On 1 September 2026, OVHcloud announced that ANSSI had qualified its SNC Cloud Platform public cloud under SecNumCloud, its third qualified offering after Bare Metal Pod and VMware on OVHcloud. Numspot, backed by Banque des Territoires, Docaposte, Dassault Systèmes and Bouygues Telecom, reported SecNumCloud qualification for its IaaS offer the same day. OVHcloud's release ties the news to Article 31 of Law No. 2024-449 and its implementing decree of 14 April 2026.
What the law actually requires
Article 31 of the SREN law (21 May 2024) obliges State administrations to ensure that a commercial cloud service handling data of 'particular sensitivity' applies security and data-protection criteria. According to the National Assembly's committee report no. 2522 (February 2026), that covers data whose compromise could harm public order, public safety, health or intellectual property. The report also notes a derogation for projects already under way, capped at eighteen months.
Decree No. 2026-272 of 14 April 2026 fills in the detail. A law-firm summary of the Légifrance text says it sets the security and data-protection measures, defines when a derogation may be granted, and lists the public-interest groupings (GIPs) caught by Article 31, among them the Agence du numérique en santé and the Centre d'accès sécurisé aux données. A companion arrêté of the same date sets the derogation procedure.
The obligation became enforceable only recently. Acteurs Publics reports that an arrêté published in the Journal officiel on 24 August wrote the SecNumCloud requirement into binding law for State administrations and their operators. Until then it rested on the 'Cloud au centre' doctrine. Clubic notes the two qualifications arrived about ten days after that order took effect.
The strongest case for the mandate
The argument for the policy deserves a fair hearing. SecNumCloud is not a generic security badge. The Assembly report describes a qualification in force since 2016 that certifies a cloud offer as 'de confiance' and, under the 2023 'Cloud au centre' circular, shields sensitive data from non-EU state access. Health records, social-security data and secure research datasets are exactly where a foreign-law compulsion risk is hardest to price. The same report records that AWS, Microsoft Azure and Google Cloud hold roughly 70% of the European market. A State that never buys from a qualified European provider gives those providers no reason to apply for qualification. Public procurement is a legitimate tool for building supply that the market has not produced.
The September announcements are some evidence it works. At the time of the Assembly report, eleven providers held a qualified offer and fourteen applications were pending. OVHcloud's new platform is pay-as-you-go and built on open APIs and open-source standards, which is closer to what developers expect than a bespoke government enclave. OVHcloud says it will roll the platform out to Italy, Germany and Poland next. Numspot says it will pursue PaaS qualification next.
Where proportionality becomes the test
A pro-innovation reading still has to ask what the mandate costs and who bears it. Three issues stand out.
First, price. The Assembly report itself concedes that sovereign offers are 'sensiblement plus chères'. That was one reason the rapporteur proposed a 30,000-inhabitant threshold for extending the regime to local authorities. Paying a premium for the most sensitive datasets is defensible. Paying it across every administration's data is not, which makes the 'particular sensitivity' test the load-bearing part of the law. If administrations read it broadly to avoid risk, the mandate becomes a blanket preference for a few vendors rather than a targeted safeguard.
Second, the derogation. Decree 2026-272 and its arrêté provide a motivated, published derogation when no adequate qualified offer exists. This is the right design: it stops the State from being forced onto an immature product just to satisfy the rule. It only works if derogations are granted promptly and reported openly, so that Parliament and the public can see where the qualified supply falls short. The 2026 qualifications make that scrutiny easier, because a derogation that was reasonable in March is harder to justify once a qualified IaaS or public-cloud offer exists.
Third, scope creep. The Assembly's bill would extend the Article 31 regime to regions, departments and larger communes. That is a separate decision from the one made in 2024, and it should be judged on evidence about sensitive-data exposure at that level. It should not be treated as a natural continuation of a rule written for central government.
A narrow instrument, not an industrial policy
SecNumCloud works best as a narrow instrument. It is a certification regime with a clear threat model, applied where the data justifies it. It works less well as a proxy for 'buy French' across all public IT. The first reading leaves open a market where qualified providers compete on features, API openness and price, and where a qualification is a floor rather than a moat. The second reading produces a captive customer base with weaker incentives to improve.
The near-term evidence supports the narrow reading. Two qualified offers arrived on the same day, from different corporate backgrounds, and one of them builds on open standards and plans to expand across Europe. That is what a procurement-driven standard should produce.
The things to watch are measurable. How many derogations are granted, for how long, and with what stated reasons? How far do qualified prices fall as the supply widens? And does ANSSI's queue of pending applications keep moving? If qualification stays slow and costly, the regime concentrates the market. If it moves quickly, the French State gets sovereignty-grade options without freezing out better products elsewhere. The September qualifications are a good start, and the derogation record will show whether the law is working as intended.