CLOUD Act: why a server in Montreal is not always sovereign

In March 2018 the US Congress passed the Clarifying Lawful Overseas Use of Data Act, better known as the CLOUD Act. The text settles a question American courts had been wrestling with for years: can a US authority require a service provider to hand over data stored abroad? The legislature’s answer is unambiguous. A provider subject to United States jurisdiction must hand over the data in its possession, custody or control, wherever it physically sits.

In practice, an order aimed at a company headquartered in Seattle or Redmond also covers the servers that company runs in Montreal, Toronto or Frankfurt. The provider can challenge the order in certain cases of conflict with a foreign law, but the principle stands: what counts is the owner’s jurisdiction, not the server’s location.

The CLOUD Act also provides for bilateral agreements governing reciprocal access to data between states. The United States has concluded such agreements with the United Kingdom and Australia. As of this writing, there is no such agreement with Canada.

Take an SME in Granby that migrates its quotes, its pricing and its client data to the “Montreal region” of a large American cloud provider. Technically, everything is beyond reproach: the data sits in data centres located in Quebec, encrypted and replicated across several sites. Legally, it remains in the hands of a company incorporated under American law, and therefore exposed to the CLOUD Act.

That is the whole distinction between data residency and data sovereignty. Residency answers the question “where are the servers?” Sovereignty answers a more demanding one: “what law applies to whoever controls them?” The Canadian regions of AWS, Azure and Google Cloud offer the first, not the second.

Does that mean these services are off limits? No. For plenty of low-sensitivity uses they remain a reasonable and documentable choice. But for sensitive personal information, industrial secrets or files covered by professional secrecy, the word “sovereign” in a sales deck deserves to be held up against the provider’s ownership structure.

Law 25 (CQLR c. P-39.1) governs the disclosure of personal information outside Quebec. Before such a disclosure, section 17 requires an assessment that considers, among other things, the legal regime applicable in the destination state. The disclosure can only take place if the assessment shows the information would receive adequate protection, and it must be the subject of a written agreement.

And what if the data stays physically in Quebec but with an American-owned provider? The prudent reading is to treat CLOUD Act exposure as a risk to document: in the privacy impact assessment that section 3.3 requires before any project involving a system that processes personal information, then in the processor contract under section 18.3, which has to cover data residency and incident notification timelines. Ignoring that exposure means building a compliance record that would not survive serious scrutiny.

This is no longer theoretical. The Commission d’accès à l’information can impose administrative monetary penalties directly, reaching $10M or 2% of worldwide revenue, and the penal track, before the courts, runs up to $25M or 4%. The CAI’s first penalties were made public in 2026. Our Law 25 compliance guide sets out all the obligations.

For a law firm, a notary’s office, an accounting practice or a clinic, three legal layers stack up. First professional secrecy, protected by codes of ethics: entrusting client files to a third party remains a governed disclosure, and the professional stays responsible for it. Then Law 25 and its section 17. Finally the CLOUD Act, which can compel an American provider to disclose a file, US law even allowing, in certain cases, an order that forbids telling the client.

Lawyers are among the professionals most exposed when it comes to protecting information. A lawyer who pours their files into an AI tool hosted with an American-owned provider should be able to answer a very simple question from their client: who, in the last resort, can be compelled to hand this file over?

The answer runs through the architecture, but also through how internal use is governed. An AI acceptable use policy that forbids putting personal information or client files into unapproved public tools is now the norm in regulated professions.

Not all hosting is equal. Here is the hierarchy we use at Cogio to assess an AI infrastructure, from most sovereign to least.

In the field, the hosting question gets settled at the same time as the AI architecture. We distinguish four, each with its level of sovereignty and its order of cost.

Let us be straight, because that is how we work: for some very fine reasoning, such as complex legal analysis or sharp synthesis across dozens of documents, frontier models keep an edge over the best 70-billion-parameter open models. Claiming otherwise would be selling you a disappointment.

That is exactly the dilemma the hybrid architecture resolves. Confidential documents, personal information and trade secrets never leave the local infrastructure, where an open model handles the large majority of queries. For questions that demand cutting-edge reasoning, a sensitivity router redacts and anonymizes the query before sending it to the external API, under a contract guaranteeing zero retention, no training on your data and a documented jurisdiction.

Properly partitioned, this approach combines the confidentiality of local processing for what has to stay with you and the power of frontier models for what can leave once anonymized.

Three questions are enough to place your organization. Where does your data physically sit, and the data your AI tools process? Who is the ultimate owner of each provider, and what law do they answer to? Do those answers appear in your register and in the assessments Law 25 requires?

If even one answer is missing, the next exercise is an inventory: the list of your tools, each provider’s jurisdiction, the sensitivity of the data involved. That is the starting point of our approach, which always begins with an audit before recommending any architecture at all.

And if you practise a regulated profession, do that inventory this week rather than this quarter: professional secrecy cannot be repaired after the fact. To talk it through with us, write to us.