In May 2026, Canada's Minister of Artificial Intelligence and Digital Innovation, Evan Solomon, told a reporter that only four countries in the world have a foundation model: the United States, China, France with Mistral, and Canada with Cohere. It is worth pausing on this, because it is the kind of statement a government makes when it wants a domestic company to stand in for something larger; perhaps a nation's technological independence. Ottawa signed a memorandum of understanding with Cohere, committed up to $240 million toward a data centre in Cambridge, Ontario, and in June 2026 Prime Minister Mark Carney launched a national strategy built on a $2 billion federal package and a promise to keep Canadian data, compute, and internet traffic inside Canadian borders.

Looking closer at the Cambridge facility, the claim gets more complicated. The data centre is being built and operated by CoreWeave, an American cloud company. Cohere itself was valued near $20 billion largely off of a merger with a German AI firm, Aleph Alpha, and its own government MOU explicitly describes it as a strategically important LLM provider, not a fully domestic supply chain. Given this, it is fair to ask how much Canadian ownership across the stack is actually required, achievable, or desirable, given that the compute underneath still runs through an American vendor. A sovereign model that operates on rented and foreign-operated servers leads to the question: Which layer of the AI stack does a country actually need to own to call itself sovereign, and which layers can it rent without giving up something it cannot get back.

The UK took a different route by giving investment packages, including a £1.1 billion AI Hardware Plan announced on June 8, 2026 at London Tech Week, and AI Growth Zones designed to attract global AI firms to build in Britain. Industry voices argued that compute and frontier models, which are the most important layers in AI, are almost entirely outside UK control, since the chips are dominated by global supply chains centred on Nvidia and the most advanced models are built by American and Chinese labs regardless of where the servers physically sit. Hence, as Jim Killock, executive director of the Open Rights Group, noted: "AI adoption does not mean AI independence."

The stack framing that dominates most sovereignty writing, who owns the chips, who owns the model weights, who owns the data centre, misses where dependency usually forms not in who owns the chips, who owns the model weights, who owns the data centre, but once a government or a company feeds its data into a platform, such as Palantir's Foundry, that data gets restructured into a proprietary internal shape. If government data is treated in a proprietary format, the files may not be readily usable by any comparable system, even if exports in formats like CSV or JSON are technically possible. This lock-in tied the government to the vendor for longer than they may have initially signed the contract for. For example, in the UK, a parliamentary-adjacent review of Palantir's NHS and defence contracts flagged vendor lock-in and market control as a standing risk, warning that dependence on a single proprietary system makes switching suppliers prohibitively difficult. Reports pointed to Switzerland's decision to cancel its own Palantir contract as the closest thing to a warning label the industry has produced. The same worry has surfaced inside the US government too, where a former Treasury official described the IRS's reliance on a single company (in this case Palantir as well) for core functions as risky because the vendor becomes indispensable, at which point it can set terms which the client must abide by.

A list of some companies and how they may lock a government in:

This is why sovereignty cannot be reduced to a question about frontier AI labs. Companies such as AWS, IBM, or Palantir are not frontier AI labs. The dependency that matters most is which company controls the format your data lives in once it is inside their system. A government can diversify its model vendor, run Cohere one year and Mistral the next, but still be locked into a single infrastructure or data platform vendor that sit underneath both, hence diversification has to happen at every layer a client depends on.

An individual can go through the same audit a country goes through and look through which services hold your data, on what terms, and what happens if you leave. I ran this audit on my own accounts as a small-scale test of these same questions that the UK, Canada, and other countries are grappling with.

The audit worked the same way at home as it may work at the policy level. For each service, I looked at what company held my data, whether that data was used to train the company's AI, whether the company could read it, and whether I could own the space it sat in, or at least keep it in an open format instead of a proprietary one. None of these switches removed dependency. What changed is which kind of dependency I have. I moved my data from companies that can read, sell, or train on it, to ones that structurally cannot, and I moved it out of closed, proprietary formats that only one company's software can open, into formats any software can read.

Storage: My data was scattered across several Google accounts, OneDrive, Dropbox, USB drives, and old CD discs, each with its own terms and its own retention risk. I bought a Synology NAS and moved everything onto it. The files sit in standard formats on drives I hold, so if Synology disappeared tomorrow my data is still readable, and no company can train on it, sell it, or lock me out over a terms of service violation. Setup took me a weekend, cost around 1,000 CAD, and the hardware should run seven to ten years. I have two drives that mirror each other, so a single drive failure should not cost me the data. For remote access, I use Tailscale, which creates a direct connection between my devices and the NAS rather than routing my files through a third party's cloud servers to reach them.

Email: I moved from Gmail and Outlook to Tuta, which encrypts the message body and subject line by default on my end. Google could read my inbox to train models or serve ads, and Tuta structurally cannot, since the encryption means Tuta cannot read the contents either.

Two-factor Authentication: I moved from Google and Microsoft Authenticator to Aegis, which is free, open source, and stores codes locally rather than syncing them through a company account. The dependency here is on a piece of software rather than a company, so if the developers walked away, the code is public and the community can keep maintaining it.

Password Manager: I moved from LastPass, which suffered a major data breach in 2022, to Bitwarden, which is also open source. I can self-host it if I want to remove the server dependency entirely, an option LastPass never gave me.

Documents: I moved from Microsoft Office and Google Docs to LibreOffice, which is also open source and free. It doesn't feed documents into anyone's model training. It's less polished than Microsoft's suite, but capable enough for most of what I actually do.