8JUN

France awards Health Data Hub to Scaleway

3 min read

09:58UTC

France awarded the national Health Data Hub hosting contract to Scaleway on Thursday 23 April 2026 in a multi-year migration reported at around €180m, moving millions of citizens' health records off Microsoft Azure with migration targeted for late 2026 to early 2027.

← Back to Trump said don't strike; Israel struck Iran Jump to analysis ↓

ConflictDeveloping

Key takeaway

Cloud au Centre has moved from doctrine to contract; Scaleway now carries two €180m wins simultaneously.

On Thursday 23 April 2026, France awarded the hosting contract for the national Health Data Hub (HDH, the French national platform aggregating health records from millions of citizens for research) to Scaleway, the Iliad-owned cloud provider ¹. The contract is reported at around €180m across a multi-year migration, with the data currently held on Microsoft Azure transferring to Scaleway between late 2026 and early 2027. Scaleway was evaluated on more than 350 technical criteria.

France names the driver as exposure to the US CLOUD Act (the Clarifying Lawful Overseas Use of Data Act, the 2018 statute allowing American authorities to compel disclosure of data held by any US-headquartered provider regardless of where the data physically sits). Microsoft told the French Senate last year that it could not guarantee French customer data would never be disclosed under such an order. The HDH migration moves that legal exposure off French citizens' medical records by late 2026; for Microsoft, the loss is the reference customer Azure cited as proof its European data-residency offer was good enough. Anne Le Hénanff, France's digital affairs minister, opened Sovereign Tech Europe the same day the award was announced.

This is also Scaleway's second sovereign-framework win in seven days. The Commission named Scaleway among four awardees at SEAL-3, the highest tier requiring zero foreign technical dependencies, under the €180m EU sovereign-cloud framework on 17 April . The two contracts share a price tag and not much else: different scope, different commissioning authority, different delivery timetable. SecNumCloud, France's national security certification administered by ANSSI (the Agence nationale de la sécurité des systèmes d'information), is a contractual condition Scaleway must satisfy before migration completes, not one cleared at award. The convergence of SecNumCloud and SEAL-3 in a single provider is the closest operational test the European cloud market has of whether the two frameworks describe the same thing in practice.

Deep Analysis

In plain English

The Health Data Hub is a French government system that holds health records for millions of French citizens, used by researchers and hospitals to study disease patterns and develop treatments. It has been hosted on Microsoft Azure, a US cloud service, since 2019. France has now awarded the contract to Scaleway, a French cloud company. The reason is a US law called the CLOUD Act, which allows US authorities to demand access to data stored by US companies, even when that data is located physically in Europe. France decided this created an unacceptable legal risk for citizens' most sensitive information. Scaleway must pass a French security certification called SecNumCloud before the migration can complete.

Deep Analysis

Root Causes

The Health Data Hub's Azure dependency was itself a product of political failure: the platform was created in 2019 under the PPST national health data strategy, and the decision to host on Azure was made under time pressure after no French cloud provider could meet the combined technical and capacity requirements at the time of award. Scaleway's qualification for the 2026 contract reflects five years of cloud capacity and SecNumCloud certification work that did not exist in 2019.

The US CLOUD Act, passed in 2018, created a retroactive legal risk for the 2019 hosting decision that French regulators did not fully price at the time. The CNIL (Commission Nationale de l'Informatique et des Libertés) issued a non-binding opinion in 2021 stating the Azure hosting created 'legal uncertainty' regarding French citizens' health data; this opinion became the administrative basis for the procurement review that resulted in the 2026 contract change.

What could happen next?

Precedent
France's Health Data Hub award will be cited in EU member states' public procurement guidance as a reference case for applying CAIDA-style data-sovereignty criteria before CAIDA is formally law.
Short term · 0.75
Risk
Scaleway's SecNumCloud certification is a contractual condition not yet cleared at the time of award; ANSSI qualification timelines have slipped before, and a delay past Q1 2027 would create a health data gap with no compliant host.
Immediate · 0.6
Consequence
Microsoft's loss of the Health Data Hub contract will be cited in procurement reviews across Belgium, the Netherlands, and Spain, where similar public health cloud contracts are up for renewal in 2026-2027.
Short term · 0.7

Source Landscape

This story draws on centre-leaning sources from France

France

LeftRight

Primary parallel: Germany's Bundesgesundheitsministerium (Federal Health Ministry) began migrating federal health data off AWS to Deutsche Telekom's T-Systems sovereign cloud between 2021 and 2023, driven by the same CLOUD Act concern.

