The number and what it measures
On 13 October 2026, CCIA Europe released a study by the Brussels think tank ECIPE estimating that the EU's proposed Cloud and AI Development Act (CADA) would cost Europe about €115 billion over ten years. CCIA Europe's members include Amazon, Google and Meta. According to The Next Web's report, the study models three scenarios for 2027 to 2036: €35.6 billion (narrow), €115 billion (central) and €233 billion (broad). The central figure is more than six times the Commission's upper estimate of €18 billion, a number the same report attributes to The Register.
The lobby's headline needs a close reading. The report says about €80 billion of the €115 billion comes from private-sector costs. That figure assumes the Commission uses Article 31 of its proposal to extend assessments, and by implication sovereignty requirements, to a quarter of the private cloud spending in scope, in sectors such as energy, banking, transport and healthcare. The proposal does not impose those requirements on the private sector. The study's own author says it is not a full cost-benefit assessment and puts no value on security, resilience or strategic autonomy.
So the €115 billion is a conditional model result, not a forecast of what the adopted law will do. The Commission's €18 billion has its own limits, since it comes from the party that wrote the proposal.
The strongest case for CADA
Before criticising the sovereignty tiers, here is the best argument for them. European public bodies run health records, tax systems and policing on infrastructure owned by providers subject to foreign law. The US CLOUD Act, enacted in March 2018, lets US authorities compel US-based providers to hand over data, and the Justice Department's CLOUD Act page describes the Act as meant to speed access to electronic information held by US-based global providers. The Commission's own Study on Cloud and AI Development in the EU points to "risks arising from third-country laws with extraterritorial effects" and to the EU's dependence on non-European suppliers. Governments are entitled to decide who can reach their citizens' most sensitive records. Brussels also has a point that a hypothetical "kill switch", in which a foreign government forces a provider to degrade service, is a resilience risk worth designing against, even if nobody has shown it happening to an EU customer.
What the tiers actually require
The proposal was published on 3 June 2026. Covington & Burling's analysis describes four "Union assurance levels":
- Level 1 applies to essentially all providers serving the public sector. It requires infrastructure, assets and customer data to be kept in the EU. Providers controlled in a third country must also guarantee they are not required to report unexploited vulnerabilities to third-country authorities.
- Level 2 requires all personnel, infrastructure and assets to be in the EU, and requires controlled providers to prevent third-country access to customer data.
- Level 3 requires the provider to be owned and controlled in the EU. The one derogation is for third countries with an EU adequacy decision that cannot compel providers to degrade or disrupt service.
- Level 4 excludes any provider controlled in a third country, with no derogation.
Higher levels are triggered by a Member State risk assessment of sensitive public-sector activities. Level 3's derogation matters for Washington: whether the United States qualifies as an "associated" country depends on an adequacy decision, which turns the tier into a diplomatic question as well as a technical one.
Where the lobbying frame is weak, and where it isn't
The fair reading is that the ECIPE number overstates the cost for the text as proposed. It prices a private-sector expansion that would require the Commission to act, and the study itself says it does not net out any benefits. A US trade association funding a study of a regulation that constrains its members is entitled to make its case, but readers should weigh it as advocacy.
The study does raise a real design problem. Article 31 is an open door. If the Commission can ask energy, banking and health firms for the same assessments as public bodies, the migration cost the study stresses, which the report says is about 69% of its total, becomes a live risk. Rewriting software and moving workloads is the expensive part of any sovereignty regime. Buyers who face a choice between a provider with the best security record and one that meets an ownership test will pay for that choice in price and quality, and the study estimates about €34 billion in recurring price rises.
A pro-innovation approach doesn't need to reject sovereignty requirements. The workable position is proportionate:
- Tie tiers to threat models. Level 4 exclusion by ownership should be reserved for narrowly defined workloads such as defence and intelligence-adjacent systems. Technical controls, such as customer-held keys and in-EU operations, address the stated risks without ruling out providers by nationality.
- Write the private-sector limit into the law. If the legislature does not intend a 25% private-workload expansion, say so in the text instead of leaving a delegated power that markets must price in.
- Publish a real cost-benefit assessment. Both the €18 billion and the €115 billion are contested. The Commission should disclose its assumptions so that critics and supporters argue over the same model.
- Use the CLOUD Act channel for the legal conflict. The DOJ lists executive agreement negotiations with the EU as resumed in March 2023. A durable agreement addresses the conflict-of-laws problem that tiers only work around.
What this means for the US
The US government and US providers will read CADA as discrimination in procurement, and the ECIPE study gives them a number to wave. The better argument for Washington is narrower: that technical safeguards can answer European security concerns without ownership tests, and that a negotiated CLOUD Act agreement is a cheaper fix than a fragmented market. Both sides should get the numbers right first. A €115 billion figure that depends on a rule nobody has proposed is not a reason to scrap the act, and a €18 billion figure nobody can audit is not a reason to wave it through.