Sovereign cloud: definition, SecNumCloud, the CLOUD Act and what to do with AWS and Azure

Read this first. This article is for information only and is not legal advice. It reflects the texts and provider announcements checked in October 2026. Qualification statuses and service scopes change quickly: check them against the official sources listed when you make your choice, and have your conclusions validated by a lawyer or your DPO.

“Can we stay on AWS?” “Do we need to move to a sovereign cloud?” These questions often mix three separate topics: where the data is located, exposure to foreign laws such as the US CLOUD Act, and the business’s actual regulatory obligations. This article separates them, reviews the offerings available at the end of October 2026, then sets out a method for deciding. It is written from a French and EU perspective, where the debate is most advanced. To place this topic within our wider expertise, see our page on AWS and Azure cloud consulting.

Sovereign cloud: a definition

There is no single legal definition of “sovereign cloud”: providers, public authorities and the press use it in different ways. To reason clearly, break it down into verifiable criteria.

Three questions to assess a service’s sovereignty

1. Where is the data? Hosting countries and regions, including backups, and the locations from which the service is administered. This is data residency.
2. Which law is the provider subject to? If the provider, its parent company or its controlling shareholders fall under a non-European law that can compel disclosure of data, hosting in France is not enough. This is legal protection, or immunity from extraterritorial laws.
3. Who operates the service and who holds the keys? Operations staff, support, emergency access, encryption key management. This is operational and technical sovereignty.

An AWS or Azure region in France answers the first question. On its own, it does not answer the other two.

Sovereign cloud, trusted cloud, European cloud

• European cloud: a provider headquartered in Europe. This says nothing about its security level.
• Trusted cloud (“cloud de confiance”): a term used in France for SecNumCloud-qualified offerings, including those built on US technology but operated by a French company (S3NS, Bleu).
• Hyperscalers’ “sovereign” offerings: AWS European Sovereign Cloud, Microsoft Sovereign Cloud. They strengthen residency and operational autonomy, but remain part of US groups.

SecNumCloud: ANSSI’s qualification

What SecNumCloud checks

SecNumCloud is ANSSI’s requirements framework for cloud service providers. Version 3.2, published in 2022, covers the whole security of the service: governance, access management, cryptography, operations, continuity, subcontracting. Its distinctive feature is a chapter on protection against non-European law: the provider, its capital and its governing bodies must not allow a non-European entity to take control, and both the data and the administration of the service must remain within the European Union.

The qualification is granted for a specific offering and scope of services, after a multi-milestone process. ANSSI publishes the official list of qualified offerings; it includes, for example, OVHcloud, 3DS Outscale and Cloud Temple, each for defined scopes. Always check, service by service, what is covered.

Who must use it: the SREN law and the 2026 texts

In France, Article 31 of the SREN law of 21 May 2024 requires State administrations, some of their operators and certain public interest groupings to use, for particularly sensitive data entrusted to a private provider, offerings that protect against access by third-country public authorities. This obligation was made operational in 2026:

Text	Date	Content
Decree No. 2026-272	14 April 2026, published in the Official Journal on 16 April 2026	Sets the scope, refers to an ANSSI framework approved by order, organises exemptions
Order of 14 April 2026	14 April 2026	Sets out the exemption procedure
Order of 12 August 2026	Published in the Official Journal on 14 August 2026, in force on 15 August 2026	Approves the requirements framework; compliance is demonstrated by an ANSSI qualification or by a European certification recognised as equivalent by ANSSI

A key point for SMEs and mid-sized companies: this obligation does not apply to private businesses in general. It may still affect you indirectly if you work for a public body subject to these texts, if a tender requires it, or if your own customers impose it by contract.

What is the CLOUD Act?

What the law says

The CLOUD Act (Clarifying Lawful Overseas Use of Data Act) is a US federal law enacted in March 2018. It added a provision to the US Code (18 U.S.C. § 2713) requiring electronic communication and cloud service providers subject to US jurisdiction to preserve or disclose data in their possession, custody or control, whether that data is stored in the United States or elsewhere. It also allows the United States to conclude bilateral agreements on electronic evidence: the Department of Justice lists those signed with the United Kingdom and Australia. For the European Union, it mentions the resumption of negotiations in March 2023, not a concluded agreement.

The decisive criterion is therefore not where data is stored, but the provider’s jurisdiction. A European subsidiary of a US group may be affected if the parent company is considered to control the data: this is what SecNumCloud’s independence criterion neutralises.

