TL;DR
The 24% ownership cap in France’s SecNumCloud framework is a key test for AI sovereignty, challenging US-based providers and shaping future European cloud standards. The rule’s implications are still unfolding.
France’s national cybersecurity agency, ANSSI, has implemented a new sovereignty criterion in its SecNumCloud certification: a 24% ownership cap for non-EU companies. This rule directly tests whether foreign governments can exert legal influence over cloud providers, marking a significant shift in European AI and cloud sovereignty efforts. The development matters because it could reshape how international tech firms operate in regulated European markets and influence global standards.
SecNumCloud, created by ANSSI in 2016 and now at version 3.2, is a qualification rather than a certification. It requires providers to meet strict legal and operational criteria, including EU data storage, audited key custody, and immunity from non-EU extraterritorial laws. The 24% ownership rule is a straightforward, arithmetic test: no individual or group of non-EU companies can hold more than 24% of voting rights in a provider. This rule aims to guarantee legal sovereignty by limiting foreign control.
As of mid-2026, around ten providers hold an active SecNumCloud qualification, including OVHcloud and Scaleway, with more in the pipeline. The rule is mandatory for French public sector data hosting and is being extended to operators of vital importance and essential services under EU directives. US hyperscalers like AWS cannot directly qualify because of their ownership structures, prompting them to create joint ventures with European control, such as Thales–Google S3NS and Capgemini–Orange Bleu, to comply with the ownership cap.
Legal Sovereignty and International Cloud Operations
The 24% ownership rule signifies a fundamental shift toward ensuring European legal sovereignty over cloud and AI infrastructure. It challenges US and other non-EU providers by limiting foreign control, potentially restricting their ability to operate fully within the European market without local partnerships. This development could lead to increased reliance on European-controlled providers and influence global standards for data sovereignty and AI governance.
As an affiliate, we earn on qualifying purchases.
European Certification Frameworks and Sovereignty Measures
Security certifications like ISO 27001, SOC 2, and BSI C5 primarily assess operational security practices but do not address legal jurisdiction or sovereignty. In contrast, France’s SecNumCloud adds a legal dimension, explicitly requiring EU domicile, EU-only data storage, and immunity from non-EU laws, with the ownership cap being a key component. This approach reflects broader European efforts to assert legal control over data and AI infrastructure amid increasing geopolitical tensions and extraterritorial laws like the US CLOUD Act.
US hyperscalers have responded by forming joint ventures with European firms, aiming to meet the ownership restrictions while maintaining their service offerings. For example, Thales and Google’s S3NS, and Capgemini and Orange’s Bleu, are structured to comply with the 24% rule, illustrating the practical impact of the framework on international cloud strategies.
“The 24% ownership rule is a simple arithmetic test, but its implications are profound — it directly challenges US-based providers’ ability to control and operate within France’s sovereignty framework.”
— Thorsten Meyer, AI compliance expert
EU data sovereignty cloud services
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Unresolved Questions About Implementation and Global Impact
It remains unclear how widespread the adoption of joint ventures will become among US and European providers, and whether other countries will adopt similar sovereignty measures. The long-term effectiveness of the 24% rule in preventing foreign influence is also uncertain, especially as providers innovate around ownership structures. Additionally, the impact on multinational cloud strategies and the potential for regulatory arbitrage are still developing.
AI and cloud sovereignty certification
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Future Developments in European Cloud Sovereignty Standards
Expect further clarification from ANSSI and European regulators on the application of the 24% rule, including potential updates to the framework. More providers are likely to seek SecNumCloud qualification through European-controlled joint ventures. Additionally, legal and geopolitical debates around sovereignty and extraterritorial laws will shape future policy, possibly leading to new standards or revisions in existing frameworks.
European cloud security compliance
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Key Questions
What is the significance of the 24% ownership rule in SecNumCloud?
The 24% rule is a straightforward arithmetic test designed to ensure European legal sovereignty by preventing foreign control over cloud providers, especially US-based companies.
Can US tech giants qualify directly under SecNumCloud?
No, US-based providers cannot meet the ownership restrictions directly. Instead, they form joint ventures with European control to comply with the 24% ownership cap.
Does certification guarantee immunity from non-EU laws?
No, certifications like SecNumCloud attest to operational security and legal control but do not eliminate the applicability of laws like the CLOUD Act. The ownership rule aims to limit foreign influence, not legal jurisdiction entirely.
How does this affect international cloud providers operating in Europe?
Providers must restructure ownership or form European-controlled joint ventures to meet sovereignty requirements, potentially impacting their operational models and strategic decisions.
Will other European countries adopt similar sovereignty rules?
It is possible, as the focus on legal sovereignty grows within the EU, but specific frameworks and thresholds may vary depending on national policies and legal considerations.
Source: ThorstenMeyerAI.com
