Study: EU Cloud Sovereignty Law Could Cost €115 Billion Over Ten Years
A Brussels think tank estimates the proposed Cloud and AI Development Act will cost Europe billions, with private firms facing the largest share of expenses.
Key points
- The central estimate for the Cloud and AI Development Act costs is €115bn over a decade.
- Private companies in sectors like banking and energy would bear approximately €80bn of that total.
- Moving and rewriting software accounts for roughly 69% of the projected financial impact.
A study commissioned by CCIA Europe estimates that the European Union’s proposed Cloud and AI Development Act (CADA) could cost the continent €115 billion over ten years. The Brussels-based think tank ECIPE produced the analysis, which was funded by a lobby group representing major US technology firms including Amazon, Google, and Meta.
Matthias Bauer, the author of the report, defined this figure as the central estimate of "economic exposure" between 2027 and 2036. The study outlines three potential scenarios, with a narrow case totaling €35.6 billion and a broad case reaching €233 billion. These figures significantly exceed the European Commission’s own upper estimate of €18 billion, which The Register previously reported.
Cost Breakdown and Regulatory Scope
The proposal establishes four distinct levels of sovereignty for cloud services procured by public bodies. The lowest tier requires EU establishment and data location, while the highest tier mandates control over software development processes. Mitchell Rutledge, policy manager at CCIA Europe, stated that taxpayers and businesses would pay the bill, arguing that official assessments missed 70 percent of the law’s true impact.
According to the ECIPE study, direct costs to public budgets amount to approximately €33.3 billion. The majority of the total €115 billion cost stems from moving and rewriting software, which comprises about 69 percent of the total. Higher cloud prices account for the remaining 30 percent of the estimated expenditure.
Impact on Private Sector and Member States
Private companies in critical sectors such as energy, banking, transport, and healthcare would face about €80 billion in costs. This projection relies on an assumption that Article 31 of the proposal will require these firms to conduct the same risk assessments as public bodies. The study assumes this requirement will apply to a quarter of private cloud spending within the scope of the regulation.
Per capita costs vary significantly across member states. Luxembourg faces the highest burden at approximately €1,711 per working-age person. Denmark, Austria, Finland, and Ireland follow with costs between €856 and €905. Germany’s per capita cost is estimated at €396, though the study notes that parts of its public sector already operate under similar rules.
What should you do?
The study explicitly states that it does not value the security, resilience, or strategic autonomy benefits the law aims to provide. Authors advise that the data should not be interpreted as a comprehensive cost-benefit assessment. CCIA Europe is urging member states to limit the rules to sensitive workloads and to drop requirements based on a company’s origin. Amazon and Google did not respond to questions from The Register regarding these findings.
What to do and how to stay safe: Cloud and AI Development Act
- Review internal procurement policies to identify which cloud services fall under potential sovereignty classifications.
- Monitor legislative updates regarding Article 31 to understand if private sector risk assessments will become mandatory.
- Evaluate current software architecture to estimate the effort required for potential data relocation or code rewriting.
- Track official European Commission communications for clarifications on how third-level providers from outside the EU will be recognized.
Step-by-step guide: How to Remove Data from Data Brokers: The Manual Cleanup Process
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
How much does the study estimate the CADA law will cost?
The central estimate is €115 billion over ten years, with a range from €35.6 billion to €233 billion.
Which sector faces the highest financial impact?
Private companies in sectors like energy, banking, and healthcare would face about €80 billion in costs.
What is the primary driver of these costs?
Moving and rewriting software makes up about 69% of the total estimated cost.
Did Amazon and Google comment on the study?
No, Amazon and Google did not respond to questions from The Register.
