TL;DR
- Ontario's US-business restriction concerns the supplier entering the contract, not automatically the developer or country of origin of the AI product.
- Assess the supplier's headquarters or main office, corporate control and whether it has fewer than 250 full-time employees in Canada.
- For services, a documented commitment that at least 90% of delivery staff will be in Canada may support an exception. An only-viable-source exception has separate conditions.
- Assess data hosting, subprocessors, PHIPA readiness and US CLOUD Act exposure separately from procurement eligibility.
- Use the nine-point checklist and copyable assessment record below without a download or email form.
A hospital buying an AI phone agent might sign with a Canadian reseller, use US-developed software and process calls through multiple cloud providers. Which company does Ontario assess under its US-business procurement restriction? Start with the legal supplier on the contract, not the product's country of origin.
Is your AI vendor a US business under Ontario's rules?
Ontario's Buy Ontario Procurement Directive generally restricts new procurements from a supplier whose headquarters or main office is in the United States, including where the supplier is controlled by a corporation whose headquarters or main office is in the US, and that has fewer than 250 full-time employees in Canada. Both parts matter. Covered buyers include Ontario hospitals and other designated broader public-sector organizations.
For policy background, use Ontario’s official directive and the Supply Ontario guides linked below. This article is a working assessment, not a substitute for the directive or legal advice.
What to do: Identify the contracting legal entity before asking about the technology stack.
For broader technology due diligence, use the enterprise voice AI vendor evaluation framework to assess subprocessors and data flows alongside the procurement record.
The nine-point Ontario AI vendor procurement checklist
Use this checklist in an RFQ, RFP or vendor-risk assessment. Mark each item reviewed only after the evidence is in your procurement file. A checked box is not a finding of eligibility.
- 1. Contracting supplier: Who signs the agreement? Record the legal name and whether the contracting party is a reseller. Product origin alone does not decide supplier status.
- 2. Headquarters: Where is the supplier's headquarters or main office? Ask for a signed declaration. Incorporation location or a Canadian sales address is not conclusive.
- 3. Corporate control: Does a corporation whose headquarters or main office is in the US control the supplier? Request an ownership chart and voting-rights details. The policy does not define control; Supply Ontario points to the Ontario Business Corporations Act as helpful guidance, including voting rights and the ability to elect a board majority. Have counsel assess the arrangement.
- 4. Canadian workforce: Does the supplier have 250 or more full-time employees in Canada? Obtain a dated employee-count representation, not a worldwide headcount.
- 5. Services exception: If claimed, will at least 90% of the staff required to deliver the contracted services be located in Canada for the contract term? Obtain the required commitment and a staffing breakdown showing job titles, counts and locations. The separate only-viable-source exception requires its own justification.
- 6. Attestation: Has the supplier provided the declaration required by your procurement documents? Supply Ontario provides optional sample language for US-business status and the services staffing commitment. Adapt it to the procurement with legal counsel; the sample wording itself is not mandatory.
- 7. Privacy and subprocessors: Where will audio, transcripts, metadata and backups be processed? Identify subprocessors, access jurisdictions, retention rules, PHIPA responsibilities, privacy impact assessment evidence and any CLOUD Act exposure. These issues do not determine US-business status.
- 8. Contract value and local preference: Which Buy Ontario supplier-preference band applies? For designated broader public-sector buyers, assess Ontario preference below $139,000, Canadian preference from $139,000 to below $368,000, and trading-partner preference and weighted domestic criteria at $368,000 and above, subject to applicable requirements and exceptions. The US-business restriction on new procurement is not limited to these bands.
- 9. Existing agreements: Is this a new procurement or an extension expressly provided for in the original contract? Obtain the original agreement, option wording and proposed amendment.
What to do: Record the evidence and outcome for every question. Escalate incomplete or contradictory declarations rather than guessing.
How should a Canadian reseller or US-controlled subsidiary be assessed?
Assess the entity entering the agreement. Ontario's guidance distinguishes the contracting supplier from the product's origin. A Canadian reseller of US-developed AI software is not automatically a US business because the software is American.
That does not mean a Canadian-incorporated company automatically qualifies. A subsidiary controlled by a corporation whose headquarters or main office is in the US may be treated as US-headquartered under the relevant rule.
What to do: Request the contracting entity's ownership chart, headquarters declaration and Canadian full-time employee count. Reassess if the contracting party changes.
