27MAY

France awards Health Data Hub to Scaleway

3 min read

15:19UTC

France awarded the national Health Data Hub hosting contract to Scaleway on Thursday 23 April 2026 in a multi-year migration reported at around €180m, moving millions of citizens' health records off Microsoft Azure with migration targeted for late 2026 to early 2027.

← Back to Brussels slips sovereignty law a third time Jump to analysis ↓

TechnologyDeveloping

Key takeaway

Cloud au Centre has moved from doctrine to contract; Scaleway now carries two €180m wins simultaneously.

On Thursday 23 April 2026, France awarded the hosting contract for the national Health Data Hub (HDH, the French national platform aggregating health records from millions of citizens for research) to Scaleway, the Iliad-owned cloud provider ¹. The contract is reported at around €180m across a multi-year migration, with the data currently held on Microsoft Azure transferring to Scaleway between late 2026 and early 2027. Scaleway was evaluated on more than 350 technical criteria.

France names the driver as exposure to the US CLOUD Act (the Clarifying Lawful Overseas Use of Data Act, the 2018 statute allowing American authorities to compel disclosure of data held by any US-headquartered provider regardless of where the data physically sits). Microsoft told the French Senate last year that it could not guarantee French customer data would never be disclosed under such an order. The HDH migration moves that legal exposure off French citizens' medical records by late 2026; for Microsoft, the loss is the reference customer Azure cited as proof its European data-residency offer was good enough. Anne Le Hénanff, France's digital affairs minister, opened Sovereign Tech Europe the same day the award was announced.

This is also Scaleway's second sovereign-framework win in seven days. the Commission named Scaleway among four awardees at SEAL-3, the highest tier requiring zero foreign technical dependencies, under the €180m EU sovereign-cloud framework on 17 April . The two contracts share a price tag and not much else: different scope, different commissioning authority, different delivery timetable. SecNumCloud, France's national security certification administered by ANSSI (the Agence nationale de la sécurité des systèmes d'information), is a contractual condition Scaleway must satisfy before migration completes, not one cleared at award. The convergence of SecNumCloud and SEAL-3 in a single provider is the closest operational test the European cloud market has of whether the two frameworks describe the same thing in practice.

Deep Analysis

In plain English

The Health Data Hub is a French government system that holds health records for millions of French citizens, used by researchers and hospitals to study disease patterns and develop treatments. It has been hosted on Microsoft Azure, a US cloud service, since 2019. France has now awarded the contract to Scaleway, a French cloud company. The reason is a US law called the CLOUD Act, which allows US authorities to demand access to data stored by US companies, even when that data is located physically in Europe. France decided this created an unacceptable legal risk for citizens' most sensitive information. Scaleway must pass a French security certification called SecNumCloud before the migration can complete.

Deep Analysis

Root Causes

The Health Data Hub's Azure dependency was itself a product of political failure: the platform was created in 2019 under the PPST national health data strategy, and the decision to host on Azure was made under time pressure after no French cloud provider could meet the combined technical and capacity requirements at the time of award. Scaleway's qualification for the 2026 contract reflects five years of cloud capacity and SecNumCloud certification work that did not exist in 2019.

The US CLOUD Act, passed in 2018, created a retroactive legal risk for the 2019 hosting decision that French regulators did not fully price at the time. The CNIL (Commission Nationale de l'Informatique et des Libertés) issued a non-binding opinion in 2021 stating the Azure hosting created 'legal uncertainty' regarding French citizens' health data; this opinion became the administrative basis for the procurement review that resulted in the 2026 contract change.

What could happen next?

Precedent
France's Health Data Hub award will be cited in EU member states' public procurement guidance as a reference case for applying CAIDA-style data-sovereignty criteria before CAIDA is formally law.
Short term · 0.75
Risk
Scaleway's SecNumCloud certification is a contractual condition not yet cleared at the time of award; ANSSI qualification timelines have slipped before, and a delay past Q1 2027 would create a health data gap with no compliant host.
Immediate · 0.6
Consequence
Microsoft's loss of the Health Data Hub contract will be cited in procurement reviews across Belgium, the Netherlands, and Spain, where similar public health cloud contracts are up for renewal in 2026-2027.
Short term · 0.7

Source Landscape

This story draws on centre-leaning sources from France

France

LeftRight

Primary parallel: Germany's Bundesgesundheitsministerium (Federal Health Ministry) began migrating federal health data off AWS to Deutsche Telekom's T-Systems sovereign cloud between 2021 and 2023, driven by the same CLOUD Act concern.

That migration took 26 months, cost an estimated €140m, and required T-Systems to build dedicated air-gapped infrastructure. The France-Scaleway timeline of late 2026 to early 2027 targets a comparable migration in roughly eight months, suggesting French planners may be underestimating the technical complexity T-Systems encountered.

