TL;DR
France’s SecNumCloud introduces a unique sovereignty test based on a 24% ownership cap, challenging US-based cloud providers and reshaping European data governance. This rule emphasizes ownership control over security practices.
France’s national cybersecurity agency ANSSI has implemented a new sovereignty requirement for cloud providers, establishing a strict 24% ownership cap on foreign control. This rule is designed to ensure that providers hosting sensitive European data are under European control and immune from non-EU extraterritorial laws, marking a significant shift in cloud sovereignty standards across Europe.
The SecNumCloud framework, created by ANSSI in 2016 and now in its latest version 3.2, includes a legal sovereignty requirement, which is unique among European standards. It mandates that companies controlling cloud services must have capital and voting rights held by entities based in the EU, with foreign ownership not exceeding 24% individually and 39% collectively. This ownership cap is a straightforward, arithmetic check—unlike traditional security certifications—aimed explicitly at preventing foreign legal reach.
Currently, only around nine or ten providers hold an active SecNumCloud qualification, including OVHcloud, Dassault’s Outscale, and Scaleway, with several more in the pipeline. Under France’s Cloud au Centre doctrine, this standard is mandatory for hosting sensitive public-sector data, and it is being extended to critical infrastructure sectors such as health, energy, finance, and transport. US hyperscalers like AWS, despite their compliance with other certifications such as C5, cannot meet the sovereignty requirement unless they alter ownership structures, which some have done through joint ventures like S3NS and Bleu.
Implications of the 24% Ownership Cap for Cloud Control
The 24% ownership rule fundamentally shifts how cloud sovereignty is enforced in Europe. It emphasizes ownership control over technical or procedural security measures, compelling foreign providers to restructure ownership to comply. This development challenges US-based cloud giants, who typically operate under American jurisdiction, and could accelerate the emergence of European-controlled cloud services. The rule also signals a move toward legal sovereignty as a key criterion, which could influence future standards and regulations across Europe, affecting global cloud strategies and data governance.
European cloud sovereignty compliance software
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
European Cloud Sovereignty and the Role of Certifications
European cloud standards have historically focused on security practices—such as ISO 27001, SOC 2, and BSI C5—which certify operational controls without addressing jurisdictional control. The introduction of SecNumCloud and its ownership cap marks a departure, emphasizing legal sovereignty as a core requirement. The framework’s unique approach, combining technical, legal, and ownership controls, reflects Europe’s broader push for digital sovereignty amid geopolitical tensions and US cloud dominance.
While certifications like C5 attest to control implementations, they do not address legal jurisdiction. Conversely, SecNumCloud’s ownership rule directly targets who controls the data and under which legal system, making it a more comprehensive sovereignty measure. US hyperscalers have responded by creating joint ventures or restructuring ownership to meet the 24% limit, illustrating the rule’s immediate impact on market strategies.
“Our goal is to guarantee that data hosting providers are under European control and immune from non-EU extraterritorial laws.”
— ANSSI spokesperson
Unresolved Questions About Implementation and Impact
It remains unclear how many US or non-EU providers will successfully restructure ownership to comply with the 24% rule. The long-term impact on the availability and competitiveness of cloud services in Europe is still uncertain, as providers may face significant operational and legal challenges in achieving compliance. Additionally, the extent to which this rule will influence future European regulations or inspire similar standards elsewhere is still developing.
Next Steps for Cloud Providers and Regulatory Adoption
Providers aiming for SecNumCloud qualification will continue to adjust ownership structures, potentially through joint ventures or local subsidiaries, to meet the 24% ownership threshold. ANSSI is expected to clarify enforcement timelines and expand the rule’s scope to critical sectors, including health and energy. Meanwhile, legal and industry experts will monitor how these standards influence European cloud procurement policies and whether other countries adopt similar sovereignty measures.
Key Questions
What exactly is the 24% ownership rule?
The 24% ownership rule limits foreign control of cloud providers operating in France and Europe, requiring that no single non-EU entity hold more than 24% of voting rights or capital, ensuring legal sovereignty and control.
How does SecNumCloud differ from other security certifications?
While certifications like ISO 27001 or C5 focus on operational security controls, SecNumCloud emphasizes ownership control and legal jurisdiction, making it a sovereignty-focused qualification.
Will US cloud providers be able to meet the sovereignty standards?
US providers can attempt to restructure ownership or create joint ventures to comply with the 24% cap, but fully meeting the sovereignty requirements may require significant operational changes.
What are the implications for European data sovereignty?
The rule strengthens European control over data hosting, potentially reducing reliance on US providers and encouraging the development of locally controlled cloud services.
Is this standard legally binding for all cloud providers in France?
Yes, for hosting sensitive public-sector data and critical infrastructure, compliance with SecNumCloud is mandatory under current French regulations.
Source: ThorstenMeyerAI.com
