Canadian companies just got a shiny new toy: OpenAI's GPT-5.6, GPT-6, and GPT-6.1 are now available on Amazon Bedrock in the Canada Central and Canada West regions. That means developers can tap into frontier AI models without signing a separate deal with OpenAI or setting up a US entity. It's a big win for access and speed—but there's a catch that could land you in hot water with privacy regulators.
Here's the twist: 'from Canada' doesn't mean 'in Canada.' The service uses cross-Region inference (CRIS), which routes your requests to supported destination regions for processing. Depending on the inference profile you choose, your data might be processed in North America or in AWS's global pool. That's a huge difference for banks, hospitals, and government agencies bound by FIPPA, Quebec's Law 25, and federal directives. Pick the wrong profile, and you've quietly exported sensitive data. AWS isn't hiding this—it's in the fine print—but the headline and the architecture aren't saying the same thing.
The winners? Canadian enterprises and ISVs that get frontier AI without the usual red tape, plus AWS, which scores a defensive point against Azure and Google Cloud. OpenAI wins distribution—every Bedrock seat is a seat it didn't have to sell directly. The losers? Microsoft, whose privileged position as OpenAI's main cloud is looking shaky. Also Canadian sovereign-AI plays, whose 'hosted here, governed here' pitch gets harder when the alternative is GPT-6.1 with an AWS control plane, even if the compute sits in Ohio. And regional MSPs whose differentiation was navigating access to frontier models—that friction just vanished.
The angry constituency is the data-protection crowd. Privacy officers and procurement reviewers now have to adjudicate a service whose geography depends on a configuration parameter they don't control at the API layer. That's a nightmare. And it's only a matter of time before someone runs regulated data through a global profile and the postmortem is ugly. Watch for provincial privacy regulators or federal procurement to issue guidance specifically on CRIS profile selection—that would turn a config detail into a compliance mandate overnight.
The pace is also dizzying. GPT-5.5 went GA in June, GPT-5.6 rolled out to 25+ regions, and now GPT-6 and 6.1 are here by October. Release notes are arriving faster than most enterprises can complete a security review. That quietly advantages buyers who accept defaults over those who customize—and defaults might not be the safe choice.
So what's next? AWS could offer in-Canada processing for these models, or 'Canada' might remain a front door forever. Trends suggest the pressure will mount as regulators catch on. The smart play: check your inference profile, read the fine print, and don't assume 'from Canada' means 'in Canada.' Your data's passport might be Canadian, but its destination could be anywhere.