What evidence supports the 90% Canadian services exception?
A supplier claiming the services exception should document a commitment that at least 90% of personnel required to deliver the contracted services will be located in Canada for the contract term. The relevant denominator includes employees and independent contractors needed for the contracted services, not necessarily the vendor's entire workforce.
Ask for total delivery headcount, roles, locations and how staffing changes will be managed. An only-viable-source exception is different: the buyer must document why there is only one viable source and why procurement cannot be delayed.
What to do: Use a procurement-specific attestation informed by Supply Ontario's optional samples and legal review. Retain the staffing commitment, exception justification and approval with the procurement record.
Does Canadian data hosting establish procurement eligibility?
No. Hosting location does not decide whether a supplier meets Ontario's US-business definition. Equally, a supplier outside that definition does not automatically satisfy hospital privacy or security requirements.
For voice AI, the privacy review should trace call audio, transcripts, logs, metadata, backups and all subprocessors. US-controlled providers may create CLOUD Act considerations even where data is stored in Canada. Actual exposure depends on US jurisdiction, the providers' possession or control of the data and the specific arrangements; Canadian residency alone is not a complete legal answer.
| Separate review | Evidence to request |
|---|---|
| Data flow and residency | Architecture diagram showing storage, processing and backup locations |
| Subprocessors | Current vendor list, services performed and access jurisdictions |
| PHIPA and privacy | Contractual safeguards, access controls, retention and deletion terms, privacy impact assessment inputs |
| Operations | Escalation procedures, human oversight, incident response and audit records |
| Cross-border access | Provider control, relevant legal exposure and documented mitigations |
What to do: Keep supplier eligibility and privacy/security sign-off as separate decisions.
What should the final supplier assessment record contain?
A defensible procurement record identifies the supplier, evidence, relevant rule, exception if any, decision owner and outstanding issues. It also distinguishes the US-business restriction from other Buy Ontario preferences and contract-specific requirements.
Copy this template into your procurement file:
| Assessment field | Record |
|---|---|
| Supplier legal name and contracting entity | |
| Product or service | |
| Headquarters or main office | |
| Controlling corporation and voting-rights evidence | |
| Full-time employees in Canada, evidence date | |
| US-business definition assessment | Meets / Does not meet / Pending |
| Services or only-viable-source exception, if claimed | |
| Attestation received, version and date | |
| Applicable procurement value and local preference | |
| Original contract and extension-option review | |
| Privacy, subprocessor and PHIPA review reference | |
| Procurement reviewer and date | |
| Approval, unresolved questions and next action |
Decision guidance: If the supplier does not meet the definition, continue with other applicable procurement and risk checks. If it meets the definition, do not proceed without a properly supported applicable exception. If evidence is incomplete, keep the assessment pending.
What to do: Retain the signed attestation, source evidence, exception approvals and separate security/privacy decision. For enterprise deployment considerations, use the separate technology and operational approval process and review the enterprise voice AI orchestration guide.
Official Sources
- Ontario Buy Ontario Procurement Directive
- Supply Ontario Procurement Restriction Policy FAQ
- Supply Ontario Procurement Restriction Policy Guide
- Supply Ontario Building Ontario Businesses Initiative Buyer Guide
- US Department of Justice CLOUD Act white paper announcement
- Ontario IPC: Protecting personal health information when using third-party providers
This is general procurement information as of October 2026, not legal advice. Verify the applicable directive, procurement-specific attestation and contract-specific requirements before making a determination.
Frequently Asked Questions
Does a Canadian reseller make US-developed AI software eligible?
Not automatically. The restriction assesses the contracting supplier. The reseller's own headquarters, corporate control and Canadian full-time workforce must still be checked.
Does a Canadian office mean a US-headquartered supplier is not a US business?
No. A local office is not the same as headquarters, and the supplier must be assessed against the Canadian full-time employee threshold.
Can a US business provide services using Canadian staff?
An exception may apply where at least 90% of the staff required for contracted services are located in Canada, with the required commitment and evidence.
Does Canadian hosting eliminate CLOUD Act exposure?
Not necessarily. Review the legal control of relevant providers, their access to information and the specific deployment arrangements.
Can an existing SaaS contract simply be renewed?
An extension expressly contemplated by the original agreement is different from a newly negotiated extension. Review the original contract and current directive before proceeding.