That migration took 26 months, cost an estimated €140m, and required T-Systems to build dedicated air-gapped infrastructure. The France-Scaleway timeline of late 2026 to early 2027 targets a comparable migration in roughly eight months, suggesting French planners may be underestimating the technical complexity T-Systems encountered.

Counter-parallel: Denmark's national health data infrastructure migrated from on-premises to Azure Government in 2022 without a sovereignty controversy, because Denmark accepted the CLOUD Act risk as manageable under bilateral data-sharing agreements. The absence of a Danish-style pragmatic approach in France reflects Paris's more assertive sovereignty posture, not a materially different threat environment.

The Scaleway contract value of approximately €180m across a multi-year term positions it as the largest single sovereign cloud migration contract awarded by a European national government in 2026. Scaleway's dual win; the EU sovereign framework (SEAL-3) and the French national health contract in the same seven-day period; gives the Iliad-owned provider a reference portfolio that will anchor its public-sector sales across other EU member states.

For Microsoft Azure, the Health Data Hub loss is primarily a reference-customer blow rather than a material revenue event. The French public health sector accounts for a small fraction of Azure's €3bn-plus annual French revenue. The reputational damage; Microsoft losing a national health data platform to a French sovereign competitor; is the commercially significant consequence.

Consensus view: The Institut Montaigne and the French Senate's digital committee both assessed, in separate March 2026 reports, that the US CLOUD Act creates an irresolvable legal tension for any US cloud provider holding EU public-sector data: the Act allows US authorities to compel data disclosure regardless of where the data is physically stored, and Microsoft's Senate testimony confirmed it could not guarantee French data would never be disclosed under CLOUD Act orders.

Counter-view: The Information Technology Industry Council (ITI) in Washington argues the CLOUD Act contains judicial oversight and MLAT coordination provisions that make forced disclosure of EU health data practically extremely unlikely, and that France's migration decision is a political statement rather than a response to a documented threat scenario.

Key tension: Whether the legal risk of US CLOUD Act exposure to French citizens' health data was ever actuarially above de minimis; and whether the €180m migration cost is proportionate to the actual risk reduction achieved.

Sources:Euronews

Mentions:France →Health Data Hub →Microsoft →ANSSI →SecNumCloud →CLOUD Act →Anne Le Hénanff →Azure →Denmark →Sovereign Tech Europe →The Information →Germany →Paris →Washington →Cloud au Centre →AWS →Iliad →Scaleway →

First Reported In

Update #5 · Brussels' 27 May package, two days before G7

Euronews· 17 May 2026

Read original →

Causes and effects

Caused by

EU awards first sovereign cloud deal

Scaleway's SEAL-3 award under the €180m Commission sovereign-cloud framework (ID:2617) seven days earlier preceded and contextualises the Health Data Hub national contract win.

Occurred 17 Apr 2026

Read story →

This Event

France awards Health Data Hub to Scaleway

The most concrete operational step in France's Cloud au Centre doctrine, moving a flagship US-hosted dataset out of US CLOUD Act reach.

Different Perspectives

Bahrain / Gulf partners

Bahrain's PAC-3 interceptor magazine sits at 87% depletion after absorbing IRGC salvos aimed at US bases; no resupply is scheduled before 2027, concentrating the intercept burden on US assets and Israeli Iron Dome and Arrow-3.

IAEA / Vienna process

IAEA officials cited proliferation concerns over 440.9 kg of HEU unaccounted for after 97 days without inspector access; the Board session that opened 8 June cannot retroactively close the evidentiary gap its own resolution documents.

China

China absorbed the Shanghai Qianye designation by OFAC and opposes censure at the IAEA Board, arguing the verification gap was created by strikes rather than Iranian non-compliance, a framing it shares with Russia to protect the non-Western bloc's Board votes.

Russia

Putin reaffirmed at SPIEF on 6 June his offer to hold Iran's uranium stockpile as custodian, a proposal the IAEA's 97-day verification gap now renders undeliverable: no one can transfer or confirm a stockpile that has not been inspected.

United States / Trump administration

Trump publicly asked Netanyahu not to retaliate and described a deal as 95% done; Rubio then acknowledged enrichment terms could take months. The 24-hour gap between the request and the Mahshahr strike removes the credible-restraint argument from US diplomatic leverage with Tehran.

Israel / Netanyahu government

Netanyahu struck the Mahshahr complex and missile sites inside Iran within 24 hours of Trump's public no-retaliation request, a second kinetic override of US counsel that confirms Israel will not allow Tehran to dictate the terms of the exchange.