France’s Health Data Hub is finally set to move away from Microsoft Azure and onto a domestic cloud platform, marking one of the clearest signs yet that Europe’s sovereignty debate is turning into procurement reality. The new host, Scaleway, is a French cloud provider owned by Iliad, and the transition is expected to finish between late 2026 and early 2027, according to Reuters. What makes this decision especially significant is that it was not driven by politics alone: Scaleway reportedly won after a screening process that weighed more than 350 technical criteria, even though it already held HDS certification and had made progress toward SecNumCloud qualification.
The Health Data Hub, or HDH, has been one of France’s most controversial digital projects since its launch. The platform centralizes access to large national health datasets so researchers, public agencies, and innovation teams can use them for medical studies, epidemiology, and health-system planning. From the beginning, however, the choice of Microsoft Azure to host sensitive French health records triggered political and legal objections, especially because the platform’s data would be handled by a U.S.-linked provider subject to U.S. legal reach.
That concern was not abstract. In European cloud politics, the combination of U.S. corporate control and extraterritorial legal exposure has become shorthand for a broader sovereignty problem. French authorities have spent years arguing that strategic data should be governed under stricter local and European constraints, and the Health Data Hub became a symbol of that effort because it involved personal health records, not just generic corporate workloads.
The new decision also lands at a moment when Europe is accelerating its own cloud sovereignty agenda. The European Commission’s CLOUD III DPS procurement framework, launched in 2024, is part of a wider effort to buy cloud services from providers that can satisfy sovereignty, legal, and operational requirements. Scaleway itself said it was selected under that program just days ago, underscoring that its HDH win is part of a larger institutional shift rather than a one-off French exception. (commission.europa.eu)
At the same time, the French cloud market has matured. Orange Business received SecNumCloud qualification for Cloud Avenue SecNum in July 2025, while other European cloud players have been positioning themselves for state-sensitive workloads. This matters because France is no longer choosing between “cloud” and “no cloud”; it is choosing among cloud providers whose architectures, legal models, and certifications differ sharply in how much trust they can claim.
What changed over time was not only the politics, but the regulatory backdrop. France updated the HDS framework in 2024, tightening the requirements for hosting health data and adding further emphasis on localization and transfer rules. That did not automatically rule out foreign players, but it raised the bar for any cloud provider hoping to win trust in a sector where compliance is table stakes and sovereignty is the differentiator.
Microsoft, for its part, continues to maintain HDS credentials for certain services, and it still has a major footprint in French enterprise IT. Yet the HDH switch shows that formal compliance is no longer enough if the procurement goal is to minimize dependency and reassure stakeholders that their data lives within a more clearly European operating model.
In practical terms, that kind of process tends to favor providers that can show both strong architectural discipline and a credible roadmap. Scaleway has the advantage of being French-owned, but ownership alone would not have been enough. The platform also needed to prove that it could support a mission-critical system handling tens of millions of citizens’ health records without sacrificing availability or research utility.
The company’s recent moves help explain why it was competitive. Scaleway acquired Saagie in June 2025, adding DataOps capabilities that should strengthen orchestration, data quality, and pipeline management. That is especially relevant for HDH, where the challenge is not simply storing data but transforming fragmented, massive datasets into something researchers can actually use.
That distinction matters. HDS is about the secure hosting of health data under French law, while SecNumCloud goes further by addressing technical, operational, and legal requirements that are meant to reduce exposure to non-EU legal regimes such as the U.S. CLOUD Act. In other words, HDS is necessary for the use case, but SecNumCloud is what makes the cloud look truly sovereign in French terms.
France has become increasingly serious about this framework because its digital strategy depends on more than just encryption or local data centers. If a provider can still be compelled by foreign law to produce data or disclose operational information, then French officials may see the sovereignty promise as incomplete. That is why SecNumCloud has become such a powerful benchmark in procurement and why “French cloud” increasingly means a legal architecture as much as a physical one.
