Enterprise AI
€115 billion to leave. At least €115 billion to stay.
€115 billion to leave. At least €115 billion to stay.
Dr. Anoj Winston Gladius
·
12
Min. Lesezeit
aufsatz
Image: AI generated with neuland.ai HUB
Illustrative. Figure from Proton as reported by Cybernews (note 4). Original illustration by neuland.ai.
On 14 October 2026, CCIA Europe - a lobby group whose members include Amazon, Google and Meta - published a study warning European governments that the Commission's proposed Cloud and AI Development Act could cost Europe €115 billion over ten years. That is more than six times the Commission's own upper estimate of €18 billion. The figure assumes that sovereignty requirements are extended to a quarter of private - sector cloud workloads in banking, healthcare, energy and transport - a scenario the Commission has not proposed - and by the study's own breakdown, about 69 percent of the cost is migrating to new providers and rewriting software. Two days later, Proton pointed out that European businesses and governments already send well over €11.5 billion a year to American cloud giants. That is €115 billion a decade. Read together, these are not two unrelated numbers. Europe has been told that leaving would cost €115 billion by companies that receive at least €115 billion a decade for Europe staying - some of which sell "sovereign cloud" products to the same customers in the same quarter. The message to European governments amounts to this: trust American software again, it is cheaper. In October 2026, after the year European enterprises have just had, that is a joke. The only question is whether European boards will laugh at it or pay for it.
This is the thirtieth piece in a series I have been writing for neuland.ai. Each one has pushed the same underlying argument forward: the value, the risk and the moat in enterprise AI are not in the model. They are in the layer above and around it.¹ The previous piece followed the money behind the frontier laboratories. This one follows the money behind the argument that Europe cannot afford to stop depending on them.
The bill for leaving is the best argument for leaving.
What the study actually says
The Commission proposed the Cloud and AI Development Act, known as CADA, on 3 June 2026 as part of its Tech Sovereignty Package. It sets out four assurance levels for cloud services; public bodies would choose a level for each service according to the risk involved, and the highest levels would effectively be out of reach for providers subject to foreign law. It adds an "open source first" principle to public procurement, aims to triple European data - centre capacity within five to seven years, and lets the Commission extend sovereignty risk assessments by delegated act to private companies in sectors such as banking, energy, telecommunications and healthcare.² Henna Virkkunen, the Commission's executive vice - president for tech sovereignty, put the purpose in one line: "we want to make sure that nobody has a so - called kill switch possibility there."³
The study commissioned by CCIA Europe puts the cost of that ambition at €115 billion over ten years, within a range of €35 billion to €233 billion: about €33 billion for the public sector and up to €80 billion for private companies. Per worker, Luxembourg comes out highest, followed by Denmark, Austria, Finland and Ireland - the last of which hosts the European headquarters of several of the companies that funded the study. CCIA's recommendations follow from the numbers: limit sovereignty requirements to sensitive workloads, and replace requirements based on a provider's origin with risk - based technical safeguards.⁴
Figure 1. The Commission's estimate, the lobby - funded estimate and a decade of dependence. Original chart by neuland.ai from the sources in note 4.
Read the bill
Three things stand out once you read past the headline.
First, the big number rests on a scenario nobody has put forward. The Commission's own upper estimate is €18 billion. The study reaches six times that by assuming sovereignty rules for a quarter of private - sector workloads in essential industries, which the proposal does not contain.
Second, and more interesting: by the study's own account, about 69 percent of the cost is moving to new providers and rewriting software. That is not the cost of sovereignty. It is the cost of getting out - the price of lock - in, presented as the price of independence. If leaving an infrastructure costs that much, the obvious conclusion is not to stay. It is to stop going deeper.
Third, around 30 percent is higher ongoing cloud prices. That part is real, and an earlier piece in this series accepted it: European compute costs more, and buyers will not pay much of a premium for it. The answer there was efficiency rather than surrender.⁵ It still is.
Figure 2. What the €115bn is made of. Original chart by neuland.ai from the reporting in note 4.
