TL;DR
This article examines the emerging landscape of AI sovereignty certifications, highlighting France’s SecNumCloud and the unique 24% ownership rule. It explores how these frameworks impact data control, legal jurisdiction, and provider compliance in Europe.
France’s national cybersecurity agency, ANSSI, has implemented the SecNumCloud certification, which includes a unique ownership control rule — the 24% threshold — to ensure legal sovereignty over cloud services hosting sensitive data. This development signals a shift toward formalized sovereignty testing in European AI and cloud services, with significant implications for providers and clients concerned about jurisdictional risks.
SecNumCloud, created by ANSSI, is not a traditional certification but a government-issued qualification that verifies a provider’s compliance with strict legal sovereignty criteria, including EU domicile, data storage, and immunity from non-EU extraterritorial law. The key feature is the 24% ownership rule, which limits individual foreign control to 24%, or combined control to 39%, to prevent non-EU influence over critical data infrastructure.
As of mid-2026, approximately nine providers hold active SecNumCloud qualifications, including OVHcloud and Scaleway, with a dozen more in the pipeline. The certification is mandatory for hosting sensitive French public-sector data and is being promoted for vital European sectors under NIS2 regulations.
In contrast, other frameworks like BSI C5 and EUCS focus on operational security practices and do not address legal sovereignty directly. BSI C5, for example, requires disclosure of jurisdiction and data location but does not prevent control by non-EU entities. AWS’s European Sovereign Cloud, certified with a C5 report, remains subject to US law despite its physical separation within the EU.
Impact of Sovereignty Rules on Cloud and AI Providers
The 24% ownership rule and SecNumCloud’s sovereignty criteria introduce a new dimension to cloud service selection, emphasizing legal control and ownership structure over mere security practices. This shift affects how providers structure their ownership and control models to meet European legal requirements, potentially limiting US-based providers’ ability to offer fully sovereign services without restructuring.
For European clients, these certifications aim to reduce jurisdictional risks, especially in sensitive sectors like health, energy, and finance. However, the complexity and strictness of the rules could limit market competition and influence global cloud strategies, with US hyperscalers adapting through joint ventures or control arrangements.
European cloud sovereignty certification
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Background of European Sovereignty and Certification Frameworks
European countries have long sought to assert legal sovereignty over data, especially in regulated industries. France’s SecNumCloud, introduced in 2016 and now on version 3.2, is part of this effort, combining technical, organizational, and legal requirements. It is distinct from operational security standards like ISO 27001 or BSI C5, which focus on security controls rather than jurisdictional control.
The 24% ownership rule was introduced as a practical measure to prevent non-EU entities from exerting significant influence over critical cloud services, reflecting concerns over foreign control and legal exposure. This rule is unique and arithmetic-based, making it a clear, checkable criterion for sovereignty.
Meanwhile, US hyperscalers like AWS and Microsoft have developed European-specific offerings, such as AWS’s European Sovereign Cloud, which while physically isolated, still remain under US jurisdiction, illustrating the ongoing tension between operational separation and legal sovereignty.
“SecNumCloud is a government qualification, not just a private certification, which commits the French state to the security and sovereignty of the service.”
— Anssi representative
SecNumCloud certified cloud providers
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Unresolved Questions About Certification Adoption and Impact
It remains unclear how widely the 24% ownership rule will influence global cloud provider strategies beyond France, especially as US companies seek ways to comply through joint ventures or control arrangements. The long-term impact on market competition and provider offerings is still developing, and the full legal implications of sovereignty certifications are yet to be tested in courts.
Additionally, the extent to which these frameworks will be adopted across other European countries and sectors, or whether new rules will emerge, remains uncertain.
EU data sovereignty cloud services
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Future Developments in European Cloud Sovereignty Policies
Expect further adoption of SecNumCloud and similar sovereignty frameworks across Europe, especially among public-sector and critical infrastructure providers. Regulatory agencies may refine or expand ownership rules, and US hyperscalers will likely adapt their control structures accordingly.
Legal challenges or clarifications regarding jurisdiction and sovereignty are anticipated, which could influence certification standards and provider compliance strategies. Monitoring the evolution of these policies over the next year will be essential for understanding their full impact.
government-certified cloud security
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Key Questions
What is the main purpose of the 24% ownership rule?
The 24% ownership rule is designed to limit foreign control over cloud providers hosting sensitive European data, ensuring legal sovereignty and reducing jurisdictional risks.
How does SecNumCloud differ from other security certifications?
Unlike operational security standards like ISO 27001 or BSI C5, SecNumCloud explicitly tests legal sovereignty through ownership control, domicile, and immunity from non-EU law.
Are US cloud providers compliant with SecNumCloud?
Most US providers are not currently eligible for SecNumCloud certification due to ownership and control restrictions, but they may participate via joint ventures or control arrangements that meet the 24% rule.
Will these sovereignty certifications become mandatory across Europe?
They are already mandatory for certain sectors like French public data and are likely to expand in scope, especially under regulations like NIS2, but full European-wide adoption remains to be seen.
What are the potential risks for providers not complying?
Non-compliance could result in losing access to sensitive government contracts, restrictions on hosting critical data, and increased legal and operational risks.
Source: ThorstenMeyerAI.com
