France: SecNumCloud
SecNumCloud is a qualification for cloud services issued by ANSSI, the French cybersecurity agency. It requires a high level of security and protection against laws of states outside the EU, for example through a European registered office and European majority ownership. It is mandatory for particularly sensitive data of French state administrations and bodies (Art. 31 SREN Act, decree of 14 April 2026). AI running on a server on your premises is not a cloud service under this rule.
What is SecNumCloud?
SecNumCloud is a qualification issued by the Agence nationale de la sécurité des systèmes d’information (ANSSI, the French national cybersecurity agency) for cloud offerings it rates as trustworthy. It covers infrastructure, platforms and software as a service (IaaS, PaaS, SaaS). It is based on a framework of technical, operational and legal requirements. ANSSI lists qualified offerings in a catalogue.
Since version 3.2 of the framework (2022), SecNumCloud explicitly requires protection against laws of states outside the EU that could allow access to data, such as the US CLOUD Act. This includes, among other things:
- the provider’s registered office in the EU and limits on shareholdings from outside the EU,
- no access to data by suppliers or service providers from outside the EU,
- operation of the service with the provider’s own resources and own staff.
ANSSI itself points out that the qualification does not guarantee the security of the applications a customer runs on it.
Who has to use SecNumCloud?
Article 31 of the SREN Act of 21 May 2024 requires state administrations, their operators (opérateurs) and certain public interest groupings to use cloud services protected against access by authorities from third countries for data of particular sensitivity. Decree No. 2026-272 of 14 April 2026 implements this. Data counts as particularly sensitive in particular if it is:
- subject to secrets protected by law,
- needed for essential tasks of the state, such as national security, public order and the protection of health and life.
Time-limited exceptions are possible for projects that started before the decree. Article 31 does not name municipalities and other local authorities.
What does this mean for AI?
An AI that processes sensitive state data as a cloud service must meet the requirements. This concerns not only hosting but the whole chain: if the AI model runs at another provider, for example through an interface of a US company, the data reaches that provider.
| Option | What to check |
|---|---|
| AI as a provider’s cloud service | Is the offering SecNumCloud-qualified, including the AI model? |
| AI platform in a qualified cloud, model at a third party | Do inputs leave the qualified environment? |
| AI on a server in your own data centre | Not a cloud service of a private provider; your own security requirements apply |
How does this work with basebox?
In France, basebox offers only the server that your organisation’s IT runs itself; HDS certification is planned, and until then basebox does not operate any servers in France, neither remotely nor in its own data centre. Our hardware partner FAST LTA delivers the server to France. It stands in your data centre, and the AI model runs on this hardware, without an internet connection if you wish. The server sends no telemetry, no usage statistics and no licence checks to the outside. basebox has no access to your data. basebox is a German company and is not subject to the US CLOUD Act.
The interface and support are available in German and English, not in French.
Not legal advice: The obligations under Art. 31 SREN depend on the ANSSI framework and on exceptions in individual cases. Whether your data counts as particularly sensitive is decided by your authority. Research as of 11 October 2026.
Frequently asked questions
Do French municipalities have to use SecNumCloud?
Article 31 of the SREN Act names state administrations, their operators (opérateurs) and certain public interest groupings, but not local authorities (collectivités territoriales). Municipalities can, however, require SecNumCloud in their tenders.
Is SecNumCloud the same as HDS?
No. HDS is the certification for hosting health data under the French Public Health Code (Code de la santé publique). It requires data to stay in the European Economic Area and disclosure of possible access from third countries. SecNumCloud goes further and is meant to rule out such access.
Is there a European alternative?
The EU has been working for years on a certification scheme for cloud services (EUCS). Whether it will come, and with what requirements for protection against third-country laws, was still open in October 2026.
Sources
- ANSSI (cyber.gouv.fr): SecNumCloud pour les fournisseurs de services cloud (French) ↗
- French Ministry of the Economy: promulgation of Act No. 2024-449 of 21 May 2024 to secure and regulate the digital space (SREN, French) ↗
- Derriennic Associés: analysis of Decree No. 2026-272 of 14 April 2026 on Art. 31 SREN (French) ↗
- French Ministry of the Economy, Legal Affairs Directorate: technical sheet on implementing Art. 31 SREN (May 2026, French) ↗
- CMS Francis Lefebvre: new HDS framework, comparison with SecNumCloud ↗
This article was created with the help of AI, based on the sources listed. Responsible for the content: basebox GmbH. Not legal advice, no liability. Research as of 11 October 2026.