The same companies sell sovereignty
Here is the part that turns a policy dispute into a joke. Amazon and Google, both CCIA members, have spent the past two years selling European customers sovereignty. AWS markets a European Sovereign Cloud whose data is hosted and stored solely in the region and kept separate from other AWS regions; Google markets a range of sovereign solutions; Microsoft, which also sells into the same market, offers its own Sovereign Cloud.⁶
So sovereignty is a premium product when it carries a hyperscaler's name, and a €115 - billion burden when the Commission asks for the real thing. The difference between the two is exactly what CADA's assurance levels are designed to test. A provider headquartered in the United States can run European data centres and satisfy the lowest level. The next level asks whether a foreign government can still compel the provider to hand over data - and under the US CLOUD Act it can, wherever the servers are.6 An earlier piece in this series made the same point about location: it is not jurisdiction.⁷
Figure 3. How the argument against Europe's cloud sovereignty rules is built. Original flowchart by neuland.ai from the reporting in notes 4 and 6.
"Risk - based, not origin - based" - 2026 says otherwise
CCIA's central request sounds reasonable: judge cloud services by technical risk, not by where the provider comes from. So test it against the year European enterprises have just had.
On 12 June, a United States export - control directive suspended a frontier model for every customer in the world, Europeans included, until access was restored at the start of July.⁷ Origin decided that. In September, a frontier laboratory pulled its next model shortly before launch; in October, Meta closed its new frontier model and began selling its best versions to businesses. Vendors decided those. And as the previous piece showed, the frontier is now financed by more than three trillion dollars of commitments on American balance sheets.⁷
Encryption can protect a disk. Data residency can keep bytes in Frankfurt. Neither can overrule an export directive, a parent company's legal obligations or a vendor's change of strategy. In 2026, origin was not a crude proxy for risk. It was the risk.
Figure 4. 2026 events decided by who owns what. Original timeline by neuland.ai; sources in notes 2, 3 and 7.
Why "trust us again" is a joke
Trust is not restored by a study. It is earned by behaviour, and the behaviour is on the record: a model switched off by government directive; capacity rationed even for one of the largest companies in the world; metering moving from tokens to compute time; open weights closed; and now a campaign telling Europe that independence is unaffordable, from companies selling it sovereign - branded versions of dependence.
It is rather like a landlord warning tenants that moving out will cost them a fortune, while offering them a "sovereign" flat in the same building. The warning may even be accurate. It is still not advice.
What this means for European enterprises
CADA is a proposal, not law; it still has to pass through negotiation between the Parliament and member states, and its reach into private companies depends on later delegated acts.² Waiting for Brussels to decide is the worst available strategy, because the one useful truth in the study is that the cost of leaving grows every year you stay.
The cheapest migration is the one your architecture never needs. That means building portability now rather than paying for it later: a platform that runs on whichever infrastructure you choose, models whose weights you can hold, and a knowledge layer that belongs to you rather than to the service you happen to be using.
And it means looking one layer up. CADA's assurance levels are about cloud infrastructure. But moving your servers to a European provider achieves very little if every AI call still goes to an American API through a European storefront - the pattern the previous piece described. The next lock - in is not being built in the data centre. It is being built in the AI layer, right now, one wrapper at a time.
Where neuland.ai stands on this
The neuland.ai HUB is built so that leaving is cheap. It is cloud - agnostic: the same platform runs on premises, in a European sovereign cloud, in a hyperscaler region or fully air - gapped, so changing infrastructure is a redeployment rather than a rewrite. Most work runs on open - weight models hosted in house - Mistral, Nemotron, GLM, Qwen and DeepSeek - with proprietary models such as Claude and GPT used only where the customer's policy allows. The knowledge layer, the permissions and the record of every retrieval and decision belong to the customer and stay with the customer. It is, in other words, the kind of platform CADA's open - source - first principle and its assurance levels assume should exist.⁸
This is also the answer to the question European boards are now asking: can we afford sovereignty? Honestly, what you cannot afford is the lock - in that makes it expensive. Design the exit before you need it, and sovereignty stops being a migration project and becomes a configuration choice.
