17OCT

Bruegel puts the cloud law at 86bn euros

3 min read

17:43UTC

The Brussels think-tank Bruegel put the migration of public-sector workloads to sovereign-level cloud at up to 86bn euros, using the Commission's own impact assessment.

← Back to Trump waives his own 500% Russia tariffs Jump to analysis ↓

ConflictDeveloping

Key takeaway

The financial case against the cloud law comes from inside Brussels, not from Washington.

The Brussels think-tank Bruegel published a "First Glance" analysis on Thursday 11 June that put a number on CADA the Commission had not advertised. the Commission's own impact assessment, Bruegel found, costs the migration of public-sector workloads to sovereign-level cloud at up to 86bn euros, on an assumed price premium of just 5% that Bruegel calls unrealistic⁠¹.

That figure dwarfs the rest of the sovereignty budget. The 4.12bn euro AI Gigafactories call due in July and the 2bn euro open-source strategy together come to under a tenth of it.

Bruegel's deeper objection is structural: CADA's test for the highest assurance levels turns on a provider's nationality, not on technical safeguards, and the author argues origin is a poor proxy for security. CADA was adopted on 3 June as the package's cloud law; the critique lands while the ink is barely dry.

The source matters as much as the sum. This is not US industry lobbying against a Buy-European tilt. It is a centre, Brussels-embedded institution telling the Commission its own figures do not hold.

Deep Analysis

In plain English

A Brussels think-tank called Bruegel published an analysis on 11 June saying the EU's new cloud law would cost far more than the EU admitted. The EU's Cloud and AI Development Act, known as CADA, requires government agencies to switch from US cloud services to European-owned ones for their most sensitive data. Bruegel found that the EU's own paperwork puts the bill for this switch at up to 86bn euros. To put that in perspective: the EU's plan to build big new AI computing centres costs about 4bn euros. The migration bill alone could be twenty times that. Bruegel also argues the law uses the wrong test: it checks where a company is based rather than how secure its actual technology is. A European-owned cloud provider with poor security would qualify; a US provider with strong technical safeguards would not.

Deep Analysis

Root Causes

CADA's 5% price-premium assumption in the Commission's impact assessment was set before any large-scale public-sector migration to sovereign-tier services had been completed.

The Netherlands' award of the Health Data Hub to Scaleway on 23 April 2026 at roughly €180m for millions of citizens' records is the closest comparable; per-record and per-workload pricing from a real migration was not published before CADA's adoption. the Commission worked with a hypothetical premium, not empirical migration data.

The deeper structural issue is that CADA's adoption was delayed three consecutive times (March, April, 27 May before 3 June) in part due to US trade pressure, and the impact assessment was not revised to incorporate more conservative cost scenarios during those delays.

Escalation

Bruegel's 86bn euro figure becomes the contested number in any CADA trilogue review. The Commission adopted CADA on 3 June; the text is in trilogue between Commission, Parliament and Council. The analysis, coming from a Brussels-embedded institution rather than a US industry lobby, is harder for the Commission to dismiss and is likely to be cited by Council delegations seeking to narrow CADA's scope or adjust the assurance-tier thresholds during trilogue.

What could happen next?

Risk
If the trilogue accepts a narrower assurance-tier scope in response to the cost critique, CADA's operational effect on actual public-sector procurement could be smaller than the Commission framed at adoption.
Medium term · Suggested
Consequence
The 5% price-premium assumption will need empirical grounding from real migrations, such as the Netherlands' Scaleway Health Data Hub contract, before the Commission can defend its impact assessment in trilogue.
Short term · Assessed
Meaning
A cost critique sourced to the Commission's own impact assessment, published by a Commission-adjacent institution eight days after CADA adoption, structurally weakens the political case for the law before any member state has had to budget for compliance.
Short term · Assessed

Source Landscape

This story draws on centre-leaning sources from Belgium

Belgium

LeftRight

Primary parallel: Australia's 2019 cloud security framework (Certified Cloud Services List) applied a security-tier model to government cloud procurement, with the highest tier limited to Australian-hosted services.

The government's own Department of Finance costed compliance at 2-4x standard cloud prices for top-tier services; some departments chose not to migrate and accepted a lower assurance tier. The EU's CADA four-tier model faces the same migration selectivity problem: actual migration cost depends on how many workloads agencies classify at each tier, not on the theoretical ceiling.

Counter-parallel: GDPR (General Data Protection Regulation) compliance costs were estimated at €200bn across the EU economy before implementation; actual compliance spending came in well below that figure once firms understood which activities triggered which obligations. The €200bn pre-implementation GDPR ceiling suffered from the same top-down aggregation that makes Bruegel's 86bn euro ceiling unreliable as a per-agency planning figure.

