TL;DR
European cybersecurity standards like SecNumCloud enforce a 24% ownership limit to prevent foreign government control over cloud providers. This raises questions about sovereignty and compliance for US-based companies operating in Europe. The debate over certification meaning and legal jurisdiction is intensifying as more providers seek compliance.
European cybersecurity authority ANSSI’s SecNumCloud framework enforces a 24% ownership cap on non-EU investors to ensure legal sovereignty over cloud providers handling sensitive data. This rule is causing significant debate among industry stakeholders about the true meaning of sovereignty and the limits of existing certifications.
SecNumCloud, created by France’s ANSSI, is not a traditional certification but a government-issued qualification that requires providers to demonstrate ownership control within the EU, including a 24% ownership limit. This control measure is unique and arithmetic-based, making it a strict test of sovereignty, unlike security-focused standards like ISO 27001 or C5.
As of mid-2026, approximately nine to ten providers, including OVHcloud and Scaleway, have obtained active SecNumCloud qualifications, with more in the pipeline. The regulation is mandatory for hosting sensitive French public-sector data and is expanding to other critical sectors under EU directives like NIS2. US hyperscalers, unable to meet the ownership restrictions directly, are creating control structures through joint ventures, such as Thales-Google’s S3NS and Capgemini-Orange’s Bleu, to comply with the rule.
Implications of the 24% Control Limit for Cloud Providers
The 24% ownership cap fundamentally challenges the ownership and control claims of US-based cloud giants operating in Europe. It emphasizes the importance of legal sovereignty over security practices, potentially reshaping how providers structure their ownership and control mechanisms to meet European regulatory demands. This could influence global cloud strategies and data governance policies.
ISO 27001 certification for cloud providers
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
European Frameworks and the Sovereignty Control Test
European security standards like ISO 27001, SOC 2, and BSI C5 primarily certify security practices but do not address jurisdictional control. In contrast, France’s SecNumCloud explicitly tests control through a quantitative ownership limit, making it unique. The framework reflects a broader EU push to ensure legal sovereignty over data, especially in sensitive sectors, amidst ongoing concerns about foreign government influence and extraterritorial law enforcement.
US cloud providers, such as AWS, remain subject to US laws like the CLOUD Act, which complicates compliance with sovereignty standards. To navigate this, they are establishing control structures via joint ventures that meet the 24% rule, but these arrangements raise questions about their authenticity and effectiveness.
“Achieving ISO 27001 is a 1 on the complexity scale, but SecNumCloud is a 10—it’s brutally hard and requires precise control over ownership and legal domicile.”
— Scalingo CEO
European cybersecurity compliance tools
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Remaining Questions About Sovereignty Compliance
It is still unclear how many US providers will successfully restructure control arrangements to meet the 24% ownership cap long-term. The effectiveness of joint ventures in truly maintaining sovereignty, versus merely creating compliance structures, remains an open question. Additionally, the broader impact of these standards on global cloud market dynamics and legal interpretations is still evolving.
cloud sovereignty control software
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Future Developments in European Cloud Sovereignty Rules
In the coming months, more providers are expected to seek SecNumCloud certification or establish control structures to comply with the 24% rule. Regulatory agencies are likely to expand the scope of the framework, potentially applying similar sovereignty tests to other critical sectors. Industry stakeholders will closely monitor legal challenges and the practical effectiveness of control arrangements in maintaining sovereignty claims.
data governance compliance solutions
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Key Questions
What is the 24% ownership rule in SecNumCloud?
The 24% rule limits individual foreign ownership to 24% and collective ownership to 39%, serving as an arithmetic test of legal sovereignty over cloud providers handling sensitive data in Europe.
Why is the 24% rule considered more effective than traditional security certifications?
Because it directly measures ownership control and legal sovereignty, rather than just security practices, making it a more definitive test of jurisdictional independence.
How are US cloud providers attempting to comply with the sovereignty standards?
They are creating joint ventures and control structures that meet the ownership caps, such as Thales-Google’s S3NS and Capgemini-Orange’s Bleu, to bypass direct ownership restrictions.
Does holding a SecNumCloud qualification mean a provider is immune from US law?
No. SecNumCloud primarily tests control within the EU; providers like AWS remain subject to US laws like the CLOUD Act, regardless of certification.
What are the implications for global cloud providers operating in Europe?
They must adapt ownership and control structures to meet sovereignty standards, potentially affecting their corporate structures and data governance policies across regions.
Source: ThorstenMeyerAI.com
