26MAR

France awards Health Data Hub to Scaleway

3 min read

09:36UTC

France awarded the national Health Data Hub hosting contract to Scaleway on Thursday 23 April 2026 in a multi-year migration reported at around €180m, moving millions of citizens' health records off Microsoft Azure with migration targeted for late 2026 to early 2027.

← Back to Iran rejects ceasefire; Kharg fortified Jump to analysis ↓

ConflictDeveloping

Key takeaway

Cloud au Centre has moved from doctrine to contract; Scaleway now carries two €180m wins simultaneously.

On Thursday 23 April 2026, France awarded the hosting contract for the national Health Data Hub (HDH, the French national platform aggregating health records from millions of citizens for research) to Scaleway, the Iliad-owned cloud provider ¹. The contract is reported at around €180m across a multi-year migration, with the data currently held on Microsoft Azure transferring to Scaleway between late 2026 and early 2027. Scaleway was evaluated on more than 350 technical criteria.

France names the driver as exposure to the US CLOUD Act (the Clarifying Lawful Overseas Use of Data Act, the 2018 statute allowing American authorities to compel disclosure of data held by any US-headquartered provider regardless of where the data physically sits). Microsoft told the French Senate last year that it could not guarantee French customer data would never be disclosed under such an order. The HDH migration moves that legal exposure off French citizens' medical records by late 2026; for Microsoft, the loss is the reference customer Azure cited as proof its European data-residency offer was good enough. Anne Le Hénanff, France's digital affairs minister, opened Sovereign Tech Europe the same day the award was announced.

This is also Scaleway's second sovereign-framework win in seven days. The Commission named Scaleway among four awardees at SEAL-3, the highest tier requiring zero foreign technical dependencies, under the €180m EU sovereign-cloud framework on 17 April . The two contracts share a price tag and not much else: different scope, different commissioning authority, different delivery timetable. SecNumCloud, France's national security certification administered by ANSSI (the Agence nationale de la sécurité des systèmes d'information), is a contractual condition Scaleway must satisfy before migration completes, not one cleared at award. The convergence of SecNumCloud and SEAL-3 in a single provider is the closest operational test the European cloud market has of whether the two frameworks describe the same thing in practice.

Deep Analysis

In plain English

The Health Data Hub is a French government system that holds health records for millions of French citizens, used by researchers and hospitals to study disease patterns and develop treatments. It has been hosted on Microsoft Azure, a US cloud service, since 2019. France has now awarded the contract to Scaleway, a French cloud company. The reason is a US law called the CLOUD Act, which allows US authorities to demand access to data stored by US companies, even when that data is located physically in Europe. France decided this created an unacceptable legal risk for citizens' most sensitive information. Scaleway must pass a French security certification called SecNumCloud before the migration can complete.

Deep Analysis

Root Causes

The Health Data Hub's Azure dependency was itself a product of political failure: the platform was created in 2019 under the PPST national health data strategy, and the decision to host on Azure was made under time pressure after no French cloud provider could meet the combined technical and capacity requirements at the time of award. Scaleway's qualification for the 2026 contract reflects five years of cloud capacity and SecNumCloud certification work that did not exist in 2019.

The US CLOUD Act, passed in 2018, created a retroactive legal risk for the 2019 hosting decision that French regulators did not fully price at the time. The CNIL (Commission Nationale de l'Informatique et des Libertés) issued a non-binding opinion in 2021 stating the Azure hosting created 'legal uncertainty' regarding French citizens' health data; this opinion became the administrative basis for the procurement review that resulted in the 2026 contract change.

What could happen next?

Precedent
France's Health Data Hub award will be cited in EU member states' public procurement guidance as a reference case for applying CAIDA-style data-sovereignty criteria before CAIDA is formally law.
Short term · 0.75
Risk
Scaleway's SecNumCloud certification is a contractual condition not yet cleared at the time of award; ANSSI qualification timelines have slipped before, and a delay past Q1 2027 would create a health data gap with no compliant host.
Immediate · 0.6
Consequence
Microsoft's loss of the Health Data Hub contract will be cited in procurement reviews across Belgium, the Netherlands, and Spain, where similar public health cloud contracts are up for renewal in 2026-2027.
Short term · 0.7

Source Landscape

This story draws on centre-leaning sources from France

France

LeftRight

Primary parallel: Germany's Bundesgesundheitsministerium (Federal Health Ministry) began migrating federal health data off AWS to Deutsche Telekom's T-Systems sovereign cloud between 2021 and 2023, driven by the same CLOUD Act concern.

That migration took 26 months, cost an estimated €140m, and required T-Systems to build dedicated air-gapped infrastructure. The France-Scaleway timeline of late 2026 to early 2027 targets a comparable migration in roughly eight months, suggesting French planners may be underestimating the technical complexity T-Systems encountered.

