TL;DR
- In broad terms, a sovereignty requirement is a condition a public buyer attaches to a cloud service, tying it to European control through ownership, operations, personnel or legal jurisdiction.
- On 13 October 2026 the European Centre for International Political Economy published a study that measures ten years of adjustment cost for Europe's Cloud and AI Development Act: €35.6 billion in its narrow scenario, €115 billion in the central one and €233 billion under broad application.
- Behind the €115 billion headline sits a commissioned body of research: CCIA Europe, a lobbying group whose members include Amazon, Google and Meta, funded the study.
- The central figure carries an explicit assumption, with Article 31 requirements extended to 25% of the potential private essential-sector base, and the €80 billion private-sector line follows from it.
- The estimates the European Commission published reach €18 billion at the top end, according to The Register, and leave one-off re-architecting out of its monetised equations, which is the gap the ECIPE paper sets out to fill.
- A European buyer can plan a costed exit path now: the migration and software-redesign questions a cost model answers are the same ones a procurement file can settle early.
- The study states that security, resilience and strategic-autonomy benefits are outside its model and that it should not be read as a complete social cost-benefit assessment.
Capture of the ECIPE publication page for the study (ecipe.org/publications/economic-impact-of-cada/, retrieved 2026-10-14): the paper's own summary, its scenario figures and the tables behind them.
What the study measures over ten years
The European Centre for International Political Economy published Occasional Paper No. 08/2026 on 13 October 2026, with Matthias Bauer as its author. The paper puts a number on the adjustment costs that Europe's proposed Cloud and AI Development Act could generate between 2027 and 2036, and it names the channels it counts: higher cloud costs, migration and software-adjustment costs, and the economic effects of postponed digitalisation.
The study's own framing explains why the subject is hard. Under CADA, public authorities and potentially private organisations in essential sectors would have to use cloud services meeting progressively stronger sovereignty requirements, labelled from UAL1 to UAL4, and each level narrows the set of eligible providers and technology architectures. A rule that changes which suppliers qualify changes what a migration costs, and the study finds most of that cost in software migration and redesign.
The three scenarios behind €115 billion and €233 billion
One figure survived the press coverage, and the paper publishes three. The narrow scenario lands at €35.6 billion of cumulative exposure across 2027-2036, the medium scenario at €115 billion and the broad scenario at €233 billion. The central case sits deliberately in the middle, and the assumptions behind it are stated: 20% of affected workloads fall into the highly restrictive UAL3-4 categories, and Article 31 requirements extend to 25% of the potential private essential-sector base, a coverage level that runs from 10% under the narrow reading to 50% under the broad one.
Netics editorial diagram: the reported figures and the model assumptions behind them, side by side, with Article 31 named as the mechanism that extends coverage into private sectors.
The scale becomes legible through comparison. The €115 billion central figure is about 23% larger than the entire €93.5 billion Horizon Europe research budget for 2021-2027, and the €33.3 billion public-budget component is roughly three-quarters of the €43 billion-plus public-investment benchmark attached to the European Chips Act and more than three times the up to €10 billion behind the AI Gigafactories initiative. The paper itself states that these comparisons illustrate magnitude only and that its estimates are not equivalent to programme budgets or investment commitments.
Who commissioned the research
The Register reported the funding detail alongside the number, and the ECIPE page itself describes the paper as an independent report funded by CCIA Europe. The study was commissioned by CCIA Europe, a lobbying group whose members include Amazon, Google and Meta, and the article attaches an asterisk to the €80 billion private-sector figure because it assumes sovereignty requirements extended to 25% of cloud workloads in essential industries.
That disclosure tells a reader how much weight to put on each part. The Commission's own omission of re-architecting costs is a substantive finding, and it stands or falls on the arithmetic in the paper. The choice of a 25% coverage assumption is a modelling decision, and a reader can re-run the intuition with 10% or 50%, both of which the study also publishes.
Capture of The Register's report (theregister.com, 14 October 2026, retrieved 2026-10-14): the funding detail, the modelled-scenario caveat and the Commission comparison.
