Understanding The 24% Rule In AI Sovereignty Certifications

France’s national cybersecurity agency, ANSSI, has implemented a new sovereignty criterion within its SecNumCloud framework, involving a 24% ownership cap on foreign control of cloud and AI providers. This rule is designed to ensure that providers operating in France and the EU are under European legal sovereignty, addressing concerns over extraterritorial laws and foreign influence. The rule is now a key factor for vendors seeking SecNumCloud qualification, which is mandatory for hosting sensitive public-sector data in France.

The 24% ownership rule is part of the SecNumCloud qualification, created by ANSSI in 2016 and now in its latest version 3.2. It requires that capital and voting rights held by entities outside the EU do not exceed 24% individually, or 39% collectively. This arithmetic threshold is the first of its kind, directly addressing ownership and control rather than just technical security practices.

SecNumCloud is not a traditional certification but a qualification issued after an audit by authorized evaluators, backed by the French government. It mandates EU data domicile, EU-only data storage, audited key custody, and immunity from non-EU extraterritorial law. As of mid-2026, approximately nine to ten providers, including OVHcloud and Scaleway, hold an active qualification, with more in progress. The framework is now a legal requirement for hosting sensitive French public-sector data and is expected to expand to other critical sectors.

Implications of the 24% Ownership Cap for Data Sovereignty

The 24% ownership rule represents a novel approach to legal sovereignty in cloud and AI services within Europe. It shifts the focus from technical security controls to ownership and control, directly addressing concerns over foreign influence and extraterritorial laws. For providers, complying with this rule means restructuring ownership or control mechanisms, often involving complex corporate arrangements. For users, it offers a higher assurance that data stored and processed within these providers remains under European jurisdiction, reducing risks associated with laws like the CLOUD Act. As the framework gains prominence, it could influence global standards on sovereignty and data control, especially in sensitive sectors like health, energy, and finance.

Background and Development of the Sovereignty Control Measures

The concept of sovereignty in cloud computing has gained prominence amid increasing concerns over foreign legal influence and data localization. France’s SecNumCloud initiative, launched in 2016, was designed to create a government-backed security qualification that goes beyond technical controls to address legal jurisdiction. The critical innovation was the ownership cap, introduced in version 3.2, which limits foreign control to 24%. This development follows broader European efforts to assert digital sovereignty and reduce dependence on non-EU providers, especially American hyperscalers. While other frameworks like BSI C5 focus on security controls, SecNumCloud emphasizes control and ownership as the key to sovereignty.

“The qualification commits the French State to the security level of the service and ensures control remains within the EU jurisdiction.”

— Anssi official, speaking on SecNumCloud

Unresolved Questions About the 24% Control Limit

It remains unclear how widely the 24% ownership rule will be adopted outside France or whether other European countries will implement similar controls. The practical enforceability of the cap, especially in complex corporate structures, is also still being evaluated. Additionally, the impact on US-based hyperscalers and their ability to qualify under the framework is uncertain, given their corporate ownership structures and the possibility of strategic control arrangements. The long-term influence of this regulation on global data sovereignty standards is still developing, and legal challenges or adaptations may arise.

Next Steps for Providers and Policy Development

As of mid-2026, more providers are expected to seek SecNumCloud qualification, navigating the ownership restrictions. The French government is likely to refine enforcement and possibly expand the scope to other sectors. International providers will need to adapt their ownership structures to meet the 24% cap if they aim to access the French and broader European markets. Meanwhile, other European nations may consider similar sovereignty measures, potentially leading to a patchwork of regulations. Monitoring the evolution of these controls and their legal interpretations will be crucial for stakeholders.

Key Questions

What is the main purpose of the 24% ownership rule?

The rule aims to ensure European legal sovereignty over cloud and AI services by limiting foreign control, reducing reliance on non-EU laws and extraterritorial influence.

Does holding a SecNumCloud qualification mean a provider is immune from US laws?

No. The qualification guarantees compliance with French legal sovereignty requirements but does not exempt providers from US laws like the CLOUD Act if they are US-based or controlled by US entities.

How does the ownership cap affect US tech giants operating in Europe?

US companies must structure ownership or control arrangements to keep foreign control below 24%, which may involve joint ventures or other corporate strategies to meet the requirement.

Is this ownership rule unique to France?

Yes, it is a specific feature of France’s SecNumCloud framework, but it could influence broader European policies on data sovereignty and control in the future.

Source: ThorstenMeyerAI.com