TL;DR
European security frameworks like SecNumCloud and C5 establish sovereignty criteria for AI cloud providers. The 24% ownership rule is central to legal control, impacting US and non-EU companies operating in Europe. This article assesses what is confirmed, what remains uncertain, and why it matters.
European cybersecurity standards for AI cloud providers now include a specific ownership threshold — the 24% rule — which directly tests legal sovereignty over data. This development is crucial for companies operating in Europe, especially foreign firms, as it determines control and legal compliance within the EU.
SecNumCloud, managed by France’s ANSSI, is a government-backed qualification that enforces strict sovereignty requirements, including the ownership cap of 24% for non-EU controlling interests. It also mandates EU data storage, legal domicile, and immunity from non-EU extraterritorial laws. As of mid-2026, about ten providers hold active SecNumCloud qualifications, including OVHcloud and Dassault’s Outscale, with more in progress.
In contrast, the German BSI C5 certification, which is a security controls attestation rather than sovereignty test, requires providers to disclose jurisdiction but does not restrict ownership or control. Both frameworks address jurisdiction but differ fundamentally: C5 discloses, SecNumCloud restricts ownership to ensure sovereignty. Notably, US hyperscalers like AWS, despite holding C5 attestations, remain subject to US law, illustrating the limits of security certifications in establishing sovereignty.
To circumvent restrictions, US firms have adopted joint ventures and control-sharing arrangements, such as Thales and Google’s S3NS, which comply with the 24% ownership rule while maintaining operational control within the EU. These structures highlight the importance of ownership thresholds over mere compliance badges.
Implications of the 24% Ownership Cap for Cloud Control
The 24% ownership rule fundamentally shifts how sovereignty is measured in European AI cloud services. It emphasizes ownership and control over security practices alone, affecting foreign companies’ ability to operate freely within the EU without risking legal exposure under non-EU laws like the CLOUD Act. This development could reshape the landscape of cloud providers, favoring those with EU-controlled ownership structures and potentially limiting US-based hyperscalers’ market access.
For European regulators and businesses, the rule offers a clearer legal framework to ensure data sovereignty, especially for sensitive sectors like health, energy, and finance. It also raises questions about the future of US cloud giants in Europe, as compliance may require complex ownership restructuring or joint ventures, potentially affecting cost, flexibility, and market competition.
European cloud sovereignty certification
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
European Sovereignty Frameworks and Their Legal Foundations
The concept of sovereignty in European cloud standards has evolved from traditional security controls to include legal jurisdiction and ownership. SecNumCloud, introduced in 2016 and updated to version 3.2, is a government-issued qualification that enforces EU domicile, data storage, and immunity from non-EU laws, with the 24% ownership limit as a core test of sovereignty. It is mandatory for hosting sensitive French public sector data and is being extended to critical infrastructure sectors.
Meanwhile, the German C5 standard, developed by BSI, is a mature security controls scheme that requires disclosure of jurisdiction but does not restrict ownership, making it less effective as a sovereignty measure. US hyperscalers like AWS, despite C5 attestations, remain under US jurisdiction, illustrating that certification alone does not guarantee sovereignty. The recent emergence of joint ventures and control-sharing structures signifies a strategic adaptation by non-EU companies to meet the ownership threshold.
“The 24% ownership rule is the most direct test of sovereignty, expressed as a simple arithmetic check on control, not just security practice.”
— Thorsten Meyer
AI cloud security compliance tools
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Unresolved Questions About Sovereignty Enforcement
While the 24% ownership rule is clear in principle, it remains uncertain how strictly regulators will enforce it across different sectors and providers. The impact of joint ventures and control-sharing arrangements on sovereignty compliance is still being evaluated, and there is no comprehensive legal precedent yet. Additionally, the potential for legal challenges or loopholes to undermine the rule’s effectiveness remains an open question.
As an affiliate, we earn on qualifying purchases.
Next Steps in European Cloud Sovereignty Developments
Regulators are expected to publish further guidance on implementing and enforcing the ownership threshold. More providers will seek SecNumCloud certification or develop compliant joint ventures, especially as the European Union expands its sovereignty initiatives. The evolution of legal challenges and industry adaptations will shape the future landscape of cloud sovereignty, with ongoing debate about the balance between security, control, and market access.
As an affiliate, we earn on qualifying purchases.
Key Questions
What does the 24% ownership rule mean for foreign cloud providers in Europe?
The 24% rule limits non-EU ownership and control, requiring foreign providers to restructure ownership or form joint ventures to operate legally within the EU while maintaining sovereignty over data.
How does SecNumCloud differ from other certifications like ISO 27001 or C5?
SecNumCloud is a government-backed qualification that enforces legal sovereignty, including ownership restrictions, data location, and immunity from non-EU laws. ISO 27001 and C5 primarily certify security practices without explicitly addressing sovereignty or ownership control.
Can US hyperscalers meet the sovereignty requirements in Europe?
US hyperscalers can attempt to meet sovereignty standards through joint ventures and control-sharing arrangements that comply with the 24% ownership cap, but they remain subject to US jurisdiction unless they restructure ownership and control explicitly within the EU framework.
Will the 24% rule prevent US companies from operating in Europe?
Not necessarily; US companies can still operate by establishing EU-controlled entities or joint ventures that meet the ownership threshold, but this may involve significant restructuring and compliance costs.
Source: ThorstenMeyerAI.com
