Why The 24% Rule Is A Wake-Up Call For AI Sovereign Cloud Certification Practices

France’s national cybersecurity agency, ANSSI, has implemented a new sovereignty requirement in its SecNumCloud qualification that limits foreign ownership to 24% for cloud providers hosting sensitive data within the EU. This rule is forcing US-based cloud providers to restructure ownership to comply, marking a significant shift in European cloud sovereignty policy. This development matters because it directly impacts how foreign companies can operate in the European cloud market and highlights ownership control as a critical factor in sovereignty certification.

SecNumCloud, created by ANSSI in 2016, is a government-backed qualification that assesses cloud providers on technical, operational, and legal criteria, including sovereignty. Unlike typical certifications, it explicitly tests ownership control through a numerical cap—foreign ownership must not exceed 24% individually or 39% collectively. This requirement is designed to ensure that the provider is under European control and immune from non-EU extraterritorial laws, such as the US CLOUD Act.

As of mid-2026, approximately nine providers have obtained SecNumCloud qualification, including OVHcloud and Scaleway, with more in the pipeline. Major US hyperscalers like Amazon remain ineligible unless they restructure ownership, which US providers have attempted by creating joint ventures or control arrangements, such as Thales–Google’s S3NS and Capgemini–Orange’s Bleu project. These arrangements permit US companies to meet the sovereignty criteria by transferring operational control to European entities, effectively working around the ownership cap.

Implications for Cloud Providers and European Data Sovereignty

This development underscores a shift towards legal sovereignty as a core component of European cloud regulation. The 24% ownership rule makes clear that physical and operational separation alone are insufficient; control and ownership are now central. For foreign providers, especially US-based firms, this means significant restructuring or partnership strategies to meet sovereignty standards. It also signals a broader move by European regulators to prioritize control over data and infrastructure, potentially reshaping the competitive landscape and influencing future certification frameworks.

European Sovereignty and Certification Landscape

Historically, European cloud regulation has focused on security controls, with frameworks like ISO 27001, SOC 2, and BSI C5 certifying best practices in security and operational controls. SecNumCloud, however, introduces a legal sovereignty dimension, requiring providers to demonstrate control through ownership caps, domicile, and legal compliance. The rule emerged amid growing concerns over US and other non-EU companies’ influence over data and infrastructure, especially after revelations of extraterritorial laws like the CLOUD Act. As of 2026, the framework is becoming a de facto requirement for hosting sensitive public-sector data in France and potentially beyond, influencing procurement and operational decisions across Europe.

“The 24% ownership rule is a game-changer because it makes ownership control the litmus test for sovereignty, not just security practices.”

— Thorsten Meyer, AI compliance expert

Unresolved Challenges and Future Regulatory Developments

It remains unclear how US providers will fully adapt ownership structures to meet the 24% cap without significant restructuring or joint ventures. The long-term impact on market competition and whether other European countries will adopt similar rules are still developing. Additionally, legal and operational complexities of implementing these ownership controls, especially for multinational corporations, are ongoing issues.

Next Steps for Cloud Providers and Regulatory Adoption

US and other non-EU cloud providers are expected to continue restructuring ownership arrangements or forming European-controlled joint ventures to qualify under the new rule. Regulatory agencies in France and possibly other EU countries may expand or tighten sovereignty criteria, further influencing market dynamics. The industry will also watch how certification authorities and auditors adapt to verify ownership controls accurately and efficiently.

Key Questions

What is the 24% ownership rule in SecNumCloud?

The 24% ownership rule limits foreign ownership to 24% for providers hosting sensitive data within the EU, ensuring effective European control and sovereignty.

Why does ownership control matter for sovereignty certification?

Ownership control determines who ultimately controls the provider and whether it is subject to non-EU laws, which is crucial for data sovereignty and legal immunity.

How are US cloud providers responding to this rule?

Many US providers are restructuring ownership or creating joint ventures with European entities to meet the ownership cap and qualify under SecNumCloud.

Does certification guarantee immunity from non-EU laws?

No, certifications like SecNumCloud demonstrate control and compliance but do not automatically exempt providers from laws like the CLOUD Act.

Will other European countries adopt similar sovereignty rules?

It is still uncertain, but the trend suggests increased emphasis on sovereignty and ownership control across the EU, which could lead to broader adoption.

Source: ThorstenMeyerAI.com