On a podcast where I was a guest, the interviewer asked me a question. A client tells you: I’m ready to work with you, but I don’t want you to use AI. What do you say?
I answered with a question. Do you not want AI at all, or do you not want your work going to American or Chinese companies? Those are two different things.
Often, people don’t know there are several ways to use AI without sharing their data. What holds them back is mostly that data sharing and cybersecurity, then cost [1]. Those are real concerns, and they can be addressed without giving up on AI.
Three reasons businesses say no to AI, according to Statistics Canada
It’s probably worth clarifying why someone says no to AI: it changes everything. This spring, between April 1 and May 6, Statistics Canada surveyed businesses about AI [1]. Three results stand out:
- 40% said AI isn’t relevant to their business.
- 13.4% cited cybersecurity or privacy concerns. It’s the top barrier, and it climbs with size: 22.3% among businesses with 20 to 99 employees, 30% among those with 100 or more.
- 10.6% cited cost, which came second.
So a “no” to AI can mean “I don’t see the point,” “not my data elsewhere,” or “it’s too expensive.” Three kinds of no, three different conversations: the first is about needs, the second about what happens to the data, the third about what it costs.
When the “no” means “not my data elsewhere,” it can be sorted out, and I see two ways to do it.
The first way: sovereign AI, under your control
The first: keep full control of your data and use AI anyway. That’s what’s called sovereign AI. It costs more, but it’s private and very well protected. The AI can run on your own servers, or on ring-fenced online servers, and control stays entirely with you.
For example, an open model can be installed on a server rented in Canada, from OVHcloud, which has GPU servers in Beauharnois, Quebec [3]. These models lag a little behind the most powerful ones, by about six months, from what I see. But they keep improving and are becoming more and more accessible: Mistral, a French company, launched its biggest model, Large 4, on October 6, and promises to publish the weights, meaning the model itself, before the end of the month [2].
The second way: codes instead of names
The second: de-identify before sending. You replace the names with codes, keep the lookup table in-house, and send the rest to one of the big models. When the answer comes back, you put the names back in.
In Quebec, this is called de-identification, not anonymization: whoever keeps the table can re-identify people, so Quebec’s Law 25 still applies [4]. It calls for reasonable precautions: check with your legal counsel, depending on your data.
Is it the right path for everyone? No, and maybe not for the military. It depends on how sensitive the data is, and on the context.
An in-house AI is a bit like a group of employees
Without AI, your data still goes through people: programmers, the people you hire or do business with. An AI installed on your own server becomes a bit like a group of employees you share information with.
That said, if a client wants no AI at all, I tell them they won’t get the economies of scale, or the speed, of a team that uses it well.
“Our data can’t leave”: a limit worth checking
Defence spending is picking up again in Canada, and I think it will last for years. And here in the Outaouais, we’re right next to Ottawa and Ontario, where most of the people in that sector are.
A friend works at a firm that had a defence contract. I showed him how I work. He said: “You need to talk to my guys. But we’re looking for an AI model, and our data can’t leave.” He was thinking of the big online models, the only ones he knew. He didn’t know you could install one in-house. I’m sure he’s figured it out since we talked.
We want to jump to the solution fast, with what we’ve heard and what we feel. I look at the needs first. Then the limits. And I ask myself whether they’re real.
The takeaway
Before you write “no AI” into a contract, or sign one that says it, ask yourself three questions:
- What do I actually need?
- What’s stopping me?
- Is this limit real, or just something I’ve heard?
An open model on a server in Canada, or names replaced with codes before sending (check with your legal counsel): two ways to say yes to AI while keeping control of your data.
Sources
- Statistics Canada, “Analysis on artificial intelligence use by businesses in Canada, second quarter of 2026,” June 11, 2026: the Statistics Canada analysis.
- Mistral AI, “Introducing Mistral Large 4,” October 6, 2026: Mistral AI’s announcement.
- OVHcloud, public cloud region availability (GPUs in Beauharnois, BHS5): OVHcloud’s regions page.
- Act respecting the protection of personal information in the private sector (P-39.1), sections 12 (de-identification) and 23 (anonymization): the act on LégisQuébec.
