The hyperscalers’ lobby just put a price on leaving them. €79 billion of it is moving workloads off their platforms and rewriting the code. Brussels’ new sovereignty law doesn’t count a single euro.
Sovereign AI | theCUBE Research | Amit Eyal Govrin | October 2026
The confession
Europe’s biggest cloud landlords just confessed. Not in court, not to a regulator. In their own study, with their own economists, at their own expense.
On Tuesday, as EU digital ministers sat down in Ireland, CCIA Europe, the lobby whose members include Amazon, Google and Meta, fired its opening shot at the Cloud and AI Development Act, Europe’s proposed sovereignty law [1]. The price tag came stapled to it: €115 billion over ten years, according to an ECIPE study CCIA funded [2]. CCIA calls that six times the Commission’s own upper estimate of €18 billion [1].
Now read the line items. Of that €115 billion, €79.1 billion, or 69%, is not higher cloud prices. It is migration and rewriting: moving workloads, replacing software components, new APIs, database changes, identity and access work [2]. The study even explains the mechanism: “The more integrated the service, the more quickly migration turns into redesign” [2].
CCIA’s policy manager, Mitchell Rutledge, said it better than I ever have: “Businesses cannot simply switch servers; they must redesign software and rewrite code across entire supply chains” [1].
Sit with that for a second. The companies that sold Europe its cloud just paid an economist to calculate what it costs to leave them. The answer came back at €79 billion. That is not the price of sovereignty. That is the price of lock-in, itemized, footnoted and funded by the landlord.
I have spent two years asking vendors to put an exit price in writing. CCIA just did it for an entire continent, free of charge. Genuinely, thank you.
A few details make it better. Ireland, where the ministers were meeting and where several US tech giants keep their European headquarters, lands fifth in the EU for cost per worker [2]. The countries that hosted the landlords most generously get the biggest bill for moving out.
Then do the arithmetic in public. Run ECIPE’s own model on the Commission’s own workload split, 70% at Level 1 and 1% at Level 4, and the bill is €35.6 billion [2]. Twice the Commission’s number, not six times. The other roughly €80 billion comes from ECIPE’s own assumptions: more workloads pushed to the top tiers, and a quarter of private essential-sector workloads pulled in, a coverage figure Brussels has not proposed [2][3]. Scenario modeling, dressed as an invoice.
Before Brussels takes a victory lap, though: CADA does not count the exit either. Two weeks ago, in the Eclipse edition, I wrote that CADA has a rubric and no Financial pillar [17]. The lobby just sent the bill that proves it. Both sides of this fight are arguing about who owns the provider. The Data Act unlocked the door. Nobody is pricing the move.
What Brussels actually wrote
The Commission proposed CADA on 3 June 2026 [19]. Beyond tripling EU data center capacity within five to seven years, its heart is a single EU-wide sovereignty framework with four assurance levels [4]:
- Level 1. Data processed and stored in the EU.
- Level 2. Independence from third countries and transparency over the software supply chain.
- Level 3. Owned and controlled from the EU, with criteria such as personnel citizenship. The Commission can still recognize third-country providers.
- Level 4. Full transparency and control over the software supply chain, and no third-country interference.
Map those four levels onto the 5 Pillars and you get Territorial, Operational, Technological and Legal. Financial never shows up.
Three more details matter. Level 1 is the mandatory floor for all public-sector cloud procurement, and the risk assessment only decides whether a workload climbs to Level 2, 3 or 4 [19]. The Commission’s own modeling assumes roughly 70% of workloads stay at Level 1, with 1% at Level 4 [2]. And Article 31 lets the Commission extend the same assessments to private companies in high-criticality sectors like banking, energy and health through delegated acts [2]. That clause is why the lobby’s number is so large, and why it is not entirely made up.
So the official design is this: “the vast majority of the market remains open to our partners” [4], most regulated workloads get the lowest tier, and the lowest tier is a postcode.
The litmus test, run on the law
Same test I run on every vendor. This week the vendor is the regulator. If a law is going to define sovereignty for 450 million people, it can survive the five questions I ask a startup.
01 Territorial
The question. Where do the data and compute physically reside?
The story. Level 1 makes EU residency the floor for every public cloud contract [19]. Clean, enforceable, auditable.
Under pressure. Residency is the cheapest pillar to fake and the easiest to sell. Every hyperscaler already has a region in Frankfurt. If 70% of workloads stop at Level 1 [2], the headline achievement of Europe’s flagship sovereignty law is that the data is in the right postcode. Your crown jewels are home. Who holds the keys to the house is a different question.
Verdict. Pass. Also the pillar that mattered least.
