29OCT

Bruegel puts the cloud law at 86bn euros

3 min read

17:49UTC

The Brussels think-tank Bruegel put the migration of public-sector workloads to sovereign-level cloud at up to 86bn euros, using the Commission's own impact assessment.

← Back to Iran threatens legal action on Sinokor ships Jump to analysis ↓

ConflictDeveloping

Key takeaway

The financial case against the cloud law comes from inside Brussels, not from Washington.

The Brussels think-tank Bruegel published a "First Glance" analysis on Thursday 11 June that put a number on CADA the Commission had not advertised. the Commission's own impact assessment, Bruegel found, costs the migration of public-sector workloads to sovereign-level cloud at up to 86bn euros, on an assumed price premium of just 5% that Bruegel calls unrealistic⁠¹.

That figure dwarfs the rest of the sovereignty budget. The 4.12bn euro AI Gigafactories call due in July and the 2bn euro open-source strategy together come to under a tenth of it.

Bruegel's deeper objection is structural: CADA's test for the highest assurance levels turns on a provider's nationality, not on technical safeguards, and the author argues origin is a poor proxy for security. CADA was adopted on 3 June as the package's cloud law; the critique lands while the ink is barely dry.

The source matters as much as the sum. This is not US industry lobbying against a Buy-European tilt. It is a centre, Brussels-embedded institution telling the Commission its own figures do not hold.

Deep Analysis

In plain English

A Brussels think-tank called Bruegel published an analysis on 11 June saying the EU's new cloud law would cost far more than the EU admitted. The EU's Cloud and AI Development Act, known as CADA, requires government agencies to switch from US cloud services to European-owned ones for their most sensitive data. Bruegel found that the EU's own paperwork puts the bill for this switch at up to 86bn euros. To put that in perspective: the EU's plan to build big new AI computing centres costs about 4bn euros. The migration bill alone could be twenty times that. Bruegel also argues the law uses the wrong test: it checks where a company is based rather than how secure its actual technology is. A European-owned cloud provider with poor security would qualify; a US provider with strong technical safeguards would not.

Deep Analysis

Root Causes

CADA's 5% price-premium assumption in the Commission's impact assessment was set before any large-scale public-sector migration to sovereign-tier services had been completed.

The Netherlands' award of the Health Data Hub to Scaleway on 23 April 2026 at roughly €180m for millions of citizens' records is the closest comparable; per-record and per-workload pricing from a real migration was not published before CADA's adoption. the Commission worked with a hypothetical premium, not empirical migration data.

The deeper structural issue is that CADA's adoption was delayed three consecutive times (March, April, 27 May before 3 June) in part due to US trade pressure, and the impact assessment was not revised to incorporate more conservative cost scenarios during those delays.

Escalation

Bruegel's 86bn euro figure becomes the contested number in any CADA trilogue review. The Commission adopted CADA on 3 June; the text is in trilogue between Commission, Parliament and Council. The analysis, coming from a Brussels-embedded institution rather than a US industry lobby, is harder for the Commission to dismiss and is likely to be cited by Council delegations seeking to narrow CADA's scope or adjust the assurance-tier thresholds during trilogue.

What could happen next?

Risk
If the trilogue accepts a narrower assurance-tier scope in response to the cost critique, CADA's operational effect on actual public-sector procurement could be smaller than the Commission framed at adoption.
Medium term · Suggested
Consequence
The 5% price-premium assumption will need empirical grounding from real migrations, such as the Netherlands' Scaleway Health Data Hub contract, before the Commission can defend its impact assessment in trilogue.
Short term · Assessed
Meaning
A cost critique sourced to the Commission's own impact assessment, published by a Commission-adjacent institution eight days after CADA adoption, structurally weakens the political case for the law before any member state has had to budget for compliance.
Short term · Assessed

Source Landscape

This story draws on centre-leaning sources from Belgium

Belgium

LeftRight

Primary parallel: Australia's 2019 cloud security framework (Certified Cloud Services List) applied a security-tier model to government cloud procurement, with the highest tier limited to Australian-hosted services.

The government's own Department of Finance costed compliance at 2-4x standard cloud prices for top-tier services; some departments chose not to migrate and accepted a lower assurance tier. The EU's CADA four-tier model faces the same migration selectivity problem: actual migration cost depends on how many workloads agencies classify at each tier, not on the theoretical ceiling.

Counter-parallel: GDPR (General Data Protection Regulation) compliance costs were estimated at €200bn across the EU economy before implementation; actual compliance spending came in well below that figure once firms understood which activities triggered which obligations. The €200bn pre-implementation GDPR ceiling suffered from the same top-down aggregation that makes Bruegel's 86bn euro ceiling unreliable as a per-agency planning figure.

