The European Union and Canada concluded negotiations on 30 October in Montreal on a digital trade agreement that facilitates data transfers and business across the Atlantic, but does not determine who will obtain sensitive government contracts, for which both sides are developing similar benchmarks.
The proposal for new European rules for the most sensitive public sector services examines who controls the company, while the Canadian federal government gives priority to Canadian-owned and controlled providers in the procurement of sovereign cloud services.
A European company bidding to provide cloud services for the Canadian government does not enjoy the advantages granted to Canadian companies.
Under the proposed European rules, a Canadian company cannot apply for the most sensitive government contracts in the EU until the European Commission determines that Canada meets European requirements for such work.
Canadian Prime Minister Mark Carney, European Council President António Costa and European Commission President Ursula von der Leyen presented the Alliance for the Future in Montreal, setting out more than twenty measures ranging from critical minerals to defence.
The extent of Canada’s exposure to pressure from Washington was demonstrated in June 2025, when Ottawa introduced a tax on the income of large technology companies, mostly American. As a result of that tax, Trump ended trade negotiations, and the Canadian government withdrew it on 29 June, the day before the first collection.
Canada now wants to export more to Europe and import more from it in order to become less dependent on the US. In that relationship, however, it maintains the Buy Canadian policy, which gives Canadian companies an advantage in government procurement, and the European Union opposes this.
The cloud market in the EU and Canada is still dominated by Amazon, Microsoft and Google
Trade in services delivered over the internet, from software to financial and business services, amounted to €19.8 billion between the EU and Canada in 2025, of which €11.2 billion were European exports and €8.6 billion imports from Canada.
The agreement should remove unjustified restrictions on data transfers between the two parties and facilitate the electronic conclusion of contracts, along with the signing and issuing of invoices, while preserving privacy protection.
Exporters’ software and data most often run in the cloud – that is, on computers that companies rent over the internet – and the agreement does not specify from which supplier this capacity will be leased.
According to research by Synergy Research Group, published in July 2025, between 2017 and 2024 European cloud service providers more than tripled their revenues in the domestic market, but the market itself grew sixfold over the same period, reaching €61 billion.
European and Canadian server rental companies would benefit most from large government contracts
Their share fell from 29 to approximately 15 per cent, where it has remained since 2022, while Amazon, Microsoft and Google together hold about 70 per cent of the European market.
In Canada, the share of American companies is even higher. Amazon, Microsoft and Google accounted for 85 per cent of Canada’s online server and data-space rental market in June 2026, according to estimates by the Canadian Anti-Monopoly Project, an organisation that advocates stronger competition.
When a European or Canadian software company sells more software, it has to lease more capacity of this kind, and most of that money goes to those three companies.
European and Canadian server rental companies would benefit most from large government contracts. However, the EU and Canada are still drafting the rules governing eligibility for those contracts.
A Canadian address does not replace owner verification
The US CLOUD Act requires affected service providers, through due process, to preserve or provide US authorities with data under their control, even when it is stored outside the US. Moving a server to Canada or Europe does not, in itself, release a US company from that obligation.
The Canadian government has established a CAD300 million fund to help smaller companies pay for computer leases to develop artificial intelligence.
If a company leases capacity from a Canadian provider, the fund covers up to two-thirds of its costs; if it leases from a foreign provider, it covers up to half. From 1 April 2027, the fund will support only leases from Canadian providers.
The fund defines a Canadian provider as any company registered in Canada whose servers and data are located in Canada, regardless of ownership. Under these rules, the Canadian subsidiary of the French company OVHcloud would be a Canadian provider, as would the Canadian subsidiaries of Amazon and Microsoft.
Canada sets stricter requirements for its government data. The federal agency that manages the government's computer systems has announced a tender for government data storage in which companies owned and controlled by Canadians are favoured.
The state stores its most sensitive data in its own data centres. Amazon’s Canadian subsidiary qualifies as Canadian for the small business fund, but does not enjoy the advantage that Canadian-owned companies receive when bidding to store government data.
Under the European proposal, a company is controlled by the person who actually makes its business decisions, even when that person does so through other companies they own
On 3 June, the European Commission proposed the Cloud and AI Development Act (CADA), which introduces four levels of requirements for public sector services, depending on the sensitivity of the work.
At the third level, the provider and its key subcontractors must, in principle, not be controlled by a state or company outside the EU, must have an enterprise, infrastructure and staff in the Union, and the employees who provide the service must be EU citizens.