Counter-parallel: Denmark's national health data infrastructure migrated from on-premises to Azure Government in 2022 without a sovereignty controversy, because Denmark accepted the CLOUD Act risk as manageable under bilateral data-sharing agreements. The absence of a Danish-style pragmatic approach in France reflects Paris's more assertive sovereignty posture, not a materially different threat environment.

The Scaleway contract value of approximately €180m across a multi-year term positions it as the largest single sovereign cloud migration contract awarded by a European national government in 2026. Scaleway's dual win; the EU sovereign framework (SEAL-3) and the French national health contract in the same seven-day period; gives the Iliad-owned provider a reference portfolio that will anchor its public-sector sales across other EU member states.

For Microsoft Azure, the Health Data Hub loss is primarily a reference-customer blow rather than a material revenue event. The French public health sector accounts for a small fraction of Azure's €3bn-plus annual French revenue. The reputational damage; Microsoft losing a national health data platform to a French sovereign competitor; is the commercially significant consequence.

Consensus view: The Institut Montaigne and the French Senate's digital committee both assessed, in separate March 2026 reports, that the US CLOUD Act creates an irresolvable legal tension for any US cloud provider holding EU public-sector data: the Act allows US authorities to compel data disclosure regardless of where the data is physically stored, and Microsoft's Senate testimony confirmed it could not guarantee French data would never be disclosed under CLOUD Act orders.

Counter-view: The Information Technology Industry Council (ITI) in Washington argues the CLOUD Act contains judicial oversight and MLAT coordination provisions that make forced disclosure of EU health data practically extremely unlikely, and that France's migration decision is a political statement rather than a response to a documented threat scenario.

Key tension: Whether the legal risk of US CLOUD Act exposure to French citizens' health data was ever actuarially above de minimis; and whether the €180m migration cost is proportionate to the actual risk reduction achieved.

Sources:Euronews

Mentions:France →Health Data Hub →Microsoft →ANSSI →SecNumCloud →CLOUD Act →Anne Le Hénanff →Azure →Denmark →Sovereign Tech Europe →The Information →Germany →Paris →Washington →Cloud au Centre →AWS →Iliad →Scaleway →

First Reported In

Update #5 · Brussels' 27 May package, two days before G7

Euronews· 17 May 2026

Read original →

Causes and effects

Caused by

EU awards first sovereign cloud deal

Scaleway's SEAL-3 award under the €180m Commission sovereign-cloud framework (ID:2617) seven days earlier preceded and contextualises the Health Data Hub national contract win.

Occurred 17 Apr 2026

Read story →

This Event

France awards Health Data Hub to Scaleway

The most concrete operational step in France's Cloud au Centre doctrine, moving a flagship US-hosted dataset out of US CLOUD Act reach.

Different Perspectives

ASML / European tech industry

ASML's Q2 2026 guidance came in €300m below consensus as China DUV revenue collapsed 17 percentage points; the company's CEO wrote US export-control outcomes directly into 2026 guidance. European tech firms named on the USTR retaliation list alongside SAP, Siemens and Spotify face the same calculus: US trade exposure constrains what Brussels can legislate on their behalf.

France / Anne Le Henanff

Le Henanff chaired the G7 Digital Ministerial at Bercy on 29 May with CAIDA off the agenda, pivoting France's presidency to AI safety principles it had not designed the week around. France backs CAIDA but cannot override Berlin's tariff calculus, so the ministerial produced no new French-led commitment.

Germany / Federal government

Berlin's automotive sector faces up to $200bn in threatened US tariffs, a commercial exposure that dwarfs any benefit CAIDA's public-sector cloud rules would deliver to German digital firms. Federal silence inside the College of Commissioners functions as a block under consensus adoption rules without requiring a formal veto.

USTR / Ambassador Andrew Puzder

Puzder's public warning on 25 May that CAIDA is inconsistent with the EU-US trade framework was the first time Washington made its bilateral pressure visible before a Commission adoption vote rather than after. The USTR Section 301 determination on 24 July provides the enforcement backstop.

European Commission / Henna Virkkunen

Virkkunen framed the third slip as a procedural delay in finalising a 400-page text without addressing Puzder's trade-framework red line publicly. The Commission enforces existing law against Google while losing the legislative timeline on CAIDA, exposing an asymmetric position: enforcement holds; new sovereignty legislation does not.

OpenForum Europe / open-source community

The EUR 350m Sovereign Tech Fund has no Commission host, no budget line, and no commissioner's name attached six weeks after the April conference, while Germany is already paying maintainers to staff international standards bodies. The CRA open-source guidance resolves contributor liability but leaves the financial-donations grey area open with the 11 September reporting clock running.