Stockholm svarar på EU-förslag om molntjänster och artificiell intelligens

Finansdepartementet har remitterat Europeiska kommissionens förslag till förordning om utveckling av moln och AI KOM (2026) 502 till bland annat Stockholms stad för yttrande. Förordningen syftar till att stärka Europas kapacitet, konkurrenskraft och digitala suveränitet, med fokus på forskning, innovation, datacenterkapacitet och autonomi.Förslaget innehåller initiativ för att stärka forskning och innovation inom strategiskt viktiga områden, såsom energieffektiv digital infrastruktur, avancerad AI samt tillgång till data och beräkningsresurser.Kommissionen föreslår särskilda accelerationszoner för att underlätta etablering av datacenter. Inom zonerna ska tillståndsförfaranden förenklas och samordnas genom ett samlat grundtillstånd.Kommissionen föreslår även ett gemensamt EU-ramverk med fyra riskbaserade tillitsnivåer för molntjänster. Ett nationellt erkännande ska kunna gälla i hela EU och stödja offentliga aktörers val och upphandling av molntjänster. Vidare föreslås möjlighet till gemensamma upphandlingar av datacenter, moln- och AI-tjänster samt programvara. En europeisk molnfederation ska inrättas för att underlätta samarbete och delning av datacenter och molntjänster.Slutligen vill kommissionen främja användning och återanvändning av lösningar med öppen källkod och öppna standarder inom EU:s moln- och AI-ekosystem, särskilt i offentlig sektor. [R1 PM Europeiska kommissionens förslag till förordning om utveckling av moln och AI KOM (2026) 502.pdf] 1 (9) PM Rotel I (Dnr KS 2026/850) Europeiska kommissionens förslag till förordning om utveckling av moln och AI KOM (2026) 502 Remiss från Finansdepartementet Remisstid den 2 oktober 2026 Förslag till beslut Föredragande borgarrådet Karin Wanngård Sammanfattning av ärendet Finansdepartementet har remitterat Europeiska kommissionens förslag till förordning om utveckling av moln och AI KOM (2026) 502 till bland annat Stockholms stad för yttrande. Förordningen syftar till att stärka Europas kapacitet, konkurrenskraft och digitala suveränitet, med fokus på forskning, innovation, datacenterkapacitet och autonomi. Förslaget innehåller initiativ för att stärka forskning och innovation inom strategiskt viktiga områden, såsom energieffektiv digital infrastruktur, avancerad AI samt tillgång till data och beräkningsresurser. Kommissionen föreslår särskilda accelerationszoner för att underlätta etablering av datacenter. Inom zonerna ska tillståndsförfaranden förenklas och samordnas genom ett samlat grundtillstånd. Kommissionen föreslår även ett gemensamt EU-ramverk med fyra riskbaserade tillitsnivåer för molntjänster. Ett nationellt erkännande ska kunna gälla i hela EU och stödja offentliga aktörers val och upphandling av molntjänster. Vidare föreslås möjlighet till gemensamma upphandlingar av datacenter, moln- och AI-tjänster samt programvara. En europeisk molnfederation ska inrättas för att underlätta samarbete och delning av datacenter och molntjänster. Slutligen vill kommissionen främja användning och återanvändning av lösningar med öppen källkod och öppna standarder inom EU:s moln- och AI-ekosystem, särskilt i offentlig sektor. Borgarrådsberedningen föreslår att kommunstyrelsen beslutar följande. Remissen besvaras med Stockholms stads yttrande, bilaga 1 till promemorian. 2 (9) Beredning Ärendet har remitterats till stadsledningskontoret. Stadsledningskontoret delar målen i EU-kommissionens förslag men efterfrågar ytterligare analys, tydligare regler och flexibilitet vid genomförandet. Föredragande borgarrådets synpunkter Stockholm är en stad där digitalisering, artificiell intelligens och tillgång till säkra digitala tjänster får allt större betydelse för såväl invånare som företag och stadens verksamheter. Jag ser därför positivt på EU-kommissionens ambition att stärka Europas förutsättningar inom moln och AI. Att stärka Europas konkurrenskraft, digitala motståndskraft och förmåga att utveckla och använda ny teknik kan få betydelse även för Stockholms fortsatta digitalisering. För Stockholms stad handlar frågan samtidigt om mer än teknisk utveckling. Stadens möjligheter att använda moln- och AI-tjänster påverkar i förlängningen hur väl vi kan utveckla välfärdstjänster, använda stadens resurser effektivt och erbjuda stockholmare säkra och ändamålsenliga digitala tjänster. Gemensamma europeiska ramar kan bidra till detta, men det är viktigt att de utformas med hänsyn till olika förutsättningar och till redan genomförda investeringar och befintliga regelverk. En viktig fråga för Stockholms stad är att den digitala utvecklingen inte leder till nya former av beroende. För staden är det betydelsefullt att kunna välja mellan flera leverantörer och att kunna byta lösningar utan orimliga tekniska eller ekonomiska kostnader. Interoperabilitet, öppna standarder och möjligheten att flytta data är därför viktiga förutsättningar för en långsiktigt hållbar digitalisering. En utveckling mot fler konkurrenskraftiga europeiska aktörer skulle kunna bidra till ökad konkurrens och minskad sårbarhet, samtidigt som fördelarna måste vägas mot eventuella konsekvenser för datahantering och säkerhet. Jag ser även positivt på ambitionen att stärka forskning, innovation och användningen av AI. Kommuner och regioner bör ges möjlighet att vara en del av detta arbete, eftersom det är på lokal och regional nivå som många digitala lösningar i slutändan möter invånarna. Stockholm kan bidra som testbädd och genom samverkan, men det är samtidigt viktigt att de satsningar som görs på europeisk och nationell nivå ger kommunerna realistiska möjligheter att delta och att nödvändiga investeringar och anpassningar kan genomföras. När det gäller den föreslagna utbyggnaden av datacenter finns det också skäl att väga möjligheterna mot de konsekvenser som kan följa. En ökad kapacitet kan bidra till Europas och Stockholms digitala utveckling, men större etableringar kan samtidigt påverka elförsörjning, energipriser och förutsättningarna för samhällets fortsatta elektrifiering. För Stockholm är det därför viktigt att datacenteretableringar ses som en del av ett större energisystem. Spillvärme bör, där det är tekniskt och ekonomiskt lämpligt, kunna tas tillvara och integreras i fjärrvärmesystemet. 3 (9) Det finns samtidigt behov av ytterligare tydlighet kring de föreslagna accelerationszonerna och hur dessa ska förhålla sig till svensk lagstiftning och kommunernas ansvar. Effektivare tillståndsprocesser kan vara positivt, men bör inte ske på bekostnad av det kommunala självstyret, en väl fungerande samhällsplanering eller nödvändiga miljö- och kvalitetskrav. Innan förslagets konsekvenser går att bedöma fullt ut behöver därför flera delar förtydligas. Sammantaget delar jag EU-kommissionens ambition att stärka Europas kapacitet, konkurrenskraft och digitala suveränitet inom moln och AI. Samtidigt behöver genomförandet ske med hänsyn till lokala och nationella förutsättningar och utan att skapa onödig administrativ komplexitet. För Stockholms stad är det särskilt viktigt att utvecklingen stärker säkerhet, konkurrens och innovationsförmåga, samtidigt som kommunen ges tillräckligt handlingsutrymme att utforma lösningar utifrån stockholmarnas behov och stadens förutsättningar. I övrigt hänvisar jag till Stockholms stads yttrande. Stockholm den 16 september 2026 Karin Wanngård Bilagor 1. Stockholms stads yttrande, dnr KS 2026/850- 2. Remiss - Europeiska kommissionens förslag till förordning om utveckling av moln och AI KOM (2026) 502, dnr KS 2026/850-1.1 3. Bilagor (annexes) till förslaget till förordning om utveckling av moln och AI KOM (2026) 502, dnr KS 2026/850-1.2 4. Bilaga - Konsekvensbedömningsrapport, del 1 av 2, dnr KS 2026/850-1.3 5. Bilaga - Konsekvensbedömningsrapport, del 2 av 2, dnr KS 2026/850-1.4 6. Bilaga - Sammanfattning av konsekvensbedömningsrapport, dnr KS 2026/850-1.5 Borgarrådsberedningen tillstyrker föredragande borgarrådets förslag. 4 (9) Ärendet Finansdepartementet har remitterat Europeiska kommissionens förslag till förordning om utveckling av moln och AI KOM (2026) 502 till bland annat Stockholms stad för yttrande. Förordningen syftar till att stärka Europas kapacitet, konkurrenskraft och digitala suveränitet, med fokus på forskning, innovation, datacenterkapacitet och autonomi. Forskning, utveckling och innovation Förslaget innehåller initiativ för att stärka forskning och innovation inom strategiskt viktiga områden, såsom energieffektiv digital infrastruktur, avancerad AI samt tillgång till data och beräkningsresurser. Satsningarna ska genomföras i samarbete mellan kommissionen och medlemsstaterna och kan bland annat medfinansieras via EU-program. Medlemsländerna föreslås även inrätta nationella AI-center, i första hand inom befintliga europeiska digitala innovationshubbar, för att främja utveckling, testning och användning av AI samt erfarenhetsutbyte. Därutöver uppmanas medlemsländerna att ta fram nationella strategier för moln- och AI-användning. Datacenterkapacitet Kommissionen föreslår särskilda accelerationszoner för att underlätta etablering av datacenter. Inom zonerna ska tillståndsförfaranden förenklas och samordnas genom ett samlat grundtillstånd. Vid bedömningen ska bland annat tillgång till el och nätkapacitet, hållbarhet, återvinning av spillvärme och miljöpåverkan beaktas. Medlemsländerna ska även utse kontaktpunkter för vägledning och stöd under etableringsprocessen. Digital autonomi Kommissionen föreslår ett gemensamt EU-ramverk med fyra riskbaserade tillitsnivåer för molntjänster. Bedömningen ska omfatta bland annat säkerhet, suveränitet, kontroll, leverantörens etablering och datahantering. Ett nationellt erkännande ska kunna gälla i hela EU och stödja offentliga aktörers val och upphandling av molntjänster. Förordningen innehåller även EU-regler för offentlig upphandling av molntjänster och AI-system, där andra kriterier än pris kan beaktas, exempelvis bidrag till europeiska digitala leveranskedjor. Medlemsländerna ska särskilt riskbedöma verksamheter som kan påverka samhällssäkerheten, exempelvis försvar, rättsväsende och kritisk infrastruktur. Vidare föreslås möjlighet till gemensamma upphandling av datacenter, moln- och AI-tjänster samt programvara. En europeisk molnfederation ska inrättas för att underlätta samarbete och delning av datacenter och molntjänster. Slutligen vill kommissionen främja användning och återanvändning av lösningar med öppen källkod och öppna standarder inom EU:s moln- och AI-ekosystem, särskilt i offentlig sektor. En EU-katalog över sådana lösningar och ett frivilligt europeiskt nätverk för öppen källkod föreslås för att främja samarbete, erfarenhetsutbyte och återanvändning. 5 (9) Remissammanställning Ärendet har remitterats till stadsledningskontoret. Stadsledningskontoret Stadsledningskontorets tjänsteutlåtande daterat den 16 juli 2026 har i huvudsak följande lydelse. Sammanfattning av synpunkter Stadsledningskontoret delar målen i EU-kommissionens förslag men efterfrågar ytterligare analys, tydligare regler och flexibilitet vid genomförandet. Hänsyn behöver tas till att den digitala mognaden ser olika ut i Europa, samt befintliga investeringar och nuvarande regelverk. En ökad datacenterkapacitet är positivt, men det centrala är att den leder till fler tjänsteleverantörer, det minskar risker för inlåsningseffekter och ökar konkurrensen. Stadslednings-kontoret är också positivt till effektiva administrativa processer, men konstaterar att det är oklart hur accelerationszonerna för att bygga ut datacenter kommer utformas, det gör att deras konsekvenser är svåranalyserade. En kraftig utbyggnad av datacenterkapaciteten kan påverka energiinfrastrukturen, elektrifieringen och prisbilden. Därför behövs flexibla lösningar som tar hänsyn till befintliga och planerade investeringar. Spillvärme bör fortsatt integrerats i energisystemet. Stadsledningskontoret är preliminärt positivt till förslaget om tillitsnivåer för molntjänster, som kan underlätta offentliga upphandlingar. Upphandlande myndigheter bör dock själva kunna avgöra hur kvalitativa och icke-prisbaserade värden ska vägas in, utan detaljstyrning från EU-nivå. Ställningstaganden Stadsledningskontoret vill inledningsvis understryka behovet och vikten av förordningen och ställer sig positiva till dess ambition och mål. Både förutsättningar och regelverk för moln- och AI-tjänster har stor inverkan och en avgörande betydelse för hur Stockholms stad kan arbeta med digitala tjänster och lösningar. Stadsledningskontoret instämmer i kommissionens mål att stärka kapacitet, konkurrenskraft och digital suveränitet inom molntjänster och på AI-området. Detta bedöms kunna medföra positiva effekter för den fortsatta digitaliseringen inom staden. • Stadsledningskontoret betonar att staden delar målen och ambitionen från kommissionens förslag men understryker att det behövs en vidare analys och förtydliganden inom flera av åtgärderna inom förordningen. • Stadsledningskontoret understryker behovet av tydlighet i hur förordningen relaterar till befintliga EU-regler för att undvika administrativt betungande implementering. 6 (9) • Stadsledningskontoret betonar vikten av att förordningen tar höjd för att den digitala mognaden ser olika ut runt om i Europa. En del länder och städer har kommit längre än andra, det behöver därför finnas handlingsutrymme, flexibilitet och hänsyn till befintliga investeringar. • Stadsledningskontoret instämmer i behovet av ökad datacenterkapacitet, men betonar att om inte den ökade kapaciteten leder till fler tjänsteleverantörer som levererar kvalitativa konkurrenskraftiga tjänster, i förhållande till de globala aktörerna, riskerar mervärdet att utebli. • Stadsledningskontoret betonar att det är centralt att förordningen understödjer en ökad konkurrenskraft på marknaden, skapar fler valmöjligheter och främjar innovation. Valmöjligheter underlättar för staden att använda sina resurser effektivt och ställa krav. En ökning av europeiska tjänster främjar konkurrenskraften och kan öka utbudet av leverantörer och därmed minska risken för inlåsningseffekter. Forskning, utveckling och innovation Stadsledningskontoret instämmer i förslagen för forskning, utveckling och innovation. • Stadsledningskontoret betonar att det är viktigt att även kommuner och regioner har en roll i forsknings- och innovationsarbetet givet det invånarnära uppdraget. Detta för att säkerställa att tjänster som utvecklas möter behoven, kan tillämpas och implementeras. Kommuner och regioner har dessutom tillgång till flera relevanta datamängder och kan erbjuda möjligheter till test och utveckling. • Stadsledningskontoret instämmer i kommissionens förslag om att inrätta nationella AI-center och understryker behovet av att inkludera både privat och offentlig sektor för att främja ett brett införande av AI i samhället. • Stadsledningskontoret noterar att det i förordningen finns förslag om framtagande av nationella moln- och AI-strategier. Stadsledningskontoret betonar behovet av att en sådan strategi stöds av nationell finansiering för att täcka bland annat tröskelkostnader, för att kunna uppnå nationella och europeiska mål om enhetlighet i data och förutsättningar för interoperabilitet. • Stadsledningskontoret betonar att det även under nästa programperiod behöver finnas tillgång för städer till finansieringsmöjligheter från EU-nivå. Annars riskeras städers deltagande i innovation och utvecklingsprojekt att minska. Städer spelar en central roll, både som testbäddar och som inköpare av produkter och tjänster. Datacenterkapacitet I kommissionens förslag föreslås att tillståndsprocesser för datacenter ska simplifieras och särskilda accelerationszoner ska införas i medlemsländer. 