How The 24% Rule Exposes Flaws In AI Sovereignty Testing

The 24% ownership cap in France’s SecNumCloud framework is now a key criterion for demonstrating legal sovereignty of cloud providers, exposing a significant flaw in current testing methods for AI and cloud data control.

SecNumCloud, developed by France’s national cybersecurity agency ANSSI, includes a unique rule: foreign ownership exceeding 24% of voting rights disqualifies a provider from certification. This ownership threshold is expressed as an arithmetic check, making it a straightforward, checkable criterion for sovereignty.

While traditional security certifications like ISO 27001, SOC 2, and BSI C5 verify operational security practices, they do not address legal jurisdiction or ownership control. SecNumCloud’s ownership rule aims to fill this gap by explicitly testing legal sovereignty, but its practical implications reveal limitations in current frameworks.

As of mid-2026, only about a dozen providers have achieved SecNumCloud qualification, including OVHcloud and Outscale, with several more in progress. This certification is mandatory for hosting sensitive French public-sector data and is being pushed for critical infrastructure under EU regulations.

Implications of the 24% Ownership Cap in Sovereignty Testing

The 24% ownership rule exposes a fundamental flaw in how sovereignty is tested for cloud and AI providers. Certifications that verify security practices do not address who ultimately controls the data or the provider’s legal jurisdiction. This gap means that companies can hold certifications but still be subject to foreign laws, such as the US CLOUD Act, if ownership exceeds the threshold.

For European regulators and clients, this raises concerns about the true sovereignty of data stored and processed within certified providers. It also complicates procurement decisions, as organizations must now consider ownership structures alongside security standards.

The rule’s arithmetic simplicity makes it a powerful, transparent test, but it also reveals that current certification schemes inadequately address legal control, which is critical for data sovereignty in sensitive sectors like health, finance, and energy.

European Sovereignty Frameworks and Certification Limitations

France’s SecNumCloud was introduced in 2016 and updated to version 3.2, incorporating strict legal sovereignty requirements, including EU data residency and immunity from non-EU law. Its unique ownership cap is designed to prevent foreign legal reach, especially from the US, by limiting foreign ownership to below 24%.

Other frameworks, such as Germany’s BSI C5, focus on operational controls and transparency but do not explicitly test legal sovereignty or control. BSI C5 requires disclosure of jurisdiction but does not impose ownership limits, leaving residual risk if a provider is under foreign control.

US hyperscalers like AWS are ineligible for SecNumCloud in native form due to ownership and control restrictions but have created joint ventures with controlled ownership structures to meet the 24% threshold, such as S3NS and Bleu, which are operated by non-US entities but still subject to US law.

“SecNumCloud’s ownership cap is designed to ensure that providers operating within France are legally controlled within the EU, but it does not eliminate all jurisdictional risks.”

— ANSSI spokesperson

Remaining Questions About Sovereignty and Certification Effectiveness

It is still unclear how effectively the 24% rule prevents foreign legal influence, especially as providers create ownership structures to circumvent the cap. The real-world legal and operational risks posed by foreign control remain difficult to quantify.

Additionally, the broader impact of this rule on global cloud and AI providers, and whether it will be adopted or adapted by other European countries, is still developing.

Next Steps for Sovereignty Testing and Certification Standards

Regulators are expected to refine and expand sovereignty testing criteria, potentially incorporating more nuanced legal control measures beyond ownership caps. Providers will likely continue to develop ownership structures to meet these requirements, raising ongoing compliance challenges.

Further analysis and case studies will emerge as more providers achieve SecNumCloud certification, revealing the practical effectiveness and limitations of the 24% rule in protecting European data sovereignty.

Key Questions

What is the significance of the 24% ownership rule in SecNumCloud?

The 24% ownership rule provides a simple, arithmetic test for legal sovereignty, aiming to prevent foreign control over providers handling sensitive EU data. However, it also exposes gaps in current certification schemes that only verify security practices, not legal control.

Does certification guarantee that a provider is immune from foreign laws?

No. Certifications like SecNumCloud verify operational security and ownership limits but do not eliminate the risk of foreign jurisdictional influence, especially if ownership structures are designed to circumvent the rules.

Why are US hyperscalers creating joint ventures with controlled ownership?

To meet the 24% ownership cap and qualify for European sovereignty certifications like SecNumCloud, US hyperscalers are establishing joint ventures with non-US entities, though they remain subject to US law.

Will other European countries adopt similar sovereignty testing frameworks?

It is still uncertain, but the success and limitations of France’s SecNumCloud may influence broader European policy development on data sovereignty and cloud certification standards.

What are the practical implications for companies choosing cloud providers?

Organizations must consider not only security certifications but also ownership structures and jurisdictional controls when selecting providers for sensitive data, especially in regulated sectors.

Source: ThorstenMeyerAI.com