The €115bn sovereignty bill is lobbying, but your workload map is not optional
A CCIA Europe study puts the cost of the EU's proposed Cloud and AI Development Act at €115bn. Treat it as advocacy, and use the debate to classify which workloads could be in scope.
What happened
On 14 October 2026, The Register reported on a study that estimates the European Commission's proposed Cloud and AI Development Act (CADA) could cost Europe €115 billion over ten years. The study was conducted by the European Centre for International Political Economy (ECIPE) and commissioned by CCIA Europe, a lobby group whose members include Amazon, Google and Meta.
The headline figure is more than six times the Commission's upper estimate of €18 billion. According to the report as relayed by The Register, it breaks down into €33.3 billion in direct public-sector costs and €80 billion in costs that could fall on private companies in banking, healthcare, energy and transport. Code rewriting and re-architecting account for 69% of the estimated costs.
The €80 billion is a modelled scenario, not a current obligation. It assumes sovereignty requirements extend beyond public procurement to cover 25% of cloud workloads in essential private-sector industries, which the study ties to Article 31 of the proposed law. Per-worker costs over ten years range from €1,711 in Luxembourg to €856 in Ireland.
The study's headline against the Commission's own estimate, then where it says the money lands:
| Cost line | Estimate | Status |
|---|---|---|
| Direct public-sector costs | €33.3bn | Modelled |
| Private-sector costs (banking, healthcare, energy, transport) | €80bn | Modelled scenario: assumes rules cover 25% of cloud workloads in essential private-sector industries |
| Share that is code rewriting and re-architecture | 69% | Of estimated costs |
Per worker over ten years, for the five countries The Register lists:
CCIA's policy manager Mitchell Rutledge said Member States "cannot rely on the Commission's incomplete estimates". CCIA recommends that governments limit sovereignty restrictions to sensitive workloads and replace requirements based on corporate origin or personnel nationality with risk-based technical safeguards. The Register points out the conflict of interest: CCIA's members dominate the European cloud market, and AWS and Google both market sovereign cloud options. Neither Amazon nor Google responded to its questions, and it concludes it is unclear whether sovereignty will prove as expensive as CCIA predicts.
Why it matters
The number is advocacy, and the argument is still worth reading. A study commissioned by the providers most affected will favour its commissioners. But the underlying point, that the cost depends on how far the rules reach into private workloads, is a fair one. The scope is the live question, not the figure.
Rewrite cost is the real variable. Nearly seven in ten of the estimated euros are code changes and re-architecture. That tells you where sovereignty bills come from in practice: applications built around provider-specific services, not the hosting itself. A workload that is portable costs little to move. One that is welded to a proprietary platform does not.
Origin-based and risk-based rules lead to different strategies. If requirements turn on who owns or staffs the provider, your options are limited to a set of providers. If they turn on technical safeguards such as customer-held keys and control over where operations run, you may meet them within your current estate. CCIA is lobbying for the second. Nobody yet knows which will be adopted, so a strategy that depends on either outcome is premature.
This is a proposal. Nothing in the article says the Act has been adopted in its current form. Spending heavily now against a text that may change is as risky as ignoring it.
What we would do
- Classify every workload by sensitivity. Mark which hold regulated, public-sector or otherwise sensitive data, and which are commodity. Most estates find the sensitive set is smaller than feared, and that is the set any narrow rule would target.
- Record each workload's dependency on provider-specific services. Note which ones would need re-architecture to move. That is the exposure the study says drives the cost, and you can measure it today.
- Separate legal exposure from data location. Residency in a region does not settle questions about who can be compelled to provide access. Take legal advice on what your contracts and your providers' structures mean for the workloads you have flagged.
- Buy portability where it is cheap. Containers, open data formats, infrastructure as code and customer-managed encryption keys cost little to adopt in new builds and reduce the price of any future change.
- Price an exit for your top workloads. Estimate the effort for the two or three most sensitive systems, even roughly. A number you built beats one a lobby group published.
- Follow the legislative text, not the commentary. Assign someone to track the Act's progress, and revisit the plan when the scope of Article 31 is clearer.
The sensible response to a contested €115 billion is not to panic or to dismiss it. It is to find out what the rules would cost you, workload by workload.
Questions we are asked
Is the €115 billion figure what sovereignty will cost?
No. It is a modelled estimate commissioned by a lobby group whose members include large US cloud providers. Most of it rests on an assumption that sovereignty rules extend to private-sector workloads, which is not an existing obligation. It is useful for understanding the argument, not for budgeting.
Does this affect UK organisations?
Directly, only where you serve EU public bodies or operate essential services in EU member states. Indirectly, it may shape what sovereign options providers build and how they price them. The proposal is not law, so the sensible step is to understand your exposure, not to start migrating.
What should we do before the rules are settled?
Classify your workloads by sensitivity and by the legal exposure of the provider, and check how portable each one is. That work is useful whatever the final text says, because it tells you what a requirement would cost you and where you already have options.