7 (9) • Stadsledningskontoret noterar förslaget om att införa dessa accelerationszoner och delar bedömningen att det i grunden är positivt att införa effektiva administrativa processer som underlättar för såväl staden som näringslivet, samtidigt som krav upprätthålls och kvalitet samt rättssäkerhet säkerställs. • Stadsledningskontoret vill samtidigt framhålla att det i nuläget är oklart hur dessa zoner närmare kommer att utformas, vilket försvårar möjligheten att analysera förordningens konsekvenser. Det är rimligt att anta att förordningen kan komma att påverka såväl miljöbalken som plan- och bygglagen och det lokala elnätet, därmed även det kommunala planmonopolet och tillsynsansvaret. Det finns därför behov av ytterligare klargöranden av hur dessa ansökningsförfaranden kan komma att utformas. Vidare noteras att denna typ av förslag, att införa särskilda zoner för snabbare etableringsprocesser, återfinns i andra förordningar från EU-nivå. Det är viktigt att det finns en samstämmighet i införandet av dessa zoner, för att undvika att det är olika tillståndsprocesser som lättas i olika zoner- något som kan riskera att försvåra administration, planering och tillståndsprocesser i stort. • Stadsledningskontoret understryker behovet av en tydlig analys av hur accelerationszoner ska kunna genomföras samt vilka konsekvenser de får för svensk lagstiftning. • Stadsledningskontoret påminner om vikten av att det kommunala självstyret respekteras i framtagandet av dessa zoner. • Stadsledningskontoret noterar att en kraftig utbyggnad av datacenterkapaciteten kan få stor påverkan på energipriser och energiinfrastrukturen och därmed försvåra elektrifieringen av samhället samt övrig näringslivsetablering. Spillvärme från datacenter och annan likande verksamhet bör fortsätta att integreras i energisystemet. Detta måste beaktas i den föreslagna förordningen men även i kommissionens arbete med revideringen av energieffektiviserings- och förnybarhetsdirektiven. Kommuner och regioner behöver flexibilitet att välja kostnadseffektiva lösningar utifrån lokala förhållanden. • Stadsledningskontoret betonar att om datacenter ska etableras att det är viktigt att krav ställs på energiåtervinning via exempelvis fjärrvärme. Utöver att granska var i elnätet det finns effekt måste det granskas hur dessa etableringar är en del av ett optimerat energisystem. • Stadsledningskontoret betonar att konsekvenserna av den storskaliga etablering som kommissionen föreslår behöver utredas tydligt. Digital autonomi I sitt förslag till förordning föreslår kommissionen införandet av ett fyrgradigt klassificeringssystem för tillitsnivåer på EU-nivå utifrån säkerhet och suveränitet. 8 (9) • Stadsledningskontoret instämmer i förslaget om att införa ett klassificeringssystem. Ett unionsomfattande godkännande kan bidra till enklare processer, underlätta upphandlingar och effektivisera inköpsprocesser. • Stadsledningskontoret är preliminärt positivt till förslaget om att inrätta olika tillitsnivåer avseende säkerhet och suveränitet, samt att varje medlemsstat ska utse en eller flera behöriga myndigheter som ska ansvara för att pröva ansökningar om att få ett erkännande som tillhandahållare inom en viss tillitsnivå, samt utöva tillsyn. • Stadsledningskontoret noterar att enligt det remitterade förslaget till ny förordning ska upphandlande myndigheter använda så kallade icke- prisbaserade tilldelningskriterier för att bedöma i vilken utsträckning leverantörer bidrar till utvecklingen av ett europeiskt moln- och AI- ekosystem. Stadsledningskontoret ser positivt på att främja en sådan utveckling, men menar att det är olämpligt att i en förordning reglera att detta specifikt ska ske i utvärderings-fasen av en upphandling. Stadsledningskontoret menar att det är viktigt att Kommissionen tar hänsyn till att upphandlande myndigheter kan beakta kvalitativa värden inte bara i utvärderingsfasen utan även, inte sällan på ett bättre sätt, genom att ställa obligatoriska krav. Stadsledningskontoret menar att förslaget bör omformuleras på ett sätt som möjliggör för upphandlande myndigheter att välja vilken metod som ska användas för att ta sådana hänsyn, utifrån omständigheterna i den enskilda upphandlingen. Till exempel om det ska göras med beaktande av tilldelningskriterier, obligatoriska krav eller bäggedera. • Stadsledningskontoret understryker vikten av att beakta att inte bidra till ytterligare komplexitet i regelverket eller onödig administration för offentlig upphandling eftersom regelverket redan i dag är komplext. Hänsyn behövs tas till de pågående förenklingsprocesserna på EU-nivå samt kommissionens kommande uppdatering av upphandlingsreglerna. • Stadsledningskontoret betonar vikten av säkra och tillitsfulla system särskilt i relation till tredjeland. Risken att känsliga data kan läcka till aktörer i tredjeland hämmar användningen av digitaliseringens fulla potential. Givet att mycket av data som Stockholms stad innehar är känsliga data är det av största vikt att minimera risker med otillbörlig påverkan från ett tredjeland på leverantörer och tjänsteleverantörer. En ökad mängd europeiska tjänste- leverantörer kan vara riskminimerande för stadens användning av molntjänster framåt. • Stadsledningskontoret noterar att en av de största utmaningarna som staden har i övergången till molntjänster ligger i farhågor kring risken för leverantörsberoende. Särskilt i hänsyn till dess långsiktiga konsekvenser för kostnader, flexibilitet och säkerhet. 9 (9) • Stadsledningskontoret betonar att interoperabilitet, öppna applikationsprogrammeringsgränssnitt och möjligheten att migrera data och konfigurationer är nödvändiga förutsättningar för en hållbar användning av molntjänster inom den offentliga sektorn. • Stadsledningskontoret noterar att en brist med nuvarande utbud bland molntjänstleverantörer är avsaknad av alternativ för att undvika leverantörsberoende. Nuvarande erbjudande begränsar ofta möjligheten att migrera data och kritiska konfigurationer utan betydande tekniska eller ekonomiska hinder. För organisationer inom offentlig sektor undergräver detta långsiktig flexibilitet, kostnadskontroll och operativ motståndskraft. • Stadsledningskontoret ser ett behov av fler leverantörsneutrala lösningar som säkerställer interoperabilitet. • Stadsledningskontoret menar att åtgärder för att förbättra den offentliga förvaltningens tillgång till och användning av molntjänster bör ta hänsyn till lokala insatser som krävs för att anpassa infrastruktur och data till nya ramverk. Om sådana anpassningar förväntas måste de åtföljas av finansiering eller stödmekanismer, annars blir genomförandet ojämnt. • Stadsledningskontoret noterar även att säkerhetskrav ofta innebär tekniska anpassningar och kompetensutveckling på lokal nivå. Dessa bör stödjas på ett realistiskt sätt genom finansiering och praktisk vägledning, inte bara genom formella förväntningar på efterlevnad. --- [Stockholms stads yttrande.pdf] Stadshuset Ragnar Östbergs Plan 1 105 35 Stockholm Sida 1 (6) bvvvv Till Finansdepartementet Ert Dnr: Fi2026/01676 Europeiska kommissionens förslag till förordning om utveckling av moln och AI KOM (2026) 502 Sammanfattning Stockholms stad delar målen i EU-kommissionens förslag men efterfrågar ytterligare analys, tydligare regler och flexibilitet vid genomförandet. Hänsyn behöver tas till att den digitala mognaden ser olika ut i Europa, samt befintliga investeringar och nuvarande regelverk. En ökad datacenterkapacitet är positivt, men det centrala är att den leder till fler tjänsteleverantörer, det minskar risker för inlåsningseffekter och ökar konkurrensen. Stockholms stad är också positiv till effektiva administrativa processer, men konstaterar att det är oklart hur accelerationszonerna för att bygga ut datacenter kommer utformas, det gör att deras konsekvenser är svåranalyserade. En kraftig utbyggnad av datacenterkapaciteten kan påverka energiinfrastrukturen, elektrifieringen och prisbilden. Därför behövs flexibla lösningar som tar hänsyn till befintliga och planerade investeringar. Spillvärme bör fortsatt integrerats i energisystemet. Stockholms stad är preliminärt positivt till förslaget om tillitsnivåer för molntjänster, som kan underlätta offentliga upphandlingar. Upphandlande myndigheter bör dock själva kunna avgöra hur kvalitativa och icke-prisbaserade värden ska vägas in, utan detaljstyrning från EU-nivå. Ställningstaganden Stockholms stad vill inledningsvis understryka behovet och vikten av förordningen och ställer sig positiva till dess ambition och mål. Både förutsättningar och regelverk för moln- och AI-tjänster har stor inverkan och en avgörande betydelse för hur Stockholms stad kan arbeta med digitala tjänster och lösningar. Stockholms stad instämmer i kommissionens mål att stärka kapacitet, konkurrenskraft och digital suveränitet inom molntjänster och på AI-området. Detta bedöms kunna medföra positiva effekter för den fortsatta digitaliseringen inom staden. • Stockholms stad betonar att staden delar målen och ambitionen från kommissionens förslag men understryker att Kommunstyrelsen Yttrande Dnr KS 2026/850 2026-08-26 Kungsklippan 6 112 25 Stockholm daniel.lauridsen@stockholm.se start.stockholm Yttrande Dnr KS 2026/850 Sida 2 (6) det behövs en vidare analys och förtydliganden inom flera av åtgärderna inom förordningen. • Stockholms stad understryker behovet av tydlighet i hur förordningen relaterar till befintliga EU-regler för att undvika administrativt betungande implementering. • Stockholms stad betonar vikten av att förordningen tar höjd för att den digitala mognaden ser olika ut runt om i Europa. En del länder och städer har kommit längre än andra, det behöver därför finnas handlingsutrymme, flexibilitet och hänsyn till befintliga investeringar. • Stockholms stad instämmer i behovet av ökad datacenterkapacitet, men betonar att om inte den ökade kapaciteten leder till fler tjänsteleverantörer som levererar kvalitativa konkurrenskraftiga tjänster, i förhållande till de globala aktörerna, riskerar mervärdet att utebli. • Stockholms stad betonar att det är centralt att förordningen understödjer en ökad konkurrenskraft på marknaden, skapar fler valmöjligheter och främjar innovation. Valmöjligheter underlättar för staden att använda sina resurser effektivt och ställa krav. En ökning av europeiska tjänster främjar konkurrenskraften och kan öka utbudet av leverantörer och därmed minska risken för inlåsningseffekter. Forskning, utveckling och innovation Stockholms stad instämmer i förslagen för forskning, utveckling och innovation. • Stockholms stad betonar att det är viktigt att även kommuner och regioner har en roll i forsknings- och innovationsarbetet givet det invånarnära uppdraget. Detta för att säkerställa att tjänster som utvecklas möter behoven, kan tillämpas och implementeras. Kommuner och regioner har dessutom tillgång till flera relevanta datamängder och kan erbjuda möjligheter till test och utveckling. • Stockholms stad instämmer i kommissionens förslag om att inrätta nationella AI-center och understryker behovet av att inkludera både privat och offentlig sektor för att främja ett brett införande av AI i samhället. • Stockholms stad noterar att det i förordningen finns förslag om framtagande av nationella moln- och AI-strategier. Stockholms stad betonar behovet av att en sådan strategi stöds av nationell finansiering för att täcka bland annat tröskelkostnader, för att kunna uppnå nationella och Yttrande Dnr KS 2026/850 Sida 3 (6) europeiska mål om enhetlighet i data och förutsättningar för interoperabilitet. • Stockholms stad betonar att det även under nästa programperiod behöver finnas tillgång för städer till finansieringsmöjligheter från EU-nivå. Annars riskeras städers deltagande i innovation och utvecklingsprojekt att minska. Städer spelar en central roll, både som testbäddar och som inköpare av produkter och tjänster. Datacenterkapacitet I kommissionens förslag föreslås att tillståndsprocesser för datacenter ska simplifieras och särskilda accelerationszoner ska införas i medlemsländer. • Stockholms stad noterar förslaget om att införa dessa accelerationszoner och delar bedömningen att det i grunden är positivt att införa effektiva administrativa processer som underlättar för såväl staden som näringslivet, samtidigt som krav upprätthålls och kvalitet samt rättssäkerhet säkerställs. • Stockholms stad vill samtidigt framhålla att det i nuläget är oklart hur dessa zoner närmare kommer att utformas, vilket försvårar möjligheten att analysera förordningens konsekvenser. Det är rimligt att anta att förordningen kan komma att påverka såväl miljöbalken som plan- och bygglagen och det lokala elnätet, därmed även det kommunala planmonopolet och tillsynsansvaret. Det finns därför behov av ytterligare klargöranden av hur dessa ansökningsförfaranden kan komma att utformas. Vidare noteras att denna typ av förslag, att införa särskilda zoner för snabbare etableringsprocesser, återfinns i andra förordningar från EU-nivå. Det är viktigt att det finns en samstämmighet i införandet av dessa zoner, för att undvika att det är olika tillståndsprocesser som lättas i olika zoner- något som kan riskera att försvåra administration, planering och tillståndsprocesser i stort. • Stockholms stad understryker behovet av en tydlig analys av hur accelerationszoner ska kunna genomföras samt vilka konsekvenser de får för svensk lagstiftning. • Stockholms stad påminner om vikten av att det kommunala självstyret respekteras i framtagandet av dessa zoner. • Stockholms stad noterar att en kraftig utbyggnad av datacenterkapaciteten kan få stor påverkan på energipriser och energiinfrastrukturen och därmed försvåra elektrifieringen av samhället samt övrig näringslivsetablering. Spillvärme från datacenter och annan Yttrande Dnr KS 2026/850 Sida 4 (6) likande verksamhet bör fortsätta att integreras i energisystemet. Detta måste beaktas i den föreslagna förordningen men även i kommissionens arbete med revideringen av energieffektiviserings- och förnybarhetsdirektiven. Kommuner och regioner behöver flexibilitet att välja kostnadseffektiva lösningar utifrån lokala förhållanden. • Stockholms stad betonar att om datacenter ska etableras att det är viktigt att krav ställs på energiåtervinning via exempelvis fjärrvärme. Utöver att granska var i elnätet det finns effekt måste det granskas hur dessa etableringar är en del av ett optimerat energisystem. • Stockholms stad betonar att konsekvenserna av den storskaliga etablering som kommissionen föreslår behöver utredas tydligt. Digital autonomi I sitt förslag till förordning föreslår kommissionen införandet av ett fyrgradigt klassificeringssystem för tillitsnivåer på EU-nivå utifrån säkerhet och suveränitet. • Stockholms stad instämmer i förslaget om att införa ett klassificeringssystem. Ett unionsomfattande godkännande kan bidra till enklare processer, underlätta upphandlingar och effektivisera inköpsprocesser. • Stockholms stad är preliminärt positivt till förslaget om att