A CCIA-funded study puts the bill for the Cloud and AI Development Act (CADA) at €115 billion over ten years in its central scenario. Most of that cost could fall on private firms, and it would land unevenly across member states.
Europe’s push for cloud sovereignty now has a price tag attached. Following accusations from CCIA that Europe’s new Cloud and AI Development Act (CADA) is discriminatory towards the American tech industry, the same organization has commissioned a study that estimates the act could cost the EU 115 billion euros over the next decade, depending on how strictly the rules currently debated will be enforced.
- More estimates range from 35 billion euros to 233 billion euros. The new study does not include any security or autonomy benefits the act could bring about, and instead is a pure cost study rather than a cost benefit analysis.
Where the money goes. The new paper estimates that migration costs and code rewriting will make up about 69% of all costs incurred by this legislation, whilst recurring price premiums would make up 30%.
- That is, if we use the medium end 115 billion euros figure from the study, which rests on a mix of more restrictive regulation and enforcement combined with private sector spillover costs and double the amount level of 3-4 security assurances than what the Commission estimates.
- According to the paper, the Commission’s impact assessment failed to monetise re-architecting costs, which could be quite considerable. Once compliance reaches down the software stack of these companies, it will not only touch where the data is stored, but entire systems which will have to be reconstructed.
Beyond public procurement. Under article 30 of the act, CADA’s assurance levels only apply to public cloud contracts. Nonetheless, Article 31 opens a door to the private sector.
- Private companies which run critical infrastructure (any sector classed as “high criticality” under the NIS2 cybersecurity directive, for example energy companies, banks, hospitals, and transport operators) may be eventually required by the Commission to run the same kind of risk assessments.
- This would happen through delegated acts, which are rules the Commission adopts on its own. Parliament and Council can veto them but can’t negotiate them.
A considerable burden on the private sector. The European Centre for International Political Economy (ECIPE) has argued that since the private market is considerably larger than the public one (cloud spending in the public sector amounts to 4.1 billion euros a year compared to the critical-sector’s private firms spending of 61 billion euros a year), rules reaching even only a quarter of these firms (which is ECIPE’s medium range estimate) would add about 80 billion euros of cost to the total (roughly 70% of the 115 billion euros estimated in the paper). Most of the headline number thus would not even come from government procurement, but would rather come from the cost burden imposed on the private sector.
A conditional risk. Article 31 nonetheless does not immediately mandate these assessments onto private sector companies. The Commission may use delegated acts to do so, but it may also decide not to. It is incredibly hard for anyone to truly know how far it will go, with this uncertainty preventing companies from being able to plan their investments early enough, leading to additional costs if the rule is then eventually implemented.
- It is also wholly possible that the EU Commission does not extend these rules to the private sector, and that the additional incurred costs do not actually materialize.
Who pays? The burden would not be equally spread amongst European countries:
- Capacity that qualifies at levels 3-4 is concentrated in France and Germany, meaning dependence partly shifts from outside to within the EU.
- Smaller open economies like Luxembourg, Ireland and Malta would be hit hardest relative to size.
- Italy’s total economic exposure, spread across public budgets, private firms and delayed digitalisation, would amount to 12.8 billion euros over ten years, with its modelled GDP impact amounting to 0.02%.
- Italy, like France, Spain and Germany already applies national cloud security rules, and thus partially absorbs CADA related costs.
The bottom line: Whilst many sovereignty advocates argue that dependency itself carries an unpriced cost, this new study illustrates that there are also tangible expenses directly linked to the implementation of this act, and that they are perhaps greater than anticipated even by the EU itself. Much of this is dependent on details still being debated and considered at the EU level, such as how far Article 31 will reach.