In that sense, the acquisition of Saagie becomes strategically interesting. DataOps capabilities can help with pipeline governance, quality assurance, orchestration, and repeatability, all of which matter in a setting where datasets come from multiple institutions and require strict controls. If Scaleway can improve the data layer, it may help France extract more value from the national health corpus without weakening oversight.
This is where cloud debates often become overly simplistic. Many discussions focus on where the bits are stored, but the bigger competitive advantage may come from who can make the bits useful while keeping them compliant. For health research, the practical outcome is what matters: better access, lower friction, and a platform that supports secondary use without creating a governance free-for-all.
Germany’s Schleswig-Holstein has become a reference point because it is explicitly trying to cut license costs and reduce dependence on proprietary software in government workflows. That is not the same as cloud sovereignty, but it reflects the same underlying instinct: public administrations want to own more of their digital destiny and avoid being trapped in expensive, inflexible, foreign-controlled ecosystems.
In France, the strategy is more nuanced. Rather than abandoning all major international vendors, the state is trying to segment workloads and place the most sensitive ones with providers that satisfy sovereignty criteria. This is why the marketplace for “trusted cloud” in Europe is becoming more layered, with domestic players, European alliances, and hybrid offerings all competing for a share of public procurement.
For citizens, the implications are more subtle but more consequential. The average person may not care which cloud brand stores their health data, but they do care whether the system is secure, dependable, and governed in a way that inspires confidence. If the migration helps build public trust in a national health-data platform, then it could make secondary-use research politically easier and socially more legitimate.
There is also a symbolic dimension. France is signaling that critical health infrastructure should not depend on a U.S. hyperscaler if a local alternative can meet the technical bar. That does not end the transatlantic cloud relationship, but it does make clear that strategic workloads are being reclassified as assets that should live closer to national control.
Still, the symbolism is hard to miss. A project that had become a lightning rod for sovereignty criticism is now being repatriated to a French provider. That weakens the argument that only U.S. hyperscalers can handle the scale and complexity of national health data, and it may encourage other European public bodies to test domestic alternatives more aggressively.
The competitive question is whether hyperscalers can adapt fast enough. They may respond through local partnerships, trusted-cloud joint ventures, more onshore processing, or deeper legal separation of operating entities. But if buyers increasingly prioritize control as much as capability, then the cloud market’s center of gravity may shift toward providers that can prove independence in ways that go beyond branding.
But there is a caution here. Health-data platforms often look strongest right after a migration announcement and then become difficult during integration, governance refinement, and user onboarding. The real measure of success will be whether researchers can query, combine, and govern datasets more efficiently without creating new bottlenecks or overcomplicating compliance.
There is also the issue of interoperability across Europe. If France wants HDH to support broader European research efforts, it will need mechanisms that align with cross-border access requirements, privacy rules, and future AI governance regimes. In that context, sovereignty cannot become a wall; it has to become a controlled gateway.
The broader European lesson is that cloud policy is no longer theoretical. Governments are buying, certifying, and restructuring around a more explicit hierarchy of trust, and that will continue to shape procurement, competition, and public expectations. Scaleway’s win is important because it shows that a domestic provider can beat a hyperscaler on a mixture of security, sovereignty, and technical suitability when the stakes are high enough.
What to watch next:
Source: Mobile Europe Scaleway to replace Microsoft in hosting French Health Data Hub - Mobile Europe
Overview
The Health Data Hub, or HDH, has been one of France’s most controversial digital projects since its launch. The platform centralizes access to large national health datasets so researchers, public agencies, and innovation teams can use them for medical studies, epidemiology, and health-system planning. From the beginning, however, the choice of Microsoft Azure to host sensitive French health records triggered political and legal objections, especially because the platform’s data would be handled by a U.S.-linked provider subject to U.S. legal reach.That concern was not abstract. In European cloud politics, the combination of U.S. corporate control and extraterritorial legal exposure has become shorthand for a broader sovereignty problem. French authorities have spent years arguing that strategic data should be governed under stricter local and European constraints, and the Health Data Hub became a symbol of that effort because it involved personal health records, not just generic corporate workloads.
