26OCT

Bruegel puts the cloud law at 86bn euros

3 min read

15:07UTC

The Brussels think-tank Bruegel put the migration of public-sector workloads to sovereign-level cloud at up to 86bn euros, using the Commission's own impact assessment.

← Back to China puts drone-part exports under licence Jump to analysis ↓

TechnologyDeveloping

Key takeaway

The financial case against the cloud law comes from inside Brussels, not from Washington.

The Brussels think-tank Bruegel published a "First Glance" analysis on Thursday 11 June that put a number on CADA the Commission had not advertised. the Commission's own impact assessment, Bruegel found, costs the migration of public-sector workloads to sovereign-level cloud at up to 86bn euros, on an assumed price premium of just 5% that Bruegel calls unrealistic⁠¹.

That figure dwarfs the rest of the sovereignty budget. The 4.12bn euro AI Gigafactories call due in July and the 2bn euro open-source strategy together come to under a tenth of it.

Bruegel's deeper objection is structural: CADA's test for the highest assurance levels turns on a provider's nationality, not on technical safeguards, and the author argues origin is a poor proxy for security. CADA was adopted on 3 June as the package's cloud law; the critique lands while the ink is barely dry.

The source matters as much as the sum. This is not US industry lobbying against a Buy-European tilt. It is a centre, Brussels-embedded institution telling the Commission its own figures do not hold.

Deep Analysis

In plain English

A Brussels think-tank called Bruegel published an analysis on 11 June saying the EU's new cloud law would cost far more than the EU admitted. The EU's Cloud and AI Development Act, known as CADA, requires government agencies to switch from US cloud services to European-owned ones for their most sensitive data. Bruegel found that the EU's own paperwork puts the bill for this switch at up to 86bn euros. To put that in perspective: the EU's plan to build big new AI computing centres costs about 4bn euros. The migration bill alone could be twenty times that. Bruegel also argues the law uses the wrong test: it checks where a company is based rather than how secure its actual technology is. A European-owned cloud provider with poor security would qualify; a US provider with strong technical safeguards would not.

Deep Analysis

Root Causes

CADA's 5% price-premium assumption in the Commission's impact assessment was set before any large-scale public-sector migration to sovereign-tier services had been completed.

The Netherlands' award of the Health Data Hub to Scaleway on 23 April 2026 at roughly €180m for millions of citizens' records is the closest comparable; per-record and per-workload pricing from a real migration was not published before CADA's adoption. the Commission worked with a hypothetical premium, not empirical migration data.

The deeper structural issue is that CADA's adoption was delayed three consecutive times (March, April, 27 May before 3 June) in part due to US trade pressure, and the impact assessment was not revised to incorporate more conservative cost scenarios during those delays.

Escalation

Bruegel's 86bn euro figure becomes the contested number in any CADA trilogue review. The Commission adopted CADA on 3 June; the text is in trilogue between Commission, Parliament and Council. The analysis, coming from a Brussels-embedded institution rather than a US industry lobby, is harder for the Commission to dismiss and is likely to be cited by Council delegations seeking to narrow CADA's scope or adjust the assurance-tier thresholds during trilogue.

What could happen next?

Risk
If the trilogue accepts a narrower assurance-tier scope in response to the cost critique, CADA's operational effect on actual public-sector procurement could be smaller than the Commission framed at adoption.
Medium term · Suggested
Consequence
The 5% price-premium assumption will need empirical grounding from real migrations, such as the Netherlands' Scaleway Health Data Hub contract, before the Commission can defend its impact assessment in trilogue.
Short term · Assessed
Meaning
A cost critique sourced to the Commission's own impact assessment, published by a Commission-adjacent institution eight days after CADA adoption, structurally weakens the political case for the law before any member state has had to budget for compliance.
Short term · Assessed

Source Landscape

This story draws on centre-leaning sources from Belgium

Belgium

LeftRight

Primary parallel: Australia's 2019 cloud security framework (Certified Cloud Services List) applied a security-tier model to government cloud procurement, with the highest tier limited to Australian-hosted services.

The government's own Department of Finance costed compliance at 2-4x standard cloud prices for top-tier services; some departments chose not to migrate and accepted a lower assurance tier. The EU's CADA four-tier model faces the same migration selectivity problem: actual migration cost depends on how many workloads agencies classify at each tier, not on the theoretical ceiling.

Counter-parallel: GDPR (General Data Protection Regulation) compliance costs were estimated at €200bn across the EU economy before implementation; actual compliance spending came in well below that figure once firms understood which activities triggered which obligations. The €200bn pre-implementation GDPR ceiling suffered from the same top-down aggregation that makes Bruegel's 86bn euro ceiling unreliable as a per-agency planning figure.

