22OCT

Bruegel puts the cloud law at 86bn euros

3 min read

17:24UTC

The Brussels think-tank Bruegel put the migration of public-sector workloads to sovereign-level cloud at up to 86bn euros, using the Commission's own impact assessment.

← Back to EU questions AI labs over loss of control Jump to analysis ↓

TechnologyDeveloping

Key takeaway

The financial case against the cloud law comes from inside Brussels, not from Washington.

The Brussels think-tank Bruegel published a "First Glance" analysis on Thursday 11 June that put a number on CADA the Commission had not advertised. the Commission's own impact assessment, Bruegel found, costs the migration of public-sector workloads to sovereign-level cloud at up to 86bn euros, on an assumed price premium of just 5% that Bruegel calls unrealistic⁠¹.

That figure dwarfs the rest of the sovereignty budget. The 4.12bn euro AI Gigafactories call due in July and the 2bn euro open-source strategy together come to under a tenth of it.

Bruegel's deeper objection is structural: CADA's test for the highest assurance levels turns on a provider's nationality, not on technical safeguards, and the author argues origin is a poor proxy for security. CADA was adopted on 3 June as the package's cloud law; the critique lands while the ink is barely dry.

The source matters as much as the sum. This is not US industry lobbying against a Buy-European tilt. It is a centre, Brussels-embedded institution telling the Commission its own figures do not hold.

Deep Analysis

In plain English

A Brussels think-tank called Bruegel published an analysis on 11 June saying the EU's new cloud law would cost far more than the EU admitted. The EU's Cloud and AI Development Act, known as CADA, requires government agencies to switch from US cloud services to European-owned ones for their most sensitive data. Bruegel found that the EU's own paperwork puts the bill for this switch at up to 86bn euros. To put that in perspective: the EU's plan to build big new AI computing centres costs about 4bn euros. The migration bill alone could be twenty times that. Bruegel also argues the law uses the wrong test: it checks where a company is based rather than how secure its actual technology is. A European-owned cloud provider with poor security would qualify; a US provider with strong technical safeguards would not.

Deep Analysis

Root Causes

CADA's 5% price-premium assumption in the Commission's impact assessment was set before any large-scale public-sector migration to sovereign-tier services had been completed.

The Netherlands' award of the Health Data Hub to Scaleway on 23 April 2026 at roughly €180m for millions of citizens' records is the closest comparable; per-record and per-workload pricing from a real migration was not published before CADA's adoption. the Commission worked with a hypothetical premium, not empirical migration data.

The deeper structural issue is that CADA's adoption was delayed three consecutive times (March, April, 27 May before 3 June) in part due to US trade pressure, and the impact assessment was not revised to incorporate more conservative cost scenarios during those delays.

Escalation

Bruegel's 86bn euro figure becomes the contested number in any CADA trilogue review. The Commission adopted CADA on 3 June; the text is in trilogue between Commission, Parliament and Council. The analysis, coming from a Brussels-embedded institution rather than a US industry lobby, is harder for the Commission to dismiss and is likely to be cited by Council delegations seeking to narrow CADA's scope or adjust the assurance-tier thresholds during trilogue.

What could happen next?

Risk
If the trilogue accepts a narrower assurance-tier scope in response to the cost critique, CADA's operational effect on actual public-sector procurement could be smaller than the Commission framed at adoption.
Medium term · Suggested
Consequence
The 5% price-premium assumption will need empirical grounding from real migrations, such as the Netherlands' Scaleway Health Data Hub contract, before the Commission can defend its impact assessment in trilogue.
Short term · Assessed
Meaning
A cost critique sourced to the Commission's own impact assessment, published by a Commission-adjacent institution eight days after CADA adoption, structurally weakens the political case for the law before any member state has had to budget for compliance.
Short term · Assessed

Source Landscape

This story draws on centre-leaning sources from Belgium

Belgium

LeftRight

Primary parallel: Australia's 2019 cloud security framework (Certified Cloud Services List) applied a security-tier model to government cloud procurement, with the highest tier limited to Australian-hosted services.

The government's own Department of Finance costed compliance at 2-4x standard cloud prices for top-tier services; some departments chose not to migrate and accepted a lower assurance tier. The EU's CADA four-tier model faces the same migration selectivity problem: actual migration cost depends on how many workloads agencies classify at each tier, not on the theoretical ceiling.

Counter-parallel: GDPR (General Data Protection Regulation) compliance costs were estimated at €200bn across the EU economy before implementation; actual compliance spending came in well below that figure once firms understood which activities triggered which obligations. The €200bn pre-implementation GDPR ceiling suffered from the same top-down aggregation that makes Bruegel's 86bn euro ceiling unreliable as a per-agency planning figure.

