Scenarios explained
Scenarios explained: uncovering CADA’s true economic footprint
The total economic footprint of the Cloud and AI Development Act (CADA) depends entirely on how far sovereignty requirements extend into European public services and essential commercial sectors. To fill the empirical gap left by the European Commission’s official estimates, ECIPE modelled three core implementation paths alongside a high-restriction stress sensitivity.
The unrealistic academic baseline
Narrow
10-year EU exposure
€35.6bn
Regulatory scope. Sovereignty mandates bite strictly where the state acts as both customer and data controller. Requirements apply only to highly sensitive public-sector workloads (70% UAL1, 20% UAL2, 9% UAL3, 1% UAL4), with private-sector Article 31 coverage capped at 10%.
The reality. An academic low-restriction benchmark, but politically unrealistic. Under current cybersecurity enforcement, national authorities are unlikely to allow essential commercial infrastructure (power grids, banks) to operate under lower security tiers than government ministries.
In scope: public-sector workloads classified as highly sensitive only.
The realistic central baseline
Medium Central case
10-year EU exposure
€115bn
Regulatory scope. Reflects moderate, practical enforcement. 20% of affected workloads are pushed into restrictive high assurance levels (50% UAL1, 30% UAL2, 15% UAL3, 5% UAL4), and Article 31 requirements extend to 25% of private essential-sector entities under NIS2 (e.g. energy, transport, health, finance).
The reality. The central reference case for public policy discussions. It provides a grounded anchor that accounts for moderate private-sector spillover without relying on worst-case hyperbole.
In scope: public sector plus private high-criticality entities under NIS2.
The gold-plating warning
Broad
10-year EU exposure
€233bn
Regulatory scope. High-scope implementation where mandates flow down contractual supply chains. 25% of workloads require UAL3/UAL4, and Article 31 reaches 50% of all private essential entities.
The reality. A stark policy warning highlighting the immediate economic penalty if Member States choose to ‘gold-plate’ CADA rules during national implementation.
In scope: all NIS2 entities and their supply chains.
Side-by-side scenario comparison
| EU-wide measure | Narrow | Medium | Broad |
|---|---|---|---|
| 10-year total bill across the national economy | €35.6bn | €115bn | €233bn |
| One-off software rewriting & server move costs | €21.4bn | €79.1bn | €159.3bn |
| Extra yearly 'sovereignty' markup across the economy | €1.2bn/yr | €2.9bn/yr | €5.8bn/yr |
| Temporary price surges from cloud shortages | €20m | €306m | €1.3bn |
| Lost savings & productivity from delays | €151m | €1.9bn | €6.1bn |
| Minimum taxpayer support needed for infrastructure upgrades | €19m | €186m | €593m |
| Local tech companies facing forced product redesigns (vendor equivalents) | 62 | 246 | 561 |
| Expanded total monetised impact over 10 years | €35.7bn | €115.5bn | €235bn |
Source: ECIPE calculations. Present values, EU27, 2027–2036.
Why official estimates missed the mark
Three critical blind spots
The European Commission initially painted CADA as a minor public procurement update with limited economic fallout. ECIPE’s research demonstrates that official impact assessments structurally underestimated CADA’s real-world cost by ignoring three factors.
1
Omission of software rewriting
€79.1bn in Medium
- While the Commission acknowledged application porting benchmarks (€30,000 to €600,000 per application), it completely excluded application re-architecting, software substitution, and code-rewriting expenses from its final monetised equations.
- In reality, compliance is not simple data relocation; it requires replacing software dependencies and re-engineering architecture – representing nearly 70% of CADA’s total economic cost.
2
Ignoring private-sector spillover via Article 31
€80bn in Medium
- Official calculations treated CADA almost exclusively as a public procurement framework. They ignored Article 31, which allows regulators to extend strict sovereignty rules to private entities operating in essential NIS2 sectors (energy, banking, transport, healthcare).
- Annual EU public sector cloud spend is roughly €4.1 billion, whereas private essential sector cloud spend exceeds €61 billion.
- Extending mandates to just 25% of essential private workloads accounts for 70% of CADA’s entire €115 billion economic footprint.
3
Unrealistic ‘frictionless’ supply assumptions
€1.9bn in Medium
- The Commission assumed European cloud providers could scale up capacity at high security tiers (UAL3 and UAL4) overnight without shortages or price spikes.
- In reality, compliant high-tier capacity is severely constrained. Supply bottlenecks will force public authorities and businesses to defer cloud and AI rollouts, forfeiting €1.9 billion in productivity gains.