The scale comparison makes the cost case vivid. The 86bn euro ceiling on public-sector migration dwarfs the entire sovereignty supply budget: the AI Gigafactories call due in July totals 4.12bn euros, and the Open Source Strategy adds 2bn euros over seven years. Together those two instruments add up to roughly 6.1bn euros against an 86bn euro migration bill.

Gartner's May 2026 sovereign-cloud IaaS forecast projects European sovereign cloud spending at $12.6bn in 2026, rising to $23.1bn in 2027. If those figures hold, the annual sovereign-cloud market for 2026 and 2027 combined is roughly $35.7bn: the migration cost Bruegel cites is more than two full years of the sovereign cloud market at its projected peak.

the Commission's 1% top-tier workload estimate suggests actual migration volumes will be far smaller than the ceiling figure implies, but CADA's critics have the headline number.

Consensus view: Bruegel's First Glance analysis, published 11 June 2026, draws on the Commission's own impact assessment figures. The structural argument, shared by ECIPE and the BSA (Business Software Alliance), is that nationality of incorporation is a weaker security proxy than technical criteria such as cryptographic key management, data residency, and audit rights.

These organisations argue a risk-based framework using technical safeguards would achieve equivalent security outcomes at lower cost than an origin-based test.

Counter-view: Francisco Mingorance of CISPE (Cloud Infrastructure Service Providers in Europe, the European cloud industry body) has argued that the Draghi report recommendation CADA implements, specifically the recommendation for a European-sovereignty tier in public cloud procurement, was premised on market power: European cloud providers cannot win public tenders against hyperscalers on price alone, and an origin-based criterion is the mechanism that makes the market contestable.

CISPE's position is that Bruegel's 86bn euro estimate uses the Commission's own figure but not the Commission's counterfactual: non-migration exposes European public data to US CLOUD Act extraterritorial access indefinitely.

Key tension: Whether the 86bn euro migration cost is a real barrier or a ceiling on a distributional argument; Bruegel assumes uniform migration to sovereign-tier services, while the Commission's own text reserves the strictest tier for approximately 1% of public services.

Sources:Bruegel

Mentions:Bruegel →Cloud and AI Development Act →European Commission →AI Gigafactories →Ursula von der Leyen →GDPR →Francisco Mingorance →CLOUD Act →Brussels →CISPE →Australia →Health Data Hub →

First Reported In

Update #9 · EU chip share slips to 9% as law takes hold

Bruegel· 18 Jun 2026

Read original →

Causes and effects

This Event

Bruegel puts the cloud law at 86bn euros

The figure dwarfs the rest of the sovereignty budget and the critique carries weight because of where it comes from. This is a centre, Brussels-embedded institution telling the Commission its own sums do not hold, not US industry lobbying against a Buy-European tilt.

Led to

Bruegel says EU sovereignty mimics rivals

Bruegel's CADA cost estimate of up to €86bn is the analytical context for Mariniello's broader mimicry critique of the sovereignty package.

Occurred 1 Jun 2026

Read story →

Different Perspectives

Nigerian Air Force

The air force listed 12 Turkish Aksungur and two Chinese CH-4D armed drones on 25 October. No contract has been published, so these are plans.

Civilians in Western Sahara

A UN report of October 2023 records allegations of Moroccan drone strikes east of the berm. An aerial strike there in November 2022 reportedly killed six civilians, the UN said, citing Polisario and local media.

Thunder Tiger

The Taichung company said on 16 October that all 1,520 of its Gauntlet I attack drones passed inspection. Its MoU with AeroVironment covers fitting Switchblade to its uncrewed boats and ground vehicles and exploring joint production in Taiwan.

EDGE Group

The Emirati group said on 9 October it will supply glide bombs and guidance kits for the Royal Moroccan Air Force's armed drones. A separate memorandum explores making small arms and aero engines in Morocco.

Rajnath Singh

India's Defence Acquisition Council, which he chairs, approved about Rs 2.12 lakh crore of proposals on 26 October, including kamikaze drones and tank-mounted counter-drone systems. About 82 per cent of the value is to go to Indian industry, by the ministry's account.

Kongsberg

The Norwegian group said on 13 October it will invest more than 200m zlotys in a Pomeranian plant to build and maintain SAN counter-drone systems. It expects series output to begin in the first half of 2028.

Written with AI from Lowdown's published reporting. Not individually reviewed by an editor. Editorial standards.