The qualification economy: how a French purchasing rule turned a security audit into OVHcloud’s market

I. The mechanism: a qualification becomes a market only when a rule cites it

SecNumCloud is a qualification awarded by ANSSI, the French national cybersecurity authority, to a named service after an audit of its security, its governance and its immunity from non-European law (IT SOCIAL, 3 September 2026). For years it was a credential — respected, expensive, and commercially optional. What changed is not the audit. What changed is that a purchasing rule now points at it.

Article 31 of the law of 21 May 2024 known as loi SREN concerns the hosting of the state's sensitive data. Its implementing decree, decree number 2026-272 of 14 April 2026, sets the conditions under which public administrations, state operators and public-interest groupings may use commercial cloud services for that data, and the conditions under which a derogation can be granted (numerique.gouv.fr, 14 May 2026, publishing a joint technical note by the legal affairs directorate of the French finance ministries and DINUM). OVHcloud's own reading of the pair is blunt: they "require the use of certified cloud services for sensitive data belonging to the French State and its operators" (OVHcloud, 1 September 2026).

The rule did not appear from nowhere, and the company's own record shows how long the runway was. Announcing a SecNumCloud 3.2 qualification across three distinct sites — Roubaix, Gravelines and Strasbourg — OVHcloud stated that over 80 customers were then using its qualified Private Cloud solutions, and described France's Cloud at the Centre doctrine, established in 2021 and specified in summer 2023, as already requiring administrations to host personal and sensitive data on a SecNumCloud-qualified cloud (OVHcloud, 9 January 2024). A doctrine asks. A decree obliges. The distance between those two verbs is the subject of this dossier.

The economic consequence is the part most commentary misses. A qualification does not create demand; a citation does. The moment a procurement rule names a security framework, every buyer inside the rule's perimeter is converted from a prospect who might value sovereignty into a customer who has no lawful alternative — and every provider outside the qualified list is converted from a competitor into a non-bidder. That is the mechanism this dossier follows through the numbers.

II. What the decree actually says — including where the record disagrees with itself

Two dated accounts of the decree's status do not agree, and we print both rather than choose.

On 20 April 2026, six days after the signature, a French cybersecurity title reported that the prime minister had signed the implementing decree, that it requires protection against extraterritorial laws while implicitly favouring SecNumCloud-qualified operators without naming the qualification, and that it tasks ANSSI with writing a reference framework of technical requirements covering ten key domains — which had to be validated before the article could take effect. On that account, entry into force was still pending, because ANSSI had not published the framework. The same report set out the transition arithmetic: entities holding contracts with non-compliant suppliers get 18 months to migrate where a compliant offer exists, and a 12-month derogation where none does (INCYBER NEWS, 20 April 2026).

On 1 September 2026 a French IT trade title reported the machinery as complete: after the April decree, "an order of the prime minister published on 14 August" made recourse to SecNumCloud-stamped cloud services compulsory for the state's providers (LeMagIT, 1 September 2026). A second trade account of the same week describes the April decree as already imposing a qualified cloud for the sensitive data of the state and its operators, and notes that the requirement is spreading to healthcare, finance and industry (IT SOCIAL, 3 September 2026).

We have not opened the August order or the decree's own text: Légifrance and a mirror of the official journal both returned interstitial challenge pages to our fetcher rather than the legal text. So the decree is cited here through three dated secondary readings and one government publication note, and the sequence is printed as the record shows it — signed 14 April 2026, a technical note for public buyers published 14 May 2026, an obligation reported as activated by an order of 14 August 2026 — without our asserting a single date of entry into force. For a candidate or a supplier the operational meaning survives the ambiguity: by September 2026 the market behaved as though the rule bites.

III. The third line, and what it is not

Until 2026, qualified cloud in France was largely a business of dedicated environments: bare metal or hosted private clouds that a buyer reserves and sizes in advance. The demand from administrations and regulated sectors was for the thing they use everywhere else — instances and storage ordered self-service, paid by consumption, driven by an API (IT SOCIAL, 3 September 2026). SNC Cloud Platform is OVHcloud's answer to that gap: multi-tenant, self-service, infrastructure-as-code, pay-as-you-go, built on open APIs and open-source standards, with data reversibility presented as a design goal (OVHcloud, 1 September 2026).

Its own beta page is unusually candid about the boundary, and worth quoting for anyone tempted to read a press release as a finished product. Registrations closed with the beta ending in June 2026; the beta was free; the localisation was a single region, eu-west-rbx — Roubaix; and the page states plainly that during the beta "the service is not SecNumCloud qualified yet but 'under qualification'" (OVHcloud Labs, consulted 5 September 2026). The beta scope was compute (instances on shared hosts in three profiles matching Public Cloud flavours, instances on dedicated hosts, metal instances from a catalogue) plus block and object storage — with network attachment through a trusted network access reserved for SecNumCloud services (OVHcloud Labs, consulted 5 September 2026; IT SOCIAL, 3 September 2026).