The new decision also lands at a moment when Europe is accelerating its own cloud sovereignty agenda. The European Commission’s CLOUD III DPS procurement framework, launched in 2024, is part of a wider effort to buy cloud services from providers that can satisfy sovereignty, legal, and operational requirements. Scaleway itself said it was selected under that program just days ago, underscoring that its HDH win is part of a larger institutional shift rather than a one-off French exception. (commission.europa.eu)
At the same time, the French cloud market has matured. Orange Business received SecNumCloud qualification for Cloud Avenue SecNum in July 2025, while other European cloud players have been positioning themselves for state-sensitive workloads. This matters because France is no longer choosing between “cloud” and “no cloud”; it is choosing among cloud providers whose architectures, legal models, and certifications differ sharply in how much trust they can claim.
Why this move matters now
The timing is important because HDH is no longer a hypothetical data platform. It sits at the center of France’s health-data strategy and therefore touches both public trust and the future of medical research. Moving away from Microsoft is not just a supplier change; it is a policy statement about where Europe believes sensitive data should live and under what legal assumptions it should operate.The Long Shadow of the Microsoft Deal
Microsoft Azure’s selection in 2019 was controversial almost immediately, and that controversy never really disappeared. Critics argued that France was building a national health-data infrastructure on infrastructure controlled by an American provider, a choice that looked increasingly uncomfortable as geopolitical tensions sharpened and data-sovereignty language became more mainstream.What changed over time was not only the politics, but the regulatory backdrop. France updated the HDS framework in 2024, tightening the requirements for hosting health data and adding further emphasis on localization and transfer rules. That did not automatically rule out foreign players, but it raised the bar for any cloud provider hoping to win trust in a sector where compliance is table stakes and sovereignty is the differentiator.
Microsoft, for its part, continues to maintain HDS credentials for certain services, and it still has a major footprint in French enterprise IT. Yet the HDH switch shows that formal compliance is no longer enough if the procurement goal is to minimize dependency and reassure stakeholders that their data lives within a more clearly European operating model.
From compliance to trust
The deeper story is that cloud strategy has shifted from pure capability to trusted capability. Organizations increasingly want a provider that can do the technical work while also fitting legal, political, and national-security expectations. In health data, that requirement is stronger than in most other sectors because the social consequences of failure are so much greater.- The original Microsoft arrangement became a sovereignty flashpoint.
- Updated French HDS rules increased the pressure on hosting providers.
- Public-sector buyers now weigh legal exposure as heavily as performance.
- Health data has become a proxy for broader cloud-policy debates.
- The HDH switch reflects trust engineering, not just IT migration.
How Scaleway Won the Contract
Scaleway reportedly prevailed after a rigorous selection process that examined more than 350 technical criteria. That detail matters because it suggests the decision was not reduced to a single sovereignty checkbox; instead, HDH appears to have evaluated security, resilience, performance, scaling capacity, and operational maturity as a package.In practical terms, that kind of process tends to favor providers that can show both strong architectural discipline and a credible roadmap. Scaleway has the advantage of being French-owned, but ownership alone would not have been enough. The platform also needed to prove that it could support a mission-critical system handling tens of millions of citizens’ health records without sacrificing availability or research utility.
The company’s recent moves help explain why it was competitive. Scaleway acquired Saagie in June 2025, adding DataOps capabilities that should strengthen orchestration, data quality, and pipeline management. That is especially relevant for HDH, where the challenge is not simply storing data but transforming fragmented, massive datasets into something researchers can actually use.
Why 350 criteria is more than a headline
A criteria-heavy process usually signals a buyer trying to avoid the trap of overvaluing one dimension, such as sovereignty, at the expense of day-to-day operability. In a health-data environment, the cloud must be reliable, auditable, and performant under load. If the platform is too hard to operate, it undermines the very mission it was meant to support.- Security likely mattered, but so did real-world resilience.
