The report argues that restrictions favoring European cloud providers would leave governments and businesses facing bills to migrate workloads and rewrite software. Direct public-sector costs are estimated at €33.3 billion, with a further €80 billion potentially falling on private companies in sectors including banking, healthcare, energy, and transport. However, a large asterisk is attached to the €80 billion figure: it assumes the Commission extends sovereignty requirements beyond public procurement to cover 25 percent of cloud workloads in essential private-sector industries. In other words, it is a modelled scenario, not a bill Brussels has already handed European businesses.
The study comes with baggage of its own. CCIA represents several US technology giants that dominate the European cloud market, including Amazon and Google. Both have been selling European customers cloud services while more recently developing sovereign cloud offerings designed to address concerns about foreign ownership, data access, and regulatory control. Amazon, for example, has been developing its AWS European Sovereign Cloud, while Google markets a range of sovereign cloud solutions. Meta, another CCIA member, has its own interests in European AI infrastructure, although it is not a commercial cloud provider on the scale of AWS or Google Cloud.
The report specifically targets Article 31 of the proposed legislation, which it says could allow the Commission to extend sovereignty requirements into essential private-sector services. CCIA argues that forcing businesses to move from existing cloud infrastructure could trigger expensive software projects, with code rewriting and re-architecting accounting for 69 percent of its estimated costs. Luxembourg would apparently take the biggest hit, with the study putting the cost at €1,711 per worker over ten years. Denmark (€905), Austria (€900), and Finland (€864) also face hefty bills, as does Ireland (€856), which hosts the European headquarters of several US tech giants.
CCIA is urging EU governments to overhaul the proposed legislation, limit sovereignty restrictions to sensitive workloads, and abandon requirements based on corporate origin or nationality in favor of what it calls risk-based technical safeguards. "Member States cannot rely on the Commission's incomplete estimates when deciding CADA's strict sovereignty requirements for cloud and AI providers," said Mitchell Rutledge, CCIA Europe's policy manager. "Taxpayers and businesses will foot the bill, yet the official assessment missed 70 percent of CADA's true impact."
For AWS and Google, offering European customers greater control over their data also helps retain business that might otherwise migrate to European competitors. It is a rather convenient arrangement: sell customers sovereignty on one hand, while an industry association representing their interests warns governments against imposing too much of it on the other. Neither Amazon nor Google responded to The Register's questions.