02 Operational
The question. Who runs it, who approves changes, who takes the 3 a.m. page?
The story. Level 2 brings operating, personnel and certification conditions [2]. And the market is moving ahead of the law: on Saturday, 24 October, AWS will cut its European Sovereign Cloud off the AWS global network backbone for several hours, run by a team made up entirely of EU residents, to prove it can operate alone [7]. Credit where earned. That is a real test, and I want to see the results.
Under pressure. CISPE says it is unclear whether CADA audits companies or services, and nothing requires the audit results to be published [5]. Any member state can designate a provider sovereign, but only the state hosting its European headquarters can enforce it [5]. We have seen this movie. EUCS never got adopted, in part because member states’ positions on sovereignty proved irreconcilable [9]. CADA hands the same argument to 27 auditors and calls it harmonization. And AWS’s test, as good as it is, covers the operational layer, not ownership or the full legal criteria [8].
Verdict. Partial. The criteria are real. The enforcement is a group chat.
03 Technological
The question. Can you audit it, fork it, self-host it?
The story. This is the best writing in the Act. Level 2 requires a full software bill of materials, controls on third-country software, source-code audits and migration arrangements. Level 4 requires the provider to show effective control over the design, development, maintenance and evolution of its software [2]. Add an open-source-first principle that Jones Day reads as a structural challenge to proprietary business models [16], even if Article 41 only encourages it [19].
Under pressure. Read who has to pass. The provider. Not you. A Level 4 provider proves it controls its stack. Nothing in the four levels proves that you, the customer, can take your workloads, your code and your logic and run them anywhere else. Sovereign from Washington, still captive to Paris. And CISPE has spotted a door in the annexes: a European aggregator holding the contract can wrap a foreign-controlled subcontractor’s services into a recognized Level 2, 3 or 4 offering [5]. Sovereignty laundering, now with a certificate.
Verdict. Partial. The strongest text in the Act, aimed at the wrong owner.
04 Legal
The question. Which court can compel whoever holds your data, your keys or your model?
The story. Levels 3 and 4 are serious. EU ownership and control, no third-country interference [4]. Even CISPE, which agrees with almost nothing, calls the Level 3 definition “robust” [5]. Others openly question whether a US hyperscaler could pass a Level 3 audit at all with the CLOUD Act in force [10].
Under pressure. On 10 June 2025, Anton Carniaux, Microsoft France’s director of public and legal affairs, told a French Senate inquiry under oath that he could not guarantee French citizens’ data would never reach US authorities without French consent [11][20]. That candor deserves credit, not a penalty. It also proves Levels 1 and 2 do not touch the Legal pillar. A US-parented provider can clear both, and CISPE says almost any vendor can [5]. Europe’s own champions are not immune either: an Ontario court ordered OVHcloud to hand over subscriber data stored in France, the UK and Australia [12]. Jurisdiction follows the corporate tree, not the rack. And Level 3 lets the Commission recognize third-country providers anyway [4], which is a sentence that should keep CISPE up at night.
Verdict. Pass at Levels 3 and 4. Fail at 1 and 2, where most workloads live.
05 Financial
The question. Can you leave? On your timeline, at a survivable cost, without a meter you don’t own setting your gross margin three years out?
The story. I read the four levels three times. Residency, operations, supply chain, ownership. The word migration does show up. Level 2 wants the provider to keep a migration plan in case its own third-country suppliers fail it or get restricted [19]. The provider gets an exit plan. You get a deadline: once a risk assessment says move, a public body has at most 12 months to do it [19]. No exit price. No lock-in test. No cap on renewal increases. No requirement that a certified service publish what leaving costs.
Brussels will say that is the Data Act’s job. Fair, up to a point. From 12 January 2027, switching charges, egress included, go to zero [21]. Credit where earned. But functional equivalence only binds infrastructure. For PaaS and SaaS, the provider owes you open interfaces, not a working replacement, and it is not required to build anything new [21]. That is exactly where ECIPE parks the €79 billion: APIs, databases, identity [2]. As I wrote in the Eclipse edition, killing the exit fee tells you the door is unlocked. It says nothing about the rent. CADA’s own explanatory memorandum calls the Data Act “an enabler” [19]. It enables you to open the door. It does not carry the furniture to your new home.
Under pressure. Europe already ran the experiment. Broadcom bought VMware and scrapped perpetual licenses, and CISPE members reported price increases of 800% to 1,500% to its cloud competition watchdog [15]. In January 2026 Broadcom announced it was ending the VMware cloud provider program in Europe, and CISPE now puts the cumulative increase above 1,000% [13]. Nothing in CADA’s four levels would have stopped any of it, because a sovereign landlord can still raise the rent.
