How The 24% Rule Exposes The Illusions In AI Sovereignty Certification Claims

The 24% ownership threshold in France’s SecNumCloud framework has emerged as a critical measure that reveals the limitations of sovereignty certifications for cloud and AI providers. While many vendors display a variety of security badges, only this ownership rule directly tests whether a provider can be compelled by foreign law, making it a unique and revealing standard. This development matters because it shifts focus from security practices to control and jurisdiction, impacting how organizations assess sovereignty claims.

SecNumCloud, created by France’s ANSSI, is not a traditional certification but a government-issued qualification that includes a specific ownership control rule. The rule states that foreign companies holding more than 24% ownership or voting rights cannot meet the sovereignty standard, which requires EU control and immunity from non-EU extraterritorial laws. As of mid-2026, about a dozen providers, including OVHcloud and Outscale, have achieved or are pursuing this qualification, which is mandatory for hosting sensitive French public-sector data.

This ownership rule is arithmetic-based and easy to verify, making it a practical tool for assessing sovereignty. It effectively disqualifies US-based hyperscalers like AWS, Microsoft, and Google from meeting the threshold unless control is transferred or ownership is restructured. Vendors like Thales and Capgemini have created joint ventures with US firms to meet the 24% limit, illustrating how the rule influences control structures. However, the rule does not eliminate legal risks associated with jurisdiction; it merely tests ownership control explicitly.

Implications of the 24% Ownership Cap for AI and Cloud Sovereignty

The 24% rule exposes a fundamental flaw in claims of sovereignty based solely on security certifications. While certifications like SecNumCloud and C5 demonstrate security practices, they do not address legal jurisdiction or extraterritorial laws. The ownership control standard directly tests whether a provider can be subject to foreign legal orders, making it a more definitive measure of sovereignty. This shift could influence procurement decisions, especially for sensitive data in regulated industries, and challenge the narrative that security badges alone suffice for sovereignty claims.

Background of Sovereignty Certification Frameworks and the 24% Control Rule

Traditionally, security certifications such as ISO 27001, SOC 2, and BSI C5 focus on operational security controls, verifying that providers run their systems securely and competently. However, they do not address legal jurisdiction or sovereignty directly. France’s SecNumCloud, introduced in 2016 and now in version 3.2, adds a unique element: a control based on ownership and legal sovereignty, specifically a 24% ownership threshold for foreign entities. This rule is part of a broader effort to ensure providers hosting sensitive data are subject to EU law and immunity from non-EU extraterritorial laws.

Other frameworks, like BSI C5, include jurisdiction disclosures but do not impose control limits. The key difference is that SecNumCloud’s ownership cap is arithmetic and checkable, making it a practical test of sovereignty that complements security standards. The framework has become mandatory for French public-sector data and is being pushed into critical infrastructure sectors.

“The 24% ownership rule is a straightforward arithmetic test that reveals whether a provider can truly claim sovereignty or is still under foreign control.”

— Thorsten Meyer, AI security expert

Remaining Uncertainties About Sovereignty Certification Effectiveness

It remains unclear how widely the 24% ownership rule will influence global cloud procurement beyond France and whether other jurisdictions will adopt similar standards. Additionally, while the rule effectively tests ownership, it does not address other sovereignty concerns such as legal enforcement, data access, or compliance with extraterritorial laws. The long-term impact on US hyperscalers and their ability to meet sovereignty claims through restructuring is still evolving, and the practical enforceability of these ownership limits in complex corporate structures remains to be seen.

Future Developments in Sovereignty Certification and Control Structures

As of mid-2026, more providers are expected to achieve SecNumCloud qualification, and the focus will likely shift toward how ownership structures are adjusted to meet the 24% threshold. Regulatory bodies in France and the EU may expand or refine sovereignty standards, potentially influencing other jurisdictions. Additionally, legal and corporate strategies from US-based providers to circumvent ownership limits will be closely watched, alongside discussions on whether control or jurisdiction should be the primary criterion for sovereignty claims.

Key Questions

What does the 24% ownership rule mean for US cloud providers?

The rule limits foreign ownership to 24%, meaning US providers must restructure ownership or control to meet the sovereignty standard, which could involve joint ventures or other control arrangements.

Does holding a security certification guarantee sovereignty?

No. Certifications like SecNumCloud or C5 demonstrate security practices but do not address legal jurisdiction or immunity from foreign laws. The 24% rule specifically tests ownership control, a different aspect of sovereignty.

Can a provider meet the sovereignty standard without changing ownership?

Typically no. The ownership control threshold is explicit; exceeding 24% ownership by foreign entities disqualifies a provider from meeting the sovereignty standard unless control is restructured.

Will other countries adopt similar sovereignty control measures?

It is uncertain. France’s approach is unique, but the concept of control-based sovereignty testing may influence other jurisdictions, especially in Europe, in the coming years.

What are the implications for data security and legal risk?

While the 24% rule enhances sovereignty assurances, it does not eliminate legal risks related to jurisdiction or extraterritorial laws. Organizations must consider both security certifications and control standards when assessing providers.

Source: ThorstenMeyerAI.com