The CLOUD Act and the GDPR

Article 48 of the GDPR provides that a judgment or decision of a third-country court or authority requiring the transfer or disclosure of personal data is only recognised or enforceable if it is based on an international agreement, such as a mutual legal assistance treaty. In its Guidelines 02/2024, adopted in final form in June 2025, the European Data Protection Board (EDPB) clarified that, without such an agreement, responding to that request is still a transfer under the GDPR: it requires a legal basis and a ground under Chapter V, with the Article 49 derogations applying only in limited cases.

A separate question is often confused with this one: routine transfers of data to the United States. These currently rely on the EU-US Data Privacy Framework, an adequacy decision of 10 July 2023. The EU General Court dismissed Philippe Latombe’s action for annulment on 3 September 2025 (Case T-553/23). An appeal has been brought before the Court of Justice (Case C-703/25 P): the framework’s stability is worth monitoring.

What this means in practice

The CLOUD Act risk is a legal risk, not an automatic data leak, and its weight depends on the nature of the data. The CNIL illustrated this with the French Health Data Hub, hosted on Azure by Microsoft Ireland: it noted that belonging to a group with a US parent company creates a legal possibility of disclosure requests from the US administration, and recommended, for the most sensitive databases, a host subject exclusively to European law or SecNumCloud qualified.

For most of an SME’s data (website, internal tools, everyday commercial data), this risk can be considered acceptable once analysed and documented. For strategic trade secrets, large-scale health data or sensitive data belonging to public-sector customers, it deserves a formal analysis.

EUCS: where does the European certification stand?

The EUCS (European Cybersecurity Certification Scheme for Cloud Services) was meant to harmonise cloud certification across Europe. ENISA published a draft in December 2020, then the file stalled for a long time, notably over the place of sovereignty requirements.

As of October 2026, the EUCS has not been adopted and no EUCS certificate can be issued. Two European Commission proposals, still under negotiation, are reshaping the picture:

• the revised Cybersecurity Act, proposed on 20 January 2026: the Commission states that work on the EUCS will resume, with certification remaining focused on technical assurance;
• the Cloud and AI Development Act (CADA), presented in June 2026, which proposes four sovereignty assurance levels for public-sector cloud procurement, from simple hosting in the Union up to providers owned and controlled in the Union.

In practice, SecNumCloud remains the reference benchmark in France for now. The order of 12 August 2026 also provides that a European certification recognised as equivalent by ANSSI may be accepted.

Trusted cloud offerings in October 2026

Offering	Operated by	Technology	SecNumCloud status, end of October 2026
PREMI3NS (S3NS)	S3NS, a Thales subsidiary	Google Cloud	SecNumCloud 3.2 qualification announced in December 2025 (IaaS, CaaS, PaaS)
Bleu	Bleu, a Capgemini and Orange joint venture	Microsoft (Azure, Microsoft 365)	Qualification in progress; the company aims for the end of 2026, according to the trade press
AWS European Sovereign Cloud	Dedicated Amazon entities in Germany	AWS	Not a SecNumCloud-qualified offering
EU Data Boundary and Microsoft Sovereign Cloud	Microsoft	Azure, Microsoft 365	Not a SecNumCloud-qualified offering

S3NS

S3NS announced in December 2025 the SecNumCloud 3.2 qualification of PREMI3NS, covering IaaS, CaaS and PaaS scopes with more than twenty services, operated by its own teams from data centres in France. The qualified catalogue is narrower than Google Cloud’s: check that the services you need are included.

Bleu

Bleu runs Microsoft technologies through a French company. According to Next (October 2026), Bleu has passed the first qualification milestones without yet being qualified, and now aims for the end of the year. Until it appears on ANSSI’s list, the qualification cannot be considered obtained.

AWS European Sovereign Cloud

On 15 January 2026, AWS announced the general availability of the AWS European Sovereign Cloud, with a first region in Brandenburg, Germany, physically and logically separate from other AWS regions. AWS states that it is operated exclusively by EU residents, through a new parent company and three German subsidiaries led by EU citizens, and has announced sovereign Local Zones in Belgium, the Netherlands and Portugal. The first attestations, published in March 2026, cover SOC 2, C5 and seven ISO certifications. As the group remains American, the offering does not meet SecNumCloud’s independence criterion, and to our knowledge it has no region in France.

Microsoft: EU Data Boundary and Microsoft Sovereign Cloud

On 26 February 2025, Microsoft announced the completion of the EU Data Boundary: customer data for its core services (Microsoft 365, Dynamics 365, Power Platform and most Azure services) is stored and processed within the EU and EFTA, with documented exceptions, notably for responding to security incidents. Microsoft also groups its offerings under the Microsoft Sovereign Cloud name: public cloud with enhanced controls (Data Guardian, external key management), private cloud on Azure Local, and national clouds operated with partners. Again, this is about residency and controls, not legal immunity.

