TL;DR
The 24% ownership cap is a key criterion in France’s SecNumCloud framework, testing foreign control over providers. Its practical implications and effectiveness are still being evaluated, with few providers currently certified.
The 24% ownership rule in France’s SecNumCloud framework is a unique legal sovereignty requirement that tests control over cloud providers by restricting foreign ownership to less than 24%. This rule is central to the certification’s purpose of ensuring European legal sovereignty over sensitive data, and it is now a key criterion for providers seeking to operate within French and European public sectors.
SecNumCloud, created by France’s ANSSI in 2016, is a qualification rather than a traditional certification. It assesses providers based on 360 criteria across technical, organizational, operational, and legal domains, with a focus on legal sovereignty. The ownership cap—less than 24% foreign control—is the only explicit arithmetic test, designed to prevent non-EU entities from exerting control over providers hosting sensitive data.
As of mid-2026, approximately nine to ten providers have obtained an active SecNumCloud qualification, including OVHcloud, Outscale, and Scaleway. The certification is mandatory for hosting French public-sector data and is being pushed for critical infrastructure and essential services, impacting sectors like health, energy, finance, and transportation.
Other frameworks like BSI C5 and EUCS focus on security controls and operational practices but do not explicitly address sovereignty or control, making the 24% rule distinct in its approach to legal ownership and jurisdiction.
Implications of the 24% Ownership Cap for European Data Control
The 24% ownership rule represents a novel approach to ensuring European sovereignty over cloud and AI services. By quantifying control through ownership percentages, it aims to prevent foreign governments and non-EU entities from exerting influence over critical data infrastructure. This has significant implications for US-based hyperscalers and other non-EU providers, who must adjust ownership structures to qualify.
While the rule enhances legal sovereignty, experts note it does not automatically guarantee security or compliance with other standards. Its effectiveness in preventing extraterritorial legal reach depends on implementation and enforcement.
European cloud sovereignty certification
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Legal and Technical Foundations of the 24% Control Rule
SecNumCloud is a government-backed qualification that builds on ISO 27001 but adds specific legal sovereignty requirements, including EU data residency, audited key custody, and immunity from non-EU law. The ownership cap—less than 24% foreign control—is a distinctive feature designed to safeguard European legal jurisdiction.
Other frameworks like BSI C5 focus on security controls and disclosure of jurisdiction but do not impose ownership limits. AWS’s European Sovereign Cloud, for example, maintains compliance with C5 but remains subject to US law, illustrating the distinction between security certifications and sovereignty controls.
The rule’s arithmetic nature makes it a strict control that is difficult to achieve, with providers like OVHcloud and Outscale actively pursuing certification amid complex ownership restructuring.
“The 24% rule is the most straightforward test of ownership control, expressed as an arithmetic cap, and it is the only sovereignty measure in SecNumCloud.”
— Thorsten Meyer
ISO 27001 compliance cloud security
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Unresolved Questions About the 24% Control Limit’s Effectiveness
It is still unclear how effectively the 24% ownership cap will prevent non-EU control in practice, especially as providers restructure ownership to qualify. The long-term impact on foreign investment and control remains uncertain, and enforcement mechanisms are still being tested.
Additionally, the extent to which the rule will influence global cloud market dynamics and whether it will serve as a model for other jurisdictions are still developing issues.
As an affiliate, we earn on qualifying purchases.
Next Steps for Certification Adoption and Policy Development
More providers are expected to pursue SecNumCloud certification as it becomes mandatory for certain sectors. The French government and ANSSI are likely to refine implementation guidelines and enforcement practices. International providers may further adapt ownership structures to meet the 24% rule, and discussions about its broader influence on European data sovereignty are ongoing.
Observers will monitor the certification’s impact on market competition, foreign investment, and the evolution of sovereignty standards in cloud and AI services.
As an affiliate, we earn on qualifying purchases.
Key Questions
What is the purpose of the 24% ownership rule in SecNumCloud?
The rule aims to prevent non-EU control over providers hosting sensitive European data, thereby safeguarding European legal sovereignty.
How many providers currently hold SecNumCloud certification?
As of mid-2026, about nine to ten providers, including OVHcloud and Outscale, have obtained the qualification.
Does the 24% rule guarantee security or compliance?
No, it specifically tests ownership control; security compliance is assessed separately through other frameworks like ISO 27001 or C5.
Can US-based companies qualify for SecNumCloud?
They can only qualify if they restructure ownership to ensure foreign control remains below 24%, as US companies are generally ineligible due to jurisdictional restrictions.
Source: ThorstenMeyerAI.com