And the Commission knows where the money is. In June, its own Digital Markets Act preliminary view on AWS and Azure pointed to lock-in effects and high switching costs [22]. One part of the Commission has diagnosed the condition. Another wrote a sovereignty law without it.
The lobby’s own study makes the point from the other side: higher tiers concentrate qualifying supply in a handful of larger EU markets, so smaller member states may swap dependence on Seattle for dependence on Paris [2]. A captive customer is a captive customer, whatever passport the landlord carries.
Verdict. Fail. The pillar that rules them all, never written down.
Everyone at the table, graded
One pass, one split down the middle, two partials, one fail. That is the law. Now the people fighting over it. I’m grading the dependency, not the company.
CCIA and the hyperscalers. Their study argues the Commission left out application re-architecting and code rewriting, which ECIPE calls the single largest cost driver [2]. Correct. Read that twice. The single largest cost of leaving a hyperscaler is that your software was built to never leave. The lobby’s prescription is to replace corporate-origin and staff-nationality rules with risk-based technical safeguards [1]. Translation: keep the meter, add a lock to the door, and let us hold the key. I would take the €115 billion more seriously if the same study carried a line for what staying costs over the same decade. It does not. The baseline it measures against is today’s prices, forever [2].
CISPE. Right about Levels 1 and 2, right about the aggregator loophole, right that CADA does not even oblige buyers to assess whether a European option exists [5]. Also the group running Europe’s best Financial-pillar case, the Broadcom complaint [13]. So why is its CADA ask reserved procurement shares for European providers handling sensitive data [6], and not an exit clause for customers? Swapping a US landlord for a European one is a change of nationality, not a change of terms. And a small irony for the file: CISPE counts Microsoft and Amazon as associate members, and Broadcom calls it an organisation funded by hyperscalers [14]. Everybody in this fight is somebody’s proxy.
The member states. Twenty-seven designators, enforcement parked at the headquarters address [5], and a track record of stalling the last attempt [9]. Omdia’s new report finds that “clear guidance on AI and cloud sovereignty requirements is largely absent” across governments [18]. CADA was supposed to fix that. It gave them a vocabulary and kept the argument.
The buyers. You are the ones who will tick Level 1, file the risk assessment and call it sovereignty. CISPE already worries the assessments become a rubber stamp [5]. Don’t let it be yours. A Level 1 certificate with no exit number behind it is the ostrich posture, and it’s the only unacceptable one.
The executive TCO
Three line items, and only one of them is on the invoice.
- The sovereignty premium. ECIPE prices compliant services at 10% to 40% above today’s cloud, anchored in BCG’s 10% to 30% range and the French Cour des comptes’ 25% to 40% uplift for SecNumCloud [2]. Real money, and it is the number both sides keep quoting.
- The renewal shock. VMware customers in Europe reported 800% to 1,500% [15]. Put that next to the premium. A 30% sovereignty markup is a rounding error on a 1,000% renewal you could not walk away from.
- The exit. €79 billion by the lobby’s own math [2]. That liability exists today, on today’s architectures, whether CADA passes or not. CADA does not create it. CADA just makes someone finally read it out loud.
Exit cost is the only honest measure. Everything else is marketing with a flag on it.
Monday
- Steal the lobby’s method. Take ECIPE’s migration categories (APIs, databases, identity, security tooling) and price your own exit against them. Same spreadsheet, your name on it.
- Stop treating Level 1 as a goal. It is the floor. If your risk assessment ends at residency, it is not a risk assessment. It is a map.
- Don’t confuse a free exit with a fair meter. Bank the Data Act’s zero switching fees in January. Then price the rewrite, because nobody is waiving that one.
- Ask every “sovereign” provider, European ones included, for three things in writing: a published exit price, an open export of your workloads and logic, and a cap on renewal increases.
- Check the contract chain, not the logo. If your sovereign provider resells someone else’s service underneath, find out whose, and under which jurisdiction.
- Plan your next renewal as if it is your Broadcom moment. For a lot of you, it will be.
The close: CADA needs a fifth level
Brussels built a passport control. Four booths, each stricter than the last, all checking the same thing: where the vendor comes from and who owns it. Useful. Overdue. Incomplete.
Sovereignty is not a passport. It is an exit visa. The question that decides every other pillar is the one CADA never asks: can you leave, and what does it cost?
Parliament has its rapporteurs and no committee vote date yet, and the stated aim is to finish trilogues by the end of 2027 [23]. Plenty of time for one more level. So here is my amendment, free to any MEP who wants it. Add a fifth level, and make it apply to every tier, Level 1 through Level 4, European and foreign alike:
- Published exit price. Every certified service states, audited, what it costs a customer to leave.
