Digital sovereignty: what a sovereign cloud really changes

Digital sovereignty is the ability to keep control of your data and systems without depending on decisions made outside your own legal framework. In France, the debate centres on the sovereign cloud: should sensitive data be hosted by a qualified European operator, or is a European data centre run by a US hyperscaler enough? The answer comes down to one idea, which this article unpacks: storage location does not protect you, the provider's jurisdiction does. For the details of ANSSI's qualification, see our article on SecNumCloud.

On 10 June 2025, before the French Senate's inquiry into public procurement, the rapporteur asked Microsoft France's director of public and legal affairs whether he could guarantee that public sector data bought through UGAP, the State purchasing agency, would never be passed to US authorities without French consent. The answer: "No, I cannot guarantee it", adding that it had never happened so far. That answer sums up the debate: a contractual commitment does not bind another country's authorities.

A few months later, on 31 October 2025, the Cour des comptes (the French national audit office) published a report on the sovereignty of the State's civilian information systems. It notes the opacity of how US laws (the CLOUD Act and FISA Section 702) are applied, finds that the July 2021 "cloud first" doctrine was weakened in practice, that the ministerial clouds (Nubo and Pi) remain little used, and cites the hosting of the Health Data Hub on Microsoft Azure. For the Court, control of sensitive data is the route to sovereignty.

The issue is not limited to the State. Local authorities, hospitals, manufacturers and regulated companies ask the same question at every contract renewal: which data can be entrusted to which provider?

Many offers highlight "data hosted in France". That helps, but it does not answer the question of access by a foreign authority. The CLOUD Act, passed by the US Congress in 2018, requires providers subject to US law to preserve and disclose data "within such provider's possession, custody, or control", whether that data is located inside or outside the United States. A European subsidiary or a data centre in Paris changes nothing if the parent company can be compelled.

Two other confusions come up often:

• GDPR transfers versus extraterritorial access: the EU–US Data Privacy Framework, upheld by the EU General Court on 3 September 2025, governs transfers of personal data. It does not make a US provider immune to requests from its own authorities, and it does not cover your non-personal data, such as trade secrets.
• Encryption: it reduces the risk, provided the provider has no access to the keys. If the service must decrypt data to process it, protection once again depends on the operator's jurisdiction.

No law defines a "sovereign cloud". The term covers very different offers, which can be ranked by what they actually guarantee:

In France, the only third-party-verified guarantee is the SecNumCloud qualification. ANSSI presents it as a way to protect sensitive data both from cybercrime and from the application of extraterritorial laws. At European level, the EUCS certification scheme, under discussion since 2020, was meant to play this role: its sovereignty criteria were dropped from the draft in 2024. Without a common European criterion, it is up to states such as France to set their own requirements.

For the State: the SREN law and the April 2026 decree

Article 31 of the law of 21 May 2024 to secure and regulate the digital space (the SREN law) set the principle. Its implementing decree, Decree No. 2026-272 of 14 April 2026, and an order issued the same day made it operational. According to the technical note from the French Ministry of Economy's legal department published on 6 May 2026:

• State administrations, their agencies and public interest groupings that entrust particularly sensitive data to a private cloud must use a SecNumCloud-qualified offer, which protects it from access by third-country authorities not authorised by EU law;
• a temporary exemption is possible when no suitable offer exists;
• model clauses (security, reversibility, sovereignty) are provided to buyers.

Local authorities are not covered by this decree, but they can draw on it in their tenders.

For healthcare: HDS, and maybe more

Health data falls under the HDS certification, which does not currently include equivalent immunity criteria. The Cour des comptes recommends aligning the HDS framework with SecNumCloud requirements, which would make sovereignty an issue for every health data host.

For companies: no general obligation

NIS 2 does not require a sovereign cloud. It does require managing supply chain risks, which includes choosing hosting providers (see our article on NIS 2 and DORA requirements for third parties). The risk of access by a foreign authority is one of the risks to assess, alongside availability and reversibility.

For a sovereign cloud

• Verifiable protection: SecNumCloud qualification is checked by ANSSI, whereas a contractual promise from a provider subject to foreign law does not bind that country's authorities.
• Less dependency: the Cour des comptes highlights the risk of technological dependency and recommends setting a timetable in 2026 for sovereign office tools, and bringing the ministerial clouds together.
• A lever for the ecosystem: public procurement shapes the market. Without customers, European offers cannot close their functional gap.

The limits

• Cost and catalogue: qualified offers often provide fewer advanced services (AI, data analytics) and may cost more, hence the exemption in the decree.
• Sovereignty is not security: ANSSI points out that qualifying a provider does not prejudge the security of the client's information system. A misconfigured application on a qualified cloud is still vulnerable.
• Cloud is only one layer: email, office software, business applications and AI tools raise the same question. Hosting servers in France while storing documents in a US office suite only solves part of the problem.

Rather than settling the debate in the abstract, treat it as a risk decision, data set by data set:

1. Classify your data: assess its sensitivity in terms of availability, integrity, confidentiality and traceability (the DICP method), and flag what falls under an obligation (State data, health, trade secrets, classified data).
2. Assess the legal risk: include access by a foreign authority in your risk analysis, with its likelihood and severity, alongside technical threats. This is what justifies, or not, the extra cost of a qualified offer.
3. Question your suppliers: in your vendor security questionnaire, ask for the parent company's nationality and ownership structure, where data is stored and administered, the list of subcontractors, certifications (SecNumCloud, HDS, ISO 27001) and the policy for answering authority requests. This is the core of third-party risk management.
4. Contract your exit: provide for reversibility (formats, deadlines, support) in the contract or the security assurance plan. Sovereignty without the ability to leave is not sovereignty.