TL;DR
The 24% ownership threshold in France’s SecNumCloud framework questions the ability of current certifications to ensure legal sovereignty. This challenges assumptions about security standards and jurisdictional control in AI cloud services.
The 24% ownership cap in France’s SecNumCloud framework is challenging the validity of existing AI sovereignty certifications, raising questions about whether current standards effectively guarantee legal control over data in cloud services. This development matters because it could reshape how European regulators and organizations assess control and jurisdiction in cloud and AI deployments.
The SecNumCloud qualification, issued by France’s ANSSI, includes a 24% ownership rule that limits foreign control over providers seeking sovereignty status. This rule is arithmetic-based, requiring that individual foreign ownership not exceed 24%, and combined foreign ownership remains below 39%. It is designed to ensure legal sovereignty by preventing foreign influence from surpassing a critical threshold.
While traditional certifications like ISO 27001, SOC 2, and BSI C5 focus on security practices—such as access controls, encryption, and incident response—they do not address ownership or jurisdictional control. The SecNumCloud framework explicitly tests for ownership and control, making it unique among certifications. As of mid-2026, approximately nine providers hold an active SecNumCloud qualification, with several more in progress, including major players like OVHcloud and Scaleway.
This rule has practical implications: U.S.-based hyperscalers cannot qualify directly under SecNumCloud due to ownership restrictions. Instead, they form joint ventures or control structures that keep foreign ownership below the threshold, such as Thales–Google’s S3NS and Capgemini–Orange’s Bleu, where control is shifted to European entities.
Implications for Cloud Sovereignty and Certification Validity
The 24% ownership rule fundamentally challenges the assumption that existing security certifications alone can guarantee legal sovereignty. It emphasizes ownership control as a critical factor, potentially rendering traditional certifications insufficient for sovereignty claims. This shift could influence procurement, compliance, and international cloud strategies, especially for organizations handling sensitive data in Europe.
As an affiliate, we earn on qualifying purchases.
European Sovereignty Frameworks and Control Measures
European regulators have increasingly emphasized legal sovereignty over data, especially following concerns about extraterritorial laws like the CLOUD Act. France’s SecNumCloud, created in 2016 and now on version 3.2, is a government-backed qualification that combines ISO 27001-based security standards with a legal sovereignty test—the 24% ownership cap. This approach is part of a broader trend to ensure European control over cloud infrastructure and data, particularly for sensitive sectors like health, energy, and finance.
Existing certifications like BSI C5 focus on security controls and disclosure of jurisdiction, but do not restrict ownership or control directly. The new rule in SecNumCloud, therefore, introduces a control-based threshold that is unique and more restrictive, effectively challenging the adequacy of current security standards to guarantee sovereignty.
“Achieving ISO 27001 is a 1 on the complexity scale; SecNumCloud is a 10. The ownership rule makes sovereignty a matter of arithmetic, not just security.”
— Scalingo CEO
As an affiliate, we earn on qualifying purchases.
Unresolved Questions About Certification Effectiveness
It remains unclear how existing international security certifications will adapt or be interpreted in light of the ownership control requirement. There is also uncertainty about whether other European or global frameworks will incorporate similar control-based thresholds, or if the 24% rule will be challenged legally or practically by foreign companies attempting to qualify.
As an affiliate, we earn on qualifying purchases.
Future Developments in European Cloud Sovereignty Rules
Expect ongoing debates among regulators, vendors, and legal experts about the effectiveness of the 24% rule and its implications for international cloud providers. Several providers are working to meet the ownership criteria through joint ventures, and further regulatory guidance is anticipated to clarify the scope of sovereignty measures. Monitoring how these rules influence procurement and compliance strategies will be crucial in the coming months.
As an affiliate, we earn on qualifying purchases.
Key Questions
How does the 24% rule impact foreign cloud providers?
Foreign providers must structure ownership or control to keep foreign influence below 24%, often through joint ventures or control arrangements, to qualify under SecNumCloud.
Does certification guarantee legal sovereignty over data?
No. Certifications like ISO 27001 or C5 focus on security practices, but the 24% rule explicitly tests for ownership control, which directly influences sovereignty.
Will the 24% rule be adopted outside France?
It is uncertain. While similar control-based thresholds could influence other European frameworks, currently, it is specific to France’s SecNumCloud qualification.
Can U.S. companies still qualify for sovereignty status?
Not directly. U.S.-based providers cannot meet the ownership threshold unless they establish European-controlled entities or joint ventures that satisfy the 24% limit.
What are the implications for AI cloud services?
The rule emphasizes control and ownership, which could affect how AI cloud services are structured and procured within Europe, especially for sensitive or regulated data.
Source: ThorstenMeyerAI.com