Personal take
I want to be careful with the framing here. CCIA is entitled to lobby, and American cloud providers have built excellent products that a great many European organisations rely on. Migration costs are real, and the Commission's own estimate may well turn out to be too low. We route to American models ourselves when they are the best tool and the customer's policy allows it.
What I am pushing back against is the framing that dependence is the free option and independence the expensive one. Dependence has a bill too. It is simply paid every year, in instalments, to the people now warning Europe about the cost of stopping.
The regulatory backdrop is moving in the same direction. Alongside CADA, the EU AI Act has applied broadly since 2 August 2026, and the Digital Omnibus has moved the high - risk Annex III obligations to 2 December 2027 and Annex I obligations to 2 August 2028.⁹ Both regimes ask the same thing of European enterprises: be able to show who controls your systems. That is much easier when the answer is you.
We at neuland.ai would rather help European enterprises pay once to own their stack than pay every year to rent their dependence.
Series articles available at https://neuland.ai/en/resources/insights.
European Commission, proposal for a regulation on the Cloud and AI Development Act, COM(2026) 502, 3 June 2026, part of the Tech Sovereignty Package; see analyses by Jones Day (June 2026) and the Cloud Security Alliance (June 2026) on the four assurance levels, the open - source - first procurement principle, delegated acts extending sovereignty risk assessments to NIS2 - regulated sectors, and the aim to triple EU data - centre capacity within five to seven years. The proposal requires agreement by the European Parliament and the Council.
Henna Virkkunen, Executive Vice - President of the European Commission, as quoted by Lawfare, "The EU Cloud and AI Development Act", June 2026.
Study conducted by ECIPE and commissioned by CCIA Europe, published 14 October 2026, as reported by The Register (14 October 2026), IT Pro (15 October 2026), ITdaily and It's FOSS (15 October 2026): €115 billion over ten years within a range of €35 billion to €233 billion; €33.3 billion for the public sector and up to €80 billion for private companies; per - worker costs highest in Luxembourg (€1,711), Denmark (€905), Austria (€900), Finland (€864) and Ireland (€856); composition of roughly 69 percent migration and software rewriting, 30 percent higher ongoing cloud prices and 2 percent postponed projects; assumption that sovereignty rules extend to 25 percent of private - sector cloud workloads; European Commission upper estimate of €18 billion. On Proton's figure of well in excess of €11.5 billion a year sent to US cloud providers, see Jurgita Misevičiūtė, head of public policy at Proton, as quoted by Cybernews, 16 October 2026.
See the earlier piece in this series on the sovereign compute premium.
IT Pro, 15 October 2026, on AWS European Sovereign Cloud, Microsoft's Sovereign Cloud and Google's sovereign solutions. On CADA's assurance levels, see Digital Samba (June 2026), noting that a US - headquartered provider operating EU - located servers can satisfy Level 1 while leaving Level 2 unaddressed, and the Cloud Security Alliance (June 2026) on Level 2's requirement to show that foreign compulsion does not apply or has been mitigated. 18 U.S.C. § 2713, added by the CLOUD Act (2018), requires providers to disclose data within their possession, custody or control regardless of where it is stored.
See earlier pieces in this series on the commoditisation of sovereignty of location; on flexibility as an architectural property, covering the suspension of Claude Fable 5 and Claude Mythos 5 on 12 June 2026 following a US Department of Commerce export - control directive and the restoration of access on 1 July 2026; on where an agent's limits actually live, covering the withdrawal of GPT - 6.1 Astra; on the compute constraint, covering Google's limits on Meta's access to Gemini; and the previous piece on the AI capital web and Meta's Muse Wonder.
neuland.ai HUB: cloud - agnostic deployment of the same platform on premises, in a European sovereign cloud, in a hyperscaler region or air - gapped; per - task model routing under customer - set policy across self - hosted open - weight and proprietary models; customer - owned knowledge layer, permissions and append - only audit. neuland.ai AG retains responsibility for content quality and clean delivery of results across all customer engagements.
Regulation (EU) 2024/1689 (AI Act), broadly applicable from 2 August 2026. Council of the EU and European Parliament provisional political agreement on the Digital Omnibus on AI, 7 May 2026: Annex III high - risk obligations postponed to 2 December 2027; Annex I obligations postponed to 2 August 2028.
