The EU Cloud and AI Development Act could create €115bn in economic exposure between 2027 and 2036, according to a study by the Brussels think tank ECIPE. The work was paid for by CCIA Europe, whose members include Amazon, Google and Meta. The central estimate far exceeds the European Commission upper estimate of €18bn. For companies buying cloud and AI infrastructure, the dispute matters because public procurement rules may reshape prices and supplier choice.
Four sovereignty levels and cost structure
The proposal introduces four sovereignty levels for cloud services purchased by public bodies. The lowest level covers EU establishment and data location. The two highest levels limit control by companies from outside the EU. The top level also requires control over how software is built. The Commission says public bodies will select a level based on their own risk assessments.
The ECIPE author Matthias Bauer frames the €115bn figure as exposure rather than a full cost-benefit assessment. The narrow scenario totals €35.6bn and the broad scenario reaches €233bn. Direct costs to public budgets are estimated at about €33.3bn. Software migration and rewriting account for about 69% of the total, while higher cloud prices account for about 30%. The study assigns no value to security, resilience or strategic autonomy.
The Commission argues that most of the market should remain open to its partners. It says providers from outside the EU can be recognised at the third level. Article 31 allows the Commission to request similar assessments from firms in energy, banking, transport and healthcare. The study assumes this extends to one quarter of private cloud spending in scope, producing about €80bn in private-sector costs. CCIA Europe wants the rules limited to sensitive workloads and origin-based requirements removed.
What the cost dispute means for cloud buyers
For public-sector suppliers and regulated industries, procurement requirements could change migration budgets and contract terms. Organisations using non-EU hyperscalers may face requalification, workload separation or rewriting of applications. Smaller providers and startups selling to government may encounter new compliance documentation tied to the chosen sovereignty level. Large enterprises with operations in several member states will need to track how each public buyer applies its risk assessment.
The country breakdown shows uneven exposure across the labour force. Luxembourg faces about €1,711 per working-age person, followed by Denmark, Austria, Finland and Ireland at €856 to €905. Germany is estimated at €396, partly because parts of its public sector already operate under similar rules. These figures do not predict final prices, and the official assessment missed much of the impact, according to CCIA policy manager Mitchell Rutledge. Buyers should ask vendors which sovereignty level their services meet and what migration work that implies.
The marker to watch is how member states define the scope of sensitive workloads and Article 31. The EU has already awarded €180m in sovereign cloud contracts to four European providers, while France has instructed ministries to move from Windows to Linux. A Capgemini survey found most large organisations view full sovereignty as unrealistic. The final wording on third-level recognition will show whether non-EU platforms retain broad access to public contracts.
