Would a sovereign cloud cost Europe €115 billion?

A number put in front of ministers

On 13 October in Dublin, Europe's digital ministers gather for an informal telecoms council. On the sidelines, a roundtable brings together senior officials. They are shown one number: 115 billion euros over ten years. That, the pitch goes, is what the Cloud and AI Development Act would cost Europe. It is the proposal through which the Commission wants public administrations to depend less on non-European clouds.

The press release that comes with the presentation goes further. It says the figure is "six times" the Commission's own high-end estimate of 18 billion. The specialist press picks up the number the next day.

The study is signed by Matthias Bauer, director of ECIPE, an economic policy think tank. Its last page states that it is funded by CCIA Europe, the trade association whose members include Amazon, Google, Meta and Apple. So two of the biggest cloud vendors, through their association, are paying for the study that prices what it costs to give them less room. It's a bit like the baker commissioning a report on the cost of homemade bread.

We opened the study, its technical annex and the Commission's impact assessment.

The proposal in two sentences

The proposed regulation dates from 3 June 2026. It sorts public cloud use into four assurance levels, from most open to most closed: the closer an activity sits to public order, the more the provider has to be shielded from foreign laws, up to requiring a supplier owned and controlled in Europe. Think of an access badge: the more sensitive the room, the stricter the badge.

The text has not been adopted. In the European Parliament it is at the earliest possible stage: referral to committee was announced on 17 September, and no report has been voted.

Where the 115 billion comes from

The study actually gives three numbers: 35.6 billion in a narrow scenario, 115 billion in a medium one, 233 billion in a broad one. It treats the medium scenario as its central case because, in its words, it offers a "deliberately moderate" benchmark.

That medium scenario stacks two assumptions. First, 20% of the relevant public uses would fall into the two strictest levels. The Commission's own calculation puts that share at 10%. Second, the requirements would extend to 25% of the cloud workloads of private companies in essential sectors such as banking, energy, health and transport.

The 115 billion then splits into 35 billion for the public sector and 80 billion for private companies. Private companies carry about 70% of the total. It's a renovation quote where the heaviest line is for the neighbour's house, in case the neighbour decides to do the same work.

Article 31: a door that hasn't been opened

The whole private-sector chunk rests on one article of the proposal, Article 31. Reading it is worthwhile, because it supports neither what industry fears nor the opposite.

Paragraph one says private companies in essential sectors "may" run the same kind of risk assessment as public bodies. That is optional. Paragraph three says that if specific circumstances justify it, and after consulting member states, the Commission can adopt a delegated act making that assessment and protective measures mandatory for those companies.

So the door does exist in the text. But it is shut, and the key is an act the Commission has not taken. Take a regional bank running its applications on a US hyperscaler: as long as no delegated act is adopted, nothing in this proposal forces it to move.

The 25% rate is a parameter of the model, not a decision. The study tests three (10%, 25% and 50%) and says so plainly: coverage of private companies is "conditional" in the model, and how Article 31 will finally be used remains legally and politically uncertain.

The Commission's 18 billion: compared with what?

That leaves the "six times". We looked for the 18 billion in the Commission's impact assessment. It is there, on page 63, for the preferred option: between 4 and 18 billion euros in costs, over ten years and in present value, for public authorities.

The 18 billion ceiling therefore covers administrations only. Setting it against 115 billion that includes private companies is like putting the price of a kitchen next to the quote for the whole house.

Did the Commission forget the private sector? The press release says the 80 billion is "entirely omitted" from the official calculations. That is half true. The assessment does count 25,600 private companies in critical sectors and gives them between 486 million and 2.6 billion euros in costs, for building sovereignty into their risk analysis. What it doesn't price is any migration of their systems, since the text as it stands doesn't require them to move.

One more detail is worth noting. The study's narrow scenario reuses the Commission's split across the four levels exactly. With that assumption, ECIPE gets 17.4 billion for the public sector. The two calculations don't count the same items, but they land in the same order of magnitude.

Where the Commission's own numbers are weak

It would be too easy to stop there. The study points to a real weakness: the cost of rewriting software to switch clouds. By its calculations, migration and code rewriting make up 69% of the total.

On this point ECIPE is not alone. The Regulatory Scrutiny Board, the internal body that checks the Commission's impact assessments, first issued a negative opinion on this one, then a positive opinion with comments on 8 May 2026. Among those comments: better reflect migration costs in the total.

The Commission had in fact computed a porting cost of 86.3 billion euros itself. It set that aside as "maximalist", because it assumed 6,400 public bodies port all their relevant applications in the very first year. It kept a range of 2.5 to 14.8 billion instead. The debate over the migration bill is legitimate, and it started inside the Commission itself.

The study has its own blind spot, which it flags: it puts no figure on any benefit for security, resilience or autonomy. It's a balance sheet with only one column. The study says so, and adds that it shouldn't be read as a full cost-benefit analysis.

Scenario or certainty

For a French worker, the study shows 534 euros over ten years in the medium scenario. The part that would land on public budgets, the part that doesn't depend on Article 31, is 128 euros.

The study is more cautious than the way it is being presented. In a footnote, it describes its scenarios as modelling exercises, not predictions of the final text. The same day, in the CCIA press release, its head of public policy Mitchell Rutledge says the costs for private companies are "not hypothetical but inevitable".

Between those two sentences sit 80 billion euros and a delegated act nobody has written yet.