you already pay for

   In Microsoft 365: web search, AI subprocessors, retention. In Azure: an Azure Policy rule against global types, if your data requires it.

4. 4

   Document

   Do the PIA with your person in charge of the protection of personal information: storage location, processing location, the law that applies to the provider, and whether the s. 18.3 exception covers your use. Date it.

5. 5

   Review

   Subscribe to the provider’s notices and subprocessor list; redo the assessment at every change.