An exception to the control rules is possible for providers from countries expressly recognised by the Commission, subject to additional guarantees, while no such exception applies at the fourth and strictest level.
Under the European proposal, a company is controlled by the person who actually makes its business decisions, even when that person does so through other companies they own.
Amazon’s Canadian arm would be treated in Europe as a US-controlled company, even though the Canadian fund recognises it as Canadian.
For a sensitive government contract in the EU, it would be crucial whether the foreign owner or its government could access the data, shut down the service, or restrict its operation.
European conditions for Canada collide with the Buy Canadian policy
For Canadian companies to bid for such contracts in the EU, the European Commission would, under Article 18 of the CADA proposal, have to determine that Canada meets two conditions.
The first is that European server rental companies can operate freely in Canada and participate in Canadian government tenders.
The second is that the Canadian government cannot order a company to shut down or degrade services for European customers, or impose sanctions that EU regulations do not permit.
Since 2001, Canada has held a European certification confirming that it protects personal data effectively, but that certification is not sufficient for these businesses.
If Canada ceases to meet the requirements, the Commission could suspend or revoke its decision.
European companies can participate in tenders covered by CETA, the trade agreement between the EU and Canada, but they start from a weaker position
At the summit in Montreal, the EU highlighted Canada’s Buy Canadian policy as a contentious issue. From 15 June 2026, it applies to government procurement in strategic areas worth at least five million Canadian dollars.
When bids are compared, the price offered by a Canadian company is treated as ten per cent lower, and bidders receive extra points if the work is carried out in Canada using Canadian workers and materials. European companies can participate in tenders covered by CETA, the trade agreement between the EU and Canada, but they start from a weaker position.
CADA has not yet been adopted. If Canada asks for its companies to gain access to sensitive government contracts in the EU, Brussels is likely, in return, to ask Ottawa to reduce the advantages for domestic companies, both in Buy Canadian tenders and in the government data storage tender.
For the Carney government, that would mean abandoning some of the measures it intends to use to strengthen Canadian industry and protect its data.
Who counts as a domestic provider depends on the type of business
In 2012, France’s OVHcloud opened a data centre in Beauharnois, in a former aluminium smelter near Montreal. In March 2025, it stated that it had 90,000 servers and 250 employees in Canada and that, in addition to data storage, it manufactures servers and provides customer support there.
Such a presence can also secure a European company domestic treatment in Canadian procurement, because Canadian supplier status requires permanent business and tax registration in Canada, with no conditions regarding the owner’s nationality.
The dispute over the Buy Canadian policy mainly concerns European companies that offer services from the EU without their own operations in Canada
The dispute over the Buy Canadian policy mainly concerns European companies that offer services from the EU without their own operations in Canada, whereas in the procurement of the federal government’s sovereign cloud, which gives priority to Canadian ownership and control, even the Canadian branch of OVHcloud would not have the same standing as domestic companies.
In April, the Commission selected four bidders to provide servers and data storage to European institutions in a deal worth up to €180 million over six years. One of the selected bidders is a consortium that includes OVHcloud.
The Commission evaluated the bids using its own scale, which measures how well the service is protected from influences outside the EU. This scale differs from the levels set out in the CADA proposal.
Three bids received the second-highest rating: the Luxembourg Post Telecom consortium with OVHcloud and Clever Cloud, Germany’s STACKIT, and France’s Scaleway. The fourth bid, from Belgium’s Proximus group, received the lowest score accepted by the Commission.
This consortium uses Google Cloud technology, managed by S3NS, a joint venture between Google and France’s Thales. The Commission also accepted this solution, in which a European company manages American technology, but considered it less independent than the other bids.
A deal on government affairs will lag behind a trade deal
The digital agreement still needs to be legally verified, translated into EU languages and formally adopted. The Commission refers only to the decisions of the EU Council and the European Parliament, not national parliaments.
This means the agreement could enter into force more quickly than CETA, which nine EU member states have still not ratified after nine years of provisional application.
In 2027, data trade between the EU and Canada is likely to be facilitated before the two sides open sensitive government contracts to each other
In 2027, data trade between the EU and Canada is likely to be facilitated before the two sides open sensitive government contracts to each other.
Even if the Commission finds that Canada meets European requirements, only Canadian-owned companies will benefit, and these are few in a market dominated by American companies.
Whether the EU–Canada digital alliance amounts to more than a trade agreement will be revealed by the first major government tenders, when it will become clear whether companies from partner countries can compete for them on the same terms as domestic companies.