inrätta olika tillitsnivåer avseende säkerhet och suveränitet, samt att varje medlemsstat ska utse en eller flera behöriga myndigheter som ska ansvara för att pröva ansökningar om att få ett erkännande som tillhandahållare inom en viss tillitsnivå, samt utöva tillsyn. • Stockholms stad noterar att enligt det remitterade förslaget till ny förordning ska upphandlande myndigheter använda så kallade icke-prisbaserade tilldelningskriterier för att bedöma i vilken utsträckning leverantörer bidrar till utvecklingen av ett europeiskt moln- och AI-ekosystem. Stockholms stad ser positivt på att främja en sådan utveckling, men menar att det är olämpligt att i en förordning reglera att detta specifikt ska ske i utvärderings-fasen av en upphandling. Stockholms stad menar att det är viktigt att Kommissionen tar hänsyn till att upphandlande myndigheter kan beakta kvalitativa värden inte bara i utvärderingsfasen utan även, inte sällan på ett bättre sätt, genom att ställa obligatoriska krav. Stockholms stad menar att förslaget bör omformuleras på ett sätt som möjliggör för upphandlande myndigheter att välja vilken Yttrande Dnr KS 2026/850 Sida 5 (6) metod som ska användas för att ta sådana hänsyn, utifrån omständigheterna i den enskilda upphandlingen. Till exempel om det ska göras med beaktande av tilldelningskriterier, obligatoriska krav eller bäggedera. • Stockholms stad understryker vikten av att beakta att inte bidra till ytterligare komplexitet i regelverket eller onödig administration för offentlig upphandling eftersom regelverket redan i dag är komplext. Hänsyn behövs tas till de pågående förenklingsprocesserna på EU-nivå samt kommissionens kommande uppdatering av upphandlingsreglerna. • Stockholms stad betonar vikten av säkra och tillitsfulla system särskilt i relation till tredjeland. Risken att känsliga data kan läcka till aktörer i tredjeland hämmar användningen av digitaliseringens fulla potential. Givet att mycket av data som Stockholms stad innehar är känsliga data är det av största vikt att minimera risker med otillbörlig påverkan från ett tredjeland på leverantörer och tjänsteleverantörer. En ökad mängd europeiska tjänste-leverantörer kan vara riskminimerande för stadens användning av molntjänster framåt. • Stockholms stad noterar att en av de största utmaningarna som staden har i övergången till molntjänster ligger i farhågor kring risken för leverantörsberoende. Särskilt i hänsyn till dess långsiktiga konsekvenser för kostnader, flexibilitet och säkerhet. • Stockholms stad betonar att interoperabilitet, öppna applikationsprogrammeringsgränssnitt och möjligheten att migrera data och konfigurationer är nödvändiga förutsättningar för en hållbar användning av molntjänster inom den offentliga sektorn. • Stockholms stad noterar att en brist med nuvarande utbud bland molntjänstleverantörer är avsaknad av alternativ för att undvika leverantörsberoende. Nuvarande erbjudande begränsar ofta möjligheten att migrera data och kritiska konfigurationer utan betydande tekniska eller ekonomiska hinder. För organisationer inom offentlig sektor undergräver detta långsiktig flexibilitet, kostnadskontroll och operativ motståndskraft. • Stockholms stad ser ett behov av fler leverantörsneutrala lösningar som säkerställer interoperabilitet. • Stockholms stad menar att åtgärder för att förbättra den offentliga förvaltningens tillgång till och användning av Yttrande Dnr KS 2026/850 Sida 6 (6) molntjänster bör ta hänsyn till lokala insatser som krävs för att anpassa infrastruktur och data till nya ramverk. Om sådana anpassningar förväntas måste de åtföljas av finansiering eller stödmekanismer, annars blir genomförandet ojämnt. • Stockholms stad noterar även att säkerhetskrav ofta innebär tekniska anpassningar och kompetensutveckling på lokal nivå. Dessa bör stödjas på ett realistiskt sätt genom finansiering och praktisk vägledning, inte bara genom formella förväntningar på efterlevnad. Stockholm som ovan Karin Wanngård Kommunstyrelsens ordförande --- [Remiss - Europeiska kommissionens förslag till förordning om utveckling av moln och AI KOM (2026) 502.pdf] EN EN EUROPEAN COMMISSION Brussels, 3.6.2026 COM(2026) 502 final 2026/0138 (COD) Proposal for a REGULATION OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL establishing a framework of measures for strengthening Europe’s cloud and AI ecosystem (Cloud and AI Development Act) {SEC(2026) 502 final} - {SWD(2026) 502 final} - {SWD(2026) 503 final} (Text with EEA relevance) EN 1 EN EXPLANATORY MEMORANDUM 1. CONTEXT OF THE PROPOSAL • Reasons for and objectives of the proposal In recent years, cloud and AI technologies, services and applications have evolved from new concepts to indispensable pillars underpinning the functioning of our economy and society. AI unlocks unprecedented opportunities from automation and data -driven decision -making to personalised services, while cloud computing provides the computational resource, software building blocks and interfaces necessary for efficient AI development and deployment. The rapid proliferation of AI has resulted in an unprecedented and growing demand for computational capabilities. Consequently, computing infrastructures are no longer mere technical assets but have become strategic resources critical to the Union’s economic security, sovereignty, resilience, and competitiveness. As Mario Dra ghi’s report ‘The future of European competitiveness’ states, the EU must maintain a foothold in areas where technological sovereignty is required, such as security and encryption (“sovereign cloud” solutions) and thus reduce critical external dependencies by strengthening homegrown cloud and AI capabilities and infrastructure. To this end, the Draghi report calls on the European Commission to take targeted actions aimed at regaining and retaining control over data and cloud computing services, expanding domestic computational capacity and establishing a robust financial and talent flywheel to drive innovation. These objectives were later enshrined in the European AI Continent Action Plan , which presented a strategic roadmap to ensure European AI leadership. Central to achieving this is a nexus between five key domains: computing infrastructures, data, skills, development and adoption of AI algorithms, and regulatory simplification. The ongoing deployment of AI factories and AI gigafactories aims to provide broad access to high -capacity, next-generation computational resources for European businesses and researchers requiring AI capabilities. To complement this, the EU needs to expand its cloud and data centre capacity to support the wider deployment and diffusion of AI. The Union’s limited data centre capacity poses a significant threat to its ability to benefit from the digital transformation and adopt AI-driven solutions, notably those requiring low - latency compute capacity. In particular, several obstacles hinder the rapid deployment of data centres in the EU. As data storage and processing demands continue to rise - particularly due to the surge in AI workloads - the lack of data centre capacity in the EU forces European enterprises to route critical workloads through foreign hyperscaler infrastructure . This makes the EU a less attractive destination for tech investment than regions with more abundant, lower-cost compute resources. The current landscape of cloud and AI is characterised by a pronounced dependence on a limited pool of third-country providers. While the EU market for cloud computing services market is growing significantly, the market share of EU providers decreased from 29% in 2017 to 15% in 2022 and has remained stagnant since then. Currently, three non-EU hyperscalers control over 70% of the Europea n cloud market. Large market incumbents are subject to third -country jurisdictions where laws with an extraterritorial effect apply, including laws mandating data access and transfer that may conflict with EU fundamental rights and data protection framewor ks. This dependence also exposes European users to the risks related to operational discontinuity, particularly in scenarios where unilateral decisions by third-country actors could disrupt service provision. EN 2 EN Against this background, Europe has world-class research and development capabilities, vibrant open-source communities and a strong industrial base in cloud and AI, which however remain largely untapped. Against this background, the Commission has prepared the proposed Cloud and AI Development Act (‘the proposal’ ) which aims to address the limited and geographically concentrated availability of computing capacity in the EU and the risks associated with dependence on cloud and AI supplied by non-European providers. The proposal aims to (1) increase computing capacit y and AI developed and deployed in the EU through innovative and sustainable Cloud and AI technologies; (2) ensure attractive conditions for the deployment of sustainable and innovative computing capacity across the Union; (3) address concerns regarding da ta sovereignty and operational continuity of cloud and AI; (4) help protect public order by making the supply of cloud computing services more resilient, in particular in the public sector. The proposal responds to the need for a coordinated ‘ecosystem approach’ to make the EU more competitive and resilient in the cloud and AI area . It combines supply-side measures to boost domestic capabilities, demand -side measures to drive adoption, and en ablers to foster innovation and investment into cloud and AI . It places a specific focus on open source as a lever to boost t echnological sovereignty , in line with the EU Open Source Strategy which aims to promote open European alternatives across the European technology stack. First, t he proposal supports projects that are the outcome of the research and innovation initiative launched under this framework and implemented jointly with Member States. This initiative will integrate networks, cloud, AI and software into coherent ecosystems to address the following: (1) future challenges across energy-efficient compute infrastructure; (2) autonomy across the cloud stack; (3) advanced EU capabilities in advanced AI technologies such a s frontier AI, physical AI and industrial AI; (4) adoption of cloud and AI across the public and private sectors. The proposal places a particular emphasis on large-scale, cross-sectoral initiatives addressing the most strategic technological and industrial challenges ( ‘grand challenges ’). It will demonstrate the feasibility of this effort and pave the way for similar initiatives in the future, creating the conditions for investment in next-generation infrastructure and technologies. Second, the proposal responds to the growing gap in data centre capacity with a framework that simplifies and harmonises the deployment of data centres EU-wide, while ensuring their sustainability. It aims to triple EU capacity in the next five-to-seven years and reach the needed capacity by 2035, while ensuring balanced geographic deployment across Member States. To support this, the proposal presents a mechanism to identify and support data centre strategic projects with significant built -in innovation and sustainability or that contribute to the balanced distribution of computing capacity. Third, t he proposal aims to mitigate the risks stemming from the EU’s reliance on third countries for cloud computing services via a single EU -wide sovereignty framework. It provides a harmonised and auditable set of criteria at different levels of sovereignty of cloud EN 3 EN computing services. It also provides a framework for services to be assessed and formally recognised at a particular level of sovereignty. Finally, it obliges the Member States to undertake sovereignty risk assessments to determine which sub-sectors and use cases should be served by services aligned with the respective sovereignty levels to ensure appropriate protection in terms of data confidentiality, to ensure operational autonomy and to prevent harm that could undermine public order. Complementing the Cybersecurity Act (CSA2) revision, which addresses supply chain risks, the proposal ensures that contracting authorities can use sovereign cloud computing services. Together, the proposal and the CSA2 fill long-standing gaps in sovereignty and non -technical risks. At the same time, cloud computing services in Europe must meet high cybersecurity standards, which calls for a robust cybersecurity framework that provides a comprehensive response to tod ay’s geopolitical security challenges. In this legislative context, work will resume on the European Cybersecurity Certification Scheme for Cloud Services (EUCS). The proposal finally provides a framework for contracting authorities to make informed purchasing decisions a nd leverage their buying power towards lowering existing dependencies, including through the use of sector-specific EU-added-value award criteria and common procurement to drive innovation and growth, wit h a focus on creating concrete opportunities for smaller EU-based providers. Taken together, the measures set out in the proposal establish the foundations for a resilient, high-performance EU cloud and AI ecosystem. They position Europe not just as a cons umer of advanced digital technologies but as a global hub for trusted, sovereign and scalable digital infrastructure capable of shaping the standards, capabilities and markets of the next technological wave. • Consistency with existing policy provisions in the policy area The proposal is consistent with the rules on switching between data processing services introduced by the Data Act. By enabling switching and removing key sources of vendor lock- in, the Data Act seeks to ensure that cloud computing service providers in the EU compete on quality, innovation, and price. It seeks to enable cloud users to freely choose the provider that best meets their needs and combine offers of different providers in a multi-cloud approach. However, the Data Act does not contain elements to shape up a more competitive offer of European cloud computing services or encourage the entry into the market of a more diverse set of cloud computing service providers. The Data Act opens the path towards a possible reduction of dependencies on non -EU providers but does not build the road towards a more sovereign and trusted EU cloud computing sector. Its cloud switching and interoperability provisions, however, make it possible for users to embrace European cloud computing services more strongly. The Data Act is thus an enabler for the proposal. The proposal is also consistent with the Digital Markets Act (DMA). The DMA covers cloud computing services as a core platform service, meaning that cloud computing service providers designated as gatekeepers would have to comply with a set of obligations to increase fairness and market contestability . So far, no cloud computing service provider has been designated as a gatekeeper for their services. However, on 18 November 2025, the Commission opened three market investigations on cloud computing services under the DMA. T wo of these market investigations will assess whether two providers should be designated as gatekeepers for their cloud computing services (in other words whether they act as important gateways between