New EU cloud sovereignty laws could lock British firms out of public contracts

The EU’s proposed Cloud and AI Development Act (CADA) could severely impact UK businesses in its current format, according to new research from techUK.

Analysis conducted by the trade body found the legislation could cost the UK economy between £19.6 billion and £22.3 billion due to strict public sector procurement requirements.

CADA forms a central part of the EU’s Technological Sovereignty Package, unveiled by the European Commission in June this year. Under the legislation, four ‘assurance levels’ will be set out for cloud and AI providers seeking to win EU public sector contracts.

These are designed to reduce or limit the influence of foreign states over European cloud infrastructure. Levels 3 and 4 include requirements that mean staff must be based in the EU, ensure data is processed and kept entirely within the region, and exclude providers subject to third-country control.

According to techUK, British companies could find it “very difficult, if not impossible” to qualify for level 3 contracts, which require “high assurance” and some of the aforementioned enhanced sovereignty-related controls.

Level 4 contracts, which require the strictest controls, would be effectively closed to them.

While the European Commission estimates that only around 10% of public procurement will fall under these top two categories, techUK claims its analysis shows these figures “underestimate the damage” for UK firms.

“techUK modelled two scenarios. In the lower one, the share of EU public cloud and AI contracts closed to UK firms rises from 10% to 15% within two years, and private sector buyers gradually start applying CADA’s rules too,” the trade body said in a statement.

“That would cost the UK £19.6 billion over five years. In the higher one, UK firms also lose a growing share of the public contracts they still hold, and the cost would rise to £22.3 billion.”

The CADA domino effect

Under the CADA legislation, almost all cloud computing domains will be covered, spanning SaaS, IaaS, and PaaS.

Analysis by techUK shows that public procurement currently accounts for around 15% of broader EU GDP, with the UK exporting roughly $149 billion in digital services to the EU across 2025.

Around £100 billion of this relied on cloud and AI-related services, highlighting the potential scale of the impact on UK firms.

Crucially, the study warned that costs “compound over time”. TechUK’s modelling points to future pressure from EU incumbents which could push more contracts into higher assurance levels.

Private sector buyers could also begin copying CADA-style restrictions, meaning that UK firms are excluded from more contracts.

With this in mind, techUK said its high-end £22.3 billion figure is “likely an underestimate” when taking into account the compliance costs UK firms will face when meeting even lower-level assurance requirements.

Additional costs incurred through annual supply chain audits could exacerbate the situation, the trade body argued.

While UK firms could lose out, techUK noted that EU firms will also feel the pinch and fail to capture these gains. Companies headquartered in the UK with operations in the EU, for example, won't “fit neatly into a nationality test”

“Shutting them out would leave EU public bodies with fewer and weaker options in some of their most sensitive areas, including cyber resilience and defence,” techUK said.

Meeting in the middle

The study from techUK comes ahead of the UK-EU Summit, set to be held in Brussels on 20 November. The trade body said this presents an opportunity for the EU to make concessions for British cloud and AI providers.

TechUK called on lawmakers to create a “pathway” for the UK to be recognized as a trusted partner for UK public procurement contracts.

It also called for lawmakers to base sovereignty credentials on “technical security assurances” such as customer-exclusive keys, zero-retention policies, data portability, and service continuity planning rather than ownership.

Sabina Ciofu, international policy and strategy lead at techUK, warned that without changes, CADA could severely impact UK firms and have downstream consequences for EU industry.

“Leaders meet at the UK-EU Summit with a clear choice. Our analysis warns that CADA would cost the UK up to £22 billion over five years, and probably more once compliance costs are counted,” Ciofu said.

“The EU doesn’t come out ahead either. UK and EU tech firms share owners, staff, supply chains and cyber defences, and treating nationality as a measure of security breaks those links without making anyone safer. The Summit is the moment to agree a EU-UK Digital Partnership and provide a pathway for a trusted partnership that ensures reciprocal openness.”

FOLLOW US ON SOCIAL MEDIA

Follow ITPro on Google News and add us as a preferred source to keep tabs on all our latest news, analysis, views, and reviews.

You can also follow ITPro on LinkedIn, X, Facebook, and BlueSky.