Why The 24% Rule Matters For AI Sovereignty Certification Validity

The 24% ownership rule in France’s SecNumCloud framework is now a decisive factor for legal sovereignty in cloud and AI services. This criterion, established by the French cybersecurity agency ANSSI, enforces a strict ownership cap to ensure data control remains within European jurisdiction. The rule is shaping how providers structure their control and ownership to meet sovereignty requirements, impacting major cloud vendors and AI providers operating in Europe.

SecNumCloud, created by France’s ANSSI in 2016, is a qualification that tests not only security practices but also ownership sovereignty. The key measure is that companies with control over services must have less than 24% of their capital or voting rights held by non-EU entities individually, or 39% collectively. This arithmetic ownership cap ensures that European control is maintained, limiting foreign influence over critical data infrastructure.

As of mid-2026, about ten providers have obtained SecNumCloud qualification, including OVHcloud, Outscale, and Scaleway. Major US-based providers, such as Amazon Web Services, remain ineligible for SecNumCloud in its native form due to their ownership structures, but have adapted through joint ventures and control arrangements that comply with the 24% rule. Notably, AWS’s European Sovereign Cloud operates entirely within the EU but remains subject to US law.

Implications of the 24% Ownership Cap for European Cloud and AI

The 24% ownership rule fundamentally shifts how European data sovereignty is enforced. Unlike traditional security certifications that focus on technical controls, this arithmetic limit directly influences ownership structures and control rights. It aims to prevent foreign governments from exerting legal influence over critical data services, especially in sensitive sectors like health, energy, and finance. This measure is likely to shape the competitive landscape of cloud providers in Europe, favoring those with local ownership and control, and could lead to increased reliance on European or compliant providers for AI and cloud infrastructure.

For AI developers and users, the rule underscores the importance of ownership transparency and legal sovereignty. It also signals a move toward regulatory-driven data control rather than solely technical security standards, affecting how AI models are trained, hosted, and governed within Europe.

European Sovereignty Frameworks and the Role of Ownership Limits

The SecNumCloud framework is part of broader European efforts to establish digital sovereignty amid geopolitical tensions. Unlike other certifications such as ISO 27001 or BSI C5, which verify security practices, SecNumCloud’s ownership control requirement introduces a legal sovereignty test based on arithmetic ownership caps. This approach responds to concerns about foreign influence and extraterritorial laws, like the US CLOUD Act, which can compel data access regardless of technical safeguards.

While US hyperscalers like AWS and Microsoft have achieved various security attestations, their ownership structures often exceed the 24% threshold, prompting them to establish joint ventures or control arrangements that comply with the rule. This development reflects a strategic shift in how international cloud providers adapt to European sovereignty demands, emphasizing control and ownership over mere security compliance.

“The 24% ownership rule is a game-changer because it shifts the focus from technical security to legal sovereignty, fundamentally altering how providers structure control.”

— Thorsten Meyer, AI security expert

Unclear Aspects of the 24% Control Mechanism

It remains unclear how enforcement of the ownership cap will evolve, especially with complex joint ventures and control arrangements involving multiple entities. The precise legal and operational implications for providers that exceed or approach the threshold are still being tested in practice. Additionally, the extent to which this rule will influence market dynamics and provider strategies beyond France is still emerging, as other European countries consider adopting similar sovereignty measures.

Next Steps in European AI and Cloud Sovereignty Regulation

Expect ongoing adoption and refinement of the ownership rule as more providers seek SecNumCloud qualification. Regulatory bodies are likely to clarify enforcement mechanisms, including audits and control assessments. Additionally, the development of European-led AI sovereignty initiatives may integrate ownership controls into broader frameworks regulating AI development and deployment. The push for more providers to meet the 24% threshold will influence market competition and could accelerate the emergence of more European-controlled cloud services.

Key Questions

Why is the 24% ownership cap considered more important than traditional security certifications?

The 24% ownership cap directly addresses legal sovereignty by controlling who ultimately owns and controls the service, reducing foreign influence regardless of security measures.

Can US-based cloud providers meet the sovereignty requirements under the 24% rule?

Most US providers cannot meet the ownership cap directly due to their structure but can create control arrangements or joint ventures that comply with the 24% limit, as seen with AWS’s European Sovereign Cloud.

How does the ownership rule impact AI development in Europe?

It emphasizes local ownership and control, encouraging European AI providers and collaborations that adhere to sovereignty standards, potentially shaping the AI ecosystem’s structure.

Will the 24% rule be adopted outside France?

It is uncertain; while other European countries are considering similar measures, the specific arithmetic control approach is currently unique to France’s SecNumCloud framework.

Source: ThorstenMeyerAI.com