CCIA Europe's policy manager Mitchell Rutledge said: "Member States cannot rely on the Commission's incomplete estimates when deciding CADA's strict sovereignty requirements for cloud and AI providers." He added that taxpayers and businesses would foot the bill. Amazon is developing its AWS European Sovereign Cloud and Google markets sovereign cloud solutions, according to The Register, which also noted that the companies warning Brussels have plenty to gain if Europe keeps buying American cloud services.
The assumption that carries the €80 billion line
Split the central number and the structure shows. Software migration and redesign accounts for €79.1 billion, nearly 70% of the total exposure, because switching provider can mean replacing a database, adapting an application and rewriting software packages. The €80 billion attributed to private organisations arrives through Article 31, which lets private entities in high-criticality NIS2 sectors carry out the same assessments as the public sector, with the Commission able to require them through delegated acts. Recital 66 of the proposal anticipates that mirroring, so the spillover is a written part of the design.
An honest reading keeps both facts in view. The private-sector figure is conditional on a coverage percentage the model chooses, and the paper publishes the range. The public-budget figure of €33.3 billion carries no such condition, and the paper describes it as higher public-sector cloud expenditure plus public-sector migration and software-rewriting costs, which it says "ultimately have to be financed from public revenues or offset by lower spending elsewhere".
Netics editorial diagram: the study's central figures beside the Commission's monetised assessment, with software migration as the largest single item on both readings.
The estimates the European Commission published
The Commission's impact assessment acknowledged individual application migration benchmarks between €30,000 and €600,000, and it left one-off application re-architecting and code-rewriting out of its final monetised equations. The ECIPE paper calls it "a surprising omission given that system redesign ultimately represents the single largest cost driver of CADA". Its comparison point is the Commission's upper estimate of €18 billion, and The Register reports the €115 billion finding as more than six times that figure.
The study also goes further than a cost total. In the paper's words, the study "finds no broad European supply base capable of meeting requirements comparable to the proposed UAL3 and UAL4 criteria at scale", with qualifying capability concentrated in a small number of providers and larger markets, particularly France and Germany. Smaller member states with limited domestic qualifying supply "may have little practical choice but to source higher-assurance services cross-border, potentially at higher prices", and the paper concludes that CADA "would therefore reduce some forms of third-country dependence while simultaneously increasing the dependence of smaller Member States on a handful of larger EU markets". Its macroeconomic model puts real GDP 0.046% below a no-CADA baseline in the central scenario.
What a European buyer can plan for
A company outside the public sector still meets this framework through its contracts. A supplier to a public buyer inherits eligibility conditions, and an operator in energy, banking, transport or healthcare sits in the sectors where the spillover lands. Both positions reward the same preparation, and it is the preparation nobody needs a final text to start: an inventory of what runs where, the cost of moving each workload, and the terms that decide how fast a provider must help.
Netics editorial diagram: the study's per-worker exposure figures for the highest-ranking member states, from Luxembourg at €1,711 down to Ireland at €856.
The numbers in this study describe aggregate exposure across 27 member states. A single company can build its own version with the same method, and the per-worker table shows how uneven the aggregate is, from Luxembourg at €1,711 over ten years to Germany at €396 against an EU27 benchmark of €548. Netics works on this side of the question with sovereign infrastructure and cloud exit, where the first deliverable is a migration path with a real cost attached, and we wrote earlier about where the European sovereignty package draws its line for providers.
The questions a cost model answers
A cost model of this kind answers an order-of-magnitude question, and it answers distributional ones well: which member states absorb the effect, which cost item dominates, and how sensitive the total is to coverage. It answers less about timing, and it monetises no benefit, which the authors state in the summary. Read that way, the paper is a sensitivity range with a funding disclosure attached, and it stays useful when the coverage dial moves.
What turns the range into a decision is measurement inside one organisation. Pick a single production workload, price its move to a qualifying service, and compare that against the annual contract it sits on. The result is a company-specific estimate to set beside the study's aggregate range. The study's largest cost line, software migration and redesign, is the one that a company controls.
Originally published on the Netics blog.
Top comments (0)