By George Irish
Two decades ago, I heard this statement many times. Canadian charities were setting up their first web donation forms and fundraisers faced a new question: How could they embrace new online fundraising tools while still maintaining control over sensitive donor information? Worries about cross-border data flows were real — and for good reason.
Today, we face a similar issue with artificial intelligence (AI). AI can improve how fundraisers identify prospects, personalize appeals, and predict giving patterns. But it brings back the question of data sovereignty with renewed urgency. Where does donor data go when it’s processed by AI systems? Who controls it? Whose laws apply?
For Canadian charities, these aren’t just abstract worries. Donor data is both a sacred trust and a key asset. It holds personal, financial, and behavioural information that needs careful stewardship.
When donor data crosses borders, it falls under different legal systems with varying privacy protections. This is especially concerning today with cross-border tariff threats and political turmoil in the United States.
The promise of AI in fundraising
For fundraisers, AI offers the chance to do more with less. In a sector always short on resources, AI can help identify, engage, and retain donors more effectively and boost fundraising income.
AI excels at uncovering patterns in donor behaviour. It can analyze thousands of data points to predict which prospects are most likely to give, what amounts they might give, and what messaging will resonate most strongly. Some Canadian charities already use AI tools for donor analytics and report significant improvements in fundraising results.
AI’s ability to deliver powerful data insights makes charitable donor data more valuable than ever. For Canadian charities, it also highlights important data sovereignty concerns.
Data sovereignty and cross-border challenges
Data sovereignty means more than, “Is my data stored in Canada?” It looks at the entire data lifecycle, from collection and processing to storage and deletion. Online data often travels through international networks — even when sending an email from Calgary to Vancouver — and may be crossing borders without your knowledge.
True data sovereignty means ensuring that data stays entirely within Canadian borders and follows Canadian privacy laws. Personal Information Protection and Electronic Documents Act (PIPEDA) and provincial legislation like Quebec’s Law 25 set out regulations for data handling, with stricter rules for public sector and sensitive personal information.
Popular US-based and owned AI chat services like ChatGPT and Claude, answer user questions by processing the data on their own servers — mostly located outside Canada. This cross-border flow exposes user data to different legal systems and brings possible risks.
For example, U.S. laws like the CLOUD Act allow American authorities to request data from U.S. companies, even if that data is stored in other countries. This could apply to companies operating AI services, although the Act mainly targets communication and cloud storage providers.
What’s at risk for charities?
Today’s AI data sovereignty concerns mirror those faced by Canadian charities when online donation platforms first appeared, but with heightened stakes. Fundraisers face a new challenge to understand where sensitive donor data travels when processed by AI systems and understanding which laws apply at each step, but the legal landscape extends beyond data storage and handling.
Charities must also consider how AI systems use live data to update their models, and whether they were developed with data that respects privacy and copyright laws — an important area not fully covered by current regulations.
The reputational risk can’t be overstated. Donors entrust charities with personal and financial information based on relationships of trust. When data crosses borders without proper safeguards or disclosure, that trust is compromised. In a sector where reputation is currency, breaches can seriously harm donor relationships and fundraising results.
The good news is that the situation is improving. New options are emerging to help Canadian charities maintain data sovereignty while still benefiting from AI’s capabilities.
Canadian-developed AI solutions preserving sovereignty
AI data sovereignty has gained significant attention from the Canadian government in recent years. Recognizing both the strategic importance of AI development and the need to maintain control over Canadian data, federal authorities have launched ambitious initiatives to develop truly sovereign AI infrastructure. The $2-billion Canadian Sovereign AI Compute Strategy directly addresses infrastructure gaps that have led organizations to rely on foreign AI-processing capabilities.
For charities navigating these waters today, the picture is unclear. While various AI providers claim support for data residency or compliance, none currently offer comprehensive solutions that address all aspects of true data sovereignty — from ownership and control to processing location and regulatory alignment. Organizations need to carefully evaluate claims and understand the limitations of existing offerings.
Among the emerging Canadian options, Cohere stands at the front with its Sovereign AI Infrastructure Initiative. Backed by a $240 million federal partnership, Cohere is developing Canada’s first dedicated AI data centre scheduled for completion in 2025.
This project will feature:
- AI data processors hosted exclusively in Canadian facilities,
- End-to-end data processing within national borders, and
- Zero-data transborder routing enforced at the network level.
These are all critical components for keeping sensitive data entirely within Canada.
Other Canadian data service providers, such as Cloud Metric, Typica.ai, and LXT offer tailored AI solutions that address aspects of the sovereignty challenge, such as PIPEDA-compliant data processing, secure Canada-located data centres, or AI models trained using privacy-compliant data sets. These are promising alternatives to US-based services, but come with concerns around capability, cost, and implementation requirements.
For a user-friendly, sovereignty-aligned AI assistant you can start using today, Cohere offers Coral (https://coral.cohere.com/) — a conversational AI chatbot comparable to ChatGPT and Claude. The Coral platform uses Cohere’s Command R+ AI model and supports multiple interfaces, including both chat and API access, making it accessible for organizations of all sizes.
It is important to note that despite Cohere’s Canadian roots and commitment to sovereign infrastructure, until a truly sovereign AI infrastructure is developed for Canada, there’s no guaranteed protection against cross-border data flows.
The path forward
The landscape of AI sovereignty in Canada is changing rapidly. With the Canadian Sovereign AI Compute Strategy addressing critical infrastructure gaps, charities can expect more robust Canadian AI options in the coming years. In the next few years (2025-2027) we will likely see new commercial AI services that fully comply with Canada’s data sovereignty requirements, backed by government-supported infrastructure and clear guidelines for what constitutes genuine compliance.
For charitable organizations preparing for this future, a few practical steps can align innovation with data sovereignty:
- First, conduct an audit of current and planned AI implementations, with special attention to where donor data travels throughout the workflow. Many organizations discover sovereignty gaps they didn’t know existed.
- Second, examine Canadian alternatives like Cohere that offer both immediate functionality and roadmaps aligned with emerging sovereignty infrastructure. The ability to test these tools through free tiers provides low-risk entry points.
- Third, develop your own data governance rules that specifically address AI processing, and clarify what donor information can be shared with which systems under what circumstances.
- Finally, engage your donors transparently about AI usage, explaining both the benefits and the safeguards implemented to protect their information.
Building a sovereign AI future together
Twenty years ago, Canadian charities faced a data sovereignty challenge with the appearance of US-based online donation platforms. Our charitable sector responded by collaborating to support donation-processing alternatives that respected Canadian data sovereignty, sharing knowledge and best practices that benefited the entire community.
Today’s AI revolution calls for a similar collective action to foster Canadian AI tools that honour data sovereignty while delivering powerful new capabilities. The lesson remains the same: innovation and data protection don’t need to be opposing forces.
Charitable AI service providers should recognize that data sovereignty isn’t just a compliance checkbox, but a fundamental part of responsible stewardship in the AI age. As tools like Cohere’s Canadian-developed systems mature, charities will have improved opportunities to advance their missions through AI while keeping donor data where it belongs — under Canadian control, protected by Canadian values, and governed by Canadian law.
George Irish is a veteran of strategy, coaching and consulting for AI-powered charity fundraising. He works with Amnesty International Canada and Greenpeace among other organizations. He writes this column exclusively for each issue of Foundation Magazine.
Related Posts
