TL;DR
European sovereignty standards like SecNumCloud include a strict ownership cap of 24%, questioning whether certifications truly guarantee legal sovereignty. This affects providers and users in regulated industries.
European security standards for cloud and AI services now include a legal ownership cap of 24%, a rule that directly tests sovereignty by limiting foreign control. This rule is part of the SecNumCloud framework, created by France’s national cybersecurity agency, ANSSI, and is already impacting providers operating within the EU. The development raises questions about whether certifications alone can guarantee legal sovereignty or if ownership restrictions are the true measure.
SecNumCloud, established in 2016 and now at version 3.2, is a qualification rather than a traditional certification, issued after an audit by PASSI-accredited evaluators. It emphasizes legal sovereignty by requiring providers to have EU domicile, EU-only data storage, and immunity from non-EU extraterritorial laws. The key criterion is the ownership cap of 24%, which limits the share of voting rights held by non-EU entities, effectively controlling foreign influence over providers.
As of mid-2026, about ten providers, including OVHcloud and Outscale, have secured an active SecNumCloud qualification, with others in the pipeline. The rule is mandatory for hosting sensitive French public-sector data and is being pushed for broader applications across vital sectors under EU directives like NIS2. Notably, US-based hyperscalers like AWS remain subject to US law, even if they hold European certifications, because certifications do not alter jurisdictional control.
Implications of the 24% Ownership Cap for AI Sovereignty
The 24% ownership rule fundamentally challenges the assumption that security certifications alone establish legal sovereignty. It makes clear that ownership control and jurisdiction are decisive factors, especially for organizations in regulated sectors. This impacts how companies evaluate their cloud and AI providers, emphasizing ownership structure over certification badges. For European regulators and clients, the rule underscores the importance of ownership transparency and jurisdictional immunity, shaping future procurement and compliance strategies.
EU data sovereignty cloud provider
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
European Sovereignty Frameworks and Certification Limits
Traditional security standards like ISO 27001, SOC 2, and BSI C5 focus on security practices—access controls, encryption, incident response—without addressing jurisdictional control. In contrast, France’s SecNumCloud explicitly incorporates sovereignty criteria, including the ownership cap, to ensure providers are not under foreign legal influence. US providers, despite holding European certifications, remain subject to US laws such as the CLOUD Act, unless ownership restrictions are enforced.
The introduction of the 24% rule is a response to the need for true sovereignty in sensitive sectors, as the EU pushes for more control over data and AI infrastructure within its borders. This marks a significant shift from purely technical compliance to legal and ownership control, influencing procurement policies across Europe.
AI sovereignty certification tools
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Remaining Questions About Certification Authenticity and Implementation
It is still unclear how many providers will be able to meet the 24% ownership threshold in practice, given the complexity of ownership structures. Additionally, questions remain about how this rule will be enforced globally, especially for multinational companies with diverse ownership arrangements. The long-term impact on US-based hyperscalers and their European operations is also uncertain, as they must adapt control structures to comply.
As an affiliate, we earn on qualifying purchases.
Next Steps for Providers and Regulators in Sovereignty Enforcement
Providers aiming for SecNumCloud qualification will need to reassess ownership structures, potentially restructuring control to stay within the 24% limit. Regulators are expected to tighten oversight and expand the rule’s scope, possibly extending it to other sectors and jurisdictions. Monitoring how providers adapt and whether new ownership arrangements emerge will be key to understanding the future landscape of AI sovereignty in Europe.
cybersecurity compliance audit tools
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Key Questions
Does holding a security certification guarantee legal sovereignty?
No, certifications like ISO 27001 or C5 focus on security practices. They do not alter jurisdictional control or ownership structure, which are critical for sovereignty.
What is the significance of the 24% ownership limit?
The 24% rule limits foreign control over providers, ensuring legal sovereignty by preventing non-EU entities from holding majority voting rights.
Can US-based cloud providers meet the sovereignty rules?
While they can hold certifications, US providers remain subject to US law unless they restructure ownership to comply with the 24% cap, which is complex and challenging.
Will the 24% rule affect non-European cloud providers?
Yes, any provider wishing to qualify under SecNumCloud or similar frameworks will need to ensure ownership control within the specified limits to demonstrate sovereignty.
Is the ownership rule legally binding?
Yes, as part of the SecNumCloud qualification issued by ANSSI, the 24% ownership cap is a legal requirement for providers seeking certification within France and potentially broader EU applications.
Source: ThorstenMeyerAI.com