Health data: HDS, a separate framework

In France, hosting personal health data on behalf of a third party requires an HDS-certified host (Hébergement de Données de Santé, the French certification for hosting health data). Version 2 of the framework, approved by an order of 26 April 2024, added sovereignty requirements: physical hosting exclusively within the European Economic Area, controls on remote access from third countries, informing the customer when the host is subject to non-European law, and publishing a map of transfers. According to the French Digital Health Agency (ANS), certificates under the former version 1.1 have no longer been valid since 16 May 2026. A version 2.1 has been announced: check its status on the ANS website.

AWS and Microsoft both state that they hold HDS certification under version 2, for European regions including Paris (AWS) and France Central (Azure). But the provider’s certification only covers its own share: configuration, access, encryption, logging and the contract remain your responsibility. Feekr’s founder has designed and operated HDS-certified AWS infrastructure, described entirely as code: audits often hinge on exactly this split of responsibilities.

HDS and SecNumCloud do not replace each other: HDS is mandatory for health data, while SecNumCloud is only mandatory in the cases set by the SREN law or by contract.

Encryption and key management: what really protects you

Server-side or client-side

The CNIL draws a clear distinction. With server-side encryption, the provider has access to the keys in one way or another at processing time: this protects against stolen media or misconfiguration, but does not remove the provider’s access to the data, whatever the key management method. With client-side encryption, where you alone hold and control the keys, the provider no longer sees the data in clear, including when facing a request from a foreign authority. The trade-off is significant: many managed services (search, analytics, AI) can no longer process that data.

On AWS: KMS, CloudHSM and external keys

• AWS KMS with customer managed keys: the baseline, to be used widely, with strict key policies and logging in CloudTrail.
• AWS CloudHSM: dedicated HSMs, for cases that require a single-tenant hardware module.
• External Key Store (XKS): the key stays in a key manager you own outside AWS (the “hold your own key” approach). If you cut off access, AWS can no longer decrypt. AWS itself warns that, for most customers, the greater risks to availability and latency outweigh the expected benefit: keep it for data that truly requires it.

On Azure: Key Vault, Managed HSM and external key management

• Azure Key Vault with customer-managed keys for encryption at rest.
• Managed HSM: single-tenant HSMs validated to FIPS 140-3 Level 3, with local access control that even subscription administrators cannot override.
• Managed HSM external key management, which Microsoft describes as generally available and as a last-resort option, when a legal or contractual requirement mandates keeping the key outside its infrastructure.

Method: classify, decide, keep AWS and Azure for the rest

Moving an entire information system to a qualified cloud is rarely justified: narrower catalogue, costs, skills. The approach we use is more targeted.

1. Inventory and classify your data

For each application: nature of the data, volume, applicable obligations, impact of disclosure. A four-level classification is usually enough:

Level	Examples	Where to host
Public or everyday internal	Website, documentation, collaboration tools	AWS or Azure, European regions
Confidential	Customer, HR and finance data	AWS or Azure, European regions, customer-managed keys, restricted access
Regulated	Health data, data covered by a demanding contract	HDS-certified host or the offering required by contract, audited configuration
Particularly sensitive	Data within the scope of Article 31 of the SREN law, strategic secrets	SecNumCloud-qualified offering, or client-side encryption where the use case allows

2. Identify your actual obligations

Distinguish what is required (HDS for health data, the SREN law for certain public bodies, your contract clauses) from what is a preference (purchasing policy, image, caution). Both are legitimate, but they do not justify the same level of constraint. Involve your DPO and CISO from this stage.

3. Decide per data class, not for the whole company

A hybrid architecture is common: website, data and generative AI on AWS or Azure, a small scope on a qualified offering. In that case, check the flows between the two environments, identity and monitoring, which become the sensitive points.

4. Harden AWS and Azure for everything else

• Restrict regions: service control policies (SCPs) in AWS Organizations, Azure Policy for allowed locations.
• Encrypt with customer-managed keys and separate key administration from resource administration.
• Log access to data and keys, including provider support access where mechanisms exist (for example Customer Lockbox at Microsoft).
• Review contracts: DPA, list of subprocessors, clauses on requests from authorities, support location.
• Describe everything as code (Terraform, OpenTofu) to prove your configuration during an audit. This is the purpose of our cloud security and governance service.

5. Plan for reversibility

Document how you would exit: export formats, dependencies on proprietary services, estimated duration. This is what keeps today’s choices revisable tomorrow, once qualified offerings have evolved.