business users and end users). The third market investigation EN 4 EN will assess if the DMA can effectively tackle practices that may limit competitiveness and fairness in the cloud computing sector in the EU. While certain providers of cloud computing services could be regulated under both this proposal and the DMA, the DMA has different objectives and does not contain measures that would actively promote the uptake of sovereign cloud computing services. The DMA only aims at maintaining and promoting a fair and contesta ble cloud market in the Union, regulating specific behaviours of companies designated as gatekeepers and thus intervenes at a different level than the proposal, which focuses on the uptake and use of the services provided. The proposal also reinforces key objectives of the AI Act. The AI Act harmonises rules for AI systems and general -purpose AI models to be placed on the EU market, improving the functioning of the internal market and promoting the uptake of human-centric and trustworthy AI along the value chain. The AI Act ensures a high level of protection of health, safety and fundamental rights. It does not cover aspects of sovereignty. The proposal further complement s EU’s broader digital policy framework, including the EU Open Source Strategy, the Digital Decade Policy Programme and Apply AI Strategy. The EU Open Source Strategy proposes to foster open source for sovereignty, competitiveness and security through a series of focused measures, some of which are proposed in the Cloud and AI Development Act. The Digital Decade Policy Programme focuses on four cardinal points, under which its targets fall, namely (i) a digitally skilled population and highly skilled digital professionals ; (ii) secure and sustainable digital infrastructures; (iii) digital transformation of businesses; and (iv) digitalisation of public services. More specifically, the Digital Decade Policy Programme sets out a target for monitoring the deployment of edge nodes, but it does not include either a target for measuring progress in the deployment of compute capacity or data centres in the EU or concrete support measures for their deployment. This proposal complements the Digital Decade Policy Programme by leveraging the existing yearly monitoring exercise, thus creating synergies with the existing framework. It also helps advance all four Digital Decade policy programme cardinal points , notably by establishing concrete measures centred on developing innovative AI-enabling technologies, deploying expanded compute capacity, and creating a trust framework for enhanced use of cloud and AI. Moreover, the Apply AI Strategy sets out concrete actions to harness AI’s transformative potential, with a focus on boosting adoption across key industry sectors and the public sector. It also introduces support measures to strengthen the EU’s technological sovereignty by tackling cross-cutting challenges in AI development and deployment. The proposal underpins these objectives and contributes to their implementation by introducing targeted measures aimed at supporting the development and deployment of cloud and AI, increasing access to compute capacity and building trust in cloud computing services. The proposal is fully compatible with the EU’s June 2025 Communication on an International Digital Strategy . It creates a transparent, non -discriminatory blueprint for digital autonomy that allows the EU to build resilient, sovereign tech infrastructures at home while providing a trusted, legally sound model for international partnerships and multilateral governance abroad. It is fully consistent with the Union’s international commitments and partnerships and will secure access to the internal market to entities from partner countries that meet required levels of Union assurance. EN 5 EN • Consistency with other Union policies The proposal complements EU’s broader policy framework on cybersecurity and digital resilience. This proposal needs to be read in conjunction with the proposal for the review of the Chips Act, which includes measures to promote investments in advanced semi conductors, increase supply chain resilience and demand creation through increased cooperation between the semiconductor supply chain and end markets. The Directive on Security of Network and Information Systems (NIS2) improves the cybersecurity risk management of cloud computing service providers and data centres in the EU, resulting in greater trust. However, it does not contain measures to boost the uptake and use of such services and is fully focused on technical cybersecurity as opposed to broader sovereignty considerations. As detailed earlier, the proposal further supplements the Cybersecurity Act’s focus on cloud cybersecurity with sovereignty considerations. Certification under the Cybersecurity Act can address technical cybersecurity criteria but is not suited for addressing sovereignty concerns that go beyond these technical elements. Meanwhile, the European Union Agency for Cybersecurity (ENISA) has been working on developing a European Cybersecurity Certification Scheme for Cloud Services (EUCS) , which has not yet been adopted. When finalised, it could be leveraged in the framework for sovereign cloud computing services as a way of ensuring that an audited service meets the highes t cybersecurity standards. Furthemore, the proposed review of the Cybersecurity Act reinforces the trustworthiness of the hardware and software ICT supply chain. The proposal also supports the objectives of the Digital Operational Resilience Act (DORA). Th e Digital Operational Resilience Act shapes compliance obligations for cloud computing service providers. It indirectly covers cloud computing service providers if they provide services to specified financial entities or if their role is significant enough in terms of operational resilience. It has a sectoral scope and is specific to the financial sector. Under the Digital Operational Resilience Act, cloud computing service providers must implement ICT risk management and conduct regular i ncident response testing to comply with the requirements for critical third -party service providers. The financial institutions concerned, which could be public in nature, must carry out due diligence on the cloud computing service providers they work with. The proposal also supports the objectives of the Preparedness Union Strategy , which identifies dependence on critical digital infrastructure as a systemic risk and calls for a whole - of-government approach to ensuring the continuity of essential services in crisis scenarios. The sovereignty framework established by this Regulation, and in particular the risk assessment mechanism in Article 29, contributes directly to the digital preparedness dimension of that Strategy by ensuring that the cloud and AI serv ices underpinning emergency management, civil protection coordination and disaster response operations are provided at the appropriate Union assurance level. The proposal is therefore consistent with, and supportive of, the Union’s broader resilience and preparedness policy objectives. The proposal is consistent with existing rules on the processing of personal data, including the General Data Protection Regulation (GDPR) and the EU -US Data Privacy Framework. However, while the EU -US Data Privacy Framework addresses transatlantic data transfers, it does not remove sovereignty concerns about dependence on third -country providers. The proposal thus complements the EU -US Data Privacy Framework as the notion of sovereignty goes beyond data transfers and relates to operational autonomy too. EN 6 EN The proposal also supplements the Public Procurement Directives. Public authorities in the EU rely heavily on non-EU cloud computing service providers and associated problem drivers require a nuanced and targeted sectoral approach, which is not covered by the existing Public Procurement Directives and would be difficult to account for sufficiently through an overarching approach. The proposal therefore provides a sector-specific approach to sovereignty – the many layers of which cannot be addressed in the horizontal acquis that sets out general principles for the design of procurement procedures. The proposal includes complementary award criteria that are also tai lored to the specificities of cloud computing services and critical dependencies on third countries in this sector. The proposal complements the Digital Networks Act , which supports the development of a robust, fast, secure, cutting -edge digital networks and thus be beneficial to the deployment of data centres in the EU, for which high -speed, gigabit and beyond connectivity is a prerequisite. The proposal leverage s the Digital Networ ks Act’s advancements for connectivity and thus stays focused on the deployment of data centres capacities, not the prior or parallel build -out of the necessary connectivity infrastructure. The Digital Networks Act also addresses the convergence of network s infrastructure, including scenarios where a cloud computing service provider operates an electronic communications network and has so far not been subject to obligations under the European Electronic Communications Code although falling into its scope . T hus, the Digital Networks Act will clarify the procedures for connectivity between providers of various networks and other market participants within a broader ecosystem cooperation. The proposal contributes to the objectives of the Energy Efficiency Directive on guiding the data centre industry towards greater energy efficiency. However, beyond transparency and reputational considerations, it does not set incentives for data centre op erators to improve their sustainability performance and does not contain measures for accelerating the roll -out of sustainable data centres across the EU or increasing related investment. Similarly, the EU Code of Conduct on Data Centre Energy Efficiency does not concern measures to deploy a data centre, instead focusing fully on practices for operating one. Thus, the proposal provides measures to incentivise the roll -out of energy -efficient data centres, aligning with the Strategic roadmap for digitalisat ion and AI in energy , which seeks to optimise energy consumption in digital technologies while accelerating the EU’s twin green and digital transition. To identify which data centres are sustainable, the proposal refers to the rating scheme developed under the Energy Efficiency Directive. The proposal also complements the European Grids Package , which aims to ensure grids are in place and ready to uptake future loads in a horizontal manner. Here, the proposal focuses on data centres as an ultimate client of grid capacity and ensures data centres location considers grid availability, information is exchanged sufficiently in advance to feed into grid planning and hence ensure timely connection of data centres. The European Grids Package sets out ways in which Member States can accelerate grid connections, including a more efficient structure of their grid connection queue, for example by considering a project’s readiness and grid -friendly uses as o pposed to a pure first -come- first-served approach. The proposal leverages these considerations. The proposal also complements the Renewable Energy Directive and can leverage it. Data centres may benefit from the increased availability of renewable energy and storage even if they are not themselves covered by the Directive. Proximity to acceleration areas for renewables could also be a relevant factor in designating sites for faster data centre deployment. EN 7 EN The Industrial Accelerator Act puts forward measures to accelerate permitting, including setting out the principle of ‘one project, one procedure’ and establishing a single digital procedure to cover the entire permit -granting process. The Industrial Accelerator Act also requires Member States to designate at least one manufacturing industrial acceleration area or cluster where further business facilitation measures apply, including prioritised access to materials, and access to EU finance. However, as the proposed industrial acceleration measures only account for manufacturing facilities and do not account for the specific needs of data centres as well as their benefits , they have been left out of scope of the Industrial Accelerator Act . Addressing these differences , the proposal complement s the general industrial acceleration measures with measures that are tailored to the accelerated deployment of data centres. 2. LEGAL BASIS, SUBSIDIARITY AND PROPORTIONALITY • Legal basis The legal basis for this proposal is Article 114 of the Treaty on the Functioning of the European Union (TFEU) , which empowers the EU to adopt measures for improving the functioning of the internal market through the harmonisation of national provisions. The current fragmentation in data centre deployment is driven by divergent national approaches to capacity expansion, sustainability requirements, and permitting procedures . These risks creating regulatory disparities that could undermine the internal market. Variations in public procurement practices for cloud computing services, as well as inconsistent sovereignty criteria, may hinder providers’ ability to operate seamlessly across Member States, leading to market inefficiencies and unequal competitive conditions. Given these challenges, EU-level intervention in the form of a legislative proposal is justified under Article 114 TFEU, as it seeks to eliminate barriers to the internal market and levels the playing field for cloud computing service providers. Additionally, the proposal draws on Article 173(3) TFEU, which provides the legal basis for measures aimed at enhancing the EU’s industrial competitiveness and innovation capacity. The current shortage of computing capacity in the EU constrains the ability of European industries to fully benefit from the use of cloud and AI technologies, especially those requiring low -latency and high -performance computing. By increasing the availability of energy-efficient compute capacity and the development and deployment of cutting-edge cloud and AI technologies , this initiative directly helps strengthen Europe’s industrial competitiveness and technological leadership, in line with the objectives of Article 173(3) TFEU. Given the proposal’s dual objective of r emedying internal market distortions and bolstering the EU’s industrial competitiveness, it will be adopted as a single legislative instrument under the cumulative legal basis of Articles 114 and 173(3) TFEU. This joint legal foundation provides a unified regulatory response to the interlinked challenges of market fragmentation and strategic industrial capacity-building within the EU’s cloud and AI ecosystem. • Subsidiarity (for non-exclusive competence) EU action has a clear added value in addressing the problem of limited and geographically concentrated availability of computing capacity. By providing a common approach to accelerating data centre deployment, it enables coherent planning and deployment of computing capacity in a geographical ly balanced way, while avoiding a race to the bottom and reducing regulatory complexity for investors and data centre operators. EN 