What is still missing at qualification is the part that decides whether a regulated buyer can actually move a modern application. At announcement the platform offered compute, block and object storage, dedicated servers and network services; managed Kubernetes, fine-grained network control and database-as-a-service were not yet available (LeMagIT, 1 September 2026). Geographic extension is stated in two directions: to Gravelines and Strasbourg at general availability (IT SOCIAL, 3 September 2026), and to the group's European public-cloud regions starting with Italy, Germany and Poland, each deployment complying with the applicable national framework (OVHcloud, 1 September 2026).

So the honest summary is a sequenced one: France now has a qualified public cloud with a real consumption model and an incomplete managed-services catalogue. That gap is a roadmap, and — as section VII argues — a hiring plan.

IV. What it costs to hold the ticket

Sovereignty is usually discussed as a legal property. On OVHcloud's own accounts it is first a capital-intensity property.

For the six months to 28 February 2026: revenue €555.3m, up 5.5% like-for-like; adjusted EBITDA €227.2m at a 40.9% margin, up 0.9 points and described as a record since the IPO; EBIT €35.4m, a 6.4% margin, including depreciation, amortisation and impairment of €185.6m; net financial expense €28.7m; net income €5.9m; unlevered free cash flow €32.3m; and capital expenditure excluding acquisitions of €238.5m, or 42.9% of revenue, split between recurring capex at 13.0% of revenue and growth capex at 29.9%, of which around 11 points were a voluntary front-loading (OVHcloud, 9 April 2026). The reason given for the front-loading is specific and material: to secure supplies and limit the impact of exceptional cost inflation on components (OVHcloud, 9 April 2026).

Read those lines in order and the business model becomes legible. A 40.9% EBITDA margin funds an infrastructure programme that consumes more than 40% of revenue in the same period; the depreciation of yesterday's programme, €185.6m, is what compresses a 40.9% EBITDA margin into a 6.4% EBIT margin and a €5.9m net result. This is not a software business with a compliance badge. It is an industrial business whose product happens to be delivered over a network, and whose profitability is a function of how well it times purchases of physical components.

The component cycle is not a rounding error either. A trade account of the qualification week notes that OVHcloud has raised the prices of several cloud services more than once, passing through the surge in memory prices, and positions SNC Cloud Platform as the most affordable and most agile offer in its sovereign catalogue (LeMagIT, 1 September 2026). A qualified cloud that is also the cheapest sovereign option in its own catalogue is a deliberate commercial posture, and it is being taken while input costs rise.

Guidance for FY2026, reaffirmed at the third quarter, states the discipline the group has set itself: organic revenue growth between 5% and 7%; an adjusted EBITDA margin above FY2025; adjusted capex representing between 33% and 35% of revenue, excluding locked-in stock for FY2027 covered by dedicated financing; and positive levered free cash flow (OVHcloud, 25 June 2026). The annual results are calendared for 20 October 2026 (OVHcloud, 25 June 2026), which is the next moment at which any of this can be tested rather than believed.

V. The demand shape: a sovereignty tailwind and a virtualisation shock in the same book

Third-quarter FY2026 revenue was €289.6m, up 6.9% like-for-like — a sequential acceleration — with Public Cloud back above 20% growth (OVHcloud, 25 June 2026). Inside that quarter: Private Cloud €174.0m, 60.1% of revenue, up 4.0%; Public Cloud €65.6m, 22.7% of revenue, up 20.2%; Web Cloud €50.0m, 17.3% of revenue, up 2.0%. Net revenue retention was 102% like-for-like in the quarter, against 104% for the half-year (OVHcloud, 25 June 2026; OVHcloud, 9 April 2026). Geographically, France was 48% of group revenue and grew 5.8%, the other European countries 29% and grew 7.4%, and the rest of the world 23% and grew 8.6% (OVHcloud, 25 June 2026).

Two mechanisms run against each other in those lines, and both matter to anyone reading this as a market signal rather than a scoreboard.

The first is acquisition at the entry range. Repositioning the cheapest offers produced a 116%¹ increase in new customers on entry-level VPS in the half-year against the year before, and 12%¹ on Bare Metal (OVHcloud, 9 April 2026). That is a volume machine at the bottom of the funnel, refreshed again with the VPS 2027, domain-name and web-hosting ranges in the third quarter (OVHcloud, 25 June 2026).

The second is a cost shock arriving through someone else's price list. In Hosted Private Cloud, growth in the corporate segment offsets churn among smaller customers "affected by Broadcom's price increases", and those customers continue to optimise their infrastructure (OVHcloud, 25 June 2026; OVHcloud, 9 April 2026). The blunt reading: part of Europe's sovereign-cloud demand is not idealism at all, it is the search for an exit from a virtualisation bill — while at the same time OVHcloud's own qualified private line runs on VMware, and it launched new Premier 2027 servers for Managed VMware vSphere in that same quarter (OVHcloud, 25 June 2026). A provider selling both the escape route and the thing being escaped is a structural tension worth naming, and we name it without predicting how it resolves.

