1OCT

Bruegel puts the cloud law at 86bn euros

3 min read

19:22UTC

The Brussels think-tank Bruegel put the migration of public-sector workloads to sovereign-level cloud at up to 86bn euros, using the Commission's own impact assessment.

← Back to Washington left Iraq as it answered Tehran Jump to analysis ↓

ConflictDeveloping

Key takeaway

The financial case against the cloud law comes from inside Brussels, not from Washington.

The Brussels think-tank Bruegel published a "First Glance" analysis on Thursday 11 June that put a number on CADA the Commission had not advertised. the Commission's own impact assessment, Bruegel found, costs the migration of public-sector workloads to sovereign-level cloud at up to 86bn euros, on an assumed price premium of just 5% that Bruegel calls unrealistic⁠¹.

That figure dwarfs the rest of the sovereignty budget. The 4.12bn euro AI Gigafactories call due in July and the 2bn euro open-source strategy together come to under a tenth of it.

Bruegel's deeper objection is structural: CADA's test for the highest assurance levels turns on a provider's nationality, not on technical safeguards, and the author argues origin is a poor proxy for security. CADA was adopted on 3 June as the package's cloud law; the critique lands while the ink is barely dry.

The source matters as much as the sum. This is not US industry lobbying against a Buy-European tilt. It is a centre, Brussels-embedded institution telling the Commission its own figures do not hold.

Deep Analysis

In plain English

A Brussels think-tank called Bruegel published an analysis on 11 June saying the EU's new cloud law would cost far more than the EU admitted. The EU's Cloud and AI Development Act, known as CADA, requires government agencies to switch from US cloud services to European-owned ones for their most sensitive data. Bruegel found that the EU's own paperwork puts the bill for this switch at up to 86bn euros. To put that in perspective: the EU's plan to build big new AI computing centres costs about 4bn euros. The migration bill alone could be twenty times that. Bruegel also argues the law uses the wrong test: it checks where a company is based rather than how secure its actual technology is. A European-owned cloud provider with poor security would qualify; a US provider with strong technical safeguards would not.

Deep Analysis

Root Causes

CADA's 5% price-premium assumption in the Commission's impact assessment was set before any large-scale public-sector migration to sovereign-tier services had been completed.

The Netherlands' award of the Health Data Hub to Scaleway on 23 April 2026 at roughly €180m for millions of citizens' records is the closest comparable; per-record and per-workload pricing from a real migration was not published before CADA's adoption. the Commission worked with a hypothetical premium, not empirical migration data.

The deeper structural issue is that CADA's adoption was delayed three consecutive times (March, April, 27 May before 3 June) in part due to US trade pressure, and the impact assessment was not revised to incorporate more conservative cost scenarios during those delays.

Escalation

Bruegel's 86bn euro figure becomes the contested number in any CADA trilogue review. The Commission adopted CADA on 3 June; the text is in trilogue between Commission, Parliament and Council. The analysis, coming from a Brussels-embedded institution rather than a US industry lobby, is harder for the Commission to dismiss and is likely to be cited by Council delegations seeking to narrow CADA's scope or adjust the assurance-tier thresholds during trilogue.

What could happen next?

Risk
If the trilogue accepts a narrower assurance-tier scope in response to the cost critique, CADA's operational effect on actual public-sector procurement could be smaller than the Commission framed at adoption.
Medium term · Suggested
Consequence
The 5% price-premium assumption will need empirical grounding from real migrations, such as the Netherlands' Scaleway Health Data Hub contract, before the Commission can defend its impact assessment in trilogue.
Short term · Assessed
Meaning
A cost critique sourced to the Commission's own impact assessment, published by a Commission-adjacent institution eight days after CADA adoption, structurally weakens the political case for the law before any member state has had to budget for compliance.
Short term · Assessed

Source Landscape

This story draws on centre-leaning sources from Belgium

Belgium

LeftRight

Primary parallel: Australia's 2019 cloud security framework (Certified Cloud Services List) applied a security-tier model to government cloud procurement, with the highest tier limited to Australian-hosted services.

The government's own Department of Finance costed compliance at 2-4x standard cloud prices for top-tier services; some departments chose not to migrate and accepted a lower assurance tier. The EU's CADA four-tier model faces the same migration selectivity problem: actual migration cost depends on how many workloads agencies classify at each tier, not on the theoretical ceiling.

Counter-parallel: GDPR (General Data Protection Regulation) compliance costs were estimated at €200bn across the EU economy before implementation; actual compliance spending came in well below that figure once firms understood which activities triggered which obligations. The €200bn pre-implementation GDPR ceiling suffered from the same top-down aggregation that makes Bruegel's 86bn euro ceiling unreliable as a per-agency planning figure.

