What the French state's 2026 cloud numbers tell an EU CTO

On 26 March 2026, France’s interministerial digital directorate (DINUM) published its figures on the state’s move to sovereign cloud. Read them as a demand signal rather than national cheerleading. One of the largest public buyers in France is telling the market where it spends its money, and on whom.

For a CTO or head of platform in the EU or UK weighing a migration off a hyperscaler, that is useful evidence. It shows where European options have matured enough for a government to standardise on them. Read honestly, it also shows where the work is not finished.

The demand side is moving

DINUM reports €84M of orders placed on the interministerial “Nuage public” market in 2025, up 62% on 2024. Active projects rose 42%. Some 847 distinct projects placed an order, roughly two new projects a day, and 27% more public bodies used cloud than a year earlier.

Absolute numbers matter less here than the trend. A market growing at that rate is one where providers keep investing, tooling keeps improving, and each migration is a little easier than the last. That compounding is the part a buyer should care about.

Procurement is shifting European

According to DINUM, 70% of orders on the “Nuage public” market went to European suppliers in 2025; on State-perimeter orders alone, that figure was 99%. Offers holding the SecNumCloud qualification grew 20% by volume and 10% by amount over the year.

This sits under the “Cloud au centre” doctrine, in force since 2021, which makes cloud-first the default for new state IT and points it at qualified, trusted offers. SecNumCloud, the qualification issued by France’s cyber-security agency ANSSI, is the bar these providers are measured against.

The state also names systems it has already moved onto French clouds: the SI SAMU (emergency dispatch), the IGN’s Géoportail, and online electoral-roll registration. The Plateforme des données de santé (the Health Data Hub) is slated to migrate to a trusted cloud by 2027.

What “European” does and does not mean

The headline offer to reach SecNumCloud qualification late in 2025 was S3NS’s PREMI3NS. Per DINUM, S3NS is held 95% by Thales and 5% by Google, and its offer runs on Google Cloud technology operated under the SecNumCloud regime. That is the trade-off stated plainly: sovereign operation and legal control on French soil, built on hyperscaler technology under licence.

It is not the same thing as a fully independent European stack, and DINUM does not claim it is. For a CTO, that distinction is what matters: SecNumCloud attests to how an offer is operated and governed, meaning insulation from extraterritorial legal reach. It does not attest that every layer of the technology is European in origin. State the exposure factually, weigh it against your own risk model, and move on.

Other offers named as qualified or in qualification include Bleu, Scaleway, OVHcloud and NumSpot. On the SaaS layer, DINUM cites Oodrive, Whaller, Pronote and Wimi. On AI, it points to Mistral AI models deployed on Outscale’s SecNumCloud infrastructure. That is a fully French chain, worth noting for teams that assume sovereign and modern AI are mutually exclusive.

La souveraineté numérique ne se décrète pas : elle se construit dans la durée, collectivement.

Anne Le Hénanff, Minister for AI and Digital Affairs

What it means for your migration

The useful reading for a CTO is narrower than the headline. Three things follow from these numbers.

• Where a public buyer this size has already migrated critical systems, the path is de-risked. A geoportal and an electoral-roll form running on a French cloud is real, checkable evidence, not a vendor promise.
• The credible sovereign options today cluster around compute, storage and a growing SaaS layer. Those are the same areas an honest AWS/Azure/GCP map grades “mature” or “viable”. That is where you migrate first.
• The gaps do not close because a government hit its numbers. Serverless breadth, managed ML platforms and global edge remain the hard cases. A state moving a geoportal is not proof that a serverless-heavy, ML-heavy product moves as cleanly.

And the most sensitive systems are still in flight: the Health Data Hub is slated for a trusted cloud only by 2027. Treat that as a schedule, not a fait accompli, with the same discipline you would apply to any migration roadmap that has not yet cut over.

C’est une réussite industrielle et stratégique française qu’il faut maintenir et amplifier.

David Amiel, Minister for Public Accounts

The signal from Paris is real: European demand is credible, and it is growing where it is credible. That is not the same as everything moving cleanly. Map your own estate against it service by service, concede the gaps out loud, and migrate what moves first. That is the whole method, and it survives the first sceptical call precisely because it does not overclaim.