25MAY

France awards Health Data Hub to Scaleway

3 min read

13:55UTC

France awarded the national Health Data Hub hosting contract to Scaleway on Thursday 23 April 2026 in a multi-year migration reported at around €180m, moving millions of citizens' health records off Microsoft Azure with migration targeted for late 2026 to early 2027.

← Back to Two markets, two prices on one Iran deal Jump to analysis ↓

ConflictDeveloping

Key takeaway

Cloud au Centre has moved from doctrine to contract; Scaleway now carries two €180m wins simultaneously.

On Thursday 23 April 2026, France awarded the hosting contract for the national Health Data Hub (HDH, the French national platform aggregating health records from millions of citizens for research) to Scaleway, the Iliad-owned cloud provider ¹. The contract is reported at around €180m across a multi-year migration, with the data currently held on Microsoft Azure transferring to Scaleway between late 2026 and early 2027. Scaleway was evaluated on more than 350 technical criteria.

France names the driver as exposure to the US CLOUD Act (the Clarifying Lawful Overseas Use of Data Act, the 2018 statute allowing American authorities to compel disclosure of data held by any US-headquartered provider regardless of where the data physically sits). Microsoft told the French Senate last year that it could not guarantee French customer data would never be disclosed under such an order. The HDH migration moves that legal exposure off French citizens' medical records by late 2026; for Microsoft, the loss is the reference customer Azure cited as proof its European data-residency offer was good enough. Anne Le Hénanff, France's digital affairs minister, opened Sovereign Tech Europe the same day the award was announced.

This is also Scaleway's second sovereign-framework win in seven days. The Commission named Scaleway among four awardees at SEAL-3, the highest tier requiring zero foreign technical dependencies, under the €180m EU sovereign-cloud framework on 17 April . The two contracts share a price tag and not much else: different scope, different commissioning authority, different delivery timetable. SecNumCloud, France's national security certification administered by ANSSI (the Agence nationale de la sécurité des systèmes d'information), is a contractual condition Scaleway must satisfy before migration completes, not one cleared at award. The convergence of SecNumCloud and SEAL-3 in a single provider is the closest operational test the European cloud market has of whether the two frameworks describe the same thing in practice.

Deep Analysis

In plain English

The Health Data Hub is a French government system that holds health records for millions of French citizens, used by researchers and hospitals to study disease patterns and develop treatments. It has been hosted on Microsoft Azure, a US cloud service, since 2019. France has now awarded the contract to Scaleway, a French cloud company. The reason is a US law called the CLOUD Act, which allows US authorities to demand access to data stored by US companies, even when that data is located physically in Europe. France decided this created an unacceptable legal risk for citizens' most sensitive information. Scaleway must pass a French security certification called SecNumCloud before the migration can complete.

Deep Analysis

Root Causes

The Health Data Hub's Azure dependency was itself a product of political failure: the platform was created in 2019 under the PPST national health data strategy, and the decision to host on Azure was made under time pressure after no French cloud provider could meet the combined technical and capacity requirements at the time of award. Scaleway's qualification for the 2026 contract reflects five years of cloud capacity and SecNumCloud certification work that did not exist in 2019.

The US CLOUD Act, passed in 2018, created a retroactive legal risk for the 2019 hosting decision that French regulators did not fully price at the time. The CNIL (Commission Nationale de l'Informatique et des Libertés) issued a non-binding opinion in 2021 stating the Azure hosting created 'legal uncertainty' regarding French citizens' health data; this opinion became the administrative basis for the procurement review that resulted in the 2026 contract change.

What could happen next?

Precedent
France's Health Data Hub award will be cited in EU member states' public procurement guidance as a reference case for applying CAIDA-style data-sovereignty criteria before CAIDA is formally law.
Short term · 0.75
Risk
Scaleway's SecNumCloud certification is a contractual condition not yet cleared at the time of award; ANSSI qualification timelines have slipped before, and a delay past Q1 2027 would create a health data gap with no compliant host.
Immediate · 0.6
Consequence
Microsoft's loss of the Health Data Hub contract will be cited in procurement reviews across Belgium, the Netherlands, and Spain, where similar public health cloud contracts are up for renewal in 2026-2027.
Short term · 0.7

Source Landscape

This story draws on centre-leaning sources from France

France

LeftRight

Primary parallel: Germany's Bundesgesundheitsministerium (Federal Health Ministry) began migrating federal health data off AWS to Deutsche Telekom's T-Systems sovereign cloud between 2021 and 2023, driven by the same CLOUD Act concern.

That migration took 26 months, cost an estimated €140m, and required T-Systems to build dedicated air-gapped infrastructure. The France-Scaleway timeline of late 2026 to early 2027 targets a comparable migration in roughly eight months, suggesting French planners may be underestimating the technical complexity T-Systems encountered.