The scale comparison makes the cost case vivid. The 86bn euro ceiling on public-sector migration dwarfs the entire sovereignty supply budget: the AI Gigafactories call due in July totals 4.12bn euros, and the Open Source Strategy adds 2bn euros over seven years. Together those two instruments add up to roughly 6.1bn euros against an 86bn euro migration bill.

Gartner's May 2026 sovereign-cloud IaaS forecast projects European sovereign cloud spending at $12.6bn in 2026, rising to $23.1bn in 2027. If those figures hold, the annual sovereign-cloud market for 2026 and 2027 combined is roughly $35.7bn: the migration cost Bruegel cites is more than two full years of the sovereign cloud market at its projected peak.

the Commission's 1% top-tier workload estimate suggests actual migration volumes will be far smaller than the ceiling figure implies, but CADA's critics have the headline number.

Consensus view: Bruegel's First Glance analysis, published 11 June 2026, draws on the Commission's own impact assessment figures. The structural argument, shared by ECIPE and the BSA (Business Software Alliance), is that nationality of incorporation is a weaker security proxy than technical criteria such as cryptographic key management, data residency, and audit rights.

These organisations argue a risk-based framework using technical safeguards would achieve equivalent security outcomes at lower cost than an origin-based test.

Counter-view: Francisco Mingorance of CISPE (Cloud Infrastructure Service Providers in Europe, the European cloud industry body) has argued that the Draghi report recommendation CADA implements, specifically the recommendation for a European-sovereignty tier in public cloud procurement, was premised on market power: European cloud providers cannot win public tenders against hyperscalers on price alone, and an origin-based criterion is the mechanism that makes the market contestable.

CISPE's position is that Bruegel's 86bn euro estimate uses the Commission's own figure but not the Commission's counterfactual: non-migration exposes European public data to US CLOUD Act extraterritorial access indefinitely.

Key tension: Whether the 86bn euro migration cost is a real barrier or a ceiling on a distributional argument; Bruegel assumes uniform migration to sovereign-tier services, while the Commission's own text reserves the strictest tier for approximately 1% of public services.

Sources:Bruegel

Mentions:Bruegel →Cloud and AI Development Act →European Commission →AI Gigafactories →Ursula von der Leyen →GDPR →Francisco Mingorance →CLOUD Act →Brussels →CISPE →Australia →Health Data Hub →

First Reported In

Update #9 · EU chip share slips to 9% as law takes hold

Bruegel· 18 Jun 2026

Read original →

Causes and effects

This Event

Bruegel puts the cloud law at 86bn euros

The figure dwarfs the rest of the sovereignty budget and the critique carries weight because of where it comes from. This is a centre, Brussels-embedded institution telling the Commission its own sums do not hold, not US industry lobbying against a Buy-European tilt.

Led to

Bruegel says EU sovereignty mimics rivals

Bruegel's CADA cost estimate of up to €86bn is the analytical context for Mariniello's broader mimicry critique of the sovereignty package.

Occurred 1 Jun 2026

Read story →

Different Perspectives

Russia

Russia vetoed the same renewal on 17 September, arguing that Britain, France and Germany never validly triggered the snapback that reimposed the pre-2015 UN resolutions. No panel was ever seated under that mandate, so the UN list decays fastest for states that screen against it rather than against the American one.

China

China vetoed renewal of the UN sanctions monitoring mandate on 17 September, arguing that Resolution 2231 terminated on 18 October 2025 and that the Security Council should drop Iran's nuclear file altogether. On that reading there is nothing to monitor, so the sanctions survive and their enforcement does not.

Iraq

Baghdad saw the last American counter-Islamic State troops leave its territory on 30 September, completing a timetable it agreed with Washington in September 2024. Iraqi airspace deconfliction passes to Baghdad, which still has an open inquiry into the Maysan drone launches that has named nobody.

Pakistan

Treasury names Waseem Pasha Tajammal of Rawalpindi as the Cavalier group's chairman and places one of the designated incorporations in Islamabad. QatarEnergy separately told Pakistan that liquefied natural gas cargo cancellations would run through November, so Islamabad carries an enforcement question and a supply gap at once.

Turkey

Treasury named a Cavalier Dynamics company incorporated in Istanbul among the ten nodes it designated on 29 September, and Ankara has published no response. Turkey imported a record 120,000 barrels a day of Indian diesel in August, cutting Russia's share of its diesel imports to 20 per cent.

India

Suraj Yadav, a wiper from Uttar Pradesh, was killed aboard the Cape Dao on 23 September, and 19 of the ship's 20 Indian crew were taken off alive. India's September imports ran at 575,000 barrels a day from Iraq and 566,000 from Saudi Arabia, back to pre-conflict rates.