A Lobby-Funded Study Prices Europe's Cloud Rules at €115 Billion

TL;DR

• In broad terms, a sovereignty requirement is a condition a public buyer attaches to a cloud service, tying it to European control through ownership, operations, personnel or legal jurisdiction.
• On 13 October 2026 the European Centre for International Political Economy published a study that measures ten years of adjustment cost for Europe's Cloud and AI Development Act: €35.6 billion in its narrow scenario, €115 billion in the central one and €233 billion under broad application.
• Behind the €115 billion headline sits a commissioned body of research: CCIA Europe, a lobbying group whose members include Amazon, Google and Meta, funded the study.
• The central figure carries an explicit assumption, with Article 31 requirements extended to 25% of the potential private essential-sector base, and the €80 billion private-sector line follows from it.
• The estimates the European Commission published reach €18 billion at the top end, according to The Register, and leave one-off re-architecting out of its monetised equations, which is the gap the ECIPE paper sets out to fill.
• A European buyer can plan a costed exit path now: the migration and software-redesign questions a cost model answers are the same ones a procurement file can settle early.
• The study states that security, resilience and strategic-autonomy benefits are outside its model and that it should not be read as a complete social cost-benefit assessment.

What the study measures over ten years

The European Centre for International Political Economy published Occasional Paper No. 08/2026 on 13 October 2026, with Matthias Bauer as its author. The paper puts a number on the adjustment costs that Europe's proposed Cloud and AI Development Act could generate between 2027 and 2036, and it names the channels it counts: higher cloud costs, migration and software-adjustment costs, and the economic effects of postponed digitalisation.

The study's own framing explains why the subject is hard. Under CADA, public authorities and potentially private organisations in essential sectors would have to use cloud services meeting progressively stronger sovereignty requirements, labelled from UAL1 to UAL4, and each level narrows the set of eligible providers and technology architectures. A rule that changes which suppliers qualify changes what a migration costs, and the study finds most of that cost in software migration and redesign.

The three scenarios behind €115 billion and €233 billion

One figure survived the press coverage, and the paper publishes three. The narrow scenario lands at €35.6 billion of cumulative exposure across 2027-2036, the medium scenario at €115 billion and the broad scenario at €233 billion. The central case sits deliberately in the middle, and the assumptions behind it are stated: 20% of affected workloads fall into the highly restrictive UAL3-4 categories, and Article 31 requirements extend to 25% of the potential private essential-sector base, a coverage level that runs from 10% under the narrow reading to 50% under the broad one.

The scale becomes legible through comparison. The €115 billion central figure is about 23% larger than the entire €93.5 billion Horizon Europe research budget for 2021-2027, and the €33.3 billion public-budget component is roughly three-quarters of the €43 billion-plus public-investment benchmark attached to the European Chips Act and more than three times the up to €10 billion behind the AI Gigafactories initiative. The paper itself states that these comparisons illustrate magnitude only and that its estimates are not equivalent to programme budgets or investment commitments.

Who commissioned the research

The Register reported the funding detail alongside the number, and the ECIPE page itself describes the paper as an independent report funded by CCIA Europe. The study was commissioned by CCIA Europe, a lobbying group whose members include Amazon, Google and Meta, and the article attaches an asterisk to the €80 billion private-sector figure because it assumes sovereignty requirements extended to 25% of cloud workloads in essential industries.

That disclosure tells a reader how much weight to put on each part. The Commission's own omission of re-architecting costs is a substantive finding, and it stands or falls on the arithmetic in the paper. The choice of a 25% coverage assumption is a modelling decision, and a reader can re-run the intuition with 10% or 50%, both of which the study also publishes.

CCIA Europe's policy manager Mitchell Rutledge said: "Member States cannot rely on the Commission's incomplete estimates when deciding CADA's strict sovereignty requirements for cloud and AI providers." He added that taxpayers and businesses would foot the bill. Amazon is developing its AWS European Sovereign Cloud and Google markets sovereign cloud solutions, according to The Register, which also noted that the companies warning Brussels have plenty to gain if Europe keeps buying American cloud services.

