TL;DR
The 24% ownership rule, part of France’s SecNumCloud framework, enforces ownership restrictions to ensure legal sovereignty over cloud and AI services. This development shapes European AI certification standards and controls foreign influence.
The 24% ownership rule is a key component of France’s SecNumCloud framework, which requires providers to have less than 24% ownership by non-EU entities to qualify for sovereignty certification. This rule is now influencing European AI and cloud service standards, aiming to ensure legal sovereignty and data control over foreign-controlled providers.
SecNumCloud, created by France’s ANSSI in 2016, is not a traditional certification but a government-issued qualification that verifies compliance with strict security and sovereignty criteria. The ownership cap of 24% is the defining feature, designed to prevent foreign legal jurisdictions from exerting influence over critical services. As of mid-2026, about nine providers, including OVHcloud and Outscale, hold active SecNumCloud qualifications, with more in the pipeline.
US-based hyperscalers like AWS and Microsoft have adapted by creating joint ventures where control is shifted to European entities, thus meeting the ownership threshold. For example, Thales and Google’s S3NS and Capgemini with Orange’s Bleu are operating within these rules, with control held by European firms despite US parentage. These arrangements exemplify how the 24% rule is shaping provider strategies and certification standards across Europe.
How the 24% Ownership Cap Shapes European AI Control
The 24% ownership rule directly impacts the structure of AI and cloud service providers in Europe, emphasizing legal sovereignty over mere security practices. It limits foreign influence, ensuring data remains under European jurisdiction, which is crucial for sensitive sectors like health, energy, and finance. This regulation could set a precedent for broader AI sovereignty standards, influencing global data governance and international tech competition.
European cloud sovereignty certification
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Background on European Sovereignty Certification Frameworks
The concept of sovereignty in cloud and AI services gained prominence with frameworks like France’s SecNumCloud and Germany’s BSI C5. SecNumCloud, issued by ANSSI, emphasizes legal control through ownership restrictions, data location, and immunity from non-EU law. BSI C5, developed by Germany’s BSI, focuses on security controls and transparency about jurisdiction but does not restrict ownership directly. As European regulators seek to reduce dependency on US tech giants, these frameworks are becoming central to procurement and strategic planning.
The 24% rule is a distinctive feature of SecNumCloud, introduced to prevent foreign control and ensure legal sovereignty. It has already influenced provider strategies, with joint ventures designed to meet the ownership threshold while maintaining operational control within Europe.
“SecNumCloud is designed to ensure that critical cloud services in France are under European control, with ownership caps serving as a clear boundary.”
— ANSSI representative
As an affiliate, we earn on qualifying purchases.
Unclear Long-Term Implications for Global AI Standards
It remains unclear how broadly the 24% ownership rule will influence international AI certification standards beyond Europe. While it is shaping provider strategies within France and neighboring countries, whether similar ownership restrictions will become a global norm or influence international agreements is still uncertain. Additionally, the full impact on US and other non-European providers adapting control structures is evolving and may face legal or political challenges.
As an affiliate, we earn on qualifying purchases.
Next Steps in European AI Sovereignty Certification Development
Regulators are expected to expand the adoption of ownership-based sovereignty standards across Europe, particularly targeting critical infrastructure sectors. More providers are likely to seek SecNumCloud qualification or develop similar control structures to meet sovereignty requirements. International discussions on data sovereignty and AI regulation are also anticipated to influence the evolution of these standards, potentially leading to broader global frameworks by 2028.
cloud security certification France
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Key Questions
What is the 24% ownership rule?
The 24% ownership rule restricts non-EU ownership in providers seeking SecNumCloud qualification, ensuring no single non-EU entity holds more than 24% of voting rights, thereby safeguarding European legal sovereignty over critical services.
How does the 24% rule affect US tech companies?
US tech companies must create joint ventures or control structures that limit foreign ownership to under 24%, often by shifting control to European entities, to qualify for European sovereignty certifications like SecNumCloud.
Is the 24% rule legally binding?
Yes, it is a mandatory requirement for SecNumCloud qualification, backed by government authority, and is part of France’s legal framework for critical infrastructure security.
Will this rule influence global AI standards?
It is uncertain. While it currently shapes European provider strategies, whether similar ownership restrictions will become a global norm remains to be seen, with ongoing international policy discussions likely to influence future standards.
What are the main differences between SecNumCloud and C5?
SecNumCloud emphasizes ownership control, legal sovereignty, and data location, while C5 focuses on security controls and transparency about jurisdiction without restricting ownership levels directly.
Source: ThorstenMeyerAI.com
