TL;DR
Prime made for students and young adults
- Fast, free delivery for dorm and study essentials
- Prime Video and Amazon Music included
- Member-only deals
This report reveals the true meaning of European AI sovereignty certifications, focusing on SecNumCloud and the 24% ownership rule. It highlights how these standards impact data control and jurisdiction, especially in US-based cloud providers operating in Europe.
European cybersecurity standards like SecNumCloud and the 24% ownership rule are redefining what it means for AI cloud providers to demonstrate sovereignty and legal control over data. These frameworks directly impact US-based companies operating in Europe, especially those seeking to meet national security requirements. The key development is that the ownership cap — set at 24% — is the only measurable, arithmetic test for sovereignty, not just a compliance checkbox.
SecNumCloud, created by France’s ANSSI, is a government-issued qualification that enforces strict legal sovereignty requirements, including EU data residency and immunity from non-EU extraterritorial law. Unlike typical security certifications such as ISO 27001 or SOC 2, SecNumCloud’s defining feature is the ownership cap: companies with foreign ownership exceeding 24% individually or 39% collectively cannot qualify. This rule is a straightforward, checkable arithmetic measure of control, making it uniquely enforceable and transparent.
Currently, only about nine or ten providers hold an active SecNumCloud qualification, including OVHcloud and Scaleway. Major US hyperscalers like AWS, Google, and Microsoft do not qualify in their native form due to their ownership structures but are circumventing this through joint ventures and control arrangements. For example, Thales and Google jointly operate S3NS with Thales holding operational control, and Capgemini and Orange run a Microsoft Azure-based service with controlled ownership stakes.
Meanwhile, certifications like BSI C5, originating from Germany, focus on security controls and data location but do not address ownership or jurisdiction directly. A BSI C5 attestation confirms control implementation but leaves residual legal risks, especially under US law, if the provider’s parent company is US-based. Both frameworks coexist but serve different purposes: one tests practice, the other tests sovereignty.
Implications of the 24% Ownership Cap for Cloud Sovereignty
The ownership cap at 24% is a simple but powerful arithmetic rule that directly measures legal sovereignty. It prevents foreign control by limiting ownership stakes, making it a critical component for providers seeking to host sensitive data within Europe and comply with national security mandates. For US-based cloud giants, this rule forces structural changes or joint ventures to meet sovereignty standards, impacting their market strategies and legal exposure.
As European regulators and governments increasingly prioritize data sovereignty, the 24% rule and frameworks like SecNumCloud signal a shift toward tangible control measures rather than solely security practices. This could reshape the cloud landscape, favoring providers that can demonstrate clear ownership and jurisdictional independence, and potentially limiting US tech dominance in sensitive sectors.
EU data sovereignty cloud certification
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
European Sovereignty Standards and the Rise of the 24% Ownership Rule
Since 2016, frameworks like Germany’s BSI C5 have set security standards for cloud providers, focusing on controls and data location. France’s SecNumCloud, introduced in 2016 and now at version 3.2, is distinct in requiring legal sovereignty, including EU domicile, data residency, and immunity from non-EU law. Its defining measure is the ownership cap, which directly tests control through a simple arithmetic threshold.
US hyperscalers, such as AWS, Google, and Microsoft, are structurally ineligible for SecNumCloud due to their ownership and control models. They have responded by creating joint ventures and control arrangements, like Thales–Google’s S3NS and Capgemini–Orange’s Azure service, to meet the ownership criteria while maintaining US legal jurisdiction. Meanwhile, certifications like BSI C5 remain security controls that do not address sovereignty directly.
As of mid-2026, the landscape includes a handful of providers with active SecNumCloud qualifications, with more in development. The French government’s push for mandatory SecNumCloud hosting for sensitive public-sector data underscores the importance of sovereignty standards in the evolving European cloud policy environment.
“The 24% ownership rule is the only arithmetic test for sovereignty, making it uniquely transparent and enforceable.”
— Thorsten Meyer
SecNumCloud certification provider
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Remaining Questions About Sovereignty and Certification Effectiveness
While the ownership cap provides a clear arithmetic measure, the actual enforceability and global impact of these standards remain uncertain. It is unclear how many providers will successfully navigate the complex ownership structures or how regulators will verify compliance in practice. Additionally, the long-term influence of these standards on US cloud providers’ market strategies and legal risks is still developing.
Further, the extent to which these sovereignty measures will influence broader European cloud policy and whether they will lead to the emergence of truly independent European cloud providers remains to be seen.
As an affiliate, we earn on qualifying purchases.
Upcoming Developments in European Cloud Sovereignty Policies
Expect continued adoption and refinement of sovereignty standards like SecNumCloud, with more providers seeking qualification. Regulatory agencies may increase scrutiny of ownership structures, and more joint ventures or control arrangements are likely. Additionally, the European Union and national governments could introduce further legal measures to enforce sovereignty, potentially shaping the future landscape of cloud services for sensitive data.
Further analysis and transparency around compliance verification processes are anticipated, alongside ongoing debates about the balance between security, control, and market competition in the cloud industry.
As an affiliate, we earn on qualifying purchases.
Key Questions
What is the significance of the 24% ownership rule in SecNumCloud?
The 24% ownership rule is a straightforward arithmetic threshold that limits foreign ownership to ensure legal sovereignty, making it a clear, enforceable measure of control over cloud providers hosting sensitive data in Europe.
Can US cloud providers qualify for SecNumCloud?
Not in their native form, due to their ownership structures. They often create joint ventures or control arrangements to meet the 24% ownership cap while remaining subject to US law.
Does a security certification like BSI C5 guarantee sovereignty?
No. BSI C5 confirms control implementation and data location but does not address jurisdiction or immunity from non-EU law. SecNumCloud adds the sovereignty requirement through ownership caps.
What happens if a provider exceeds the 24% ownership limit?
They would be ineligible for SecNumCloud qualification, potentially limiting their ability to host sensitive data in regulated European sectors that require this certification.
What is the future of European cloud sovereignty standards?
Expect ongoing development, with more providers seeking qualification, increased regulatory scrutiny, and potential new legal measures to reinforce sovereignty and control over data hosting.
Source: ThorstenMeyerAI.com
Fall Picks
fall essentials
As an affiliate, we earn on qualifying purchases.