The assumption that carries the €80 billion line

Split the central number and the structure shows. Software migration and redesign accounts for €79.1 billion, nearly 70% of the total exposure, because switching provider can mean replacing a database, adapting an application and rewriting software packages. The €80 billion attributed to private organisations arrives through Article 31, which lets private entities in high-criticality NIS2 sectors carry out the same assessments as the public sector, with the Commission able to require them through delegated acts. Recital 66 of the proposal anticipates that mirroring, so the spillover is a written part of the design.

An honest reading keeps both facts in view. The private-sector figure is conditional on a coverage percentage the model chooses, and the paper publishes the range. The public-budget figure of €33.3 billion carries no such condition, and the paper describes it as higher public-sector cloud expenditure plus public-sector migration and software-rewriting costs, which it says "ultimately have to be financed from public revenues or offset by lower spending elsewhere".

The estimates the European Commission published

The Commission's impact assessment acknowledged individual application migration benchmarks between €30,000 and €600,000, and it left one-off application re-architecting and code-rewriting out of its final monetised equations. The ECIPE paper calls it "a surprising omission given that system redesign ultimately represents the single largest cost driver of CADA". Its comparison point is the Commission's upper estimate of €18 billion, and The Register reports the €115 billion finding as more than six times that figure.

The study also goes further than a cost total. In the paper's words, the study "finds no broad European supply base capable of meeting requirements comparable to the proposed UAL3 and UAL4 criteria at scale", with qualifying capability concentrated in a small number of providers and larger markets, particularly France and Germany. Smaller member states with limited domestic qualifying supply "may have little practical choice but to source higher-assurance services cross-border, potentially at higher prices", and the paper concludes that CADA "would therefore reduce some forms of third-country dependence while simultaneously increasing the dependence of smaller Member States on a handful of larger EU markets". Its macroeconomic model puts real GDP 0.046% below a no-CADA baseline in the central scenario.

What a European buyer can plan for

A company outside the public sector still meets this framework through its contracts. A supplier to a public buyer inherits eligibility conditions, and an operator in energy, banking, transport or healthcare sits in the sectors where the spillover lands. Both positions reward the same preparation, and it is the preparation nobody needs a final text to start: an inventory of what runs where, the cost of moving each workload, and the terms that decide how fast a provider must help.

The numbers in this study describe aggregate exposure across 27 member states. A single company can build its own version with the same method, and the per-worker table shows how uneven the aggregate is, from Luxembourg at €1,711 over ten years to Germany at €396 against an EU27 benchmark of €548. Netics works on this side of the question with sovereign infrastructure and cloud exit, where the first deliverable is a migration path with a real cost attached, and we wrote earlier about where the European sovereignty package draws its line for providers.

The questions a cost model answers

A cost model of this kind answers an order-of-magnitude question, and it answers distributional ones well: which member states absorb the effect, which cost item dominates, and how sensitive the total is to coverage. It answers less about timing, and it monetises no benefit, which the authors state in the summary. Read that way, the paper is a sensitivity range with a funding disclosure attached, and it stays useful when the coverage dial moves.

What turns the range into a decision is measurement inside one organisation. Pick a single production workload, price its move to a qualifying service, and compare that against the annual contract it sits on. The result is a company-specific estimate to set beside the study's aggregate range. The study's largest cost line, software migration and redesign, is the one that a company controls.

Sources

Source: New ECIPE study estimates €115 billion in potential economic costs from EU cloud sovereignty requirements over the next decade — ecipe.org, ECIPE press release for Occasional Paper No. 08/2026, 13 October 2026, retrieved 2026-10-14 (cumulative economic exposure of €115 billion across the EU between 2027 and 2036 under a moderate implementation scenario; adjustment costs not or only partly captured in the Commission's impact assessment; up to €233 billion under a broader application of the rules; software migration and redesign at €79.1 billion, nearly 70% of total exposure, with switching involving replacement of databases, application adaptation and rewriting of software packages; Article 31 extending sovereignty assessments and requirements beyond public procurement, adding about €80 billion over ten years at 25% of the potential private essential-sector base; direct public-budget costs of €33.3 billion; €548 per person in the working-age labour force across the EU, rising to €905 in Denmark, €900 in Austria and €856 in Ireland against €396 in Germany; a quotation from the study's author on cloud sovereignty involving more than where data is stored or who operates the servers).

