What ECIPE’s €115 billion CADA estimate measures

ECIPE’s October 2026 study estimates €115 billion in cumulative economic exposure under its Medium scenario for the proposed Cloud and AI Development Act (CADA) over 2027–2036. It is a conditional model result, not spending already incurred or an official European Commission cost estimate, according to ECIPE’s study.

ECIPE defines cumulative exposure as the present value of recurring cloud-price effects, one-time migration and software-rewriting costs, and cloud and AI benefits postponed during the transition. The headline therefore depends on how the proposal is implemented and on the assumptions used to model those costs.

How the scenario estimates compare

ECIPE’s three main scenarios estimate cumulative exposure over 2027–2036. The study also presents a separate Stress sensitivity, not a fourth main scenario.

These are implementation scenarios, not statistical confidence intervals. They show how the modeled result changes with the assumptions used; they are not observed bills or forecasts of spending that has already occurred.

What the Medium estimate counts

ECIPE breaks the €115 billion Medium estimate into €79.1 billion for migration and software rewriting, €34 billion in recurring cloud-price effects, and €1.9 billion for postponed digitalization. Migration and rewriting make up about 69% of the total.

That migration component covers more than moving files between providers. ECIPE’s model includes adapting databases and APIs, identity and access management, cybersecurity configurations and integrations, along with testing, training, and parallel operations. In other words, applications and the systems around them may need work as well as the data itself.

The estimate also leaves potential security, resilience, and strategic-autonomy benefits without a monetary value. ECIPE says it is therefore not a complete social cost-benefit analysis.

Assumptions behind the model

ECIPE’s Medium scenario assigns 20% of affected workloads to the more restrictive UAL3–4 levels. For the private-sector portion, it assumes Article 31 requirements reach 25% of a potential essential-sector cloud base valued at about €61.2 billion before coverage is applied.

The study also uses modeled total price differences of 10% at UAL1, 15% at UAL2, 30% at UAL3, and 40% at UAL4. These are inputs to ECIPE’s model, not observed market prices; they are not step-by-step additions to one another.

The levels form part of the European Commission’s proposed sovereignty-assurance framework. The Commission adopted its CADA proposal on June 3, 2026, with measures covering research and innovation, data-center capacity, and a common approach to sovereignty assessments. Its policy summary describes the levels as follows:

• UAL1: Data is processed and stored on infrastructure located in the European Union.
• UAL2: Providers demonstrate independence from third countries and transparency about their software supply chains.
• UAL3: Providers are EU-owned and controlled and meet additional criteria, such as personnel citizenship; the Commission says it can recognize providers from third countries at this level.
• UAL4: Providers offer full transparency and control over their software supply chains, with no third-country interference.

The Commission describes the framework as a tool for public-sector risk assessments and procurement, and says the vast majority of the market remains open to partners. Its proposal page sets out the act’s stated policy areas.

ECIPE identifies CCIA Europe as the study’s funder and says the author’s opinions do not necessarily represent the funder’s views.

A separate estimate for EU GDP

ECIPE’s Medium model separately puts EU27 real GDP about 0.046%, or approximately €8.5 billion, below its no-CADA baseline once the modeled adjustments work through the economy. That is a difference in GDP level, a distinct measure from the study’s cumulative exposure estimate.