8 EN The EU is uniquely positioned to ensure that investment and acceleration policies reflect collective priorities and avoid fragmentation. EU-level action would ensure that all businesses and public administrations can access sufficient compute capacity to meet their needs and is a prerequisite for Europe to become an AI continent. In addressing the dependence on cloud computing services supplied by non -European providers, EU action delivers benefits that exceed what Member States could achieve individually, especially in addressing the underlying market failures of imperfect information. This will improve the functionin g of the internal market and enable cloud computing service providers to grow beyond their national markets. • Proportionality The proposal adopts a targeted and proportionate approach to address the critical bottlenecks in the single market, specifically the compute capacity deficit and overreliance on third - country providers. The proposed solutions are confined to measures essential for achieving core objectives of the proposal notably the strengthening of the EU technological sovereignty, fostering a com petitive EU cloud and AI market, and supporting an enhanced availability of sustainable computing resources in the EU. By focusing on harmoni sed standards for sovereign cloud computing services, streamlined data centre deployment, and EU-wide cooperation mechanisms, the proposal avoids excessive regulation while directly tackling the structural barriers that impede the digital advancements across Europe. The chosen measures represent th e most suitable and least intrusive means of addressing the identified market and regulatory failures, as they leverage existing EU instruments while introducing only those new provisions necessary for cohesive and efficient implementation. The proposal wi ll give rise to direct compliance costs, covering both administrative and adjustment expenditures. These are to be borne mainly by national and local public authorities, and businesses such as data centre operators, cloud -computing service providers as wel l as their subcontractors and private -sector entities operating in sectors listed under Annex I to the NIS2 Directive, so that they comply with the obligations set out in this Regulation. However, the exploration of different options and their expected co sts and benefits has resulted in a balanced design of the instrument. The costs to public authorities will be counterbalanced by the value of reduction of total cost of ownership for IT systems and faster and more reliable procurement processes, while the costs to businesses will be counterbalanced by the value of improved predictability of regulatory direction and reduced fragmentation of national approaches together with administrative simplification. • Choice of the instrument The Commission proposes a Regulation as the optimal legal instrument for the accomplishment of the proposal’s objectives, given its capacity to ensure uniform application and immediate effect across all Member States. A Regulation provides the necessary legal certainty and consistency to fully harmoni se the regulatory framework for cloud computing services. This approach is essential to remove single market barriers, particularly in areas such as sovereignty and sustainability standards, where divergent national rules cou ld otherwise undermine the EU’s technological sovereignty and competitiveness. Given the geopolitical urgency, including the need to reduce strategic dependencies on third -country providers, a Regulation ensures a rapid, coordinated, and EU -wide response, preventing delays or inconsistencies that could arise from Member States acting greater independence. EN 9 EN 3. RESULTS OF EX-POST EVALUATIONS, STAKEHOLDER CONSULTATIONS AND IMPACT ASSESSMENTS • Stakeholder consultations Between October 2024 and November 2025, an extensive stakeholder consultation was carried out comprising the following consultation activities. Between April and July 2025, the Commission organised a Public Consultation consisting of an online questionnaire and a call for evidence for stakeholders to submit detailed position papers outlining their views and recommendations on the objectives and proposed actions envisaged by the proposal, while also giving direct evidence to inform the design of policy options. A total of 436 responses w ere received: 243 for the consultation survey and 193 for the call for evidence. A series of workshops, seminars and roundtables complemented the consultation. These included: (i) the 6th General Assembly and Alliance Forum of the European Alliance for Industrial Data, Edge and Cloud; (ii) roundtables, namely on investment in cloud compute with financial investors, on policy measures to facilitate data centre integration to the EU grid, with European Cloud Service Providers’ CEOs on developing sovereign cloud offerings in the EU, and with American Chamber of Commerce; (iii) seminar s with industry, academia and public authorities on the economic dynamics of the AI stack; and (iv) presentation s on future EU cloud and AI policy with industry. The Commission also maintained a continuous dialogue with Member States’ relevant authorities gathered in the informal Member States Cloud Cooperation Group under the European Alliance for Industrial Data, Edge and Cloud, complemented by targeted bilateral meetings. In addition, the Commission engaged in further bilateral discussions with third countries, including Japan, Switzerland and the United Kingdom, to present and discuss the considered policy options while gathering insight on best practices and assess the ex ternal effect of measures considered. Finally, the Commission held over 100 bilateral meetings with a diverse array of stakeholders, including industry representatives, academic institutions, think tanks and civil society organisations supported the formulation of the proposed policy options. • Collection and use of expertise The Commission contracted a consortium led by Technopolis Group to conduct a study to support the evidence collection and analysis stage of the impact assessment preceding the proposal. The study incorporate d multiple stakeholder engagement activities, including over 60 targeted interviews, surveys (over 250 replies), and workshops (over 100 participants). • Impact assessment The proposal is accompanied by a comprehensive impact assessment the final version of which was submitted to the Regulatory Scrutiny Board on 30 April 2026. On 8 May 2026, the Board issued a positive opinion accompanied by a request for further improvements. • Fundamental rights The proposal has been subject to a comprehensive assessment of its implications for fundamental rights, with particular emphasis on the protection of personal data as guaranteed under Article 8 of the Charter of Fundamental Rights of the European Union. The proposal introduces a framework for sovereign cloud computing services, which establishes stringent EN 10 EN safeguards to ensure that the processing of personal data involving EU citizens complies with EU data protection standards, including the GDPR. By setting these standards, the proposal minimises risks associated with non -compliant data handling while reinforcing trust in digital infrastructure. One of the core objectives of the proposal is to reduce dependence on third -country providers, whose operations may be subject to non -EU jurisdictions that can permit data access and transfer. Consequently, the proposal enhances the protection of personal data by ensuring that such data remains under the effective supervision of EU authorities, including Member State data protection agencies and the European Data Protection Board. This approach strengthens legal certainty and upholds the right to privacy as enshrined in the Charter. Furthermore, the proposal fosters a competitive single market for cloud computing services, where providers are fully bound by EU legislation and subject to applicable obligations. This not only improves data availability and continuity but also ensures that EU legal obligations, such as those related to data subject rights and regulatory overs ight, are consistently met. By increasing the market presence of EU -based providers, the proposal further embeds fundamental rights protections into the digital ecosystem, offering stronger guarantees against unauthorised access or misuse of personal data. The proportionality of these measures has been carefully considered to balance innovation with the imperative of rights protection, in line with the Charter’s principles. 4. BUDGETARY IMPLICATIONS The budgetary implications of the proposal are described in detail in the accompanying financial statement. In order to effectively implement the initiative , 25 full -time equivalents (FTEs) are required, comprised of 9 establishment plan posts and 16 contract agent posts. This staff ing configuration will be achieved through a combination of redeployment and additional recruitment. Specifically, 15 existing staff members will be reassigned from within the Commission to support the initiative , leveraging their expertise and experience in managing similar actions . The necessary staff will be drawn from DG CNECT and DG DIGIT, where they are currently assigned to relevant units or will be redeployed from within the Commission service s. To supplement these existing resources, the initiative will require an additional 10 FTEs : of 6 FTEs for DG CNECT and 4 FTEs for DG DIGIT . These additional staff members will be requested to augment the current staffing levels to ensure the initiative’s successful implementation and the effective p erformance of new activities and tasks. The additional administrative expenditure associated with new tasks described in the proposal will be mostly financed through fee-based revenue streams that fall under internal assigned revenues, thus ensuring a sustainable and viable funding model . Specifically, fee-based streams will be used to support tasks related to joint procurement and to the administration of the EuroCloud initiative intended to make i t easier for interested Member States to share idle cloud and data centre capacity. 5. OTHER ELEMENTS • Implementation plans and monitoring, evaluation and reporting arrangements The Commission should monitor the application of the proposed Regulation and evaluate its effectiveness over time. Five years after its entry into force, the Commission should review the functioning of this proposed Regulation and submit a report to the European Parliament EN 11 EN and to the Council. These reports w ill be public and detail the effective application and enforcement of the proposed Regulation. • Detailed explanation of the specific provisions of the proposed Regulation Title I of the proposed Regulation contains the general provisions, including the subject matter (Article 1) and the definitions (Article 2). Title II contains the provisions that establish the framework for the implementation of development and deployment activities across the cloud and AI ecosystem. The framework is organised into the Cloud and AI Leadership Initiatives and is reinforced by further supporting measures. Under Chapter I, Art icle 3 sets out general objective of the Cloud and AI Leadership Initiatives aiming to support research and innovation activities and achieve large - scale capacity throughout the Union’s cloud and AI ecosystem . Article 4 establishes the operational objectiv es of the Cloud and AI Leadership Initiative s. Article 5 introduces a network of Experience and Acceleration Centres for AI built on the European Digital Innovation Hubs and aiming to support the achievement of the Cloud and AI Leadership Initiatives objectives. Article 6 sets out the implementation mechanisms for the Cloud and AI Leadership Initiatives. Article 7 requires Member States to adopt a national cloud and AI strategy coherent with the Regulation’s objectives within one year of its entry into force . Article 8 establishes criteria for projects to be recognised by the Commission as a frontier AI priority project. Article 9 supports the allocation of AI computing resources to frontier AI priority projects, while also supporting industrial and physical AI projects and the development and deployment of AI models for the public sector. Title III sets out the provision on data centre capacity. Under Chapter I, Article 10 sets out the obligations for Member States to design ate data centre acceleration zones within their territory, where they are deploying data centre capacity . Article 11 prescribes the conditions within data centre acceleration zones. Article 12 establishes the obligation for Member States to designate single information points, or where possible, upgrade or integrate with the already existing single information points , for data centre operators of data centre projects in data centre ac celeration zones and further principles to be satisfied with respect to the responsibilities of the information point. Article 13 addresses the facilitated administrative and permit granting processes for data centre projects deployed in data centre accele ration zones. Under Chapter II, Article 14, lays down the mechanism for expression of interest and conditions and designation by the Commission of data centre strategic projects. Under Chapter III, Article 15 establishes a mechanism for the Commission to monitor the Union progress in increasing the compute capacity available , the volume of demand for data centre capacity, and the size of the capacity gap. Title IV contains the provision relating to autonomy and adoption. Under Chapter I, Section 1, Article 16 sets out a Union cloud computing sovereignty framework consisting of four assurance levels and introduces the requirements established in Annex II to the Regulation for cloud computing services to be considered as providing Union assurance across level 1 to level 4. Article 17 established a me chanism for cloud computing service providers to be recognised as providing a Union assurance level 1, 2, 3, or 4, where they m ust submit an application for recognition to the national competent authority of establishment. Article 18 sets out conditions and a mechanism for a possible recognition of third -countries as providing sufficient assurances to allow for cloud computing ser vices controlled from that third country to become eligible to qualify under Union assurance level 3. Section 2, Article 19 sets out the conditions for the conformity self -assessment documenting the alignment against the requirements of the Union assurance level 1. Section 3, Article 20 sets out the framework of EN 12 EN assessment performed by auditing organisations against the requirements of the Union assurance levels 2-4. Article 21 sets out the requirements for audit evidence to be established as part of the th ird-party assessment of requirements under Union assurance levels 2-4. Article 22 sets out the obligation for the Commission to establish and maintain a central repository of services recognised as offering Union assurance levels 1-4. Article 23 sets out transparency obligations for cloud computing service providers’ , to report any material changes which may substantiate a resulting change in their