EU cloud sovereignty rules could cost €115bn, study says

A study commissioned by CCIA Europe says the European Commission's proposed Cloud and AI Development Act could impose €115 billion in costs over the next decade - six times the Commission's upper estimate of €18 billion.

Prepared by the European Centre for International Political Economy, the report examines the impact of proposed EU cloud sovereignty rules. It argues that the Commission's assessment understates the financial effects on public budgets, software redesign and private-sector users in sectors including banking, energy, healthcare and transport.

The analysis focuses on Article 31 of the proposed law, which would allow sovereignty restrictions to extend beyond public procurement to essential private-sector activities. The study says that would sharply increase the economic impact because spending by essential entities on cloud services is far greater than public-sector procurement alone.

In what it describes as a conservative scenario, applying the rules to a quarter of essential commercial workloads would add €80 billion in costs, which it says were omitted from the Commission's official calculations.

The researchers also put direct public budget exposure at €33.3 billion. They say software re-architecting and code rewriting would account for 69% of the proposal's real-world impact, as companies adapt applications built on global cloud and AI systems.

The burden would not be spread evenly across the bloc. According to the study, the average cost across the EU27 would amount to €548 per worker over 10 years, but smaller, more open economies that rely more heavily on international software architectures would face higher costs.

Under the moderate scenario, Luxembourg would face costs of €1,711 per worker, followed by Denmark at €905, Austria at €900, Finland at €864, Ireland at €856 and the Netherlands at €762, the report says.

Policy dispute

The findings add to a sharpening policy debate in Brussels over how far the EU should push digital sovereignty in cloud infrastructure and artificial intelligence. Supporters of tougher rules argue that greater local control over sensitive digital systems would reduce dependence on non-EU providers. Critics warn that broad restrictions could raise costs and limit access to established global platforms.

CCIA Europe is calling for a narrower approach. It says any sovereignty restrictions should apply only to sensitive workloads where public-order risks can be demonstrated, and that origin-based and nationality-based conditions should be replaced with technical safeguards based on risk.

The group also says trusted international partners with bilateral EU procurement commitments should be exempt from Article 18 country screening. It argues that the proposed framework could fragment the Single Market by creating barriers to overseas cloud providers.

Industry warning

Mitchell Rutledge, Policy Manager at CCIA Europe, said the Commission's cost assumptions did not capture the proposal's full effect on public and private users.

"Member States cannot rely on the Commission's incomplete estimates when deciding CADA's strict sovereignty requirements for cloud and AI providers. Taxpayers and businesses will foot the bill, yet the official assessment missed 70% of CADA's true impact," Rutledge said.

He said the increase would come not only from infrastructure changes but also from rewriting software across connected business systems.

"Governments must recognise that CADA's massive spillover costs for essential private-sector entities are not hypothetical but inevitable. Businesses cannot simply switch servers; they must redesign software and rewrite code across entire supply chains," he said.

The study argues that compliance would involve much more than moving data from one provider to another. Applications developed around existing global cloud environments often rely on integrated tools, interfaces and AI services, meaning any change in provider eligibility could require extensive redevelopment.

The report says this is especially significant for European software vendors and digital small and medium-sized businesses, which would need to alter products designed to run on international cloud architectures. That could affect both cost structures and delivery timelines, particularly in countries that rely heavily on cross-border digital services.

Rutledge said broad sovereignty rules would damage innovation and hit the most digitised member states hardest.

"These sweeping restrictions risk draining European innovation and penalising highly digitised Member States. EU decision-makers must refocus CADA on objective, risk-based security rather than discriminatory rules that fragment the Single Market," he said.