Are AI Sovereignty Certifications Reliable? The 24% Rule Provides Clues

French cybersecurity authorities have implemented a unique sovereignty test for cloud providers: the 24% ownership rule. This rule is part of the SecNumCloud qualification, which verifies not only security practices but also legal control over data, making it a critical benchmark for European data sovereignty.

SecNumCloud, managed by France’s ANSSI, is a government-issued qualification that combines rigorous security requirements with legal sovereignty measures. Unlike typical certifications, it explicitly tests ownership and control by limiting foreign ownership to 24% per entity and 39% collectively. This arithmetic-based rule is designed to prevent foreign governments from exerting control over data hosted within the EU.

As of mid-2026, around nine to ten providers, including OVHcloud, Outscale, and Scaleway, hold an active SecNumCloud qualification. The framework is mandatory for hosting sensitive French public-sector data and is being extended to critical infrastructure sectors, such as energy and finance, under France’s Cloud au Centre doctrine.

In contrast, certifications like BSI C5, while demonstrating security controls, do not address jurisdictional sovereignty directly. C5 requires disclosure of jurisdiction but does not impose immunity from foreign laws, meaning providers with US parent companies still face residual CLOUD Act risks.

US hyperscalers like AWS, Microsoft, and Google have adapted by creating separate, EU-based entities with controlled ownership structures to meet the 24% rule, such as Thales-Google S3NS and Capgemini-Orange Bleu ventures. These arrangements aim to comply with sovereignty requirements without relinquishing control.

Implications of the 24% Ownership Rule for European Cloud Sovereignty

The 24% ownership threshold provides a clear, arithmetic measure of legal sovereignty, making it a practical tool for assessing control over data and infrastructure within the EU. This approach shifts the focus from security controls alone to ownership and jurisdiction, which are critical for compliance with European data laws and for safeguarding against foreign legal interference.

For organizations operating in regulated sectors, these certifications influence procurement decisions, as they impact data sovereignty and legal risk. The rule’s strictness underscores the challenge US-based providers face in meeting European sovereignty standards without restructuring ownership or control mechanisms.

European Frameworks and the Shift Toward Legal Sovereignty Testing

Traditional security certifications like ISO 27001, SOC 2, and BSI C5 mainly attest to security practices and operational controls. They do not address jurisdictional sovereignty directly. In contrast, France’s SecNumCloud, created in 2016 and now in version 3.2, introduces a legal sovereignty dimension by requiring EU domicile, EU-only data storage, and a maximum foreign ownership threshold of 24% per entity.

The framework is part of a broader European effort to establish independent, sovereign cloud infrastructure, especially for sensitive public data. The requirement for government-backed qualifications, issued after rigorous audits, aims to prevent foreign legal influence over data stored within the EU.

While US hyperscalers have sought to adapt through joint ventures and controlled ownership structures, the sovereignty test remains a significant hurdle, highlighting the tension between operational security standards and legal jurisdiction.

“The 24% ownership rule is the only practical, arithmetic test of sovereignty in the European cloud landscape, offering a tangible measure of control over foreign influence.”

— Thorsten Meyer

Remaining Questions About Certification Reliability and Enforcement

While the 24% rule offers a concrete measure of ownership control, it remains unclear how effectively it prevents foreign governments from exerting influence, especially through complex ownership structures or indirect control. The long-term enforcement and compliance monitoring of these rules are still evolving, and the impact on US hyperscalers adapting their structures is not fully known.

Additionally, the broader acceptance of these sovereignty measures outside France and Europe, and their influence on global cloud procurement practices, are still developing areas of debate and policy evolution.

Future Developments in European Cloud Sovereignty Standards

Expect further refinement of the ownership and sovereignty criteria, potentially expanding beyond the current 24% cap. As more providers seek SecNumCloud qualification, the framework’s influence will grow, possibly leading to broader adoption across Europe.

Regulatory bodies may also introduce additional measures to enforce compliance and transparency, including stricter audits and international cooperation to monitor ownership structures. The ongoing evolution of US hyperscaler strategies, such as joint ventures and local entities, will be closely watched to assess their effectiveness in meeting sovereignty standards.

Key Questions

What is the significance of the 24% ownership rule?

The 24% ownership rule is a tangible, arithmetic measure of legal sovereignty, preventing foreign governments from exerting control over EU-hosted data by limiting individual foreign ownership stakes.

Does certification guarantee immunity from foreign laws?

No. Certifications like SecNumCloud and C5 demonstrate security controls and disclose jurisdiction, but they do not eliminate legal risks such as the CLOUD Act or other extraterritorial laws.

Can US hyperscalers meet European sovereignty standards?

Yes, US providers can comply by restructuring ownership and control through joint ventures or EU-based entities, but they remain subject to US laws unless they meet the strict ownership thresholds and control criteria.

Is SecNumCloud mandatory for all cloud providers in Europe?

SecNumCloud is mandatory for hosting sensitive French public-sector data and is being extended to critical infrastructure sectors, but it is not yet universally required across all European countries.

How does C5 differ from SecNumCloud?

C5 certifies control and operational security but does not address jurisdictional sovereignty directly. SecNumCloud explicitly tests ownership and legal control, including the 24% ownership cap.

Source: ThorstenMeyerAI.com