SecNumCloud and Europe's trusted cloud audited without flags: who is qualified in 2026, where Bleu and S3NS stand, and when hyperscalers stay rational.
In August I audited French sovereign AI without the flag-waving. This is the follow-up one layer down, on the infrastructure where the sovereignty debate is actually decided: the cloud. And the honest opening statement is double. France now has the most serious trusted-cloud framework in Europe, SecNumCloud, with real teeth, a real qualified list and, since April 2026, a real legal obligation behind it. And the overwhelming majority of European workloads, including sensitive ones, still run on Amazon, Microsoft and Google, whose share of the European market has hovered around 70% while European providers sit near 15%. Both facts matter, because the useful question in late 2026 is not "sovereign cloud: yes or no?" It is: which workloads genuinely need a qualified trusted cloud, which are fine on a hyperscaler's EU region, and what did the last eighteen months (S3NS qualified, Bleu almost there, the Data Act live, the EUCS…