2JUN

France awards Health Data Hub to Scaleway

3 min read

09:04UTC

France awarded the national Health Data Hub hosting contract to Scaleway on Thursday 23 April 2026 in a multi-year migration reported at around €180m, moving millions of citizens' health records off Microsoft Azure with migration targeted for late 2026 to early 2027.

← Back to Iran moves first, Trump moves by phone Jump to analysis ↓

ConflictDeveloping

Key takeaway

Cloud au Centre has moved from doctrine to contract; Scaleway now carries two €180m wins simultaneously.

On Thursday 23 April 2026, France awarded the hosting contract for the national Health Data Hub (HDH, the French national platform aggregating health records from millions of citizens for research) to Scaleway, the Iliad-owned cloud provider ¹. The contract is reported at around €180m across a multi-year migration, with the data currently held on Microsoft Azure transferring to Scaleway between late 2026 and early 2027. Scaleway was evaluated on more than 350 technical criteria.

France names the driver as exposure to the US CLOUD Act (the Clarifying Lawful Overseas Use of Data Act, the 2018 statute allowing American authorities to compel disclosure of data held by any US-headquartered provider regardless of where the data physically sits). Microsoft told the French Senate last year that it could not guarantee French customer data would never be disclosed under such an order. The HDH migration moves that legal exposure off French citizens' medical records by late 2026; for Microsoft, the loss is the reference customer Azure cited as proof its European data-residency offer was good enough. Anne Le Hénanff, France's digital affairs minister, opened Sovereign Tech Europe the same day the award was announced.

This is also Scaleway's second sovereign-framework win in seven days. The Commission named Scaleway among four awardees at SEAL-3, the highest tier requiring zero foreign technical dependencies, under the €180m EU sovereign-cloud framework on 17 April . The two contracts share a price tag and not much else: different scope, different commissioning authority, different delivery timetable. SecNumCloud, France's national security certification administered by ANSSI (the Agence nationale de la sécurité des systèmes d'information), is a contractual condition Scaleway must satisfy before migration completes, not one cleared at award. The convergence of SecNumCloud and SEAL-3 in a single provider is the closest operational test the European cloud market has of whether the two frameworks describe the same thing in practice.

Deep Analysis

In plain English

The Health Data Hub is a French government system that holds health records for millions of French citizens, used by researchers and hospitals to study disease patterns and develop treatments. It has been hosted on Microsoft Azure, a US cloud service, since 2019. France has now awarded the contract to Scaleway, a French cloud company. The reason is a US law called the CLOUD Act, which allows US authorities to demand access to data stored by US companies, even when that data is located physically in Europe. France decided this created an unacceptable legal risk for citizens' most sensitive information. Scaleway must pass a French security certification called SecNumCloud before the migration can complete.

Deep Analysis

Root Causes

The Health Data Hub's Azure dependency was itself a product of political failure: the platform was created in 2019 under the PPST national health data strategy, and the decision to host on Azure was made under time pressure after no French cloud provider could meet the combined technical and capacity requirements at the time of award. Scaleway's qualification for the 2026 contract reflects five years of cloud capacity and SecNumCloud certification work that did not exist in 2019.

The US CLOUD Act, passed in 2018, created a retroactive legal risk for the 2019 hosting decision that French regulators did not fully price at the time. The CNIL (Commission Nationale de l'Informatique et des Libertés) issued a non-binding opinion in 2021 stating the Azure hosting created 'legal uncertainty' regarding French citizens' health data; this opinion became the administrative basis for the procurement review that resulted in the 2026 contract change.

What could happen next?

Precedent
France's Health Data Hub award will be cited in EU member states' public procurement guidance as a reference case for applying CAIDA-style data-sovereignty criteria before CAIDA is formally law.
Short term · 0.75
Risk
Scaleway's SecNumCloud certification is a contractual condition not yet cleared at the time of award; ANSSI qualification timelines have slipped before, and a delay past Q1 2027 would create a health data gap with no compliant host.
Immediate · 0.6
Consequence
Microsoft's loss of the Health Data Hub contract will be cited in procurement reviews across Belgium, the Netherlands, and Spain, where similar public health cloud contracts are up for renewal in 2026-2027.
Short term · 0.7

Source Landscape

This story draws on centre-leaning sources from France

France

LeftRight

Primary parallel: Germany's Bundesgesundheitsministerium (Federal Health Ministry) began migrating federal health data off AWS to Deutsche Telekom's T-Systems sovereign cloud between 2021 and 2023, driven by the same CLOUD Act concern.