- Performance under heavy analytics loads would have been essential.
- Data-management tooling is increasingly part of cloud selection.
- Vendor independence is valuable only if service quality remains high.
- The winning provider had to be credible to both technologists and policymakers.
Certifications and the Sovereignty Stack
One of the most notable aspects of the Scaleway decision is that it rests on a layered trust model rather than a single credential. Scaleway already has HDS certification, which is mandatory for hosting health data in France, and it says it has demonstrated a roadmap toward SecNumCloud qualification, the French security benchmark that is widely treated as the gold standard for sensitive public-sector cloud work.That distinction matters. HDS is about the secure hosting of health data under French law, while SecNumCloud goes further by addressing technical, operational, and legal requirements that are meant to reduce exposure to non-EU legal regimes such as the U.S. CLOUD Act. In other words, HDS is necessary for the use case, but SecNumCloud is what makes the cloud look truly sovereign in French terms.
France has become increasingly serious about this framework because its digital strategy depends on more than just encryption or local data centers. If a provider can still be compelled by foreign law to produce data or disclose operational information, then French officials may see the sovereignty promise as incomplete. That is why SecNumCloud has become such a powerful benchmark in procurement and why “French cloud” increasingly means a legal architecture as much as a physical one.
The meaning of SecNumCloud
SecNumCloud is not simply a marketing label. ANSSI, France’s cybersecurity agency, treats it as a highly demanding qualification for cloud service providers, and public guidance repeatedly frames it as a recommended choice for sensitive workloads. The significance of Scaleway’s roadmap is that it suggests the company is trying to meet the highest bar even if the HDH project itself does not depend on the full qualification at day one.- HDS enables lawful health-data hosting in France.
- SecNumCloud addresses broader sovereign-trust requirements.
- France is using procurement to reshape cloud dependency.
- Legal insulation from extraterritorial access is a strategic objective.
- Certification is becoming a competitive moat in regulated markets.
Data Access as the Real Prize
The HDH project is not only about storage; it is about making data usable. The official line from Scaleway stresses that the hardest part of the job is turning huge volumes of complex and disparate information into a platform that supports research and innovation. That is a crucial point because many digital-health initiatives fail not on security, but on interoperability, metadata quality, and the ability to get repeated value from messy real-world records.In that sense, the acquisition of Saagie becomes strategically interesting. DataOps capabilities can help with pipeline governance, quality assurance, orchestration, and repeatability, all of which matter in a setting where datasets come from multiple institutions and require strict controls. If Scaleway can improve the data layer, it may help France extract more value from the national health corpus without weakening oversight.
This is where cloud debates often become overly simplistic. Many discussions focus on where the bits are stored, but the bigger competitive advantage may come from who can make the bits useful while keeping them compliant. For health research, the practical outcome is what matters: better access, lower friction, and a platform that supports secondary use without creating a governance free-for-all.
Research utility versus administrative caution
There is always a tension between openness for innovation and caution around privacy. Health data can power epidemiology, AI-assisted diagnosis, and public-health modeling, but every new use case raises questions about consent, auditability, and purpose limitation. The HDH migration suggests France wants to preserve research ambition while changing the trust model underneath it.- Better data orchestration can accelerate research workflows.
- Clean pipelines reduce manual governance overhead.
- Strong metadata management can improve reuse across projects.
- Health data platforms need both scale and strict access control.
- The value of the migration depends on usable data, not just sovereign data.
A Broader European Rebalancing
The switch from Microsoft to Scaleway is part of a much bigger European pattern. The Commission’s CLOUD III DPS, public-sector open-source migrations in Schleswig-Holstein, and Denmark’s gradual move toward open source all point in the same direction: governments are trying to reduce strategic dependence on U.S. tech stacks, even if the transitions are slow and uneven. (commission.europa.eu)Germany’s Schleswig-Holstein has become a reference point because it is explicitly trying to cut license costs and reduce dependence on proprietary software in government workflows. That is not the same as cloud sovereignty, but it reflects the same underlying instinct: public administrations want to own more of their digital destiny and avoid being trapped in expensive, inflexible, foreign-controlled ecosystems.
