TL;DR
The 24% ownership threshold set by France’s SecNumCloud framework enforces legal sovereignty over cloud providers. This rule impacts US and non-EU companies, shaping European AI cloud standards and control. The development signals a move toward stricter data sovereignty measures.
France’s national cybersecurity agency, ANSSI, has implemented a new sovereignty criterion within its SecNumCloud qualification, establishing a 24% ownership cap for non-EU control of cloud providers hosting sensitive data. This rule is now a key factor in determining legal sovereignty and compliance for cloud services operating within Europe, with broad implications for international vendors and European data policies.
SecNumCloud, created in 2016 and now at version 3.2, is a government-backed qualification that certifies cloud providers meet strict security and sovereignty standards. Learn how AI made the sovereignty market real. Unlike typical certifications, it is issued after a government audit, making it a formal declaration of legal control. The core of this framework is the ownership threshold: companies with more than 24% ownership by non-EU entities cannot qualify, ensuring that control remains within the EU. Explore Europe’s AI sovereignty options. As of mid-2026, about ten providers, including OVHcloud and Scaleway, have obtained SecNumCloud status, with more in the pipeline.
This ownership rule is a simple, arithmetic check on ownership structures, but it is considered highly effective and difficult to meet. It directly addresses concerns about foreign government influence and extraterritorial legal risks, especially from US companies subject to laws like the CLOUD Act. See how AI impacted sovereignty markets. The rule effectively compels US-based cloud giants to reorganize control structures to operate within European sovereignty constraints, as seen with joint ventures like S3NS and Bleu, which are controlled by European firms but leverage US technology.
Legal Sovereignty and Control Implications for Cloud Providers
The 24% ownership rule fundamentally shifts how cloud providers are evaluated for sovereignty in Europe. It emphasizes ownership and control over security practices alone, making it a decisive factor for European public sector and critical infrastructure data hosting. For international companies, especially US-based giants, this rule necessitates restructuring ownership or control mechanisms, potentially impacting their market strategies and compliance approaches. The development signals a broader trend toward data sovereignty and legal control in European cloud policy, influencing global standards and vendor behavior.
European cloud sovereignty certification
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
European Data Sovereignty and Certification Evolution
The SecNumCloud framework was introduced in 2016 by France’s ANSSI to address legal sovereignty, going beyond traditional security certifications like ISO 27001 or C5. Unlike these, SecNumCloud explicitly incorporates legal and ownership controls, including EU domicile, data storage, and immunity from non-EU laws. The 24% ownership cap is a recent addition, reflecting growing concerns over foreign influence, especially from US tech firms, and aligning with the EU’s broader push for data sovereignty and strategic autonomy in digital infrastructure.
Other frameworks like Germany’s C5 focus on technical controls and transparency but do not explicitly address ownership or legal jurisdiction, making SecNumCloud unique in its legal sovereignty emphasis. The rule is part of a wider European effort to establish sovereignty standards amid geopolitical tensions and increasing regulatory scrutiny of foreign-controlled cloud services.
“The 24% ownership rule is a straightforward yet powerful tool that enforces legal sovereignty by limiting foreign control, fundamentally altering how cloud providers structure their ownership in Europe.”
— Thorsten Meyer, AI policy expert
As an affiliate, we earn on qualifying purchases.
Unclear Aspects of the 24% Control Threshold
While the ownership cap is clearly defined, it remains uncertain how this rule will be enforced across complex ownership structures, especially for multinational joint ventures. It is also unclear how existing US giants will reorganize to comply or whether new legal entities will be created to circumvent the rule. Additionally, the broader impact on market competition and innovation within European cloud services is still developing, with ongoing regulatory discussions and potential legal challenges.
Burning Suite – Burn and Copy Software – CD/DVD/Blu-ray – Data, Music, Video – the all-in-one solution for Win 11, 10
- Data Backup and Protection: Securely back up files on optical discs
- Save Hard Drive Space: Archive large files to discs to free space
- Wide Format Compatibility: Convert and burn various file formats easily
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Next Steps for Compliance and Market Adaptation
As of mid-2026, more providers are expected to seek SecNumCloud qualification, adapting ownership structures to meet the 24% limit. Regulatory authorities will likely refine enforcement mechanisms, and legal challenges may emerge from companies unable or unwilling to restructure. The European Commission and national agencies will continue to develop policies that reinforce sovereignty standards, potentially extending similar rules to other sectors and regions. The evolution of joint ventures like S3NS and Bleu will serve as case studies for compliance strategies.
EU cloud provider security certification
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Key Questions
What is the purpose of the 24% ownership cap in SecNumCloud?
The 24% ownership cap is designed to ensure legal sovereignty by preventing non-EU entities, especially foreign governments, from exerting control over cloud providers hosting sensitive data within Europe.
How does this rule affect US-based cloud providers?
US-based providers must reorganize ownership structures to keep non-EU ownership below 24%, often through joint ventures or restructuring, to qualify for SecNumCloud and host European public-sector data.
Is the 24% rule legally binding or just a guideline?
The rule is embedded in the formal SecNumCloud qualification criteria issued by ANSSI, making it a legally binding requirement for certification and access to certain government and critical infrastructure contracts.
Could this rule lead to reduced competition in the European cloud market?
Potentially, yes. The strict ownership limit may limit US giants’ ability to operate at full scale in Europe, encouraging local or EU-controlled providers but possibly reducing competitive options.
Will other European countries adopt similar sovereignty standards?
It is likely, as the EU and member states increasingly emphasize data sovereignty and control, leading to a broader adoption of ownership and control-based standards across Europe.
Source: ThorstenMeyerAI.com