Illustrative. Figure from Proton as reported by Cybernews (note 4). Original illustration by neuland.ai.
On 14 October 2026, CCIA Europe - a lobby group whose members include Amazon, Google and Meta - published a study warning European governments that the Commission's proposed Cloud and AI Development Act could cost Europe €115 billion over ten years. That is more than six times the Commission's own upper estimate of €18 billion. The figure assumes that sovereignty requirements are extended to a quarter of private - sector cloud workloads in banking, healthcare, energy and transport - a scenario the Commission has not proposed - and by the study's own breakdown, about 69 percent of the cost is migrating to new providers and rewriting software. Two days later, Proton pointed out that European businesses and governments already send well over €11.5 billion a year to American cloud giants. That is €115 billion a decade. Read together, these are not two unrelated numbers. Europe has been told that leaving would cost €115 billion by companies that receive at least €115 billion a decade for Europe staying - some of which sell "sovereign cloud" products to the same customers in the same quarter. The message to European governments amounts to this: trust American software again, it is cheaper. In October 2026, after the year European enterprises have just had, that is a joke. The only question is whether European boards will laugh at it or pay for it.
This is the thirtieth piece in a series I have been writing for neuland.ai. Each one has pushed the same underlying argument forward: the value, the risk and the moat in enterprise AI are not in the model. They are in the layer above and around it.¹ The previous piece followed the money behind the frontier laboratories. This one follows the money behind the argument that Europe cannot afford to stop depending on them.
The bill for leaving is the best argument for leaving.
What the study actually says
The Commission proposed the Cloud and AI Development Act, known as CADA, on 3 June 2026 as part of its Tech Sovereignty Package. It sets out four assurance levels for cloud services; public bodies would choose a level for each service according to the risk involved, and the highest levels would effectively be out of reach for providers subject to foreign law. It adds an "open source first" principle to public procurement, aims to triple European data - centre capacity within five to seven years, and lets the Commission extend sovereignty risk assessments by delegated act to private companies in sectors such as banking, energy, telecommunications and healthcare.² Henna Virkkunen, the Commission's executive vice - president for tech sovereignty, put the purpose in one line: "we want to make sure that nobody has a so - called kill switch possibility there."³
The study commissioned by CCIA Europe puts the cost of that ambition at €115 billion over ten years, within a range of €35 billion to €233 billion: about €33 billion for the public sector and up to €80 billion for private companies. Per worker, Luxembourg comes out highest, followed by Denmark, Austria, Finland and Ireland - the last of which hosts the European headquarters of several of the companies that funded the study. CCIA's recommendations follow from the numbers: limit sovereignty requirements to sensitive workloads, and replace requirements based on a provider's origin with risk - based technical safeguards.⁴
Figure 1. The Commission's estimate, the lobby - funded estimate and a decade of dependence. Original chart by neuland.ai from the sources in note 4.
Read the bill
Three things stand out once you read past the headline.
First, the big number rests on a scenario nobody has put forward. The Commission's own upper estimate is €18 billion. The study reaches six times that by assuming sovereignty rules for a quarter of private - sector workloads in essential industries, which the proposal does not contain.
Second, and more interesting: by the study's own account, about 69 percent of the cost is moving to new providers and rewriting software. That is not the cost of sovereignty. It is the cost of getting out - the price of lock - in, presented as the price of independence. If leaving an infrastructure costs that much, the obvious conclusion is not to stay. It is to stop going deeper.
Third, around 30 percent is higher ongoing cloud prices. That part is real, and an earlier piece in this series accepted it: European compute costs more, and buyers will not pay much of a premium for it. The answer there was efficiency rather than surrender.⁵ It still is.
Figure 2. What the €115bn is made of. Original chart by neuland.ai from the reporting in note 4.