The scale comparison makes the cost case vivid. The 86bn euro ceiling on public-sector migration dwarfs the entire sovereignty supply budget: the AI Gigafactories call due in July totals 4.12bn euros, and the Open Source Strategy adds 2bn euros over seven years. Together those two instruments add up to roughly 6.1bn euros against an 86bn euro migration bill.

Gartner's May 2026 sovereign-cloud IaaS forecast projects European sovereign cloud spending at $12.6bn in 2026, rising to $23.1bn in 2027. If those figures hold, the annual sovereign-cloud market for 2026 and 2027 combined is roughly $35.7bn: the migration cost Bruegel cites is more than two full years of the sovereign cloud market at its projected peak.

the Commission's 1% top-tier workload estimate suggests actual migration volumes will be far smaller than the ceiling figure implies, but CADA's critics have the headline number.

Consensus view: Bruegel's First Glance analysis, published 11 June 2026, draws on the Commission's own impact assessment figures. The structural argument, shared by ECIPE and the BSA (Business Software Alliance), is that nationality of incorporation is a weaker security proxy than technical criteria such as cryptographic key management, data residency, and audit rights.

These organisations argue a risk-based framework using technical safeguards would achieve equivalent security outcomes at lower cost than an origin-based test.

Counter-view: Francisco Mingorance of CISPE (Cloud Infrastructure Service Providers in Europe, the European cloud industry body) has argued that the Draghi report recommendation CADA implements, specifically the recommendation for a European-sovereignty tier in public cloud procurement, was premised on market power: European cloud providers cannot win public tenders against hyperscalers on price alone, and an origin-based criterion is the mechanism that makes the market contestable.

CISPE's position is that Bruegel's 86bn euro estimate uses the Commission's own figure but not the Commission's counterfactual: non-migration exposes European public data to US CLOUD Act extraterritorial access indefinitely.

Key tension: Whether the 86bn euro migration cost is a real barrier or a ceiling on a distributional argument; Bruegel assumes uniform migration to sovereign-tier services, while the Commission's own text reserves the strictest tier for approximately 1% of public services.

Sources:Bruegel

Mentions:Bruegel →Cloud and AI Development Act →European Commission →AI Gigafactories →Ursula von der Leyen →GDPR →Francisco Mingorance →CLOUD Act →Brussels →CISPE →Australia →Health Data Hub →

First Reported In

Update #9 · EU chip share slips to 9% as law takes hold

Bruegel· 18 Jun 2026

Read original →

Causes and effects

This Event

Bruegel puts the cloud law at 86bn euros

The figure dwarfs the rest of the sovereignty budget and the critique carries weight because of where it comes from. This is a centre, Brussels-embedded institution telling the Commission its own sums do not hold, not US industry lobbying against a Buy-European tilt.

Led to

Bruegel says EU sovereignty mimics rivals

Bruegel's CADA cost estimate of up to €86bn is the analytical context for Mariniello's broader mimicry critique of the sovereignty package.

Occurred 1 Jun 2026

Read story →

Different Perspectives

United States (Joint Maritime Information Center)

The JMIC, the US-led naval reporting cell, rated the Hormuz threat "severe" in its 25 October advisory, as reported by gCaptain, and warned of possible renewed mining. Eight days earlier it found no substantiation for the Guards' mine claims, while US-facilitated transits ran at about 34 a day.

United Kingdom (CPS and Counter Terrorism Policing)

The CPS charged two men under the National Security Act 2023 over the RAF Fairford incident, and Counter Terrorism Policing said it believes the foreign intelligence service involved is Iran's, LBC reported. The case now runs through the courts; both men are charged, not convicted.

Aden and Yemen's recognised government

The Houthis told people to leave Aden airport, in the government-held south, before a missile fell there on 28 October, AFP reported, and police reported a second attack that afternoon. The fight between Riyadh and the Houthis is landing on the south's main civilian airport.

Qatar (mediators)

Qatar-led mediators put new terms to Iran this week, which an Iranian official called "ideas, not a proposal". Riyadh framed the Tehran meeting as support for Qatari and Pakistani mediation, keeping Doha at the centre of the indirect channel.

Korea Shipowners' Association

The association said the ships Iran listed were sub-chartered to an overseas oil company, not owned by Sinokor, carried no South Korean crew, and that Sinokor was unaware of the warning. South Korea's shipowners are contesting whose vessels the notice covers before it takes effect.

Kuwait (foreign ministry)

Kuwait summoned Iran's ambassador, Mohammad Toutounji, and handed him a protest note over the embassy's denial that its citizen took part in the alleged plot against Interior Minister Fahad Al-Yousef. Kuwait is answering through its courts and a diplomatic protest, citing international law and the UN Charter.

Written with AI from Lowdown's published reporting. Not individually reviewed by an editor. Editorial standards.