Given concerns about what the U.S. envisioned for “digital trade alignment,” consider the possibility that the package required Canada to keep its cloud market open to U.S. companies, gave them equivalent access to government procurement, and restricted the implementation of a “Buy Canadian” approach to sovereign cloud. The U.S. would also set the standard for Canadian privacy law, Canadian law enforcement and security agencies would not wield powers over cloud providers that conflict with U.S. rules on government access to data, and the U.S. could suspend or revoke the deal if it concluded that Canada no longer met its standards. In return, the deal would allow Canadian companies to compete for sensitive U.S. government cloud contracts on the condition that the data centres, the data and the staff were U.S. based, staff were U.S. citizens, and the Canadian government was restricted from accessing the data in the U.S.

This one-sided deal would undoubtedly cause considerable concern, but as the title of this post gives away, this isn’t a U.S. deal. Rather, it is what Canada would be signing up for with Europe, with the conditions pulled from the EU’s proposed Cloud and AI Development Act (CADA). A leaked draft of a joint statement being prepared for this month’s Canada-EU summit in Montreal indicates the two sides plan to “align emerging AI and digital regulatory frameworks through associated country status for Canada” under the Act. Last month, I argued that the pivot to Europe would substitute one pressure point on digital policy for another, and this suggests that is how it may play out.

CADA, which the European Commission proposed in June as the foundation of its Tech Sovereignty Package, establishes four assurance levels for cloud services. Public bodies whose work touches public order in critical sectors such as energy, health and transport, or in national security, defence, justice or law enforcement, would be limited to services recognized at levels two to four. Level three, which the proposal says should be able to host EU classified information, is off-limits to providers under the control of a third country. Article 18 features a key exception, allowing the Commission to designate “associated third countries” whose providers may be audited at that level. To qualify, a third country must:

• hold a privacy adequacy decision from the EU
• have no measures that enable it to control a provider in a manner that conflicts with European limits on foreign government access to data
• have no measures mandating that providers degrade service or enforce sanctions that are not legitimate under European law
• place no impediments on the supply of advanced technologies
• maintain an open market for EU cloud services
• grant EU providers equivalent access to public procurement

The Computer & Communications Industry Association has argued that no major technology-producing country meets that standard, and the criteria are widely viewed as excluding U.S. services.

The benefit for Canadian companies is more limited than the summit language suggests. First, the associated country mechanism only applies to cloud providers and does not address AI regulation. Second, Canadian-controlled providers could already qualify at the first two levels by establishing themselves in Europe. Article 18 removes only one level-three requirement: the bar on third-country control. The rest stay in place. These conditions, found in an annex to the proposal, require that the provider and its subcontractors be established in the EU with their infrastructure, staff and customer data located there, that the staff be EU citizens, that technical support be performed in the EU by EU residents, and that the data not leave the EU or be used to train AI systems operated by third-country entities. On top of that, the provider must also demonstrate that it has measures in place to prevent access to customer data by the third country, which in this case means the Canadian government. The opportunity is therefore limited to Canadian-owned operations in Europe, with no new benefits for Canadian data centres or Canadian-based staff.

CADA is still a proposal that must work its way through the European Parliament and the Council of the EU, designation would require a European Commission decision reviewed by a committee of member states, and the Commission is required to repeal, amend or suspend the designation if a country no longer meets the criteria. Canada has held an adequacy finding since 2001, but the review would start with privacy, since the adequacy condition means the EU would assess whether Bill C-36, the privacy reform bill, meets its standards.

Lawful access further complicates the review. Bill C-22 would give Canadian authorities new powers to compel electronic service providers to build and maintain surveillance capabilities, which has sparked opposition from U.S. lawmakers and businesses. In fact, Canada has asserted the kind of extraterritorial reach the proposal identifies as a risk, as last year the RCMP obtained a court order requiring OVHcloud, a French provider, to disclose data based on its presence in Canada. And “Buy Canadian” policies for cloud services, which the U.S. flagged as a trade barrier earlier this year, would be subject to the procurement condition, which requires equivalent access for EU providers.

Some European conditions align with policies Canada should adopt, such as stronger privacy enforcement and limits on government access to data. But digital sovereignty is fundamentally about choice, including the ability to ensure that Canadian law governs the services Canadians use. Associated status would swap U.S. demands for European ones and leave Canada in much the same place, with its digital policy choices subject to someone else’s approval.