VI. The qualified field is now crowded — accreditation is a ticket, not a moat

On the same day OVHcloud announced its third qualification, Numspot — born of a coming-together of Bouygues Telecom, the Banque des Territoires, Dassault Systèmes and Docaposte — announced SecNumCloud qualification for its IaaS offer, having first had to qualify the administration console controlling identities, network policies and the mobilisation of OutScale compute and storage. Its PaaS qualification process was described as ongoing, with its chief executive in June 2026 expecting the stamp at end-2026 or early 2027. On the IaaS bench, that account lists OutScale, OVHcloud, Thales-Google's S3NS, Orange Business Services' Cloud Avenue SecNum, Cloud Temple and Magellan's Worldline-derived secured IaaS; Bleu, the Capgemini-Orange joint venture running on Microsoft Azure technologies, was still awaited, its president having hoped in March 2026 for qualification before the end of 2026 (LeMagIT, 1 September 2026).

This is the finding a Bloomberg-style reading would put in bold: the barrier that mattered in 2023 is becoming a table stake. When six or seven providers hold the same ANSSI stamp, the stamp stops differentiating and the competition moves to what sits above it — catalogue completeness, price per unit of compute, migration effort, and whether the managed services a regulated buyer actually needs are qualified yet. On the last of those criteria, OVHcloud's own gap list from section III is precisely where it is exposed.

VII. What the demand is buying, and what it hires

Two dated 2026 facts show the demand arriving in a form that has a payroll attached.

First, institutions. A consortium of DEEP by POST Luxembourg Group, OVHcloud and Clever Cloud was selected by the European Commission to provide a sovereign cloud for EU institutions, in a contract capped at a maximum value of €180m over six years (OVHcloud, 25 June 2026). We print that as a ceiling on a framework, not as revenue booked, and we do not divide it by six.

Second, defence. In the second quarter of FY2026 several European defence ministries approached the group; the stated stakes are AI-augmented command, drone orchestration and communications interoperability between armed forces and with NATO, all with a strong requirement for technological independence from non-European providers. OVHcloud's response is a Defence vertical built on its SecNumCloud products, a sales organisation in each country to work with each ministry, and — the sentence that matters for careers — "hiring new profiles with military backgrounds and from the Defence industry" (OVHcloud, 9 April 2026). The commercial organisation was restructured in the third quarter around a dedicated management team in six countries reporting to a new corporate chief revenue officer (OVHcloud, 25 June 2026).

Alongside that, an AI line is being assembled by acquisition: an AI Lab initiated by the acquisition of Dragon LLM, then extended through exclusive negotiations to acquire Gladia, a voice-AI specialist, in order to internalise speech-to-text building blocks; and OVHai Workspace, previewed at VivaTech as an open, collaborative agentic platform with end-to-end encryption and local processing of sensitive data (OVHcloud, 25 June 2026).

Put the three together and the shape of demand for skills is readable without a single invented number. A qualified cloud with an incomplete catalogue needs platform engineers who can bring managed Kubernetes, fine-grained networking and database services through an audit, not merely into production — which is a documentation, isolation and evidence discipline more than a coding one. A defence vertical needs people fluent in two languages at once: ministry procurement and infrastructure operations. An accreditation-led market needs auditors, compliance engineers and the unglamorous trade of writing and maintaining the control evidence that a qualification renews on. And a platform that raises prices as memory prices surge needs the capacity-planning and FinOps skills that decide whether a 33–35% capex ratio lands where guidance says it will.

VIII. What we refuse to claim

We publish no headcount for OVHcloud, no salary range, no hiring volume for the Defence vertical, no split of the €180m European framework, and no market share for any qualified provider. We do not state a date on which article 31 entered into force: two dated accounts disagree, and we print both. We have not read decree 2026-272 or the reported order of 14 August 2026 in their own texts — Légifrance and an official-journal mirror both answered our fetcher with challenge pages — so the legal instruments are cited through three dated trade and cybersecurity accounts and one government publication note, and no clause is quoted as if we had opened it. We print no full-year FY2026 revenue or margin figure, because none exists: the annual results are scheduled for 20 October 2026, and guidance is a company target, never a result. We print no share-price movement: the one figure we saw came from a market-data page we do not cite as evidence, so it is left out entirely rather than attributed. The group's own boilerplate describes 46 data centres and 1.6 million customers in more than 140 countries on 25 June 2026, and 46 data centres with 1.7 million customers on 1 September 2026; both are printed with their dates, as self-descriptions, and neither is treated as an audited figure. No ANSSI decision reference is cited: the agency's catalogue had not yet displayed the new qualification on the morning of 1 September 2026, publication following the provider's announcement with the agency's usual delay (IT SOCIAL, 3 September 2026), and we did not read the catalogue ourselves. Finally, we make no forecast about whether the qualified field consolidates; section VI states a mechanism, not an outcome.

IX. The one-sentence summary

France did not subsidise a sovereign cloud into existence; it wrote a purchasing rule, and the rule is now converting a security audit into a market — which is why the interesting question about OVHcloud is no longer whether it holds the stamp, but whether a business spending 42.9% of a half-year's revenue on infrastructure can complete a qualified catalogue faster than six competitors holding the same stamp (OVHcloud, 9 April 2026; LeMagIT, 1 September 2026).