Counter-parallel: Denmark's national health data infrastructure migrated from on-premises to Azure Government in 2022 without a sovereignty controversy, because Denmark accepted the CLOUD Act risk as manageable under bilateral data-sharing agreements. The absence of a Danish-style pragmatic approach in France reflects Paris's more assertive sovereignty posture, not a materially different threat environment.

The Scaleway contract value of approximately €180m across a multi-year term positions it as the largest single sovereign cloud migration contract awarded by a European national government in 2026. Scaleway's dual win; the EU sovereign framework (SEAL-3) and the French national health contract in the same seven-day period; gives the Iliad-owned provider a reference portfolio that will anchor its public-sector sales across other EU member states.

For Microsoft Azure, the Health Data Hub loss is primarily a reference-customer blow rather than a material revenue event. The French public health sector accounts for a small fraction of Azure's €3bn-plus annual French revenue. The reputational damage; Microsoft losing a national health data platform to a French sovereign competitor; is the commercially significant consequence.

Consensus view: The Institut Montaigne and the French Senate's digital committee both assessed, in separate March 2026 reports, that the US CLOUD Act creates an irresolvable legal tension for any US cloud provider holding EU public-sector data: the Act allows US authorities to compel data disclosure regardless of where the data is physically stored, and Microsoft's Senate testimony confirmed it could not guarantee French data would never be disclosed under CLOUD Act orders.

Counter-view: The Information Technology Industry Council (ITI) in Washington argues the CLOUD Act contains judicial oversight and MLAT coordination provisions that make forced disclosure of EU health data practically extremely unlikely, and that France's migration decision is a political statement rather than a response to a documented threat scenario.

Key tension: Whether the legal risk of US CLOUD Act exposure to French citizens' health data was ever actuarially above de minimis; and whether the €180m migration cost is proportionate to the actual risk reduction achieved.

Sources:Euronews

Mentions:France →Health Data Hub →Microsoft →ANSSI →SecNumCloud →CLOUD Act →Anne Le Hénanff →Azure →Denmark →Sovereign Tech Europe →The Information →Germany →Paris →Washington →Cloud au Centre →AWS →Iliad →Scaleway →

First Reported In

Update #5 · Brussels' 27 May package, two days before G7

Euronews· 17 May 2026

Read original →

Causes and effects

Caused by

EU awards first sovereign cloud deal

Scaleway's SEAL-3 award under the €180m Commission sovereign-cloud framework (ID:2617) seven days earlier preceded and contextualises the Health Data Hub national contract win.

Occurred 17 Apr 2026

Read story →

This Event

France awards Health Data Hub to Scaleway

The most concrete operational step in France's Cloud au Centre doctrine, moving a flagship US-hosted dataset out of US CLOUD Act reach.

Different Perspectives

Lloyd's of London

The Joint War Committee left Hormuz war-risk premiums at $10-14 million per voyage on 25 May, declining to move on Brent's 5% fall. The JWC's protocol requires a UN Security Council resolution or bilateral government certification letter before de-listing, and neither has arrived: a verbal understanding does not satisfy the formal condition the reinsurance market's treaty terms require.

Gulf Arab producers

Saudi Arabia and UAE depend on Hormuz for their own crude exports; Aramco CEO Nasser has warned no oil market recovery arrives until 2027 if the blockade continues past mid-June. Monday's $98.96 Brent settlement shortens nothing for Gulf producers without a signed instrument and a Pentagon mine-clearance timeline that runs up to six months post-ceasefire.

Qatar

Qatar holds $12bn of frozen Iranian assets at the centre of the sequencing dispute but cannot release them without explicit US Treasury authorisation, given the original freeze was a US instrument. As the asset-holding state, Qatar's leverage is real but passive: it is the escrow holder, not the decision-maker, and any resolution requires US Treasury sign-off that Trump has withheld.

Pakistan

With both Prime Minister Sharif and army chief Munir simultaneously in Beijing on 25 May, Pakistan has for the first time consolidated its civilian and military mediation tracks under China's roof. Munir's direct Tehran-to-Beijing flight signals that the security and financial threads of the sequencing problem are now being worked in parallel rather than sequentially.

China

Beijing hosted Pakistan's principal mediators and Iran's China envoy Ghalibaf simultaneously on 25 May while its banking regulator capped new state-bank lending to five sanctioned refiners. China is simultaneously the most credible third-party underwriter of the $12bn sequencing and the state whose institutions face live OFAC secondary-sanctions exposure if the deadlock persists through GL V's expiry.

United States

Trump posted on 24 May that the blockade holds until a deal is certified and signed, ruling out the informal MOU structure both sides had been building. The 'certified, and signed' condition is the first operational bar Trump has attached in 87 days, but it arrived without an executive instrument, maintaining the gap between posted ultimatum and signed US policy.