The EU’s proposed cloud sovereignty law, the Cloud and AI Development Act (CADA), could cost Europe €115bn over ten years. That is the central estimate in a study by the Brussels think tank ECIPE. CCIA Europe, a lobby group whose members include Amazon, Google and Meta, paid for it.
Matthias Bauer, the author, calls the figure “economic exposure” from 2027 to 2036. It is the central of three scenarios. The narrow scenario comes to €35.6bn and the broad one to €233bn. The European Commission’s own upper estimate was €18bn, The Register reported.
“Taxpayers and businesses will foot the bill, yet the official assessment missed 70 percent of CADA’s true impact.” Mitchell Rutledge, CCIA Europe policy manager, in a statement
The proposal sets four levels of sovereignty for cloud services bought by public bodies. The lowest covers EU establishment and data location. The top two limit control by companies from outside the EU. The highest also demands control over how the software is built, according to the Commission and the study.
The Commission says public bodies would choose a level based on their own risk assessments. It says it can recognise providers from outside the EU at the third level. Most of the market should stay open to its partners, it says.
Where the study puts the cost
The study puts direct costs to public budgets at about €33.3bn. Moving and rewriting software makes up about 69% of the €115bn total, and higher cloud prices about 30%.
About €80bn would fall on private companies in sectors such as energy, banking, transport and healthcare. That figure rests on an assumption. Article 31 of the proposal lets the Commission ask firms in these sectors for the same assessments as public bodies. The study assumes this reaches a quarter of the private cloud spending in scope.
Measured per person in the working-age labour force, Luxembourg faces the highest cost, at about €1,711. Denmark, Austria, Finland and Ireland follow, at €856 to €905. Germany comes in at €396. Parts of its public sector already work under similar rules, the study says.
What the study leaves out
The study does not put a value on the security, resilience or strategic autonomy the law aims to bring. It should not be read as a full cost-benefit assessment, the author writes.
CCIA wants member states to limit the rules to sensitive workloads. It also wants them to drop requirements based on a company’s origin, The Register reported. Amazon and Google did not respond to The Register’s questions. The EU has already awarded €180m in sovereign cloud contracts to four European providers. France has told its ministries to ditch Windows for Linux. Most large organisations think full sovereignty is unrealistic, a Capgemini survey found.