Why Many AI Sovereign Cloud Certifications Are Incomplete, According To The 24% Rule

Approximately 24% of AI sovereign cloud providers examined in a recent report do not fully meet the ownership sovereignty requirements mandated by European standards, despite holding multiple certifications. This raises concerns about whether these providers truly offer legal control over data, which is critical for regulated industries in Europe.

The analysis highlights that while many cloud providers display certifications such as ISO 27001, SOC 2, and BSI C5, these primarily verify security practices rather than legal sovereignty. The key issue is ownership control, specifically the 24% rule—a strict threshold that limits foreign ownership to 24% individually, or 39% collectively, for providers claiming sovereignty under French regulations. This criterion is unique and arithmetic-based, making it a clear measure of legal control.

As of mid-2026, around nine to ten providers have achieved the SecNumCloud qualification, which enforces sovereignty through ownership caps, EU data residency, and immunity from extraterritorial laws. However, many providers with international backing, including US-based giants, still face the challenge of meeting this ownership standard. Notably, some have created joint ventures or structured control to comply, such as Thales with Google or Capgemini with Orange, to circumvent direct foreign ownership limits while maintaining operational control.

Experts emphasize that certifications like C5 or ISO 27001 do not address sovereignty issues directly; they focus on security controls and operational practices. The 24% ownership rule is a distinct, arithmetic measure that directly tests legal control, making it a more definitive indicator of sovereignty compliance.

Implications for Data Sovereignty and Regulatory Compliance

This finding underscores that certifications alone do not guarantee sovereignty. For European industries handling sensitive data, especially in sectors like health, finance, and energy, legal control over data is essential. The 24% ownership threshold provides a clear, measurable standard that impacts procurement decisions and regulatory compliance. Companies relying solely on certificates may overestimate their sovereignty status, risking legal exposure or non-compliance with European data laws.

European Sovereignty Standards and Certification Limitations

European regulators have emphasized sovereignty, especially through frameworks like SecNumCloud and the 24% ownership rule, introduced by France’s ANSSI. These standards aim to ensure that providers hosting sensitive public-sector and critical infrastructure data are under European legal control, including restrictions on non-EU ownership and extraterritorial laws. However, many providers with international ownership structures have found ways to comply superficially, often through joint ventures or control arrangements that meet certification criteria but not the underlying sovereignty demands.

Historically, certifications like ISO 27001, SOC 2, and BSI C5 have focused on security practices, not jurisdiction or ownership. The emergence of the ownership cap as a formal test marks a shift toward more tangible sovereignty verification. Still, as of mid-2026, the landscape remains mixed, with some providers still not meeting the ownership standard despite holding recognized security certifications.

“Many providers are structurally circumventing sovereignty rules by creating joint ventures or control arrangements, which complicates compliance verification.”

— An industry expert familiar with French regulations

Extent of Non-Compliance and Future Enforcement

It is not yet clear how many providers will fully meet the ownership sovereignty standards in the long term, or how regulators will enforce the 24% ownership cap across international companies. The actual impact of these standards on market practices and provider structures remains developing, with some providers possibly adjusting control arrangements or seeking exemptions.

Next Steps for Providers and Regulators in Sovereignty Certification

Regulators are expected to increase scrutiny on ownership structures, with more providers pursuing SecNumCloud or similar sovereignty certifications. Companies may restructure ownership or control arrangements to comply with the 24% rule. Additionally, ongoing audits and regulatory updates will clarify enforcement and compliance standards, shaping the future landscape of European cloud sovereignty.

Key Questions

What does the 24% ownership rule mean for cloud providers?

The 24% rule limits foreign ownership to ensure legal sovereignty, meaning no single non-EU entity can hold more than 24% of voting rights, which is verified through a transparent, arithmetic check on ownership structures.

Why do certifications like ISO 27001 not guarantee sovereignty?

These certifications focus on operational security practices and do not address jurisdiction or ownership control, which are critical for sovereignty under European regulations.

Are US-based cloud providers able to meet European sovereignty standards?

Many US providers can meet security standards but face challenges with ownership caps and jurisdictional restrictions. Some create joint ventures or control arrangements to comply with the 24% rule.

What are the risks of relying on certifications alone for sovereignty?

Certifications may give a false sense of control, as they do not verify legal ownership or immunity from extraterritorial laws, which are essential for sovereignty in regulated sectors.

What is the significance of the ownership control standard for European data law?

It provides a clear, measurable metric to ensure that data is under European legal control, which is crucial for compliance with GDPR and national sovereignty requirements.

Source: ThorstenMeyerAI.com