Key points
- The Computer and Communications Industry Association claims the EU's Cloud and AI Development Act could cost €115 billion over ten years.
- This estimate is more than six times higher than the European Commission's previous upper limit of €18 billion for the same period.
- The report attributes these costs to mandatory workload migrations and software rewrites required by restrictions favoring European providers.
The short version
- Amazon, Google, and Meta are members of the lobbying group that commissioned the new cost analysis regarding European cloud sovereignty.
- The study suggests that shifting away from US hyperscalers would impose €33.3 billion in direct costs on public sector entities.
- Private sector industries including banking, healthcare, energy, and transport could face an additional €80 billion in expenses under modeled scenarios.
The details
According to The Register, the Computer and Communications Industry Association (CCIA) Europe commissioned a study from the European Centre for International Political Economy (ECIPE) to analyze the financial impact of the proposed Cloud and AI Development Act (CADA). The report argues that regulations designed to reduce reliance on US cloud providers will force European governments and businesses to migrate workloads and rewrite software, resulting in significant financial burdens. The ECIPE analysis projects total costs of €115 billion over the next decade, a figure that substantially exceeds the European Commission's earlier estimate of €18 billion.
The study breaks down these projected expenses into two primary categories. Public sector organizations, including government agencies, are estimated to incur €33.3 billion in direct costs. The remaining €80 billion is attributed to private sector companies operating in critical infrastructure sectors such as banking, healthcare, energy, and transportation. TechRadar notes that this €115 billion figure represents a mid-level estimate, with higher-end scenarios potentially reaching €233 billion depending on the strictness of the sovereignty requirements implemented by Brussels.
The context
A significant condition applies to the €80 billion private sector cost estimate. According to The Register, this figure assumes the European Commission extends sovereignty requirements beyond public procurement to cover 25 percent of cloud workloads in essential private industries. This is a modeled scenario rather than a confirmed legislative mandate. The CCIA represents major US technology companies that dominate the European cloud market. Amazon and Google have recently developed sovereign cloud offerings to address concerns about data access and regulatory control, suggesting that sovereignty is a marketable feature for these hyperscalers.
What to watch
- Monitor official European Commission updates regarding the final scope of the Cloud and AI Development Act and whether it will include private sector mandates.
- Track statements from CCIA Europe and its member companies as they lobby policymakers to base sovereignty decisions on risk assessments rather than vendor nationality.
- Observe how US cloud providers adjust their sovereign cloud offerings in response to evolving regulatory pressures in the European market.
What it means for organisations
Organizations should initiate immediate reviews of their current cloud dependencies and migration strategies. Procurement and legal teams need to evaluate how potential sovereignty mandates might affect vendor contracts and service level agreements. IT leaders must assess the technical feasibility of moving workloads to alternative providers, considering data residency requirements and application compatibility. Executive leadership should prepare for potential budget increases related to infrastructure restructuring. Communication channels between security, compliance, and operations teams must remain open to address evolving regulatory guidance.
Background: Data residency
Data residency laws require organizations to store specific types of information within defined geographic boundaries. You must identify where your cloud providers place physical servers. Failure to comply can result in legal penalties and loss of customer trust. Map your data flows explicitly to meet these jurisdictional requirements.
Read the full guide: Data Residency Laws: How to Keep Data in the Right Jurisdiction
What to do and how to stay safe: CCIA
- Audit current cloud service agreements to identify clauses that may conflict with future European sovereignty requirements.
- Evaluate the technical complexity and financial impact of migrating critical workloads to alternative providers or sovereign cloud environments.
- Monitor official regulatory updates from the European Commission to determine if private sector mandates are included in the final legislation.
- Consult with legal counsel to understand liability and compliance obligations under the proposed Cloud and AI Development Act.
Step-by-step guide: Secure Home Routers for Small Business Networks
General security guidance from the TechSec Headlines newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Who commissioned the study warning about €115 billion in costs?
The Computer and Communications Industry Association (CCIA) Europe commissioned the study, which includes members such as Amazon, Google, and Meta.
How does this estimate compare to the European Commission's previous figures?
The ECIPE study estimates costs at €115 billion, which is more than six times higher than the Commission's upper estimate of €18 billion.
Does the report confirm that private companies will face these costs?
No, the €80 billion private sector cost is based on a modeled scenario assuming the Commission extends sovereignty requirements to 25 percent of essential private workloads.