recognition as offering Union assurance levels 1 -4. Article 2 4 sets out the penalties and compensation rules applicable to infringement by cloud computing service providers. Section 4, Article 25 sets out the Member States obligations to designate a national competent authority. Article 26 sets out the powers of national competent authorities designated by the Member States. Section 5, Article 27 sets out principles of mutual assistance between Member S tates national competent authorities in the context of information sharing and investigation for the purpose of this Regulation. Article 28 sets out the principles of cross -border cooperation between Member States national competent authorities in the context of enforcement actions. Under Chapter II, Section 1, Article 29 sets out the obligations for Member States and Union entities to conduct risk assessments to determine the required level of conformity against the Union assurance levels 2-4 for different public sector activities. Article 30 sets out obligations for contracting authorities that procure cloud computing services to procure , as a minimum req uirement, Union assurance level 1. Wh ere a risk assessment determines that the activities of such contracting authorities have public order relevance, they must only procure and use services that have been recognised as offering Union assurance levels 2, 3 , or 4. Section 2, Article 31 allows for private sector entities within the meaning of the NIS2 Directive to conduct impact assessments with a similar purpose to the ones conducted by Union entities and public sector bodies. Section 3, Article 32 sets out obligations for the Member States contracting authorities to apply Union added value criteria in public procurement of cloud computing services and AI systems within the scope of the Regulation. Article 33 sets out obligations for Member States to monitor their procurement of innovation of cloud computing services and AI systems , introduces a lean reporting frame work and creates links to national cloud and AI strategies where Member States must create plans for the achievement of the objectives of this Article. Under Chapter III, Article 34 establishes the European public sector cloud federation (‘EuroCloud Federation’) and sets out its scope and purpose. Article 35 sets out the conditions applicable to the sharing of data centre services and cloud computing services within the EuroCloud Federation. Article 36 sets out how the Commission can recover the costs incurred in relation to the EuroCloud Federation, including the e stablishment of the EuroCloud Federation and of the platform facilitating the sharing of services among its members. Chapter IV, Article 37 sets out the conditions for the Commission to carry out procurement activities for Union entities,for contracting authorities from Member States, and fo r partner organisations selected by the Commission , including by establishing the necessary derogations to the Financial Regulation . Article 38 sets out the necessary arrangements for implementing the common procurement framework , including the governance mechanism. Article 39 sets out the applicable public procurement rules. Article 40 sets out the mechanism for the compensation of costs incurred by the Commission for the operation of the common procurement framework via fees levied on participating contracting authorities . Chapter VI, Article 41 sets out the obligations of the Union entities and public sector bodies to encourager and facilitate thier use of opensource solutions over proprietary ones. Article 42 sets out the requirements on sharing and reuse of software developed by or for Union entities and public sector bodies. Article 43 sets out the obligation for the Commission to provide and maintain an Open Source Solutions Catalogue. Article 44 sets out the rules for the establishment of a network of Member States Open Source Programme Offices. EN 13 EN Title V sets out the final provisions, including the power for the Commission to adopt delegated acts (Article 45) and implementing acts (Article 46), the review clause (Article 47), and the specification of the entry into force and dates of application of the Regulation (Article 48). EN 14 EN 2026/0138 (COD) Proposal for a REGULATION OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL establishing a framework of measures for strengthening Europe’s cloud and AI ecosystem (Cloud and AI Development Act) (Text with EEA relevance) THE EUROPEAN PARLIAMENT AND THE COUNCIL OF THE EUROPEAN UNION, Having regard to the Treaty on the Functioning of the European Union, and in particular Article 114 and Article 173(3) thereof, Having regard to the proposal from the European Commission, After transmission of the draft legislative act to the national parliaments, Having regard to the opinion of the European Economic and Social Committee (1), Having regard to the opinion of the Committee of the Regions (2), Acting in accordance with the ordinary legislative procedure, Whereas: (1) The Union is committed to become a global leader in artificial intelligence (AI). By enabling faster innovation, greater efficiency and smarter decision -making, AI contributes to substantial economic, environmental and societal gains and is a fundamental driver of competitiveness. In order to fully harness the benefits of AI across the key sectors of the economy, the Union s hould act with ambition and foresight, advancing its innovation capabilities, strengthening its competitiveness , security of supply , while reinforcing its technological sovereignty and strategic autonomy in cutting-edge digital technologies. (2) The Union has already laid strong foundations to position Europe as a continent that leads AI development and uptake, in particular through the AI continent action plan communication (3) and Apply AI Strategy (4). With Regulation (EU) 2023/2854 (5) of the European Parliament and of the Council on harmonised rules on fair access to and 1 OJ C , , p. . 2 OJ C , , p. . 3 Communication from the Commission to the European Parliament, the Council, the European Economic and Social Committee and the Committee of the Regions , ‘ AI Continent Action Plant’ , 9.4.2025, COM(2025) 165 final. 4 Communication from the Commission to the European Parliament and the Council, ‘Apply AI strategy’, 8.10.2025, COM(2025) 723 final. 5 Regulation (EU) 2023/2854 of the European Parliament and of the Council of 13 December 2023 on harmonised rules on fair access to and use of da ta and amending Regulation (EU) 2017/2394 and Directive (EU) 2020/1828 (Data Act) (OJ L 2023/2854, 22.12.2023, ELI: http://data.europa.eu/eli/reg/2023/2854/oj). EN 15 EN use of data (‘the Data Act’) and Data Union Strategy ( 6), the Union has also set up the necessary frameowrk to create a secure and interoperable single market for data, which underpins the development of AI. (3) The European Parliament, the Council, the Commission and the Member States have committed themselves to cooperate on delivering the Union’s technological sovereignty in an op en manner, in particular by secure and accessible digital and data infrastructures that enable other technological develop sments, supporting the competitiveness and sustainability of the Union’s industry and economy, in particular of small and medium -sized enterprises (‘SMEs’) (7) and small mid-caps (‘SMCs’) (8), and the resilience of the Union’s value chains, as well as fostering the start -up ecosystem, including through the smooth functioning of the former European digital innovation hubs (‘EDIHs’), which have been refoc used as the experience and acceleration centres for AI (‘Centres for AI’). (4) The Union has become increasingly dependent on a limited number of cloud computing service providers from third countries. Reinforcing the Union’s capacity to develop and deploy cloud and AI technologies within its territory has become a strategic priority for the Union’s competitiveness, security of supply and technological sovereignty, as highlighted in the report by Mario Draghi on th e future of European competitiveness (9) and in line with the Strengthening EU economic security Communication (10). Those challenges to the Union’s cloud and AI ecosystem call for the achievement of large -scale technological capacity building and support related to research and innovation activities and require collective effort by Member States, with the Union supporting the development and deployment of cloud and AI technologies and of large-scale cloud computing capacity. (5) Those dependencies translate not only into limited market shares for the European cloud computing service providers , but also into significant risks for the Union’s operational autonomy, resilience and security. The Council has called for a Cloud and AI Development Act to in clude common criteria for sovereign cloud computing services, allowing market transparency risks and risks associated with dependencies, including extraterritorial effects of legislation adopted by third countries , to be addressed (11). (6) A framework for increasing the Union’s resilience and security in the field of cloud and AI technologies should be established, reinforcing the Union’s cloud and AI ecosystem by reducing dependencies, enhancing technological sovereignty, stimulating investment and strengthening the capabilities, security, adaptability and resilience of the Union’s cloud and AI supply chain. 6 Communication from the Commission to the European Parliament and the Council , ‘Data Union Strategy’, 19.11.2025, COM(2025) 835 final. 7 As defined in Title I, Article 2, of the Annex to Commission Recommendation 2003/361/EC of 6 May 2003 concerning the definition of micro, small and medium -sized enterprises ( OJ L 124, 20.5.2003, p. 36, ELI: http://data.europa.eu/eli/reco/2003/361/oj). 8 As defined in point 2 of the Annex to Commission Recommendation (EU) 2025/1099 of 21 May 2025 on the definition of small mid -cap enterprises ( OJ L 2025/1099, 28.5.2025, ELI: http://data.europa.eu/eli/reco/2025/1099/oj). 9 The future of European competitiveness . Part A, A competitiveness strategy for Europe (‘the Draghi report’), September 2024, https://data.europa.eu/doi/10.2872/9356120. 10 Joint Communication from the Commission to the European Parliament and the Council , ‘Strengthening EU economic security’, JOIN(2025) 977 final. 11 Council Conclusions on European Competitiveness in the Digital Decade , 5.12.2025, https://data.consilium.europa.eu/doc/document/ST-16430-2025-INIT/en/pdf. EN 16 EN (7) The framework pursues separate objectives, relying on two distinct legal bases. (8) First, it is necessary to strengthen the competitiveness, capacity and resilience of the cloud and AI technological and industrial base of the Union in accordance with Article 173(3) of the Treaty on the Functioning of the European Union (TFEU). Such measures should not entail the harmonisation of national laws or regulations. To that end, this Regulation establishes the Cloud Leadership Initiative and the AI Leadership Initiative (the ‘Cloud and AI Leadership Initiatives’) to foster the development of cutting-edge cloud and AI technologies and facilities and ensure their widespread deployment, bridging the gap between the Union’s advanced research and innovation capabilities and their sustainable exploitation. (9) Second, the available compute capacity and resilience of the cloud and AI ecosystem can best be addressed through Union harmonisation measures on the basis of Article 114 TFEU. A single coherent regulatory framework h armonising certain conditions for service providers and deployers of cloud computing services, including capacity building and provision of cloud computing services, is necessary to ensure the functioning of the internal market. (10) The definition of ‘cloud computing service’ in this Regulation should be the same as that in Article 6, point (30), of Directive (EU) 2022/2555 of the European Parliament and of the Council (12), which defines a ‘cloud computing service’ as a digital service that enables on -demand administration and broad remote access to a scalable and elastic pool of shareable computing resources, including where such resources are distributed across several locations. This definition of ‘cloud computing service’ encompasses on-demand access to AI systems as defined in Article 3 , point (1), of Regulation (EU) 2024/1689 (‘Artificial Intelligence Act’) (13) of the European Parliament and of the Council , hosted and operated remotely. Only the delivery and making available of an AI system forms part of the service. The AI system itself and its underlying model are excluded from the scope of this definition. (11) The Cloud and AI Leadership Initiatives should reinforce the competitiveness and resilience of the cloud and AI technolog ical and industrial base of the Union, while strengthening the innovation capacity of its cloud and AI ecosystem and achieving the deployment of large -scale digital infrastructures, in line with the objectives set out in the AI continent action plan and the Apply AI Strategy. In particular, the Cloud and AI Leadership Initiatives should increase the cloud and data centre capacity of the Union, while advancing cutting -edge cloud and AI technologies together with broad cloud and AI adoption across the Union’s economy. It should also bring advanced resea rch in sector -specific deployment of frontier, physical and industrial AI. The Apply AI Strategy should extend the ambitions and objectives set out in the AI continent action plan and should be updated where necessary to take account of the latest technological developments and progress made in the Cloud and AI Leadership Initiatives. 12 Directive (EU) 2022/2555 of the European Parliament and of the Council of 14 December 2022 on measures for a high common level of cybersecurity across the Union, amending Regulation (EU) No 910/2014 and Directive (EU) 2018/1972, and repealing Directive (EU) 2016/1148 (NIS 2 Directive) (OJ L 333, 27.12.2022, p. 80, ELI: http://data.europa.eu/eli/dir/2022/2555/oj). 