📊 Full opportunity report: The Incorrect Assumption Of 'Not American' In AI Standards on ThorstenMeyerAI.com — validation score, market gap, and execution plan.
TL;DR
European perceptions of AI sovereignty have shifted, mistakenly equating ‘not American’ companies with being outside US legal jurisdiction. Canada’s legal protections and international agreements complicate this view. The distinction impacts procurement and regulation strategies.
European policymakers have increasingly relied on the assumption that AI companies not incorporated in the US are outside US legal reach, particularly regarding the CLOUD Act. This assumption influences procurement and sovereignty debates, but it is based on a misunderstanding of legal and jurisdictional realities, especially concerning Canadian companies like Cohere.
It is confirmed that the CLOUD Act applies only to US-incorporated providers and their subsidiaries, meaning a Canadian-incorporated company like Cohere is not directly subject to US data access laws. Canada has not signed a bilateral CLOUD Act agreement with the US, and Canadian courts have explicitly rejected the third-party doctrine, which would allow US authorities to access Canadian data via US standards.
Furthermore, Canada’s foreign intelligence laws and oversight mechanisms are designed to protect Canadians’ data from foreign surveillance, including restrictions on targeting individuals in Canada. Canada’s adequacy decision from the European Commission, granted in 2002 and reaffirmed in 2024, makes data transfers from the EU to Canada legally valid, but only within certain limits and under specific legal frameworks.
However, critics argue that this legal distinction is often misused as a proxy for sovereignty, leading to an oversimplified view that ‘not American’ equals ‘outside US jurisdiction,’ which is not accurate in legal or practical terms.
The wrong test: “not American” is not a sovereignty standard
In one press conference, European sovereignty changed definition — from “incorporated in the EU” to “not incorporated in the US” — and nobody asked whether the second is a test or merely a proxy. It’s a proxy. Proxies fail at the edges. The edges are where procurement lives.
The CLOUD Act genuinely doesn’t reach Canadian incorporation. Canada has no CLOUD Act executive agreement — negotiating since March 2022, nothing finalized. And the Supreme Court of Canada (R. v. Spencer, R. v. Bykovets) explicitly rejected the US third-party doctrine. On several dimensions Canada is more protective than the US. This is not a hit piece.
UKUSA (1946): NSA · GCHQ · CSE · ASD · GCSB. CSE’s oversight is real — ministerial authorization, an independent Intelligence Commissioner (a retired judge) who can block, NSIRA review. Now read the operative restriction:
The protection is national and territorial. Europeans are neither.
Not an accusation — architecture. It’s structurally why Safe Harbor fell: protections protect the home nationals.
Canada has adequacy since 2001/2002 (Decision 2002/2/EC). But its scope is PIPEDA-only — employee data largely excluded; Alberta/BC/Quebec regimes never got adequacy; Quebec’s was withdrawn in 2014.
It was assessed against PIPEDA’s commercial framework — not against Canada’s intelligence laws or Five Eyes participation.
That’s the same hole the CJEU punched through Safe Harbor. In fairness: the Commission did examine public-authority access and found redress “accessible to non-Canadian nationals.” That clause is the best argument Canada has — and NSIRA is largely classified. Unsettled, not resolved.
US courts have been clear for 40 years: Bank of Nova Scotia — American courts enforce subpoenas against entities subject to US jurisdiction even where compliance violates foreign law, and fine for refusal. Jurisdiction attaches to presence and activity, not the incorporation certificate. So corporate pledges to “resist” are sincere and legally insufficient. And Canadian exposure creeps through ordinary commercial expansion:
The Five Eyes question isn’t “is Canada spying for America” — that’s the tabloid version, it’s unsupported, and it’s a distraction. The real question is duller and more damaging: why is Europe using nationality as a substitute for measurement? Because a proxy is cheap and a test is expensive. “Not American” lets you approve the deal, satisfy the minister, and skip the register, the nexus, the redress. It produces a press release. It does not produce protection. Every sovereignty claim here is a jurisdictional bet — that a legal system, an alliance and a political mood hold for the life of your data. The Canadian bet is genuinely better than the American one. It’s still a bet. The only positions that don’t require one are where you hold the weights and can pull the plug. If the answer is “well, they’re not American” — you haven’t been given a standard. You’ve been given a mood.
Implications of Misjudging ‘Nationality’ in AI Legal Jurisdiction
This misconception influences European procurement policies and sovereignty assertions, potentially leading to flawed decisions based on an inaccurate understanding of jurisdictional risks. It risks oversimplifying complex legal realities and could hinder effective regulation and international cooperation in AI development and deployment.
Understanding that Canadian and other non-US companies are not automatically outside US legal reach is crucial for policymakers, companies, and regulators to make informed decisions and avoid strategic errors based on false assumptions about jurisdictional immunity.
Practical AI Governance: Building a Program for Oversight and Strategy
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Legal and Geopolitical Factors Shaping AI Jurisdiction Claims
The legal architecture around US data access laws, particularly the CLOUD Act, applies primarily to US-incorporated entities, not foreign companies with Canadian or European incorporation. Canada’s legal protections, oversight mechanisms, and international agreements, including the EU’s adequacy decision, create a complex landscape that resists simple categorization.
Recent European discussions have conflated ‘not American’ with ‘outside US jurisdiction,’ partly driven by political and sovereignty concerns. However, legal experts and courts, including Canada’s Supreme Court, have established that jurisdiction and legal protections are more nuanced, especially regarding foreign intelligence laws and international data transfer agreements.
This evolving narrative reflects broader geopolitical shifts and the importance of precise legal understanding in AI regulation and procurement.
Legal and Political Uncertainties in Jurisdictional Assumptions
It remains unclear how European policymakers will adjust their understanding of jurisdictional risks in AI procurement and regulation, especially as legal cases and international agreements evolve. The extent to which ‘not American’ will continue to serve as a proxy is uncertain, and ongoing negotiations and legal rulings could reshape the landscape.Future Developments in Jurisdictional Clarity and Policy
European policymakers are likely to refine their understanding of jurisdictional risks, moving away from simplified proxies like ‘not American.’ Legal clarifications, international negotiations, and court rulings in Canada, the US, and Europe will shape future policies. Companies and regulators should monitor developments in US-Canada data-sharing agreements, court decisions on foreign surveillance, and EU policy adjustments.
Key Questions
Does US law automatically apply to Canadian or European AI companies?
No. US laws like the CLOUD Act apply primarily to US-incorporated entities and their subsidiaries. Canadian and European companies are generally outside US jurisdiction unless they have US-based operations or subsidiaries.
Can European companies avoid US jurisdiction by not being American?
Not necessarily. Jurisdiction depends on legal incorporation, operations, and international agreements, not just nationality. Relying solely on ‘not American’ as a proxy is misleading.
How does Canada protect data from US surveillance?
Canada’s legal framework explicitly restricts foreign intelligence agencies from targeting Canadians and includes oversight mechanisms. Its EU adequacy decision also limits data transfer scope.
Why do European policymakers believe ‘not American’ is sufficient for sovereignty?
They often see jurisdictional sovereignty as tied to legal nationality, but this oversimplifies complex legal realities and international data-sharing frameworks.
What should companies consider when evaluating jurisdictional risks?
They should analyze legal incorporation, international agreements, oversight mechanisms, and court rulings—beyond just the company’s nationality.
Source: ThorstenMeyerAI.com
