TL;DR
France’s SecNumCloud framework is the only European certification that tests whether a cloud or AI provider can be compelled by a foreign government to surrender data, enforcing it through a 24% cap on individual non-EU ownership. Major providers including AWS, Microsoft Azure and Google Cloud are structurally ineligible in their native form, while the proposed Cloud and AI Development Act (CADA) could soon replace the patchwork of national labels with Union-wide assurance levels. The analysis, published by Thorsten Meyer AI on 16 July 2026, urges buyers to ask vendors about ownership rather than security badges.
A single number — 24% — has become the sharpest dividing line in European cloud and AI procurement, according to an analysis published by Thorsten Meyer AI on 16 July 2026. The figure is the maximum share of capital and voting rights that a single non-EU company may hold in a provider qualified under SecNumCloud, the French framework that remains the only European certification testing whether a foreign government can legally compel access to customer data. For buyers in regulated European industries, the report argues, that ownership question — not the security badges vendors display — is what actually decides whether data can be entrusted to a provider.
The SecNumCloud rule is precise and checkable from a company’s capitalization table: capital and voting rights held by companies based outside the EU must not exceed 24% individually or 39% collectively. The qualification, administered by French cybersecurity agency ANSSI, also requires EU domicile, EU-only storage and audited key custody across more than 360 criteria in its current version 3.2. Only around nine to ten providers hold it, including OVHcloud, Outscale, Scaleway, Numspot and Cloud Temple.
By contrast, AWS, Microsoft Azure and Google Cloud are structurally ineligible in their native form, the analysis notes — which is why sovereign offerings such as S3NS (Thales plus Google) and Bleu (Capgemini plus Orange, built on Azure) were created to put non-EU technology under European control. The report also flags untested cases: the Cohere–Aleph Alpha combination sits at roughly 90% Canadian ownership, about four times over the cap, while Mistral’s non-EU venture capital share has never been publicly tested against the threshold. The analysis stresses these are open questions drawn from public information, not assertions of non-compliance.
Every other widely displayed badge tests practice rather than ownership, the report explains. ISO 27001, SOC 2, BSI C5 and Gaia-X certify that a provider runs competently and securely; none certifies jurisdictional immunity. Germany’s C5 requires disclosure of which laws reach a provider — but, as the analysis puts it, C5 tells you the gun is in the room, while SecNumCloud requires that there be no gun.
The 24% rule: why most “sovereign cloud” certifications don’t test sovereignty
ISO 27001. SOC 2. BSI C5. Gaia-X. Every badge real, audited, correctly displayed — and not one answers the question that decides the deal: can a foreign government compel your data? Exactly one European framework tests that. It does it with a number.
C5 does cover place of jurisdiction, data location & disclosure obligations. It requires you to declare which law reaches you. C5 tells you the gun is in the room.
Requires that no non-EU law can reach you at all — enforced by the ownership cap. SecNumCloud requires there be no gun. That’s the whole difference.
The proposed Cloud and AI Development Act (COM(2026) 502) would set four Union assurance levels for public procurement. Its own recitals concede the point: Cybersecurity Act certification “is not suited for addressing sovereignty concerns.” National labels won’t be banned — but a SecNumCloud provider would still need separate Article 17 recognition. If it passes, the badge on the vendor’s website stops mattering and the assurance level starts. Meanwhile ANSSI + BSI have jointly committed to common criteria specifying where failure is disqualifying.
Microsoft showed the gap better than any critic: May 2025 — encryption makes access “technically impossible.” One month later — cannot guarantee immunity from US authorities. Thirty days between the marketing and the law. SecNumCloud doesn’t ban American technology — it forces a change of control over it (hence S3NS = Thales+Google, Bleu = Capgemini+Orange on Azure). Is it also protectionism? Partly, yes — and that critique is exactly why EUCS High+ died. Both things are true. Don’t ask if a provider is “sovereign” — the word has been marketed into meaninglessness. Ask the arithmetic: who owns you, and what law reaches you? Then check whether the answer is above or below 24% — including for the European champions nobody has asked.
Why Ownership Now Decides European Cloud Deals
The distinction matters because certifications prove practice while only SecNumCloud tests control. A vendor can hold ISO 27001, SOC 2 Type II, BSI C5 and Gaia-X membership — all real, all independently audited — and still be legally reachable by a foreign government. For buyers in regulated European industries handling sensitive data under rules such as DORA, choosing a provider that fails the ownership test can mean documenting residual CLOUD Act exposure in every data protection impact assessment rather than eliminating it.
