The European Commission's proposed Cloud and AI Development Act, or CADA, looks to lay out four tiers of requirements for cloud services where public bodies would pick a tier for each service they buy, based on the risk involved.
The upper tiers demand tighter control over who owns a provider and who controls its software. ECIPE, a Brussels-based think tank, put a 10-year cost estimate on those rules via a research report this week.
It argues the Commission's impact assessment misses an important part of the costs, mainly one-off software rewriting.
CCIA, or the Computer & Communications Industry Association, funded the study. The association is a tech trade group with members like Amazon, Google, Intel, Cloudflare, Apple, and Meta.
Three scenarios, one estimate #
ECIPE modeled three scenarios for the period between 2027 and 2036. The narrow one comes to €35.6 billion, the middle one to €115 billion, and the broad one to €233 billion.
Though none of them are being presented as a forecast. The difference is how many workloads end up in the two strictest tiers and how far the rules reach into private companies.
The middle case puts 20% of affected workloads in those tiers, and it also applies the rules to a quarter of cloud use in essential private sectors like energy and banking.
About €33.3 billion lands on public budgets. That works out to roughly €159 for each person part of the working-age workforce.
Around €80 billion, which is about 70% of the total, would fall on private companies. That only happens if the Commission uses Article 31 of the CADA to extend the rules to them.
Where the Money Goes and Who Feels It #
About 69% of the total is paid for moving to new providers and rewriting software. Higher ongoing cloud prices account for roughly 30%. Postponed digital projects make up the last 2%.
This shows that moving is not a simple fork it and forget it job. There are plenty of cases out there where an app built around one provider's services may need parts of it rebuilt for another.
The EU average in the middle case is about €548 over 10 years for each person in the workforce. Germany sits at €396. Luxembourg is highest at €1,711, though its workforce count excludes cross-border commuters.
Since Germany, France, Spain, and Italy already apply national cloud rules to some government bodies, they face a lower blow to their costs in the study's model.
Smaller countries that have little homegrown supply at the strictest tiers may end up buying from bigger EU markets at higher prices. ECIPE cautions against reading the gaps as proof of any one cause.
What the study leaves out #
The paper calls itself independent and says the views are the author's own. It puts no value on security or resilience benefits and says this is not a full cost-benefit analysis.
The Commission calls over-reliance on non-EU cloud providers a significant risk to Europe’s digital autonomy and resilience.
CCIA wants narrower rules. Its release asks for the sovereignty requirements to be kept for sensitive workloads and for technical safeguards to replace rules based on where a company comes from.
Enjoyed this update? Support independent Linux news coverage
It's FOSS has been helping people use Linux for the past 14 years. Help us stay independent from big tech. Become a Plus member, enjoy ad-free reading and get 5 eBooks.