- Logic that travels. Workloads, data, and the logic built on top export in an open format another provider can run, not just read.
- No ransom renewals. A cap on price increases for the life of the certification.
Call it Level 5: Exit. It costs Brussels nothing, it hurts every landlord equally, and the lobby has already done the math on why it matters.
When I wrote about Broadcom, I called it the arsonist now selling smoke detectors [17]. This week the landlords’ trade association sent Europe the bill for using the fire exits. Brussels should frame it, hang it in the Berlaymont, and write the law that makes sure nobody ever has to pay it twice.
Own the core. Stay movable at the edges. Until someone writes Level 5, you’re not sovereign. You’re a tenant with a very good passport.
Amit
Amit Eyal Govrin is lead analyst for sovereign AI at theCUBE Research and CEO of Agentcy Labs, which designs and builds sovereign AI platforms for enterprises and governments. His research for theCUBE Research is conducted under theCUBE Research’s editorial standards and is not sponsored or directed by Agentcy Labs. Agentcy Labs may hold commercial relationships with vendors covered in this research.
References
[1] CCIA Europe, “EU Cloud Sovereignty Carries Hidden €115 Billion Price Tag, Six Times the Commission’s Estimate, Study Finds,” Oct 13, 2026. Link
[2] Matthias Bauer, “The Real-World Economic Impact of the Cloud and AI Development Act (CADA),” ECIPE Occasional Paper 08/2026, Oct 2026 (funded by CCIA Europe). Link
[3] Carly Page, “US tech giants warn Europe that ditching US tech giants could cost €115B,” The Register, Oct 14, 2026. Link
[4] European Commission, “Cloud and AI Development Act,” updated Jun 3, 2026. Link
[5] CISPE, “Europe Takes a Tentative Step Towards Strategic Autonomy,” Jun 4, 2026. Link
[6] The Register, “Europe’s cloud minnows tell Brussels to stop big tech ‘sovereignty-washing’,” Mar 18, 2026. Link
[7] AWS Security Blog, “AWS European Sovereign Cloud: Demonstrating an independent operation,” Sep 28, 2026. Link
[8] Cloud Computing News, “AWS to disconnect European Sovereign Cloud from global network in independence test,” Sep 29, 2026. Link
[9] IAPP, “Europe’s Cloud and AI Development Act: Grand ambition, fragile foundations,” Jun 2026. Link
[10] FleishmanHillard EU, “Beyond the headlines: three key questions raised by CADA,” Jun 17, 2026. Link
[11] The Register, “Microsoft admits it ‘cannot guarantee’ data sovereignty,” Jul 25, 2025. Link
[12] Raconteur, “EU Cloud and AI Development Act: what sovereign cloud means in law,” Jun 2026. Link
[13] heise, “European cloud providers: ‘Broadcom is delivering the coup de grâce’,” Mar 20, 2026. Link
[14] Reuters via The Star, “Five cloud business groups urge EU interim measures against Broadcom,” Jul 15, 2026. Link
[15] Computing, “European customers rail against Broadcom’s 1,500% VMware price hike,” 2025. Link ; Network World, “VMware customers in Europe face up to 1,500% price increases under Broadcom ownership,” 2025. Link
[16] Jones Day, “European Commission’s Proposed Cloud Sovereignty Framework Creates New Compliance Tiers for Software Providers,” Jun 2026. Link
[17] Govrin, “The Arsonist Now Sells Smoke Detectors,” theCUBE Research, Sep 7, 2026. Link ; Govrin, “Eclipse Built the Church. Someone Still Has to Write the Commandments.,” theCUBE Research, Oct 1, 2026. Link
[18] Light Reading / Omdia, “AI and cloud sovereignty policy discussions moving beyond concerns about data residency,” Oct 13, 2026. Link
[19] European Commission, Proposal for a Regulation on the Cloud and AI Development Act, COM(2026) 502 final, Jun 3, 2026 (Council doc ST 10104/26). Link
[20] Sénat, commission d’enquête sur la commande publique, hearing of Anton Carniaux and Pierre Lagarde (Microsoft France), Jun 10, 2025. Link
[21] Regulation (EU) 2023/2854 (Data Act), Articles 29 and 30. Link
[22] European Commission, “Commission reaches preliminary position that Amazon’s and Microsoft’s market-leading cloud services should be designated,” Jun 25, 2026. Link
[23] European Parliament Legislative Observatory, procedure 2026/0138(COD); Agence Europe, “Reinier van Lanschot appointed rapporteur on Cloud and AI Development Act,” 2026. Link ; Link
