Dublin, IRELAND – As EU digital and telecoms ministers meet in Ireland today, a new report reveals that the European Commission’s proposed Cloud and AI Development Act (CADA) risks imposing €115 billion in costs over the next decade, disproportionately affecting highly digitised Member States.
The European Centre for International Political Economy (ECIPE) finds that CADA’s ‘sovereignty’ requirements – excluding non-EU providers from parts of the cloud and AI market – could cost Europe six times the Commission’s upper estimate of €18 billion.
The ECIPE study exposes three critical blind spots in the Commission’s impact assessment: €33.3 billion in direct public budget exposure; substantial software re-architecting and code-rewriting costs, accounting for 69% of CADA’s real-world impact; and €80 billion in private-sector spillovers entirely omitted from official calculations.
The independent study, commissioned by the Computer & Communications Industry Association (CCIA Europe), highlights the hidden impact of CADA’s Article 31. This provision allows the Commission to extend strict ‘sovereignty’ restrictions beyond public procurement to essential private sectors – including banking, energy, healthcare, and transport.
With essential entities’ cloud spending roughly 15 times public-procurement levels, applying CADA to just 25% of essential commercial workloads would generate €80 billion in extra costs, even under a conservative scenario. European software vendors and digital SMEs would be forced to redesign applications built on global cloud architectures and AI platforms.
While the EU27 average burden is €548 per worker over 10 years, smaller open economies reliant on global software architectures face substantially higher costs – reaching €1,711 per worker in Luxembourg, €905 in Denmark, €900 in Austria, €864 in Finland, €856 in Ireland, and €762 in the Netherlands in the moderate scenario.
CCIA Europe urges EU Member States to fundamentally overhaul CADA, limiting sovereignty restrictions to sensitive workloads where specific public-order risks are demonstrated. Discriminatory corporate-origin and personnel-nationality requirements should be replaced with verifiable, risk-based technical safeguards, while trusted international partners with bilateral EU procurement commitments should be exempted from Article 18 country screening, in line with open and non-discriminatory trade principles.
The study’s authors presented the findings today at a Dublin roundtable with senior government officials on the sidelines of the Informal Telecoms Council.
The following can be attributed to CCIA Europe’s Policy Manager, Mitchell Rutledge:
“Member States cannot rely on the Commission’s incomplete estimates when deciding CADA’s strict sovereignty requirements for cloud and AI providers. Taxpayers and businesses will foot the bill, yet the official assessment missed 70% of CADA’s true impact.”
“Governments must recognise that CADA’s massive spillover costs for essential private-sector entities are not hypothetical but inevitable. Businesses cannot simply switch servers; they must redesign software and rewrite code across entire supply chains.”
“These sweeping restrictions risk draining European innovation and penalising highly digitised Member States. EU decision-makers must refocus CADA on objective, risk-based security rather than discriminatory rules that fragment the Single Market.”
Notes for editors
- The complete ECIPE study on the economic impact of CADA, including detailed methodology, is available at www.ecipe.org/publications/economic-impact-of-cada
- Interactive maps, sector breakdowns, and country-specific reports on CADA’s estimated economic impact across the EU can be explored in the study’s online data room at www.cada-impact.eu
