TL;DR
The article explores the legitimacy of AI sovereignty certifications, highlighting the unique 24% ownership rule that tests legal control. It explains how certifications like SecNumCloud and C5 differ in verifying security practices versus sovereignty.
French cybersecurity authority ANSSI has implemented a new sovereignty criterion in its SecNumCloud qualification, requiring providers to ensure that foreign ownership does not exceed 24%. This rule tests legal sovereignty directly, making it a key measure for European cloud and AI services handling sensitive data.
The SecNumCloud certification, issued by ANSSI, is not a typical security certification but a qualification that confirms legal sovereignty over data. It mandates compliance with EU laws, data residency within Europe, and immunity from non-EU extraterritorial laws. The 24% ownership cap is the core measure, ensuring that foreign control remains below a threshold that could threaten sovereignty. As of mid-2026, only about nine to ten providers hold an active SecNumCloud qualification, including OVHcloud and Scaleway. This certification is mandatory for hosting sensitive French public-sector data and is increasingly being adopted across vital sectors, including health, energy, and finance.In contrast, BSI C5 from Germany, while a robust security standard, discloses jurisdiction but does not guarantee immunity from legal reach, highlighting a key difference. U.S.-based providers like AWS can hold C5 attestations but remain subject to U.S. laws, such as the CLOUD Act. To address this, U.S. hyperscalers have created joint ventures with European companies, like Thales-Google’s S3NS and Capgemini-Orange’s Bleu, which are structured to comply with the 24% ownership rule and meet sovereignty requirements.
Implications of the 24% Ownership Rule for European Cloud Providers
The 24% ownership rule is a fundamental measure of legal sovereignty in European cloud infrastructure, directly impacting foreign control over sensitive data. It shifts the focus from traditional security certifications to ownership and control, affecting how providers structure their corporate governance. For European industries, especially those in public sector, health, energy, and finance, this rule ensures compliance with EU sovereignty principles, reducing reliance on U.S. or non-EU jurisdictions. As the rule becomes more widely adopted, it could redefine international cloud partnerships and influence global standards for data sovereignty, making it a pivotal element in the future of AI and cloud regulation.
As an affiliate, we earn on qualifying purchases.
European Sovereignty Frameworks and the Rise of SecNumCloud
European efforts to assert legal sovereignty over data have led to the development of frameworks like SecNumCloud by ANSSI and the EUCS standard. Unlike traditional security certifications such as ISO 27001 or SOC 2, which verify security practices, these new frameworks emphasize ownership control and jurisdictional immunity. The introduction of the 24% ownership cap in SecNumCloud in 2026 marks a significant shift, aiming to prevent foreign legal influence over data stored within the EU. This development responds to concerns over extraterritorial laws like the CLOUD Act and signals a move toward sovereignty-based certifications that are legally binding and government-backed.
While ISO 27001 and similar standards remain popular for security, they do not address sovereignty or jurisdictional issues. The emergence of these new controls reflects a strategic move by European regulators to ensure that data control aligns with EU legal frameworks, especially as AI and cloud services become more critical for public and private sectors.
“SecNumCloud is not just a security standard; it’s a legal qualification that guarantees control and immunity from non-EU laws.”
— Anssi official
cloud security certification SecNumCloud
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Remaining Questions About Certification Validity and Adoption
While the ownership cap is clearly defined, it is still unclear how enforcement will be monitored and verified over time, especially for complex corporate structures. The actual impact on foreign cloud providers and their willingness to restructure ownership remains to be seen. Additionally, the extent to which other European countries will adopt similar sovereignty tests or recognize SecNumCloud as a standard is still developing. The potential for legal challenges or loopholes in the ownership rules also remains an open question.
As an affiliate, we earn on qualifying purchases.
Future Developments in European Data Sovereignty Standards
Expect continued expansion of SecNumCloud requirements, with more providers seeking certification to serve EU public sector clients. Regulatory bodies may refine enforcement mechanisms and clarify compliance procedures. Simultaneously, other European nations could develop similar sovereignty standards, leading to a more cohesive regulatory landscape. The ongoing debate over foreign ownership and jurisdiction will influence international cloud partnerships and could prompt legislative updates to address emerging sovereignty concerns.
As an affiliate, we earn on qualifying purchases.
Key Questions
What exactly is the 24% ownership rule?
The 24% ownership rule in SecNumCloud requires that foreign control over a provider must not exceed 24% of voting rights or ownership, ensuring EU legal sovereignty.
How does SecNumCloud differ from other security certifications?
Unlike ISO 27001 or SOC 2, which verify security practices, SecNumCloud is a government-backed qualification that guarantees legal control and immunity from non-EU laws.
Are U.S. cloud providers able to qualify under SecNumCloud?
U.S. providers cannot qualify directly due to ownership restrictions, but they can form joint ventures with European companies, structured to meet the ownership cap.
Will this standard become mandatory for all cloud providers in Europe?
It is currently mandatory for hosting sensitive French public-sector data and is expected to influence broader European regulations, especially for critical infrastructure sectors.
What are the main challenges in implementing the 24% rule?
The main challenges include accurately tracking ownership structures, preventing loopholes, and ensuring ongoing compliance over time.
Source: ThorstenMeyerAI.com