13 Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 laying down harmonised rules on art ificial intelligence and amending Regulations (EC) No 300/2008, (EU) No 167/2013, (EU) No 168/2013, (EU) 2018/858, (EU) 2018/1139 and (EU) 2019/2144 and Directives 2014/90/EU, (EU) 2016/797 and (EU) 2020/1828 (Artificial Intelligence Act) (OJ L, 2024/1689, 12.7.2024, ELI: http://data.europa.eu/eli/reg/2024/1689/oj). EN 17 EN (12) In order to pursue the achievement of those general objectives, the Cloud and AI Leadership Initiatives should support complementary operational objectives designed as actionable initiatives to be implemented at Union level. (13) To enable data centres to act as key enablers of a sustainable digital transition, the Cloud and AI Leadership Initiatives should support research and innovation capacities for the development of data centre technologies incorporating principles of energy and resource efficiency by design and throughout operations, with a view to achieving large-scale sustainability. This includes advancing resource and utilisation -efficient computing technologies, such as the optimisation of energy and water efficiency, the use of emerging quantum computing technologies, the development of AI -powered technologies for server efficiency, the integration of computing infrastructure with energy grids, the promotion of clean energy adoption and on-site energy generation in data centres. The Cloud and AI Leadership Initiatives should also provide access to pilot lines for data centre technologies to steer and accelerate innovation uptake in the market. Such pilots should function as demonstration facilities for cutting -edge data centre and edge semiconductor technologies, quantum computing prototypes and AI - powered data centre operation tools. (14) The Cloud and AI Leadership Initiatives should also support research, devel opment activities and the uptake of cloud stack technologies with a view to closing the capacity gap and strengthening the technological autonomy of the Union. In particular, the Cloud and AI Leadership Initiatives should foster the development of cloud computing stacks alternatives for strategic sectors. It should also facilitate the development of AI-optimised servers and software including processors and accelerators manufactured and designed in the Union, such as those developed under Regulation (EU) 2026/XXX (14) of the European Parliament and of the Council. In addition, both the Cloud and AI Leadership Initiatives under this Regulation and the Chips for Europe Initiative 2.0 supported by that Regulation should foster the co - design and cross -optimisation of hardw are and software development and the integration of AI computing infrastructures. Furthermore, the Cloud and AI Leadership Initiatives should support the complementary development and deployment of a smart and secure middleware cloud platform for common Eu ropean data spaces, in accordance with the Data Union Strategy. (15) The Cloud and AI Leadership Initiatives should also promote the development of technologies relying on open standards, open specifications and open source and foster the development of innovative, competitive and resilient cloud and AI technologies. It should foster the work on open standards and specifications and the creation of open- source software foundation s supporting the design, development and maintenance of open-source components, in particular by providing governance and coordination mechanisms and facilitating the pooling of resources. The Cloud and AI Leadership Initiatives should also create a catalo gue of software tools including open source in order to enable federation with existing catalogues for the private and public sectors and to develop a one-stop-shop for open-source resources in the Union. (16) Frontier AI technologies are advancing rapidl y and are expected to have a profound impact on the Union’s economy and society. As those technologies have become critical strategic assets, strengthening the Union’s capacity to develop and govern them is essential to ensure that the AI transition is ali gned with Union values, safety 14 References to Chips Act 2.0 to be added once adopted. See Commission proposal [add reference once published] EN 18 EN standards and long -term economic interests. By supporting pioneering projects, the Union should scale up essential breakthroughs to maintain a competitive edge in the global digital economy. Fostering the development of front ier AI technologies as strategic assets should also reduce current dependencies on third -country technologies and strengthen the Union’s AI ecosystem. (17) The emergence of physical AI, which refers to AI systems and models capable of perceiving the physical environment and executing complex actions within that environment, represents a promising frontier where advanced digital intelligence is integrated into tangible systems, such as robotics, autonomous drones and self -driving vehicles. Physical AI is essential to mitigate external dependencies and foster industrial competitiveness and strategic autonomy. It requires a dedicated approach to data and computing infrastructure. It is therefore necessary to facilitate the collection and preparation of high -quality data and access to computing resources. Furthermore, targeted support for the testing and validation of physical AI models and systems in diverse real-world environments is necessary to ensure their robustness and reliability. (18) The digital transformation of the Union’s key industries is a central pillar of the apply AI strategy. Accelerating the uptake of AI across those strategic sectors is essential to maintaining global competitiveness and increasing societal benefits. The Cloud and AI Leadership Initiatives should accelerate the development and uptake of industrial AI across the Union’s strategic industrial and service sectors, while fostering the technological development of highly capable sector -specific AI models designed to meet the operational requirements of the industries prioritised under the Apply AI Strategy, such as healthcare, transport, including aerospace , automotive, manufacturing, defence and space, climate and environment and agri-food. The Cloud and AI Leadership Initiatives should also accelerate the development of service sectors prioritised in the Apply AI Strategy and scientific discovery as priorities in the European strategy for AI in science, in line with COM(2025) 724 final. (19) In healthcare, those advancements should improve the accuracy of clinical decisions and transform the pharmaceutical sector. In the automotive sector, they should support the development , testing and deployment of innovative software platforms contributing to the Union industrial leadership in software defined vehicles and autonomous driving. The Cloud and AI Leadership Initiatives should also reduce obstacles to test and deploy AI models, in particular within cities and regions contributing to the development of Union leadership in software defined vehicles and autonomous driving. Furthermore, Member States should facilitate the development, testing and deployment of AI systems for autonomous driving, including through cooperation with the Centres for AI , the automotive industry, suppliers, cities and regions, with a view to enabling the safe and trustworthy deployment of AI -enabled connected and auto nomous mobility solutions across diverse European environments . In manufacturing, the Commission should facilitate data pooling across industrial sectors through trusted third parties to train specialised AI models, ensuring a sufficient volume of training data, while strictly preserving intellectual property rights. Secure and verifiable compute approaches should be explored to enable the use of AI in sensitive contexts. In the defence sector, where AI has emerged as a disruptive technology with significan t impact on security and defence, the Cloud and AI Leadership Initiatives could support the development of advanced capabilities in full complementarity with, and without prejudice to, dedicated Union instruments in support of the defence industry, includi ng the European defence fund (‘EDF’) and the European defence industry programme (‘EDIP’) . In the space sector, digital advances EN 19 EN should transform the way space assets, services and data flows are operated and used, and in the field of transport, digital advancements in aviation should transform the way operations are managed, with AI harnessing decades of available mission, operational and observation data. In the field of climate and environment, geospatial AI should be developed, in particular by leveraging Earth observation data from the Copernicus programme and the capabilities of the Union Space and connectivity programmes in general (15). In agriculture, AI can turn data from sensors, satellites and farm machinery into actionab le insights for farmers. It can stren gthen competitiveness and resilience, for instance by improving yield forecasting, enabling early pest and disease detection, optimising irrigation and fertiliser use, and supporting more sustainable food production. As the deployment of AI in industrial contexts requires rigorous validation in real-world environments, the Union should provide industrial actors with cloud-based AI tools and testing environments. (20) The Union should also foster the availability of high ly secured computing infrastructures for the training, testing and deployment of defence -related AI models and systems. (21) As AI agents have become increasingly capable and AI applications have become more deeply embedded in real -world business scenarios , industry is rapidly evolving towards a new paradigm that equips such systems with autonomous execution capabilities. This transition to a new paradigm requires a robust technical framework to ensure the safety, accuracy and legal compliance of those syst ems, given the stringent engineering requirements pertaining on AI platforms. Accordingly, the Cloud and AI Leadership Initiatives should aim to establish sovereign and secure AI platforms dedicated to the large -scale deployment and orchestration of advanced AI agents. Those platforms should be supported by innovative orchestration frameworks that ensure transparency and accountability in multi -agent interactions. It is also necessary to facilitate the development of rigorous testing and experimentation methodologies of AI agents and orchestration to mi nimise unintended autonomous behaviour. (22) The Cloud and AI Leadership Initiatives should increase the development and adoption of AI models and systems across the Union’s public secto r. In particular, AI models and systems should be used to support better decision -making, simplify administrative procedures and reduce unnecessary burdens, in particular for critical public domains such as healthcare where data reuse for AI models and too ls should be facilitated while ensuring security and data protection. To that end, it is appropriate to take measures to enhance the quality of public sector data and promote the sharing and reuse of training data and AI models across the Union public sector, thereby avoiding fragmentation and enabling the scaling-up of successful, user-oriented solutions. (23) The Cloud and AI Leadership Initiative should help accelerate the adoption of AI and cloud computing on a large scale, including at regional and local level. Broad adoption of AI in private and public sectors should be promoted through the network of Centres for AI . Harnessing this network, complementary support measures should be developed, to help achieve the target of digital transformation of businesses set in 15 Regulation (EU) 2021/696 of the European Parliament and of the Council of 28 April 2021 establishing the Union Space Programme and the European Union Agency for the Space Programme and repealing Regulations (EU) No 912/2010, (EU) No 1285/2013 and (EU) No 377/2014 and Decision No 541/2014/EU (OJ L 170, 12.5.2021, p. 69, ELI: http://data.europa.eu/eli/reg/2021/696/oj). EN 20 EN Decision (EU) 2022/2481 of the European Parliament and of the Council (16) (’the Digital Decade Policy Programme 2030’) . Furthermore, a dedicated curriculum on cloud computing and AI skills should be developed to equip workers in both the public and private sectors with advanced competencies to reduce dependence on non -EU providers and develop next -generation capabilities, in line with the Union policies in the field of education, training and skills including the Union of Skills communication (17).Where relevant, the curriculum should be built on relevant European initiatives, including the AI Skills Academy , the Centres for AI and the Interoperable Europe Academy, and include the participation of stakeholders with the necessary expertise. (24) The Cloud and AI Leadership Initiatives should also ensure the uptake of cloud computing services provided by European cloud computing service providers across the public and private sectors to ensure that cloud adoption is consistent with the objective of strengthening the Union’s technological autonomy , particularly in sectors such as healthcare and education wh ich involve the processing of critical data. This objective could leverage the outcomes of relevant European digital infrastructure consortiums (‘EDICs’), including shared infrastructure, common standards and best practices. The Cloud and AI Leadership Initiatives should support the establishment of the European public -sector cloud federation ( ‘the EuroCloud Federation’) under this Regulation to facilitate the sharing of secure and resilient public -sector data centre services and cloud computing services. M oreover, the Cloud and AI Leadership Initiatives should support procurement activities carried out by the Commission for Union institutions, agencies and bodies (‘Union entities’), but also national contracting authorities across the Union, as the procurem ent of digital services should not only advance the digitalisation of public -sector bodies, but also enable them to utilise their purchasing power and accelerate the adoption of resilient and secure digital solutions. (25) Member States should establish Experience and acceleration centres for AI (‘ Centres for AI’) with a view to ensuring an appropriate coverage of their territory. Centres for AI need to act as regional and local accelerators for the uptake and deployment of AI, cloud computing and other advanced technologies across the Union, supporting SMEs, SMCs and public sector bodies in their digital transformation. In order to facilitate the integration of AI into strategic industrial sectors , Centres for AI should also establish synergies with initi atives launched under the Data Union Strategy. By providing expertise, testing, skills and innovation support, Centres for AI should reinforce the competitiveness and resilience of the Union’s AI industrial base while strengthening the innovation capacity and widespread deployment of AI and other advanced technologies across the Union. The network should build on the network of European digital innovation hubs . The network will collaborate closely with other initiatives supporting the uptake of AI and other advanced technologies such as testing and experimentation facilities and AI factories. It will be built on skills-related initiatives, including the Digital large scale skills partnership unde r the Pact for skills and the skills academies, including the AI Skills Academy. (26) The implementation of the Cloud and AI Leadership Initiatives should be entrusted to the Commission and Member States. The implementation of the Cloud and AI 16 Decision (EU) 2022/2481 of the European Parliament and of the Council of 14 December 2022 establishing the Digital Decade Policy Programme 2030, ( OJ L 323, 19.12.2022, p. 4, ELI: http://data.europa.eu/eli/dec/2022/2481/oj). 