Counter-parallel: Denmark's national health data infrastructure migrated from on-premises to Azure Government in 2022 without a sovereignty controversy, because Denmark accepted the CLOUD Act risk as manageable under bilateral data-sharing agreements. The absence of a Danish-style pragmatic approach in France reflects Paris's more assertive sovereignty posture, not a materially different threat environment.

The Scaleway contract value of approximately €180m across a multi-year term positions it as the largest single sovereign cloud migration contract awarded by a European national government in 2026. Scaleway's dual win; the EU sovereign framework (SEAL-3) and the French national health contract in the same seven-day period; gives the Iliad-owned provider a reference portfolio that will anchor its public-sector sales across other EU member states.

For Microsoft Azure, the Health Data Hub loss is primarily a reference-customer blow rather than a material revenue event. The French public health sector accounts for a small fraction of Azure's €3bn-plus annual French revenue. The reputational damage; Microsoft losing a national health data platform to a French sovereign competitor; is the commercially significant consequence.

Consensus view: The Institut Montaigne and the French Senate's digital committee both assessed, in separate March 2026 reports, that the US CLOUD Act creates an irresolvable legal tension for any US cloud provider holding EU public-sector data: the Act allows US authorities to compel data disclosure regardless of where the data is physically stored, and Microsoft's Senate testimony confirmed it could not guarantee French data would never be disclosed under CLOUD Act orders.

Counter-view: The Information Technology Industry Council (ITI) in Washington argues the CLOUD Act contains judicial oversight and MLAT coordination provisions that make forced disclosure of EU health data practically extremely unlikely, and that France's migration decision is a political statement rather than a response to a documented threat scenario.

Key tension: Whether the legal risk of US CLOUD Act exposure to French citizens' health data was ever actuarially above de minimis; and whether the €180m migration cost is proportionate to the actual risk reduction achieved.

Sources:Euronews

Mentions:France →Health Data Hub →Microsoft →ANSSI →SecNumCloud →CLOUD Act →Anne Le Hénanff →Azure →Denmark →Sovereign Tech Europe →The Information →Germany →Paris →Washington →Cloud au Centre →AWS →Iliad →Scaleway →

First Reported In

Update #5 · Brussels' 27 May package, two days before G7

Euronews· 17 May 2026

Read original →

Causes and effects

Caused by

EU awards first sovereign cloud deal

Scaleway's SEAL-3 award under the €180m Commission sovereign-cloud framework (ID:2617) seven days earlier preceded and contextualises the Health Data Hub national contract win.

Occurred 17 Apr 2026

Read story →

This Event

France awards Health Data Hub to Scaleway

The most concrete operational step in France's Cloud au Centre doctrine, moving a flagship US-hosted dataset out of US CLOUD Act reach.

Different Perspectives

IAEA

Director General Rafael Grossi appeared in person at the UNSC on 19 May and warned that a direct hit on an operating reactor 'could result in very high release of radioactivity'. The session produced a condemnation record but no resolution, and the Barakah perimeter was already struck on 17 May.

Hengaw (Kurdish rights monitor)

Hengaw documented three judicial executions and the detention of Kurdish writer Majid Karimi in Tehran on 19 May, establishing Khorasan Razavi province as the newest geography in Iran's wartime judicial record. The organisation's Norway-based operation continues to surface a domestic repression track running in parallel with every diplomatic and military development.

India

Six India-flagged vessels conducted a coordinated cluster transit under PGSA bilateral assurances during the 17 May window, paying no yuan tolls. New Delhi's inclusion in Iran's state-to-state passage track insulates Indian energy supply without requiring endorsement of the PGSA's yuan-toll architecture or alignment with the US coalition.

Pakistan

Pakistan is the only functioning diplomatic bridge between Tehran and Washington. Its role is relay, not mediation in the settlement sense: it conveyed Iran's 10-point counter-MOU in early May, relayed the US rejection, and is now passing 'corrective points' in the third documented exchange of this sub-cycle without either side working from a shared text.

UK and France (Northwood coalition)

Twenty-six coalition members have published no rules of engagement eight days after the Bahrain joint statement; Lloyd's underwriters have conditioned war-risk reopening on written ROE from either Iran or the coalition. Italian and French mine-countermeasures deployments are operating on the in-water clearance task CENTCOM Admiral Brad Cooper's 90% mine-stockpile claim does not address.

Saudi Arabia

Riyadh has not publicly commented on the Barakah strike or the 50-47 discharge vote. Saudi output feeds the IEA's $106 base case; the $5 Brent premium above that model reflects institutional uncertainty no Gulf producer can compress through supply adjustment alone.