Where does your business's AI run, who can access the information it uses, and how easily could the organisation change providers? Those questions are becoming part of technology strategy alongside capability, convenience and price.
Canada's 2026 national artificial intelligence strategy, AI for All, places sovereign foundations in compute, data, talent and infrastructure among its priorities. It describes a build-partner-buy approach: developing key domestic capabilities while also working with trusted partners and using existing market solutions where appropriate. Source: Canada's National Artificial Intelligence Strategy, AI for All.
For a business, CREDIUM's interpretation is that AI sourcing should include a practical discussion of control and dependency. A national strategy provides context; it does not by itself establish a universal hosting requirement for every private company.
Distinguish location from control
Data residency describes where information is stored or processed. Operational control concerns who administers the environment, grants access, changes settings and responds to incidents. Portability concerns what the business can retrieve and move if its requirements change.
These questions overlap, but a single hosting-location statement cannot answer all of them. A vendor assessment should identify the services involved and the evidence supporting each answer. The purpose is to understand the actual arrangement rather than rely on a broad sovereignty label.
A small company does not need to own a data centre to make a considered sourcing decision. It does need a clear view of the information it is putting into a service and the dependencies it is accepting.
Begin with a map of the business information
List the information used in the proposed workflow: public research, internal operating documents, commercial records or client-provided material. Identify who owns each category and whether the business has already made commitments about how it will be handled.
Then map where that information travels. A document may pass through an application, a model service, a logging system and a backup process. Ask which services are involved in the proposed configuration, rather than assuming the visible interface represents the complete arrangement.
The detail should be proportional to the decision. A public-information research pilot and a workflow involving sensitive client records require different levels of scrutiny and different participants in the approval process.
Five questions to bring into vendor discussions
- Where does processing occur? Ask about storage, inference, backups and support access in the specific service configuration under consideration.
- Who can access the information? Identify administrative roles, relevant service providers and the controls available to the customer.
- How may submitted content be used? Obtain clear answers on retention, deletion and any use for model improvement or training.
- What can change during the relationship? Understand how the organisation learns about material changes to models, services, processing arrangements and commercial terms.
- What is the exit path? Ask which records, configurations and outputs can be exported, in which formats and with what operational effort.
Use the responses to compare the proposed arrangement with the business's actual needs. Where a question depends on contractual interpretation, security architecture or a particular regulatory obligation, involve the responsible specialist before committing.
An illustrative comparison: two AI workflows
Imagine a fictional consulting team considering two uses. The first summarises public economic announcements for an internal briefing. The second searches a collection of confidential client documents to prepare engagement notes.
The first can begin with a tightly defined public source set and a review process. The second requires a more detailed decision about permissions, retention, access separation and the commitments made to the client. The same product might be suitable for one configuration and unsuitable for another.
This example illustrates why sourcing decisions should be made at the workflow level. It is not a claim about the compliance or security of any vendor, and it is not a reported CREDIUM engagement.
Test the ability to change course
An exit plan becomes more credible when the organisation tests a small export and confirms that another person can understand and use the result. Record the configuration decisions needed to reproduce the workflow. Identify any critical information that exists only inside the service.
Also ask what happens if access is interrupted. The answer may be a manual fallback, an alternative approved process or a temporary reduction in service. Making that decision early can prevent a useful pilot from becoming an undocumented operational dependency.
Connect sourcing to the broader strategy
A good AI sourcing decision balances the value of the workflow, the information involved, the organisation's control requirements and its ability to adapt. The national sovereignty discussion makes these questions timely, while the business case determines their practical weight.
Connect the decision to the organisation's digital strategy. If the selected tool can take actions across systems, also establish an AI agent governance framework. Control becomes meaningful when it is visible in everyday operating choices.