The same companies sell sovereignty
Here is the part that turns a policy dispute into a joke. Amazon and Google, both CCIA members, have spent the past two years selling European customers sovereignty. AWS markets a European Sovereign Cloud whose data is hosted and stored solely in the region and kept separate from other AWS regions; Google markets a range of sovereign solutions; Microsoft, which also sells into the same market, offers its own Sovereign Cloud.⁶
So sovereignty is a premium product when it carries a hyperscaler's name, and a €115 - billion burden when the Commission asks for the real thing. The difference between the two is exactly what CADA's assurance levels are designed to test. A provider headquartered in the United States can run European data centres and satisfy the lowest level. The next level asks whether a foreign government can still compel the provider to hand over data - and under the US CLOUD Act it can, wherever the servers are.6 An earlier piece in this series made the same point about location: it is not jurisdiction.⁷
Figure 3. How the argument against Europe's cloud sovereignty rules is built. Original flowchart by neuland.ai from the reporting in notes 4 and 6.
"Risk - based, not origin - based" - 2026 says otherwise
CCIA's central request sounds reasonable: judge cloud services by technical risk, not by where the provider comes from. So test it against the year European enterprises have just had.
On 12 June, a United States export - control directive suspended a frontier model for every customer in the world, Europeans included, until access was restored at the start of July.⁷ Origin decided that. In September, a frontier laboratory pulled its next model shortly before launch; in October, Meta closed its new frontier model and began selling its best versions to businesses. Vendors decided those. And as the previous piece showed, the frontier is now financed by more than three trillion dollars of commitments on American balance sheets.⁷
Encryption can protect a disk. Data residency can keep bytes in Frankfurt. Neither can overrule an export directive, a parent company's legal obligations or a vendor's change of strategy. In 2026, origin was not a crude proxy for risk. It was the risk.
Figure 4. 2026 events decided by who owns what. Original timeline by neuland.ai; sources in notes 2, 3 and 7.
Why "trust us again" is a joke
Trust is not restored by a study. It is earned by behaviour, and the behaviour is on the record: a model switched off by government directive; capacity rationed even for one of the largest companies in the world; metering moving from tokens to compute time; open weights closed; and now a campaign telling Europe that independence is unaffordable, from companies selling it sovereign - branded versions of dependence.
It is rather like a landlord warning tenants that moving out will cost them a fortune, while offering them a "sovereign" flat in the same building. The warning may even be accurate. It is still not advice.
What this means for European enterprises
CADA is a proposal, not law; it still has to pass through negotiation between the Parliament and member states, and its reach into private companies depends on later delegated acts.² Waiting for Brussels to decide is the worst available strategy, because the one useful truth in the study is that the cost of leaving grows every year you stay.
The cheapest migration is the one your architecture never needs. That means building portability now rather than paying for it later: a platform that runs on whichever infrastructure you choose, models whose weights you can hold, and a knowledge layer that belongs to you rather than to the service you happen to be using.
And it means looking one layer up. CADA's assurance levels are about cloud infrastructure. But moving your servers to a European provider achieves very little if every AI call still goes to an American API through a European storefront - the pattern the previous piece described. The next lock - in is not being built in the data centre. It is being built in the AI layer, right now, one wrapper at a time.
Where neuland.ai stands on this
The neuland.ai HUB is built so that leaving is cheap. It is cloud - agnostic: the same platform runs on premises, in a European sovereign cloud, in a hyperscaler region or fully air - gapped, so changing infrastructure is a redeployment rather than a rewrite. Most work runs on open - weight models hosted in house - Mistral, Nemotron, GLM, Qwen and DeepSeek - with proprietary models such as Claude and GPT used only where the customer's policy allows. The knowledge layer, the permissions and the record of every retrieval and decision belong to the customer and stay with the customer. It is, in other words, the kind of platform CADA's open - source - first principle and its assurance levels assume should exist.⁸
This is also the answer to the question European boards are now asking: can we afford sovereignty? Honestly, what you cannot afford is the lock - in that makes it expensive. Design the exit before you need it, and sovereignty stops being a migration project and becomes a configuration choice.
Personal take
I want to be careful with the framing here. CCIA is entitled to lobby, and American cloud providers have built excellent products that a great many European organisations rely on. Migration costs are real, and the Commission's own estimate may well turn out to be too low. We route to American models ourselves when they are the best tool and the customer's policy allows it.
