Decoding The 24% Rule: What It Means For AI Sovereignty Testing Standards

European authorities have confirmed that the 24% ownership cap is the decisive measure for assessing legal sovereignty in AI and cloud service providers under the SecNumCloud framework. This rule directly impacts which companies can host sensitive data within the EU, reinforcing the legal control and jurisdiction criteria that are now central to sovereignty testing.

SecNumCloud, created by France’s ANSSI, incorporates a strict ownership threshold: companies with more than 24% ownership by non-EU entities cannot qualify. This arithmetic-based rule is unique among European standards, which typically focus on security controls. The ownership cap ensures EU legal sovereignty over data by limiting foreign control.

Currently, roughly nine or ten providers hold an active SecNumCloud qualification, including OVHcloud and Scaleway, with several more in progress. The rule is mandatory for hosting sensitive French public-sector data and is expected to influence broader EU policies on critical infrastructure and data sovereignty.

Meanwhile, other certification schemes like BSI C5 focus on control implementation but do not explicitly address sovereignty or ownership, highlighting a key distinction in the European framework landscape.

The Impact of the 24% Ownership Cap on Cloud Sovereignty

The 24% ownership rule fundamentally shifts how cloud providers approach sovereignty in Europe. It explicitly ties ownership control to legal jurisdiction, making it a practical, arithmetic measure rather than a policy or technical control. This ensures that providers hosting sensitive data within the EU are genuinely under EU legal authority, reducing risks associated with extraterritorial laws like the CLOUD Act.

For vendors, this means that achieving compliance involves not only technical security measures but also restructuring ownership and voting rights to stay below the threshold. It may limit the participation of foreign investors and influence corporate governance structures, potentially increasing operational complexity but strengthening legal sovereignty.

For European regulators and public sector entities, the rule provides a clear, measurable standard to prevent foreign control over critical data infrastructure, aligning with broader strategic goals for digital sovereignty and resilience.

European Sovereignty Testing Frameworks and Their Differentiators

The European landscape features multiple certification schemes: ISO 27001, SOC 2, BSI C5, and EUCS primarily certify security practices, not ownership or jurisdiction. SecNumCloud, in contrast, incorporates a legal sovereignty test via the 24% ownership rule, making it distinct in its focus on control and legal immunity.

Created by France’s ANSSI, SecNumCloud is a qualification rather than a certification, requiring compliance with specific legal and ownership criteria, including EU data residency and immunity from non-EU extraterritorial laws. The rule effectively limits foreign ownership to ensure EU sovereignty over data.

While providers like AWS’s European Sovereign Cloud hold security attestations like C5, they remain subject to US law, illustrating the difference between security controls and sovereignty measures. The 24% rule addresses this gap explicitly.

“SecNumCloud is designed to guarantee that providers hosting sensitive data are under EU jurisdiction, with ownership controls at its core.”

— ANSSI spokesperson

Remaining Questions About the 24% Ownership Rule’s Implementation

It is still unclear how strictly the ownership cap will be enforced across different providers and whether there will be exceptions or transitional arrangements. The impact of restructuring ownership to meet the threshold, especially for large or multinational companies, remains to be seen. Additionally, the precise legal implications for providers with foreign control structures are still under discussion within European regulatory circles.

Next Steps in European Sovereignty Certification Developments

As of mid-2026, more providers are expected to seek SecNumCloud qualification, with ongoing discussions about refining the ownership rules and extending sovereignty standards to other critical sectors. Regulators may clarify enforcement mechanisms and introduce guidance for companies restructuring ownership. The evolution of the 24% rule will likely influence broader EU policy on digital sovereignty, data control, and cross-border data flows.

Key Questions

Why is the 24% ownership rule important for AI sovereignty?

The rule directly links ownership control to legal jurisdiction, ensuring that data hosted within the EU remains under EU law, which is crucial for sovereignty and legal immunity.

How does the 24% cap differ from other security certifications?

Unlike certifications such as ISO 27001 or BSI C5, which focus on technical controls, the 24% rule is a quantitative ownership threshold that enforces legal sovereignty by limiting foreign control.

Which providers are currently meeting the 24% ownership criteria?

Providers like OVHcloud, Scaleway, and several others have obtained SecNumCloud qualification by restructuring ownership to stay below the 24% threshold, with more in progress.

Will the ownership rule affect foreign investment in European cloud providers?

Yes, the rule may restrict foreign ownership stakes, potentially limiting investment but strengthening EU control over critical data infrastructure.

What are the implications for companies with US-based parents?

They must restructure ownership or voting rights to comply with the 24% cap if they want to qualify for sovereignty standards like SecNumCloud, which could impact corporate governance and investment strategies.

Source: ThorstenMeyerAI.com