The scale comparison makes the cost case vivid. The 86bn euro ceiling on public-sector migration dwarfs the entire sovereignty supply budget: the AI Gigafactories call due in July totals 4.12bn euros, and the Open Source Strategy adds 2bn euros over seven years. Together those two instruments add up to roughly 6.1bn euros against an 86bn euro migration bill.

Gartner's May 2026 sovereign-cloud IaaS forecast projects European sovereign cloud spending at $12.6bn in 2026, rising to $23.1bn in 2027. If those figures hold, the annual sovereign-cloud market for 2026 and 2027 combined is roughly $35.7bn: the migration cost Bruegel cites is more than two full years of the sovereign cloud market at its projected peak.

the Commission's 1% top-tier workload estimate suggests actual migration volumes will be far smaller than the ceiling figure implies, but CADA's critics have the headline number.

Consensus view: Bruegel's First Glance analysis, published 11 June 2026, draws on the Commission's own impact assessment figures. The structural argument, shared by ECIPE and the BSA (Business Software Alliance), is that nationality of incorporation is a weaker security proxy than technical criteria such as cryptographic key management, data residency, and audit rights.

These organisations argue a risk-based framework using technical safeguards would achieve equivalent security outcomes at lower cost than an origin-based test.

Counter-view: Francisco Mingorance of CISPE (Cloud Infrastructure Service Providers in Europe, the European cloud industry body) has argued that the Draghi report recommendation CADA implements, specifically the recommendation for a European-sovereignty tier in public cloud procurement, was premised on market power: European cloud providers cannot win public tenders against hyperscalers on price alone, and an origin-based criterion is the mechanism that makes the market contestable.

CISPE's position is that Bruegel's 86bn euro estimate uses the Commission's own figure but not the Commission's counterfactual: non-migration exposes European public data to US CLOUD Act extraterritorial access indefinitely.

Key tension: Whether the 86bn euro migration cost is a real barrier or a ceiling on a distributional argument; Bruegel assumes uniform migration to sovereign-tier services, while the Commission's own text reserves the strictest tier for approximately 1% of public services.

Sources:Bruegel

Mentions:Bruegel →Cloud and AI Development Act →European Commission →AI Gigafactories →Ursula von der Leyen →GDPR →Francisco Mingorance →CLOUD Act →Brussels →CISPE →Australia →Health Data Hub →

First Reported In

Update #9 · EU chip share slips to 9% as law takes hold

Bruegel· 18 Jun 2026

Read original →

Causes and effects

This Event

Bruegel puts the cloud law at 86bn euros

The figure dwarfs the rest of the sovereignty budget and the critique carries weight because of where it comes from. This is a centre, Brussels-embedded institution telling the Commission its own sums do not hold, not US industry lobbying against a Buy-European tilt.

Led to

Bruegel says EU sovereignty mimics rivals

Bruegel's CADA cost estimate of up to €86bn is the analytical context for Mariniello's broader mimicry critique of the sovereignty package.

Occurred 1 Jun 2026

Read story →

Different Perspectives

Bulgarian government

Bulgaria's Prime Minister, Rumen Radev, said the sinking of HS Dignity "benefits the Russian Federation" while saying Bulgaria lacked solid evidence to accuse anyone, and Defence Minister Dimitar Stoyanov asked NATO for air defence on 16 October. The request comes from a government that stopped state military aid to Ukraine in June.

Radoslaw Sikorski

Poland's foreign minister challenged Elon Musk on X after SpaceX capped Ukraine's Starshield terminals on 14 October. Poland pays about $50m a year for Ukraine's Starlink subscriptions, so Warsaw speaks as the paying customer as well as the ally.

Andy Burnham

Burnham fast-tracked £10m of a £45m air-defence missile delivery when Zelenskyy visited London on 14 October, and his ministers are lobbying allies to ban maritime services for Russian liquefied natural gas. The measure targets insurers and shipowners, many of them in London, rather than the gas itself.

Ministry of External Affairs (India)

India's foreign ministry said after the 16 September House vote that New Delhi would take all necessary measures to protect its trade.

European Council

EU leaders on 15-16 October rejected a US idea to hand Washington the roughly €200bn of frozen Russian assets held in Europe, and Kaja Kallas said the decision belongs to Europeans. The same summit put off a decision on financing Ukraine, saying leaders "will revert to the issue in a timely manner".

Donald Trump

Trump signed the 16 October order that sets the Graham Act's duties and waives them under section 115(a), with a certification sent to Congress. He says the United States has not stopped sharing intelligence with Ukraine, and on 11 October he said both sides had agreed to halt attacks on energy infrastructure.

Written with AI from Lowdown's published reporting. Not individually reviewed by an editor. Editorial standards.