The stakes are rising for AI sovereignty testing specifically, as European AI champions attract large volumes of non-EU capital. The analysis warns that sovereign infrastructure sitting under a non-EU-controlled software layer is not a sovereign stack — and that buyers should check the arithmetic at every layer: who owns the provider, and what law reaches it. If a vendor cannot immediately state its ultimate parent and its non-EU ownership percentage, the report argues, the rest of the meeting is theatre.
European cloud security certification
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
How Europe’s Certification Landscape Split in Two
Europe’s cloud assurance labels have divided into two camps. One certifies how a company operates — access controls, encryption, incident response, audit trails. The other, consisting solely of SecNumCloud, asks who ultimately controls the company. The gap was illustrated by Microsoft’s own statements in 2025, cited in the analysis: in May of that year the company said encryption made access to customer data “technically impossible,” and roughly one month later acknowledged it could not guarantee immunity from US authorities.
Efforts to close the gap at EU level have faltered. The draft EU Cybersecurity Certification Scheme (EUCS) had its “High+” sovereignty tier stripped out during negotiations — a decision driven partly by criticism that ownership requirements amount to protectionism, a critique the analysis concedes has some force. EUCS remains unadopted, and even its High level does not equal CLOUD Act immunity. Meanwhile ANSSI and Germany’s BSI have jointly committed to developing common criteria that specify where failure is disqualifying.
“Cybersecurity Act certification is not suited for addressing sovereignty concerns.”
— Recitals of the proposed Cloud and AI Development Act, COM(2026) 502
Open Questions Around CADA and Untested Providers
Several elements remain unresolved. CADA is still a proposal, and its final shape — including how national labels such as SecNumCloud will be treated — is not settled; as drafted, even a SecNumCloud-qualified provider would need separate recognition under the act’s Article 17. EUCS remains unadopted, with no confirmed timeline. Ownership questions around individual providers, including Mistral’s non-EU venture share and the Cohere–Aleph Alpha structure, are open questions based on public information rather than formal findings of non-compliance. And the long-term tension between sovereignty requirements and protectionism — the critique that killed the EUCS High+ tier — has not been resolved.
What Buyers and Vendors Should Watch in 2026
The immediate milestone is the legislative progress of CADA (COM(2026) 502), which would establish four Union assurance levels for public procurement. If it passes, the badge on a vendor’s website stops mattering and the assurance level starts. In parallel, the ANSSI–BSI joint work on common criteria will define which failures are disqualifying — a de facto European standard in the making. The analysis recommends buyers put six questions to every vendor now: who the ultimate parent is and where it is incorporated; whether the vendor will state in writing that it is not subject to non-EU extraterritorial law; what percentage of capital and voting rights is non-EU held; who holds the encryption keys and whether they can be compelled; which certifications test ownership versus practice; and what the vendor’s CADA recognition roadmap looks like. The report advises treating the framework as arithmetic, not adjectives: ask who owns the provider and what law reaches it, then check whether the answer sits above or below 24%.
Key Questions
What is the 24% rule in European cloud certification?
It is SecNumCloud’s ownership test: capital and voting rights held by companies based outside the EU must not exceed 24% individually or 39% collectively. The rule is designed so that no non-EU government can compel a qualified provider to grant access to customer data.
Why don’t ISO 27001 or SOC 2 prove cloud sovereignty?
Those frameworks certify security practice — controls, processes and incident response — but say nothing about jurisdiction. A fully certified provider can still be legally compelled by a foreign government to produce data, which is why the analysis says certifications prove practice while only SecNumCloud tests ownership.
Can AWS, Azure or Google Cloud ever qualify under SecNumCloud?
Not in their native corporate form, because of their US ownership. The framework does not ban American technology — it forces a change of control, which is why structures such as S3NS (Thales with Google) and Bleu (Capgemini and Orange on Azure) were built to place the technology under European ownership.
What is CADA and how would it change procurement?
The proposed Cloud and AI Development Act (COM(2026) 502) would create four Union-wide assurance levels for public procurement. Its own recitals state that existing cybersecurity certification is not suited for addressing sovereignty concerns. It remains a proposal, and national labels would not be banned — but providers would need separate recognition under the new regime.
Is the SecNumCloud approach protectionism?
Partly, according to the analysis, which acknowledges the critique has merit — it is the same argument that led to the EUCS “High+” sovereignty tier being stripped out. The report’s position is that both things are true: the rule restricts non-EU ownership and it answers a jurisdictional question no other certification addresses. The analysis is not legal advice, and buyers are advised to consult counsel.
Source: Thorsten Meyer AI
