Key points
- A study funded by a US tech lobby group estimates the EU’s cloud sovereignty law could cost €115bn over ten years.
- Private companies in banking, healthcare and energy may face the bulk of these costs if new assessment rules apply to them.
- The European Commission’s own impact assessment estimated a significantly lower figure, missing much of the projected economic exposure.
The short version
- The proposed Cloud and AI Development Act aims to increase sovereignty for cloud services used by public bodies.
- A think tank study funded by CCIA Europe calculates a central cost estimate of €115bn between 2027 and 2036.
- Costs stem mainly from rewriting software and higher cloud prices, with significant impacts on private sector spending.
The details
Public bodies purchasing cloud services would face new requirements under the proposed Cloud and AI Development Act. The legislation establishes four distinct levels of sovereignty for these services. The lowest tier focuses on EU establishment and data location. The higher tiers restrict control by companies outside the European Union. The most stringent level demands control over how the underlying software is built, according to the European Commission and the study. Public bodies would select a level based on their own risk assessments.
The Brussels think tank ECIPE produced the study estimating the financial impact. CCIA Europe, a lobby group representing Amazon, Google and Meta, paid for the research. The central estimate places the cost at €115bn over a ten-year period from 2027 to 2036. This figure represents the middle of three scenarios. A narrow scenario estimates €35.6bn, while a broad scenario reaches €233bn. The European Commission’s own upper estimate was significantly lower, at €18bn, according to The Register.
Moving and rewriting software accounts for roughly 69% of the total €115bn cost. Higher cloud prices make up the remaining 30%. Direct costs to public budgets are estimated at about €33.3bn. The study also projects that private companies in sectors such as energy, banking, transport and healthcare would face about €80bn in costs. This figure assumes that Article 31 of the proposal allows the Commission to require these firms to conduct the same assessments as public bodies. The study assumes this would cover a quarter of private cloud spending in scope.
The context
Luxembourg faces the highest per-person cost among working-age labour forces, at approximately €1,711. Denmark, Austria, Finland and Ireland follow with costs between €856 and €905 per person. Germany’s estimate is €396 per person. The study notes that parts of Germany’s public sector already operate under similar rules. Matthias Bauer, the study’s author, describes the €115bn figure as “economic exposure.” Mitchell Rutledge, CCIA Europe policy manager, stated that taxpayers and businesses will foot the bill. He added that the official assessment missed 70 percent of the true impact.
The study does not assign a monetary value to the security, resilience or strategic autonomy the law aims to provide. The author advises that the report should not be read as a full cost-benefit assessment. CCIA Europe wants member states to limit the rules to sensitive workloads. The group also wants them to drop requirements based on a company’s origin, according to The Register. Amazon and Google did not respond to questions from The Register.
Defender's checklist
- Review current cloud contracts to understand data location and control provisions.
- Assess whether your organisation falls into the high-risk sectors mentioned in the proposal.
- Monitor legislative updates regarding the Cloud and AI Development Act implementation timeline.
- Prepare for potential software migration or rewriting costs if sovereignty levels change.
If your data is involved
Employees and users should monitor official communications from their organisation regarding changes to cloud service providers or data handling policies. If your workplace adopts stricter sovereignty measures, be prepared for temporary disruptions in service access or workflow changes. Watch for phishing attempts that claim to be related to these regulatory changes or new security protocols. These scams often exploit uncertainty around new rules. Verify any unexpected requests for credentials or data migration through separate, trusted channels. Report suspicious emails to your security team immediately. Do not share login details or click on links in unsolicited messages.
Background: Phishing
Phishing is a broad, automated attack sent to thousands of recipients using generic templates. Spear phishing targets specific individuals or organisations using researched personal details. The core difference lies in the level of personalisation. You defend against phishing with technical filters and against spear phishing with verification protocols and human awareness.
Read the full guide: Phishing vs Spear Phishing: Targeting Mechanics and Defence
What to do and how to stay safe: Cloud and AI Development Act
- Check with your IT department to see if your organisation’s cloud providers meet the new sovereignty levels.
- Review your data handling policies to ensure alignment with any updated public sector requirements.
- Monitor for official guidance from the European Commission on implementation timelines and exemptions.
- Prepare for potential software updates or migrations by documenting current cloud dependencies and workflows.
Step-by-step guide: What is online tracking: how data follows you and how to stop it
General security guidance from the Cipher Insider newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the Cloud and AI Development Act?
It is a proposed EU law that sets four levels of sovereignty for cloud services purchased by public bodies, aiming to increase control over data and software.
How much could the law cost Europe?
A study by ECIPE estimates a central cost of €115bn over ten years, with scenarios ranging from €35.6bn to €233bn.
Which sectors are most affected by the potential costs?
Private companies in energy, banking, transport and healthcare may face about €80bn in costs if new assessment rules apply to them.
