TL;DR
The 24% ownership threshold used in France’s SecNumCloud framework raises doubts about the sovereignty claims of cloud providers. This challenges the assumption that certifications alone guarantee legal immunity from non-EU laws, especially for US-based companies operating in Europe.
European cybersecurity frameworks, notably France’s SecNumCloud, use a 24% ownership threshold to determine legal sovereignty for cloud providers. This criterion is now calling into question the sovereignty claims of some providers, especially US-based hyperscalers attempting to meet EU legal requirements. The development impacts the credibility of certifications that focus solely on security practices but do not address legal jurisdiction.
SecNumCloud, managed by France’s ANSSI, is a government-issued qualification that emphasizes legal sovereignty through ownership control, requiring companies to hold less than 24% of voting rights if they are not based in the EU. This ownership cap is a straightforward, measurable arithmetic test, designed to prevent non-EU control and ensure compliance with EU laws.
Meanwhile, existing certifications like ISO 27001, SOC 2, and BSI C5 focus on security practices—such as encryption, access controls, and incident response—and do not address jurisdictional control. For example, a provider with a US parent can hold multiple security badges but still fall under US jurisdiction due to ownership and legal ties.
Major US hyperscalers, including Amazon, Microsoft, and Google, cannot directly qualify for SecNumCloud because of their ownership structures. Instead, they have established joint ventures or control arrangements—such as Thales–Google’s S3NS or Capgemini–Orange’s Bleu—that meet the 24% ownership rule. These arrangements allow them to claim sovereignty, but critics argue they do not truly eliminate jurisdictional risks.
Implications for European Data Sovereignty and Certification Validity
The 24% ownership rule exposes a fundamental gap in the way cloud sovereignty is certified. While certifications like SecNumCloud provide a government-backed assurance of legal control, they do not guarantee immunity from non-EU laws such as the CLOUD Act. This distinction is critical for organizations handling sensitive data in regulated European industries, as reliance on security certifications alone may give a false sense of legal protection.
As a result, European regulators and enterprises face a complex landscape where ownership control and certification claims must be evaluated together. The controversy over the 24% threshold highlights the ongoing debate about what truly constitutes sovereignty in the cloud era and whether current frameworks adequately address jurisdictional risks.
ISO 27001 cybersecurity certification
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
European Frameworks and the Limits of Certification
The concept of sovereignty in cloud services has evolved with frameworks like France’s SecNumCloud and Germany’s BSI C5. SecNumCloud, introduced in 2016 and now in version 3.2, is a qualification issued by ANSSI that combines technical standards with legal sovereignty requirements. Its core innovation is the ownership cap, which limits control by non-EU entities to 24% of voting rights.
In contrast, certifications such as BSI C5, introduced in 2016, focus on security controls but explicitly require disclosure of jurisdiction and data location. They do not, however, prevent providers from being subject to non-EU laws, especially if the provider’s parent company is US-based.
The challenge arises because US hyperscalers cannot qualify directly for SecNumCloud due to ownership restrictions. They have instead created controlled joint ventures or subsidiaries—like Thales–Google’s S3NS—that meet the ownership threshold while still being ultimately controlled by foreign entities. This workaround raises questions about the actual sovereignty these arrangements confer.
“While the certification indicates compliance with security standards, it does not guarantee immunity from laws like the CLOUD Act, which can still apply under foreign ownership.”
— A European regulator familiar with SecNumCloud
As an affiliate, we earn on qualifying purchases.
Unresolved Questions About Actual Sovereignty and Control
It remains unclear whether the ownership threshold effectively guarantees legal immunity from non-EU laws in practice. Critics argue that controlled joint ventures or minority ownerships do not truly prevent foreign governments from exerting influence or legal pressure, especially in cases where the controlling entity is ultimately foreign-owned.
Additionally, the long-term evolution of these frameworks and whether regulators will tighten ownership limits or introduce new criteria is still uncertain. The practical impact of these arrangements on data sovereignty and compliance remains to be fully tested in legal and operational scenarios.
As an affiliate, we earn on qualifying purchases.
Next Steps for Certification and Sovereignty Standards
Regulators in Europe are expected to review and potentially refine the ownership rules and sovereignty criteria in upcoming revisions of frameworks like SecNumCloud. Enterprises and providers will need to reassess their control structures and legal arrangements to ensure compliance and true sovereignty claims.
Legal challenges and audits are likely to increase as stakeholders scrutinize whether these arrangements genuinely prevent jurisdictional reach by non-EU authorities. Meanwhile, more providers may seek to demonstrate sovereignty through direct control or local ownership to meet evolving regulatory demands.
government-approved cloud security
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Key Questions
Does a security certification guarantee legal sovereignty?
No, certifications like ISO 27001, SOC 2, or C5 primarily verify security practices. They do not ensure immunity from non-EU laws or jurisdictional control.
What is the significance of the 24% ownership rule?
The 24% threshold is a measurable control designed to limit foreign influence, aiming to ensure legal sovereignty under frameworks like SecNumCloud. However, it does not eliminate jurisdictional risks entirely.
Can US hyperscalers qualify for SecNumCloud?
Generally, no. US-based providers cannot meet the ownership restrictions directly but can create controlled joint ventures or subsidiaries that do, though the sovereignty of these arrangements is debated.
Will the ownership threshold change in the future?
European regulators are considering revisions, but specific changes are not yet confirmed. The focus remains on balancing security, sovereignty, and operational flexibility.
What does this mean for organizations handling sensitive data?
Organizations must evaluate not only security certifications but also the ownership and control structures of their cloud providers to ensure compliance with sovereignty requirements.
Source: ThorstenMeyerAI.com
