France: SREN bill strengthens position of sovereign cloud players

On April 10, 2024, the French National Assembly passed a bill designed to secure and regulate the digital space (SREN bill). The law contains several measures intended to curtail the influence of the three US cloud giants: AWS, Google and Microsoft Azure. In anticipation of the European Data Act that will be implemented in 2025, the SREN bill regulates the exit costs of cloud providers, and requires more interoperability.

The bill also caps cloud credits at a year, in order to avoid indefinitely tying a business to a provider with overly attractive offers. The new bill also requires cloud managers to clarify which jurisdictions cover their infrastructure, in particular extraterritorial laws like the US Cloud Act.

Finally, the SREN law requires additional security measures for hosting State services that manage sensitive data. In fact, these services will have to choose a sovereign cloud provider that complies with the SecNumCloud frame of reference.

The last item may however clash with ongoing talks on the EUCS, the European Union’s cloud cybersecurity certification scheme. Indeed, European legislators recently removed the sovereignty clause in the framework’s highest level, which is required for a company to process sensitive data.

In addition to these cloud-related measures, the SREN bill includes a number of other measures, some of which were the subject of heated debate. The main ones are:

• the establishment of an “anti-scam filter” to alert users of a potentially illegal website and, if necessary, to block it with access providers;
• the rollout of a digital identity available to all French citizens in 2027;
• the authority given to ARCOM (French broadcasting and digital regulatory authority) to require effective age verification methods from pornographic websites.