EU can't afford sovereign cloud, research claims

The European Centre for International Political Economy (ECIPE) think tank has issued a report claiming that the EU's proposed sovereignty rules could cost the bloc billions.

The research, funded by CCIA Europe – a trade body with members including Amazon, Google, and Meta – examined the costs associated with the European Commission’s proposed Cloud and AI Development Act (CADA), which excludes non-EU providers from parts of the cloud and AI market.

The research found, the Act risks imposing €115 billion in costs over the next decade – six times the Commission’s upper estimate of €18 billion.

The reasons, said the researchers, come down to three critical blind spots in the Commission’s impact assessment:

• Failure to include €33.3 billion in direct public budget exposure
• Ignoring the cost of software re-architecting and code-rewriting, which ECIPE said accounts for 69% of CADA’s real-world impact
• Failure to take into account the cost of private-sector spill-overs, which, the report found, could amount to as much as €80 billion.

"Member states can’t rely on the Commission’s incomplete estimates when deciding CADA’s strict sovereignty requirements for cloud and AI providers," said CCIA Europe’s policy manager, Mitchell Rutledge. "Taxpayers and businesses will foot the bill, yet the official assessment missed 70% of CADA’s true impact.”

CCIA Europe is particularly bothered by Article 31 of the act, which allows the Commission to extend strict sovereignty restrictions beyond public procurement to certain private sectors, including banking, energy, healthcare, and transport.

This, it said, would increase the cost enormously, as European software vendors and digital SMEs would be forced to redesign applications currently built on global cloud architectures and AI platforms.

“Governments must recognise that CADA’s massive spillover costs for essential private-sector entities are not hypothetical but inevitable," said Rutledge. "Businesses cannot simply switch servers; they must redesign software and rewrite code across entire supply chains.”

Not entirely unexpectedly, CCIA Europe is calling on EU member states to drastically overhaul CADA, limiting sovereignty restrictions to sensitive workloads where specific public-order risks are demonstrated.

Describing corporate-origin and personnel-nationality requirements as 'discriminatory', it wants to see these rules replaced with risk-based technical safeguards.

Meanwhile, 'trusted international partners' with bilateral EU procurement commitments – like its members – should be exempted from Article 18 country screening.

“These sweeping restrictions risk draining European innovation and penalizing highly digitized member states," said Rutledge. "EU decision-makers must refocus CADA on objective, risk-based security rather than discriminatory rules that fragment the single market.”

Big US tech firms have put a lot of effort into convincing Europe that they too can provide sovereign European services. AWS's European Sovereign Cloud, for example, sees enterprise data hosted and stored solely in the region, and kept separate from other AWS Regions worldwide. Microsoft's Sovereign Cloud and Google's sovereign solutions make similar promises.

However, there are still concerns: US tech firms are subject to the US Cloud Act, which allows US law enforcement to demand access to the data they hold, even when it's stored outside the US.

Thanks to these concerns, according to Gartner research earlier this year, a fifth of European workloads are shifting to local clouds, with sovereign cloud infrastructure spending in the region set to triple between 2025 and 2027.