Key points
- The Cloud and AI Development Act could cost Europe €115 billion from 2027 to 2036, according to an ECIPE study.
- Moving and rewriting software accounts for 69% of the total estimated expense.
- Private companies in energy, banking, transport and healthcare face up to €80 billion in costs.
The short version
- European businesses and taxpayers face an estimated €115 billion cost under the proposed cloud sovereignty law.
- The study was commissioned by CCIA Europe, which represents Amazon, Google and Meta.
- The European Commission’s own upper estimate was €18 billion, far lower than the study’s central figure.
The details
The Brussels think tank ECIPE produced a study estimating the economic impact of the proposed Cloud and AI Development Act. CCIA Europe, a lobby group with members including Amazon, Google and Meta, funded the research. The central estimate places the cost at €115 billion over ten years, spanning 2027 to 2036. The author, Matthias Bauer, defines this as economic exposure. The study presents three scenarios, with a narrow range of €35.6 billion and a broad range reaching €233 billion. This central figure significantly exceeds the European Commission’s own upper estimate of €18 billion, as reported by The Register.
The context
The proposal establishes four levels of sovereignty for cloud services purchased by public bodies. The lowest level requires EU establishment and data location. The top two levels restrict control by companies outside the EU. The highest level demands control over software construction, according to the Commission and the study. Public bodies would select a level based on their risk assessments. The Commission states it can recognize non-EU providers at the third level and intends to keep most of the market open to partners.
Direct costs to public budgets are estimated at €33.3 billion. About 69% of the total €115 billion comes from moving and rewriting software. Higher cloud prices account for roughly 30%. The study assumes private companies in sectors like energy, banking, transport and healthcare will bear about €80 billion. This rests on Article 31, which allows the Commission to request similar assessments from firms. The study assumes this applies to a quarter of private cloud spending in scope.
Per working-age person, Luxembourg faces the highest cost at €1,711. Denmark, Austria, Finland and Ireland follow with €856 to €905. Germany’s cost is €396 per person. The study notes parts of Germany’s public sector already operate under similar rules. The analysis does not value the security or strategic autonomy the law aims to provide. CCIA Europe urges limiting rules to sensitive workloads and dropping origin-based requirements. Amazon and Google did not respond to questions from The Register.
What should you do?
Monitor official updates on the Cloud and AI Development Act. Review your organization’s current cloud contracts and data location policies. Assess potential costs for rewriting software or migrating services. Consult legal teams regarding compliance with future sovereignty levels.
For customers and users
Teams usually review vendor contracts when new regulations emerge. Check whether your providers offer compliant service levels. Verify that data residency options meet your specific needs. Be cautious of phishing attempts claiming to offer compliance assistance. Scammers often exploit regulatory uncertainty to steal credentials. Always verify communications through official channels. Do not share sensitive information with unsolicited contacts. Ensure your security tools are updated to detect suspicious activity.
What to do and how to stay safe: Cloud and AI Development Act
- Review current cloud service agreements for data location clauses.
- Assess internal software dependencies for potential migration needs.
- Monitor official EU publications for final legislative text.
- Consult legal counsel on compliance requirements for your sector.
Step-by-step guide: How Online Tracking Works: The Technical Chain from Request to Profile
General security guidance from the DataSafe Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the estimated cost of the EU cloud sovereignty law?
The central estimate is €115 billion over ten years, according to an ECIPE study.
Who commissioned the study?
CCIA Europe, a lobby group including Amazon, Google and Meta, paid for the study.
How does this compare to the Commission's estimate?
The European Commission’s upper estimate was €18 billion, much lower than the study’s figure.
