A Deadline Replaces a Roadmap
On 10 February 2026, three French ministers, Health Minister Stephanie Rist, Deputy Minister for AI and Digital Affairs Anne Le Henanff, and Deputy Minister for Public Service and State Reform David Amiel, announced that the Health Data Hub would abandon its planned two-stage migration and move directly to a SecNumCloud-qualified sovereign cloud. The target is a complete copy of the main SNDS database, France's national health-claims system, hosted off Microsoft Azure by the end of 2026. An expert review had confirmed the direct move was technically feasible, so the government skipped the interim step it had originally planned.
The reasoning is jurisdictional, not technical. A US-owned cloud provider can, in principle, be compelled under non-EU law to hand over data regardless of where its servers physically sit, and the SNDS is about as sensitive as a public dataset gets: it has underpinned more than 233 research projects and contributed to 29 project calls. Providers for the new hosting arrangement are being selected through the Public Cloud marketplace run jointly by DINUM, the state's digital agency, and the central state purchasing agency, with a tender attribution originally expected around the end of March 2026.
A Decree Turns Recommendation Into Requirement
A decree implementing the SREN law, published in April 2026, formally extended the SecNumCloud obligation to three additional digital-health operators. Their names have not yet appeared in an exhaustive list in the Official Journal, and the compliance timeline for each remains unclear, but the direction is not in doubt: a certification that used to function as a competitive differentiator is now, in the words of one French trade outlet covering the sector, closer to a condition of access to the public health market than a badge of honor.
That shift matters most for smaller digital-health vendors that built their infrastructure on non-SecNumCloud cloud providers. A company outside the qualified list does not need a new law naming it individually to feel the effect; it only needs a public buyer, or a decree, to start treating the qualification as the baseline. Migration costs are real, and sector commentary has flagged that they deserve to be planned well in advance, even without a public euro figure attached yet.
Five Companies Ask Paris Not to Pick One Winner
On 30 June 2026, five companies at the center of French digital health, Alan, Doctolib, Implicity, Lifen and Resilience, wrote to the cabinet of Anne Le Henanff and to the Direction generale des entreprises. Their message was not a rejection of sovereignty as a goal. It was a warning that a single accepted label, applied as the sole compliance pathway, concentrates risk rather than removing it: a provider outage, a certification bottleneck, or a slow qualification queue would hit every company that depends on that one list at the same time.
Their central request was to replace single-label logic with an approach built on audits and risk scoring, letting a company demonstrate equivalent security without being tied to one certification track. It is the same argument regulators make about vendor lock-in when the vendor is American; these five companies are making it about the risk of lock-in to a domestic label with a short and slow-growing list of qualified names.
Sovereignty Concentrated Onto Eleven Vendors
As of April 2026, only 11 cloud offers held the SecNumCloud qualification, among them OVHcloud, Orange Business, Outscale, S3NS, Worldline, Cegedim, Cloud Temple, Oodrive and Whaller, with 18 more applications reported in progress. SecNumCloud began as a way to remove French health data from the reach of non-EU legal demands, which is the textbook definition of digital sovereignty. But a qualified list that short creates its own single point of failure: pricing power, capacity limits, and a queue of applicants who cannot yet bid on public contracts that increasingly assume the label as a baseline.
The distinction officials draw between recommended and required is real on paper, but it depends on which document is doing the talking. A decree that quietly adds three more mandated operators, and a state health platform that migrates its own flagship database onto the same qualification, add up to the same practical outcome as a mandate, just built through ordinary procurement mechanics rather than a headline law. Whether the audit-based alternative the five companies asked for gets adopted before the next names appear in the Official Journal is the detail worth watching through the rest of 2026.
Read next: EuroHPC Opens Four Quantum Machines to Free Pilots | Europe's Sovereign AI Now Runs on American Money