Source: The Real-World Economic Impact of the Cloud and AI Development Act (CADA) — ecipe.org/publications/economic-impact-of-cada, ECIPE publication page with the paper's summary and tables, retrieved 2026-10-14 (the framework deciding when public authorities and potentially private organisations in essential sectors must use cloud services meeting progressively stronger sovereignty requirements from UAL1 to UAL4; Commission-acknowledged application migration benchmarks between €30,000 and €600,000 with one-off re-architecting and code rewriting omitted from the final monetised equations; system redesign at nearly 70 per cent of total exposure; transition costs from market adjustment lags, capacity shortages and software-layer bottlenecks not separately quantified; qualifying supply concentrated in a small number of providers and larger markets, particularly France and Germany; Recital 66 anticipating private-sector mirroring and Article 31 letting high-criticality NIS2 private entities carry out the same assessments, with the Commission able to require them by delegated acts; €35.6 billion under Narrow, €115 billion under Medium and €233 billion under Broad for 2027-2036, with Medium assuming 20 per cent of affected workloads in UAL3-4 categories and Article 31 coverage of 25 per cent, rising from 10 to 50 per cent; €115 billion around 23 per cent larger than the €93.5 billion Horizon Europe budget for 2021-2027; €33.3 billion at roughly three-quarters of the €43 billion-plus European Chips Act investment benchmark and more than three times the up to €10 billion for AI Gigafactories; Luxembourg at €1,711 per person in the working-age labour force, then Denmark €905, Austria €900, Finland €864, Ireland €856, with France €534, Italy €519 and Germany €396 against the EU27 benchmark of €548; real GDP 0.012 per cent below baseline under Narrow, 0.046 per cent under Medium and 0.104 per cent under Broad; no monetisation of security, resilience or strategic-autonomy benefits; cost channels named as higher cloud costs, migration and software-adjustment costs and the economic effects of postponed digitalisation; the €33.3 billion public-budget component described as higher public-sector cloud expenditure and public-sector migration and software-rewriting costs; programme comparisons stated to illustrate magnitude only; the paper described as an independent report funded by CCIA Europe; the Commission's omission of re-architecting and code rewriting called "a surprising omission"; "no broad European supply base capable of meeting requirements comparable to the proposed UAL3 and UAL4 criteria at scale"; smaller Member States with limited domestic qualifying supply sourcing higher-assurance services cross-border, with CADA reducing some third-country dependence while increasing their dependence on a handful of larger EU markets; public-budget costs that have to be financed from public revenues or offset by lower spending elsewhere, termed a taxpayer cost equivalent).

Source: US tech giants warn Europe that ditching US tech giants could cost €115B — theregister.com, 14 October 2026, retrieved 2026-10-14 (the study commissioned by CCIA Europe, a lobbying group whose members include Amazon, Google and Meta; the €115 billion finding reported as more than six times the Commission's upper estimate of €18 billion; an asterisk on the €80 billion private-sector figure because it assumes requirements extended to 25 per cent of cloud workloads in essential industries in a modeled scenario; AWS European Sovereign Cloud and Google's sovereign cloud solutions in development; the CCIA Europe policy manager quoted on incomplete Commission estimates and on taxpayers and businesses footing the bill; Article 31 as the report's target, with CCIA urging limits to sensitive workloads and risk-based technical safeguards; Luxembourg at €1,711 per worker over ten years, Denmark €905, Austria €900, Finland €864, Ireland €856; the observation that the companies warning Brussels have plenty to gain if Europe keeps buying American cloud services).

Source: ECIPE Occasional Paper No. 08/2026, its press release of 13 October 2026 and The Register's report of 14 October 2026 — the figures, the scenario assumptions and the funding detail used above, retrieved 2026-10-14. Images are official source-page captures from ECIPE and The Register, plus three Netics editorial diagrams.