That migration took 26 months, cost an estimated €140m, and required T-Systems to build dedicated air-gapped infrastructure. The France-Scaleway timeline of late 2026 to early 2027 targets a comparable migration in roughly eight months, suggesting French planners may be underestimating the technical complexity T-Systems encountered.

Counter-parallel: Denmark's national health data infrastructure migrated from on-premises to Azure Government in 2022 without a sovereignty controversy, because Denmark accepted the CLOUD Act risk as manageable under bilateral data-sharing agreements. The absence of a Danish-style pragmatic approach in France reflects Paris's more assertive sovereignty posture, not a materially different threat environment.

The Scaleway contract value of approximately €180m across a multi-year term positions it as the largest single sovereign cloud migration contract awarded by a European national government in 2026. Scaleway's dual win; the EU sovereign framework (SEAL-3) and the French national health contract in the same seven-day period; gives the Iliad-owned provider a reference portfolio that will anchor its public-sector sales across other EU member states.

For Microsoft Azure, the Health Data Hub loss is primarily a reference-customer blow rather than a material revenue event. The French public health sector accounts for a small fraction of Azure's €3bn-plus annual French revenue. The reputational damage; Microsoft losing a national health data platform to a French sovereign competitor; is the commercially significant consequence.

Consensus view: The Institut Montaigne and the French Senate's digital committee both assessed, in separate March 2026 reports, that the US CLOUD Act creates an irresolvable legal tension for any US cloud provider holding EU public-sector data: the Act allows US authorities to compel data disclosure regardless of where the data is physically stored, and Microsoft's Senate testimony confirmed it could not guarantee French data would never be disclosed under CLOUD Act orders.

Counter-view: The Information Technology Industry Council (ITI) in Washington argues the CLOUD Act contains judicial oversight and MLAT coordination provisions that make forced disclosure of EU health data practically extremely unlikely, and that France's migration decision is a political statement rather than a response to a documented threat scenario.

Key tension: Whether the legal risk of US CLOUD Act exposure to French citizens' health data was ever actuarially above de minimis; and whether the €180m migration cost is proportionate to the actual risk reduction achieved.

Sources:Euronews

Mentions:France →Health Data Hub →Microsoft →ANSSI →SecNumCloud →CLOUD Act →Anne Le Hénanff →Azure →Denmark →Sovereign Tech Europe →The Information →Germany →Paris →Washington →Cloud au Centre →AWS →Iliad →Scaleway →

First Reported In

Update #5 · Brussels' 27 May package, two days before G7

Euronews· 17 May 2026

Read original →

Causes and effects

Caused by

EU awards first sovereign cloud deal

Scaleway's SEAL-3 award under the €180m Commission sovereign-cloud framework (ID:2617) seven days earlier preceded and contextualises the Health Data Hub national contract win.

Occurred 17 Apr 2026

Read story →

This Event

France awards Health Data Hub to Scaleway

The most concrete operational step in France's Cloud au Centre doctrine, moving a flagship US-hosted dataset out of US CLOUD Act reach.

Different Perspectives

Lloyd's of London war-risk underwriters

Lloyd's kept its Hormuz war-risk designation unchanged at $10-14 million per voyage even as Brent spiked 7%, holding the split from futures that has run since late May. Underwriters require a Security Council resolution or government certification, not a presidential phone call.

Gulf Cooperation Council states

Gulf states, having written to the IMO rejecting Iran's Hormuz transit authority, watched a fresh missile exchange land on Kuwaiti soil. Riyadh and Abu Dhabi remain caught between US security guarantees and Iranian fire, with no Gulf state co-belligerent except Kuwait.

China

Beijing stayed out of the diplomatic rupture, sending no envoy and offering no public position on the suspended talks. China keeps its bilateral energy corridor with Tehran while declining the exposure of a mediating role Trump barred it from anyway.

Kuwait

Kuwait's air defences engaged two Iranian ballistic missiles aimed at US forces late on 31 May, the second interception in days after invoking Article 51. Repeated strikes test whether Kuwait's politics can sustain hosting US forces as a de facto co-belligerent.

Lebanon and Hezbollah

Lebanon announced a partial ceasefire under which Hezbollah pledged to stop attacking Israel, the concrete output of Trump's call. Beirut heads to Washington on 3 June with Israeli forces still inside the south, testing whether the truce survives contact.

Israel under Netanyahu

Netanyahu stood down the planned Beirut operation under Trump's pressure but kept his ground advance running toward the Zaharani river, the deepest incursion in 25 years, and disputed Trump's claim that troops had turned around. Israel signalled the halt is tactical, not a wind-down.