In France, the strategy is more nuanced. Rather than abandoning all major international vendors, the state is trying to segment workloads and place the most sensitive ones with providers that satisfy sovereignty criteria. This is why the marketplace for “trusted cloud” in Europe is becoming more layered, with domestic players, European alliances, and hybrid offerings all competing for a share of public procurement.
Public policy by procurement
Procurement has become one of the most effective ways for European governments to shape the cloud market. Instead of writing lofty sovereignty declarations, they are embedding those requirements directly into buying decisions. That creates incentives for providers to invest in local control, legal insulation, and security certifications that public buyers can verify. (commission.europa.eu)- Public procurement is now a policy instrument.
- Sovereignty is being operationalized through vendor selection.
- European cloud providers gain legitimacy from regulated wins.
- Open source and sovereign cloud are increasingly linked in policy debates.
- The market is reorganizing around trust tiers rather than raw scale.
Enterprise Impact Versus Citizen Impact
For enterprises, the Scaleway win sends a clear market signal: sovereignty credentials are now commercially valuable, not just politically fashionable. Vendors serving banks, ministries, healthcare organizations, and regulated industries can no longer treat local certification as an add-on; it is becoming part of the core sales proposition. Scaleway’s work with organizations such as the French Home Office’s emergency call services and Delubac Bank reinforces that it is positioning itself as a serious operator for sensitive workloads.For citizens, the implications are more subtle but more consequential. The average person may not care which cloud brand stores their health data, but they do care whether the system is secure, dependable, and governed in a way that inspires confidence. If the migration helps build public trust in a national health-data platform, then it could make secondary-use research politically easier and socially more legitimate.
There is also a symbolic dimension. France is signaling that critical health infrastructure should not depend on a U.S. hyperscaler if a local alternative can meet the technical bar. That does not end the transatlantic cloud relationship, but it does make clear that strategic workloads are being reclassified as assets that should live closer to national control.
What companies should notice
Private-sector buyers often assume sovereignty is only a public-sector concern. The HDH move shows that regulated industries may soon be pressured in the same direction, especially where personal data, critical infrastructure, or AI model training is involved. As public institutions normalize sovereign cloud procurement, enterprise customers may find their regulators, insurers, and boards asking similar questions. (commission.europa.eu)- Health-data sovereignty can spill into finance and critical services.
- Trust requirements are becoming a commercial differentiator.
- Enterprise buyers may face rising expectations from regulators.
- Public-sector moves often set private-sector norms.
- The sovereign-cloud market is likely to deepen, not shrink.
Microsoft’s Loss, But Not Its Exit
It would be a mistake to read this as Microsoft losing France outright. The company remains deeply embedded in French and European enterprise IT, and its health-data compliance pages still reflect a major regulated-market presence. Azure, Microsoft 365, and Dynamics 365 continue to be sold as certified options for certain health-data workloads, which means Microsoft is not disappearing from the sovereignty conversation; it is being pushed into a narrower lane.Still, the symbolism is hard to miss. A project that had become a lightning rod for sovereignty criticism is now being repatriated to a French provider. That weakens the argument that only U.S. hyperscalers can handle the scale and complexity of national health data, and it may encourage other European public bodies to test domestic alternatives more aggressively.
The competitive question is whether hyperscalers can adapt fast enough. They may respond through local partnerships, trusted-cloud joint ventures, more onshore processing, or deeper legal separation of operating entities. But if buyers increasingly prioritize control as much as capability, then the cloud market’s center of gravity may shift toward providers that can prove independence in ways that go beyond branding.
The new competitive landscape
A few years ago, cloud competition was mostly about scale, price, and service breadth. Now, in regulated European markets, the winning formula increasingly includes legal design, certification depth, and geopolitical credibility. That favors providers that can align technology with public policy rather than treating policy as an afterthought.- Microsoft remains important, but its route into sensitive workloads is narrower.
