TL;DR
The 24% ownership limit in France’s SecNumCloud framework enforces legal sovereignty by restricting foreign control over cloud providers. This impacts how AI cloud services are governed and their jurisdictional claims, with US hyperscalers adapting through joint ventures.
France’s national cybersecurity agency, ANSSI, enforces a 24% ownership cap on foreign-controlled companies seeking the SecNumCloud qualification, a move that directly impacts claims of AI cloud sovereignty. Learn more about the explosion of AI in sovereignty markets. This regulation aims to ensure legal sovereignty by restricting foreign ownership, marking a significant shift in European cloud governance and sovereignty claims.
SecNumCloud, established by ANSSI in 2016 and now at version 3.2, is a qualification that certifies cloud service providers meet strict security, operational, and legal standards, including EU domicile and EU-only data storage. Discover how sovereignty impacts cloud standards. Its defining feature is the ownership control rule: companies with more than 24% ownership by non-EU entities cannot qualify, effectively limiting foreign influence over critical cloud infrastructure.
As of mid-2026, roughly nine to ten providers hold an active SecNumCloud qualification, including OVHcloud, Outscale, and Scaleway, with more in the pipeline. This regulation is mandatory for hosting sensitive French public-sector data and is expected to extend to vital sectors such as health, energy, and finance under the NIS2 directive. US-based hyperscalers like AWS, Microsoft, and Google have responded by creating joint ventures with European firms, where control is shifted to comply with the ownership cap, exemplified by Thales–Google’s S3NS and Capgemini–Orange’s Bleu. Read about the leading company sale in AI sovereignty markets.
Implications of the 24% Ownership Cap on Cloud Control
The 24% ownership rule fundamentally alters how foreign cloud providers can claim sovereignty within Europe, emphasizing ownership control over mere security certifications. It pushes US tech giants to restructure control through joint ventures, potentially affecting data sovereignty and jurisdictional authority. This regulation signals a shift towards legal sovereignty as a key criterion for cloud service control, impacting international cloud strategies and sovereignty claims across Europe.
European cloud sovereignty security certification
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
European Frameworks and the Rise of Legal Sovereignty
European cloud sovereignty efforts have historically focused on security standards like ISO 27001, SOC 2, and BSI C5, which certify security practices but do not address legal jurisdiction. The SecNumCloud framework introduces a legal sovereignty dimension, requiring providers to demonstrate EU domicile and immunity from extraterritorial laws. The 24% ownership rule is a unique feature, designed to prevent foreign control and ensure compliance with EU sovereignty principles. This approach contrasts with traditional security certifications, which do not address ownership or jurisdictional control.
“SecNumCloud is designed to guarantee that providers under its scope are truly under EU control, both legally and operationally.”
— ANSSI spokesperson
AI cloud service joint venture solutions
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Unclear Aspects of the 24% Ownership Enforcement
It remains unclear how strictly the 24% ownership cap will be enforced across different types of joint ventures and restructuring efforts, and whether future legal or political challenges could modify or weaken the rule. The long-term impact on existing foreign-controlled providers and their ability to adapt remains to be seen. Additionally, the precise legal mechanisms for verifying ownership and control in practice are still under development.
EU data sovereignty cloud providers
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Next Steps for Cloud Providers and European Policy
More providers are expected to pursue SecNumCloud certification or establish joint ventures to comply with the 24% ownership rule. Regulatory agencies may refine enforcement procedures, and legal challenges could arise. European policymakers are likely to expand the scope of sovereignty rules, potentially affecting more sectors and providers. Monitoring how US hyperscalers adapt—through restructuring or new partnerships—will be critical in assessing the evolution of cloud sovereignty in Europe.
France SecNumCloud certified cloud services
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Key Questions
What is the 24% ownership rule in SecNumCloud?
The 24% ownership rule limits non-EU ownership to 24% per individual and 39% collectively, ensuring providers are under European control to claim legal sovereignty.
How does this rule affect US cloud providers?
US providers must restructure ownership, often through joint ventures where control is shifted to European entities, to qualify under SecNumCloud.
Does certification guarantee sovereignty?
No. Certifications like SecNumCloud demonstrate compliance with security and legal control standards but do not eliminate jurisdictional risks or extraterritorial laws.
Will this rule impact data privacy and security?
Yes, by enforcing ownership control and legal jurisdiction, it aims to strengthen data sovereignty, but it also complicates international cloud operations.
What happens if a provider exceeds the ownership cap?
Such providers would not qualify for SecNumCloud, potentially losing access to certain government contracts and critical sectors requiring compliance.
Source: ThorstenMeyerAI.com