The scale comparison makes the cost case vivid. The 86bn euro ceiling on public-sector migration dwarfs the entire sovereignty supply budget: the AI Gigafactories call due in July totals 4.12bn euros, and the Open Source Strategy adds 2bn euros over seven years. Together those two instruments add up to roughly 6.1bn euros against an 86bn euro migration bill.

Gartner's May 2026 sovereign-cloud IaaS forecast projects European sovereign cloud spending at $12.6bn in 2026, rising to $23.1bn in 2027. If those figures hold, the annual sovereign-cloud market for 2026 and 2027 combined is roughly $35.7bn: the migration cost Bruegel cites is more than two full years of the sovereign cloud market at its projected peak.

the Commission's 1% top-tier workload estimate suggests actual migration volumes will be far smaller than the ceiling figure implies, but CADA's critics have the headline number.

Consensus view: Bruegel's First Glance analysis, published 11 June 2026, draws on the Commission's own impact assessment figures. The structural argument, shared by ECIPE and the BSA (Business Software Alliance), is that nationality of incorporation is a weaker security proxy than technical criteria such as cryptographic key management, data residency, and audit rights.

These organisations argue a risk-based framework using technical safeguards would achieve equivalent security outcomes at lower cost than an origin-based test.

Counter-view: Francisco Mingorance of CISPE (Cloud Infrastructure Service Providers in Europe, the European cloud industry body) has argued that the Draghi report recommendation CADA implements, specifically the recommendation for a European-sovereignty tier in public cloud procurement, was premised on market power: European cloud providers cannot win public tenders against hyperscalers on price alone, and an origin-based criterion is the mechanism that makes the market contestable.

CISPE's position is that Bruegel's 86bn euro estimate uses the Commission's own figure but not the Commission's counterfactual: non-migration exposes European public data to US CLOUD Act extraterritorial access indefinitely.

Key tension: Whether the 86bn euro migration cost is a real barrier or a ceiling on a distributional argument; Bruegel assumes uniform migration to sovereign-tier services, while the Commission's own text reserves the strictest tier for approximately 1% of public services.

Sources:Bruegel

Mentions:Bruegel →Cloud and AI Development Act →European Commission →AI Gigafactories →Ursula von der Leyen →GDPR →Francisco Mingorance →CLOUD Act →Brussels →CISPE →Australia →Health Data Hub →

First Reported In

Update #9 · EU chip share slips to 9% as law takes hold

Bruegel· 18 Jun 2026

Read original →

Causes and effects

This Event

Bruegel puts the cloud law at 86bn euros

The figure dwarfs the rest of the sovereignty budget and the critique carries weight because of where it comes from. This is a centre, Brussels-embedded institution telling the Commission its own sums do not hold, not US industry lobbying against a Buy-European tilt.

Led to

Bruegel says EU sovereignty mimics rivals

Bruegel's CADA cost estimate of up to €86bn is the analytical context for Mariniello's broader mimicry critique of the sovereignty package.

Occurred 1 Jun 2026

Read story →

Different Perspectives

European Centre for International Political Economy

ECIPE found nine states gave about 97% of awarded cloud lots to home providers from 2018 to 2025, and every sovereignty-framed lot went to a domestic supplier. The think tank reads sovereignty clauses as a home-bias tool that narrows competition, with a 46% sole-bidder rate on a small sample.

Mistral AI

Mistral opened a Munich industrial AI hub on 28 September with BMW and Siemens Energy work, and Germany's digital minister Karsten Wildberger praised it on the launch page. The French lab gains a German ministerial endorsement while its 21 October Nvidia partnership ties the work to US accelerators.

AWS European Sovereign Cloud

AWS will run its Brandenburg region for several hours on 24 October cut off from the AWS global backbone, with an EU-resident team. AWS says the test follows BSI's C3A criteria and will give regulators and customers verifiable evidence of separation.

Greenland government

Greenland signed a joint declaration with the EU and Denmark in September and received Virkkunen on 24 and 25 September. The Arctic Strategy now backs a cable linking Greenland directly to Europe, an alternative to Greenland Connect, which lands in Canada and Iceland.

Greek government

Kyriakos Mitsotakis inaugurated DAEDALUS at Lavrion on 19 October, a €36m machine on Nvidia GH200 chips that anchors the PHAROS AI Factory. Athens paid 65% through Greece 2.0, making national recovery money the main funder of an EU AI Factory.

ASML

ASML reported record quarterly sales of €11.66bn and said planned supply for 2027 and 2028 will not fully meet demand. It plans about 30% more capacity in 2027, and some customers want to book for 2029 and 2030.

Written with AI from Lowdown's published reporting. Not individually reviewed by an editor. Editorial standards.