What I am pushing back against is the framing that dependence is the free option and independence the expensive one. Dependence has a bill too. It is simply paid every year, in instalments, to the people now warning Europe about the cost of stopping.
The regulatory backdrop is moving in the same direction. Alongside CADA, the EU AI Act has applied broadly since 2 August 2026, and the Digital Omnibus has moved the high - risk Annex III obligations to 2 December 2027 and Annex I obligations to 2 August 2028.⁹ Both regimes ask the same thing of European enterprises: be able to show who controls your systems. That is much easier when the answer is you.
We at neuland.ai would rather help European enterprises pay once to own their stack than pay every year to rent their dependence.
Series articles available at https://neuland.ai/en/resources/insights.
European Commission, proposal for a regulation on the Cloud and AI Development Act, COM(2026) 502, 3 June 2026, part of the Tech Sovereignty Package; see analyses by Jones Day (June 2026) and the Cloud Security Alliance (June 2026) on the four assurance levels, the open - source - first procurement principle, delegated acts extending sovereignty risk assessments to NIS2 - regulated sectors, and the aim to triple EU data - centre capacity within five to seven years. The proposal requires agreement by the European Parliament and the Council.
Henna Virkkunen, Executive Vice - President of the European Commission, as quoted by Lawfare, "The EU Cloud and AI Development Act", June 2026.
Study conducted by ECIPE and commissioned by CCIA Europe, published 14 October 2026, as reported by The Register (14 October 2026), IT Pro (15 October 2026), ITdaily and It's FOSS (15 October 2026): €115 billion over ten years within a range of €35 billion to €233 billion; €33.3 billion for the public sector and up to €80 billion for private companies; per - worker costs highest in Luxembourg (€1,711), Denmark (€905), Austria (€900), Finland (€864) and Ireland (€856); composition of roughly 69 percent migration and software rewriting, 30 percent higher ongoing cloud prices and 2 percent postponed projects; assumption that sovereignty rules extend to 25 percent of private - sector cloud workloads; European Commission upper estimate of €18 billion. On Proton's figure of well in excess of €11.5 billion a year sent to US cloud providers, see Jurgita Misevičiūtė, head of public policy at Proton, as quoted by Cybernews, 16 October 2026.
See the earlier piece in this series on the sovereign compute premium.
IT Pro, 15 October 2026, on AWS European Sovereign Cloud, Microsoft's Sovereign Cloud and Google's sovereign solutions. On CADA's assurance levels, see Digital Samba (June 2026), noting that a US - headquartered provider operating EU - located servers can satisfy Level 1 while leaving Level 2 unaddressed, and the Cloud Security Alliance (June 2026) on Level 2's requirement to show that foreign compulsion does not apply or has been mitigated. 18 U.S.C. § 2713, added by the CLOUD Act (2018), requires providers to disclose data within their possession, custody or control regardless of where it is stored.
See earlier pieces in this series on the commoditisation of sovereignty of location; on flexibility as an architectural property, covering the suspension of Claude Fable 5 and Claude Mythos 5 on 12 June 2026 following a US Department of Commerce export - control directive and the restoration of access on 1 July 2026; on where an agent's limits actually live, covering the withdrawal of GPT - 6.1 Astra; on the compute constraint, covering Google's limits on Meta's access to Gemini; and the previous piece on the AI capital web and Meta's Muse Wonder.
neuland.ai HUB: cloud - agnostic deployment of the same platform on premises, in a European sovereign cloud, in a hyperscaler region or air - gapped; per - task model routing under customer - set policy across self - hosted open - weight and proprietary models; customer - owned knowledge layer, permissions and append - only audit. neuland.ai AG retains responsibility for content quality and clean delivery of results across all customer engagements.
Regulation (EU) 2024/1689 (AI Act), broadly applicable from 2 August 2026. Council of the EU and European Parliament provisional political agreement on the Digital Omnibus on AI, 7 May 2026: Annex III high - risk obligations postponed to 2 December 2027; Annex I obligations postponed to 2 August 2028.