TL;DR
The 24% ownership threshold in France’s SecNumCloud framework is under scrutiny, as industry experts debate whether it effectively ensures legal sovereignty. The rule aims to limit foreign control, but its practical impact remains uncertain.
Industry experts and legal analysts are questioning the effectiveness of France’s 24% ownership cap in the SecNumCloud sovereignty framework. The rule, designed to limit foreign control over providers hosting sensitive data in the EU, is now facing scrutiny over whether it genuinely guarantees legal sovereignty. This debate matters because it directly impacts how companies assess data security and jurisdictional risks in European cloud services.
The SecNumCloud framework, created by France’s ANSSI, includes a 24% ownership threshold for non-EU companies, intended to prevent foreign governments from exerting control over cloud providers hosting sensitive French and European data. This ownership cap is expressed as a simple arithmetic limit on voting rights and shareholding, making it a clear and checkable criterion. As of mid-2026, around ten providers, including OVHcloud and Outscale, have obtained this qualification, which is mandatory for hosting certain public sector data in France.
However, critics argue that the ownership rule alone does not address the broader legal sovereignty issues. While the cap limits direct ownership, it does not prevent foreign governments from influencing control through other means, such as contractual arrangements or indirect influence. Furthermore, the rule does not alter the underlying jurisdictional laws—meaning providers could still be subject to extraterritorial laws like the US CLOUD Act, regardless of ownership percentages. Industry insiders emphasize that the rule’s simplicity, while operationally straightforward, may give a false sense of security regarding sovereignty.
Implications of the 24% Control Limit for Cloud Sovereignty
The debate over the 24% ownership cap is significant because it challenges the assumption that numerical ownership limits alone can guarantee legal sovereignty. For companies and governments relying on SecNumCloud-certified providers, understanding whether this rule effectively prevents foreign legal influence is crucial. If the ownership cap is insufficient, it could undermine trust in the framework’s ability to protect sensitive data from foreign jurisdictional reach, potentially affecting procurement decisions and international data governance policies.
As an affiliate, we earn on qualifying purchases.
Legal and Technical Foundations of the 24% Rule
The SecNumCloud framework, established by France’s ANSSI in 2016, aims to ensure both security and sovereignty for cloud providers handling sensitive EU data. Unlike typical security certifications like ISO 27001 or C5, SecNumCloud is a qualification backed by government oversight, including legal sovereignty requirements. A key component is the ownership threshold, which restricts foreign control by capping voting rights at 24% individually and 39% collectively. This rule is intended to prevent foreign governments from exerting control via ownership, but it does not address other forms of influence or jurisdictional law, raising questions about its overall effectiveness.
Industry has observed that US-based hyperscalers, such as AWS, remain subject to US law despite obtaining certifications like C5 or participating in sovereignty initiatives through joint ventures that comply with the 24% rule. These arrangements, like Thales-Google S3NS or Capgemini-Orange Bleu, demonstrate attempts to work within the rule’s constraints but do not eliminate legal risks stemming from extraterritorial laws.
“The rule is designed to limit foreign influence, but we recognize that legal jurisdiction remains a complex challenge that no single control can fully resolve.”
— A French government official involved in SecNumCloud
EU data sovereignty cloud provider
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Effectiveness of the 24% Rule in Ensuring Sovereignty
It is still unclear whether the 24% ownership threshold effectively prevents foreign governments from exerting control or influence over cloud providers. Critics argue that indirect influence, contractual arrangements, or legal jurisdiction laws could undermine sovereignty despite ownership limits. The actual impact of these controls on legal sovereignty remains a subject of ongoing debate and analysis.
government-approved cloud security solutions
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Next Steps in Evaluating Sovereignty Controls
Regulators, industry stakeholders, and legal experts are expected to continue scrutinizing the effectiveness of the 24% rule through audits, legal analyses, and real-world case studies. Further developments may include refining the rule, introducing supplementary controls, or revising certification standards to better address jurisdictional risks. Additionally, companies will likely increase transparency around control and influence structures to better assess sovereignty risks in their cloud providers.
As an affiliate, we earn on qualifying purchases.
Key Questions
Does the 24% ownership rule guarantee legal sovereignty?
No, the rule limits ownership but does not eliminate other forms of influence or jurisdictional risks. Legal sovereignty depends on multiple factors beyond ownership percentages.
Can foreign governments still influence providers with less than 24% ownership?
Yes, influence can occur through contractual arrangements, indirect control, or legal jurisdiction laws, which are not addressed solely by the ownership cap.
Why is the ownership threshold expressed as a percentage?
It provides a clear, arithmetic, and checkable control limit, making compliance straightforward for providers and auditors.
Are US-based hyperscalers eligible for SecNumCloud?
Generally no, because US companies are subject to US laws like the CLOUD Act. They can participate through joint ventures that comply with the ownership rules, but full sovereignty is more complex.
What are the implications for companies hosting sensitive data in France?
They must ensure their providers meet the sovereignty standards, including ownership and legal controls, to comply with French regulations and avoid jurisdictional risks.
Source: ThorstenMeyerAI.com