Conclusion: decide data by data

A sovereign cloud is not a box to tick for the whole company. It is a proportionate answer to a specific risk, reserved for the data that justifies it. For the rest, properly configured AWS and Azure, in European regions, with controlled keys and reviewed contracts, meet the requirements of most SMEs and mid-sized companies. Feekr helps you make this classification and turn it into an architecture, from the Lille metropolitan area (northern France), working alongside your legal advisers and DPO: see our cloud security and governance service, our AWS consulting and Azure consulting pages, or our cloud and AI consulting in Lille. If your projects combine AI and sensitive data, also read our overview of EU AI Act obligations.

[ YOUR QUESTIONS ]

Frequently asked questions

What is a sovereign cloud?

There is no single legal definition. The term describes a cloud service whose data is hosted in Europe, whose provider is not subject to non-European laws that allow access to that data, and which is operated from Europe. In France, the most demanding benchmark is the SecNumCloud qualification issued by ANSSI.

What is the CLOUD Act?

It is a US federal law enacted in March 2018. It requires electronic communication and cloud service providers subject to US jurisdiction to preserve or disclose, under lawful process, data in their possession, custody or control, including when that data is stored outside the United States. It also allows bilateral agreements with partner countries.

Is the CLOUD Act compatible with the GDPR?

The two can conflict. Article 48 of the GDPR provides that a decision of a third-country authority requiring a transfer is only recognised if it is based on an international agreement. The EDPB specifies that, without one, the transfer needs another legal basis and another ground under Chapter V. To our knowledge, no EU-US agreement on electronic evidence had been concluded as of October 2026.

Are AWS and Azure sovereign clouds?

Not in the SecNumCloud sense: their parent companies are American. They offer regions in France and Europe, HDS certification, customer-managed keys and dedicated offerings (AWS European Sovereign Cloud, EU Data Boundary and Microsoft Sovereign Cloud). These measures greatly reduce certain risks, but they are not equivalent to SecNumCloud qualification.

Is SecNumCloud mandatory for a private company?

Not as a general rule. The obligation under Article 31 of the French SREN law applies to State administrations, some of their operators and certain public interest groupings for their particularly sensitive data. A company may still be required to use it by contract, by a public tender or by its own security requirements.

Does encryption protect against the CLOUD Act?

It depends on who holds the keys. The CNIL (France’s data protection authority) states that server-side encryption, where the provider can access the keys, does not remove the provider’s access to the data. Only client-side encryption, with keys you alone control, prevents it, at the cost of strong limits on which services you can use.

Sources

• Légifrance: Law No. 2024-449 of 21 May 2024 on securing and regulating the digital space (SREN), Article 31 (in French)
• Légifrance: Decree No. 2026-272 of 14 April 2026 on protecting particularly sensitive data processed by a cloud service (in French)
• Légifrance: Order of 12 August 2026 approving the requirements framework for cloud service providers (in French)
• ANSSI: SecNumCloud requirements framework, version 3.2 (in French)
• ANSSI: FAQ before starting a SecNumCloud qualification (in French)
• CNIL: Encryption practices in public cloud computing (in French)
• CNIL: Main opinions and recommendations of the CNIL on the Health Data Hub (in French)
• EDPB: Guidelines 02/2024 on Article 48 GDPR, version 2.1
• Court of Justice of the EU: press release No 106/25, General Court judgment in Case T-553/23, Latombe v Commission (3 September 2025)
• US Department of Justice: CLOUD Act Resources
• European Commission: Cybersecurity Package, Questions & Answers (20 January 2026)
• European Commission: Cloud and AI Development Act
• ENISA: EUCS, Cloud Services Scheme (draft candidate scheme, December 2020)
• Business Wire: S3NS Announces SecNumCloud Qualification for PREMI3NS (December 2025)
• Next: SecNumCloud, Bleu now aims for qualification by the end of the year (October 2026, in French)
• Amazon: AWS launches AWS European Sovereign Cloud and announces expansion across Europe (15 January 2026)
• AWS Security Blog: AWS European Sovereign Cloud achieves first compliance milestone (March 2026)
• Microsoft: Microsoft completes landmark EU Data Boundary (26 February 2025)
• Microsoft Learn: What is Microsoft Sovereign Cloud?
• French Digital Health Agency (ANS): HDS certification framework published in the Official Journal (in French)
• AWS: HDS (Hébergeur de Données de Santé)
• Microsoft Learn: Health Data Hosting (HDS) France
• AWS: External key stores (AWS KMS)
• Microsoft Learn: Azure Key Vault Managed HSM overview