Is AI Sovereignty Really Tested In Certifications? The 24% Rule Gives Clarity

European cybersecurity authorities have formalized a 24% ownership control rule within the SecNumCloud framework, explicitly testing legal sovereignty over cloud services. This development clarifies how sovereignty is measured, with the ownership cap serving as a tangible threshold for compliance. The rule is a key step in defining European data sovereignty and impacts providers seeking to operate under EU jurisdiction.

SecNumCloud, issued by France’s ANSSI, requires providers to demonstrate EU legal domicile, data storage within the EU, and immunity from non-EU extraterritorial laws. The ownership cap—no more than 24% of voting rights held by non-EU entities—serves as a measurable test of sovereignty. This arithmetic threshold is unique, directly linking ownership structure to legal control, and is considered a robust indicator of sovereignty.

As of mid-2026, around nine providers have obtained or are in the process of obtaining SecNumCloud qualification, including OVHcloud, Outscale, and Scaleway. The framework is mandatory for hosting sensitive French public-sector data and is expected to expand to vital sectors across Europe. The ownership rule is designed to prevent foreign legal influence, ensuring that control remains within EU jurisdiction.

Implications of the 24% Ownership Control in European Cloud Sovereignty

The 24% ownership rule provides a clear, quantifiable measure for sovereignty, moving beyond vague jurisdictional claims. For European AI and cloud providers, it sets a benchmark for legal control, influencing procurement, partnerships, and compliance strategies. For users, it offers increased confidence that their data is under European legal authority. The rule also signals a shift toward practical sovereignty testing rather than reliance solely on security controls, which are often insufficient for legal sovereignty.

This development matters because it directly addresses the challenge of foreign influence—particularly from US-based firms—by establishing a measurable ownership threshold. It aims to foster a more sovereign European cloud ecosystem, reducing dependency on foreign legal jurisdictions and strengthening data protection and control.

European Frameworks and the Distinction Between Practice and Sovereignty

European and German cloud security standards, like ISO 27001 and BSI C5, primarily certify security practices—such as encryption, access controls, and incident response—without addressing legal jurisdiction. In contrast, SecNumCloud explicitly incorporates legal sovereignty through requirements like data residency, EU domicile, and the ownership control rule. The latter is a response to concerns over extraterritorial laws like the CLOUD Act, which can compel US providers to access data regardless of security certifications.

Existing certifications demonstrate security practice but do not guarantee legal immunity. The ownership cap in SecNumCloud fills this gap by offering a quantitative test for sovereignty, making it a significant evolution in European cloud regulation.

“The 24% ownership cap is the only arithmetic test for sovereignty, directly linking control to legal influence, and it’s a game-changer for European cloud security.”

— Thorsten Meyer

Remaining Questions About Implementation and Global Impact

It is still unclear how strictly providers will adhere to the ownership cap as a compliance threshold, and how enforcement will be managed across different sectors. The long-term impact on non-EU providers, especially US tech giants, remains uncertain, as they may seek to modify ownership structures or pursue exemptions. Additionally, the broader acceptance of this arithmetic sovereignty test outside France and the EU has yet to be seen, raising questions about international compatibility.

Next Steps for European Cloud Sovereignty Testing

Providers are expected to complete their SecNumCloud certifications or adjust ownership structures to meet the 24% threshold by late 2026. Regulatory agencies will likely increase oversight, with audits and compliance checks becoming more rigorous. The framework could serve as a blueprint for similar sovereignty tests in other sectors or regions, potentially leading to broader adoption of quantitative sovereignty standards. Watch for legal challenges or adaptations by foreign-controlled providers seeking exemptions or modifications.

Key Questions

What exactly does the 24% ownership rule test?

The rule measures whether non-EU entities hold more than 24% of voting rights in a provider, serving as a quantitative indicator of legal sovereignty and control within the EU.

Does holding a certification mean a provider is sovereign?

No. Certifications like SecNumCloud verify security practices and compliance with specific controls, but the ownership cap directly tests legal sovereignty. Both are necessary but not sufficient alone.

Will this rule affect US-based cloud providers?

Yes, providers with significant US ownership or control may need to restructure ownership or seek exemptions to meet the 24% threshold if they want to operate under SecNumCloud standards in Europe.

Is this ownership rule unique to France or Europe?

While currently specific to France’s SecNumCloud, the concept of quantifiable sovereignty testing could influence broader European or international standards, though adoption outside France remains uncertain.

What are the implications for AI providers operating in Europe?

AI providers that rely on cloud infrastructure must ensure their data control and ownership structures meet the 24% cap if they want to qualify for sovereignty certifications, impacting how they structure partnerships and data governance.

Source: ThorstenMeyerAI.com