- Trusted-cloud structures may become more common.
- Hybrid and partnership models could soften the impact of sovereignty rules.
- European vendors now have a stronger narrative in procurement battles.
- The cloud market is becoming more fragmented by jurisdiction.
What This Means for Health Research
The HDH’s stated goal is to improve secondary use of health data for research and innovation, and that objective depends on more than just where the data sits. Researchers need access pathways, audit trails, governance models, and infrastructure that can support workloads ranging from statistical analysis to machine learning. If the transition to Scaleway improves all of those layers, France could gain a more flexible national research asset.But there is a caution here. Health-data platforms often look strongest right after a migration announcement and then become difficult during integration, governance refinement, and user onboarding. The real measure of success will be whether researchers can query, combine, and govern datasets more efficiently without creating new bottlenecks or overcomplicating compliance.
There is also the issue of interoperability across Europe. If France wants HDH to support broader European research efforts, it will need mechanisms that align with cross-border access requirements, privacy rules, and future AI governance regimes. In that context, sovereignty cannot become a wall; it has to become a controlled gateway.
The research payoff
If the migration succeeds, France could end up with a stronger template for other public-health systems. That would be especially valuable in an era when data reuse is becoming central to public health planning, AI training, and medical discovery. The value proposition is not just privacy, but a more trustworthy route to faster science.- Faster access may improve research timelines.
- Better governance can increase public legitimacy.
- Stronger local control could simplify policy oversight.
- Cross-border interoperability will remain a challenge.
- Success could make HDH a model for other EU countries.
Strengths and Opportunities
Scaleway’s selection gives France a rare chance to align sovereignty goals, regulatory compliance, and domestic industrial policy in one move. If the company executes well, the country could emerge with a health-data platform that is both more trusted and more adaptable than the previous setup.- French ownership reduces political friction in a sensitive sector.
- HDS certification satisfies the legal requirement for health-data hosting.
- A credible SecNumCloud roadmap strengthens sovereignty credentials.
- The Saagie acquisition may improve data orchestration and usability.
- The project could boost France’s digital autonomy narrative.
- A successful migration may set a model for other public-sector workloads.
- The win helps expand the market for European cloud providers.
Risks and Concerns
The most obvious risk is operational: migrations of this scale are notoriously difficult, especially when health data, public trust, and national scrutiny are all involved. There is also a risk that the sovereignty narrative overshadows the equally important challenge of making the platform genuinely useful to researchers.- Migration delays could push the timetable beyond late 2026 or early 2027.
- Data quality or interoperability problems could limit the platform’s impact.
- Sovereignty rules may add friction for some research use cases.
- Overemphasis on legal control could hurt usability.
- Cloud concentration inside Europe may simply replace one dependency with another.
- Certification progress is not the same as continuous operational excellence.
- Public expectations may exceed what the first migration phase can deliver.
Looking Ahead
The next year will be less about the announcement itself and more about whether France can turn a sovereignty victory into a working national platform. The transition window to late 2026 or early 2027 leaves room for technical surprises, governance disputes, and scope adjustments, especially if the HDH team tries to preserve continuity while changing the underlying cloud model.The broader European lesson is that cloud policy is no longer theoretical. Governments are buying, certifying, and restructuring around a more explicit hierarchy of trust, and that will continue to shape procurement, competition, and public expectations. Scaleway’s win is important because it shows that a domestic provider can beat a hyperscaler on a mixture of security, sovereignty, and technical suitability when the stakes are high enough.
What to watch next:
- Whether the HDH migration stays on schedule.
- Whether Scaleway advances further toward full SecNumCloud qualification.
- How researchers respond to the new platform and its access model.
- Whether more French or EU agencies follow the same procurement logic.
- How Microsoft and other hyperscalers adapt their sovereign-cloud offers.
- Whether the French model influences other health-data systems across Europe.
Source: Mobile Europe Scaleway to replace Microsoft in hosting French Health Data Hub - Mobile Europe
