A new analysis suggests the proposed Cloud and AI Development Act could cost Europe billions over the next decade, according to a lobby-funded report.
Key points
- The ECIPE study estimates costs between €35.6 billion and €233 billion.
- CCIA Europe, representing Amazon and Google, commissioned the report.
- Most costs stem from moving data and rewriting software applications.
A study funded by a US tech lobby group warns that the EU’s proposed cloud sovereignty law could cost Europe €115 billion over ten years. The Brussels think tank ECIPE produced the analysis, which challenges the European Commission’s own lower estimates of the regulatory impact.
What happened
The Cloud and AI Development Act (CADA) proposes four levels of sovereignty for cloud services used by public bodies. The highest level restricts control by non-EU companies and dictates how software is built. Matthias Bauer, the study author, calls the €115 billion figure "economic exposure" from 2027 to 2036.
CCIA Europe, a lobby group with members including Amazon, Google and Meta, paid for the research. The study presents three scenarios, with a narrow estimate of €35.6 billion and a broad one of €233 billion. The European Commission’s upper estimate was previously reported as €18 billion.
Direct costs to public budgets are estimated at €33.3 billion. Moving and rewriting software accounts for about 69% of the total, while higher cloud prices make up 30%. Mitchell Rutledge, CCIA Europe policy manager, stated that taxpayers and businesses will foot the bill.
About €80 billion would fall on private companies in energy, banking, transport and healthcare. This assumes Article 31 applies to a quarter of private cloud spending. Luxembourg faces the highest per-person cost at €1,711, followed by Denmark, Austria, Finland and Ireland.
Why it matters
Cloud sovereignty laws aim to reduce reliance on foreign technology providers for critical infrastructure. These regulations often require data to remain within specific geographic borders and limit who can control the underlying software. Organizations must balance security goals with the significant financial burden of migrating systems to compliant providers.
The fix
- Review current cloud contracts for data location clauses.
- Assess dependencies on non-EU software providers.
- Monitor legislative updates for changes to sovereignty levels.
- Plan budgets for potential system migration costs.
Why it matters
Teams usually evaluate regulatory changes by mapping current infrastructure against new requirements. Check whether your organization relies on services that might be restricted under higher sovereignty tiers. Consider the long-term operational impact of shifting data residency. Align security strategies with potential compliance costs to avoid unexpected financial exposure during future audits.
What to do and how to stay safe: CADA
- Inventory all cloud services used by public or regulated bodies.
- Identify which providers are headquartered outside the EU.
- Estimate costs for migrating data to compliant vendors.
- Watch for official guidance on Article 31 implementation.
Step-by-step guide: What Does End-to-End Encryption Mean on Messenger: The Real Privacy Impact
General security guidance from the Crypt Weekly newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Who funded the study on CADA costs?
CCIA Europe, a lobby group whose members include Amazon, Google and Meta, paid for the study conducted by ECIPE.
What is the highest estimated cost of the law?
The broad scenario in the study estimates the cost could reach €233 billion over ten years.
Which country faces the highest per-person cost?
Luxembourg faces the highest cost per working-age person, estimated at about €1,711.