17 Communication from the Commission to the European Parliament, the Council, the European Economic and Social Committee and the Committee of the Regions , ‘The Union of Skills’, 5.3.2025, COM(2025) 90 final. EN 21 EN Leadership Initiatives should , where relevant, also be entrusted to any other structure with the a ppropriate expertise and resources. In particular, without prejudice to the next (2028-2034) multiannual financial framework, it should be possible to entrust the implementation of the Cloud and AI Leadership Initiatives to joint undertakings, such as the Smart Networks and Services Joint Undertaking ( ‘the JU’) established by Council Regulation (EU) 2021/2085 ( 18) or the European High Performance Computing Joint Undertaking ( ‘the EuroHPC JU’) established by Council Regulation (EU) 2021/1173 (19) and, where relevant, their successor. (27) The Cloud and AI Leadership Initiatives’ operational objectives should, in particular, be implemented by setting ambitious, forward -looking objectives that aim to go beyond the current state of the art in infrastructure development, cloud computing and AI. The Cloud and AI Leadership Initiatives should therefore support major strategic ‘grand challenges’ focusing on the development and deployment of cutting -edge cloud and AI technolog ies and infrastructure of key importance for the Union. Those grand challenges should build on those established in Regulation (EU) 2026/XXX [Chips Act 2.0] on a framework of measures for strengthening Europe’s semiconductor ecosystem, aimed at enabling se miconductor technologies underpinning AI, cloud computing, data centres and edge infrastructures. (28) The Cloud and AI Leadership Initiatives may be supported by funding from Union programmes and other instruments, in particular from Horizon Europe and the digital Europe programme, as well as the InvestEU programme, in accordance with Regulation (EU) 2021/694 ( 20), Regulation (EU) 2021/695 ( 21) and Regulation (EU) 2021/523 ( 22).Under the 2028-2034 multiannual financial framework , the Cloud and AI Leadership Initiatives could continue receiving support under successive Union programmes, subject to their adoption and in accordance with their respective legal bases. (29) In addition to receiving funding under Union programmes, the Cloud and AI Leadership Initiatives may be supported by Member States through research, development an innovation measures , in line with the applicable State aid rules, ensuring that national policies and Union policy are mutually consistent, as well as through private-sector investments. In particular, private-sector stakeholders should be encouraged to take into consideration the Cloud and AI Leadership Initiatives whe n developing their investment strategies for cloud computing and AI. In so doing, private investments can help provide a coherent and coordinated investment pathway 18 Council Regulation (EU) 2021/2085 of 19 November 2021 establishing the Joint Undertakings under Horizon Europe and repealing Regulations (EC) No 219/2007, (EU) No 557/2014, (EU) No 558/2014, (EU) No 559/2014, (EU) No 560/2014, (EU) No 561/2014 and (EU) No 642/2014 ( OJ L 427, 30.11.2021, p. 17, ELI: http://data.europa.eu/eli/reg/2021/2085/oj). 19 Council Regulation (EU) 2021/1173 of 13 July 2021 on establishing the European High Performance Computing Joint Undertaking and repealing Regulation (EU) 2018/1488 ( OJ L 256, 19.7.2021, p. 3, ELI: http://data.europa.eu/eli/reg/2021/1173/oj). 20 Regulation (EU) 2021/694 of the European Parliament and of the Council of 29 April 2021 est ablishing the Digital Europe Programme and repealing Decision (EU) 2015/2240 (OJ L 166, 11.5.2021, p. 1, ELI: http://data.europa.eu/eli/reg/2021/694/oj). 21 Regulation (EU) 2021/695 of the European P arliament and of the Council of 28 April 2021 establishing Horizon Europe – the Framework Programme for Research and Innovation, laying down its rules for participation and dissemination, and repealing Regulations (EU) No 1290/2013 and (EU) No 1291/2013 (OJ L 170, 12.5.2021, p. 1, ELI: http://data.europa.eu/eli/reg/2021/695/oj). 22 Regulation (EU) 2021/523 of the European Parliament and of the Council of 24 March 2021 establishing the InvestEU Program me and amending Regulation (EU) 2015/1017 (OJ L 107, 26.3.2021, p. 30, ELI: http://data.europa.eu/eli/reg/2021/523/oj). EN 22 EN aligned with the broader policy objectives and long -term implementation goals set out by the Cloud and AI Leadership Initiatives. (30) The Commission should receive advice from stakeholders with appropriate expertise on the implementation of the Cloud and AI Leadership Initiatives. The Commission should, in particular, foster cooperation with existing expert and advisory forums, such as the Alliance for Industrial Data, Edge and Cloud, the Apply AI Alliance and the Industrial Alliance for Semiconductors . The Alliance for Industrial Data, Edge and Cloud should act as an exchange forum for various stakeholders in next -generation edge and cloud technologies, including businesses, Member States ’ representatives and other relevant experts. It should help the Commission to design strategic investment road maps to enable the next generation of highly sec ure, distributed, interoperable and resource -efficient computing technologies. The Apply AI Alliance should act as a coordination forum for AI stakeholders and policymakers to advance the discussion on the potential of AI in strategic Union sectors. The Apply AI Alliance should continue to help implement the objectives of the Apply AI Strategy, in particular by organising industrial workshops, identify and assess new AI use cases in strategic sectors and call for specific supporting policy actions. Alongside the Apply AI Alliance, the AI Observatory should provide robust indicators to assess the impact of AI in strategic sectors, monitor technological developments and trends , as well as the changes it may bring to the labour market. (31) The Cloud an d AI Leadership Initiatives should enhance synergies with actions currently supported by the Union and Member States, including under Horizon Europe and the Digital Europe programme, as well as Council Regulation (EU) 2021/1173 and Regulation (EU) 2026/XXX [Chips Act 2.0] on a framework of measures for strengthening Europe’s semiconductor ecosystem. The Commission and the Member States should ensure consistency, complementarity and synergies between the Cloud and AI Leadership Initiatives, and relevant nati onal and regional strategies, programmes and investment plans, including those implemented under national reform programmes, smart specialisation strategies, recovery and resilience plans and other national or regional funding instruments supporting the objectives of the Cloud and AI Leadership Initiatives. Such coordination should aim to maximise the impact of public investments, avoid duplication of funding, promote alignment of priorities across governance levels, and facilitate the scaling -up and deploy ment of results across the Union. (32) In order to ensure that the policies of the Union and the Member States are mutually consistent, Member States should adopt national strategies to help achieve the Union’s objectives on the development of cloud and AI, in line with the AI continent action plan and the Apply AI Strategy. The national strategies should notably include the ‘AI first’ principle defined in the Apply AI Strategy, urging organisations to reflect on their business processes, considering the needs of an opportunities offered by AI, while taking into consideration the potential risks. The national cloud and AI strategies should also be aligned with the associated digital targets set under Decision (EU) 2022/2481 (23), in particular on the adoption of cloud computing services, big data and AI by at least 75% of Union enterprises for their business operations, and the deployment of at least 10 000 climate-neutral highly secure edge nodes in the Union, 23 Decision (EU) 2022/2481 of the European Parliament and of the Council of 14 December 2022 establishing the Digital Decade Policy Programme 2030 (OJ L 323, 19.12.2022 , p. 4, ELI http://data.europa.eu/eli/dec/2022/2481/oj). EN 23 EN while ensuring low latency. The measures adopted under the national strategies could inform the national digital decade strategic road maps (the ‘national road maps’). (33) Where a Member State has already adopted a national strategy that adequately covers the objectives set out in this Regulation, it should not be required to adopt another strategy. However, if a Member State identifies gaps in its existing strategy in light of those objectives, it should update it accordingly. The European Artificial Intelligence Board established by the Artificial Intelligence Act (‘the AI Board’) plays a central role in ensuring the consistent and effective implementation of Union AI policy. As cloud computing underpins and enables AI, the AI Board should serve as a platform to facilitate cooperation and coordination of AI adoption -related activities between the Union and the Member States. In order to perform this task, the AI Board should have the necessary expertise and appropriate participation. (34) Given the unprecedented scale of resources required for frontier AI development, it is necessary to set criteria for the designation of a project as a frontier AI priority project. Such projects should support the development and scaling -up of frontier AI technologies, notably in the sector of cybersecurity . In view of their technical complexity and capital -intensive nature, the projects require a collaborative approach at Union level. It is therefore appropriate to require them to involve broad participation from entities across the Union, in particular through EDICs establis hed pursuant Decision (EU) 2022 /2481 or any other legal structure capable of representing a meaningful share of the Union’s interest. (35) The allocation of sufficient AI computing resources to frontier AI priority projects should be of strategic importan ce to the Union and the Member States. The Union should match, on a proportional basis and within the limits of available European high-performance computing (‘EuroHPC’) capacity, the AI computing resources contributed or committed by the Member States to the designated frontier AI priority projects. The Union and the Member States s hould also provide sufficient compute time for AI industrial innovation, physical AI and p ublic sector AI projects. This is without prejudice to the rules and procedures laid down in Council Regulation (EU) 2021/1173. The EuroHPC JU access policy should be accommodated to reflect the allocation of such computing resources in an efficient, trans parent and timely manner without prejudice to the continuity of ongoing operations and the rights of projects already benefiting from allocated EuroHPC AI computing resources. (36) To achieve the Union’s AI ambitions, it is necessary to strengthen and invest in digital infrastructures, including cloud and edge capacity enabling training, fine -tuning, deployment and real-time operation. The deployment of data centres across the Union is lagging and remains concentrated in a limited number of established hubs, creating structural imbalances between Member States and inefficiencies such as higher costs, increased latency for peripheral regions, unequal opportunities for businesses and slower digit al transformation. Increasing and geographically balancing data centre capacities across the Union is also key to reducing dependencies on external infrastructures, thus mitigating economic security risks and supporting the competitiveness, resilience and sovereignty of the Union. (37) Data centres are critical infrastructure for the Union, and can create substantial economic value, including valuable investments and jobs, and may support innovation ecosystems – especially if they are integrated with local needs and follow best practices. If properly managed, the expansion of data centre capacity in the Union can bring significant economic and strategic benefits, help modernise the energy system, EN 24 EN support clean energy growth and the sustainable use of energy. This depends on the implementation of an adequate framework preventing any negative impacts , such as energy supply stress, adverse environmental impacts and lost opportunities. Data centre acceleration zones (‘acceleration zones’) should contribute to this objective by enabling infrastructure deployment at scale and speed within a clear and streamlined regulatory framework. (38) Where capacity is being deployed on the territory of Member States , acceleration zones should be designated where the development, expansion and modernisation of data centres may be facilitated . The designation of such zones should help address the Union capacity gap and increase the Union’s competitiveness , autonomy and technological resilience, while ensuring com pliance with applicable Union law, including requirements relating to energy efficiency and environmental protection. Sufficient and timely energy supply to the acceleration zones constitutes a fundamental enabling condition for their effective deployment and for the development of data centre capacity across the Union. Reliable and accurate information on future energy demand contributes to cost -effective grid development. Member States should therefore prepare an analysis for each acceleration zone, identifying its current and future energy needs. Such analysis should serve the purpose of providing information for the national grid planning thereby contributing to purposeful anticipatory grid investments and faster energy connections for the acceleration zone. When defining the scope, Member States should take into account the availability of relevant transport and network infrastructure. The results of these assessments should be reflected in national network development plans to adequately capture future points of energy demand in upcoming grid planning. To ensure that acceleration zones enable the right conditions for the deployment of capacity, Member States should facilitate clear and efficient procedures for grid connection and flexible connection agreements and should clarify the conditions for grid connection pursuant to Directive (EU) 2019/944 to data centre operators. An upcom ing legal proposal to future-proof electricity bills in the EU will provide incentives to make an optimal and cost-effective use of the grid infrastructure and incentivise system -friendly consumption. Power purchasing agreements (‘PPAs’) are important inst ruments for data centres as they provide long -term price stability, while enabling data centre operators to procure clean electricity at scale, thereby supporting reliable operations and the transition to a clean energy system. Member States should therefo re promote the uptake of PPAs, also in acceleration zones, by removing unjustified barriers and disproportionate or discriminatory procedures or charges, with a view to providing price predictability. (39) When setting sustainability requirements for data centres deployed in data centre acceleration zones, Member States should ensure that the key performance indicators as defined in Commission Delegated Regulation (EU) 2024/1364 (24) in accordance with Directive (EU) 2023/1791 of the European Parliament and of the Council (25) are used. The objective is to ensure consistent environmental standards, increase energy efficiency and support the Union’s broader climate , environmental and sustainability goals in acceleration zones . Furthermore, to pr event speculative reservation of 24 Commission Delegated Regulation (EU) 2024/1364 of 14 March 2024 on the first phase of the establishment of a common Union rating scheme for data centres ( OJ L 2024/1364, 17.5.2024, ELI: http://data.europa.eu/eli/reg_del/2024/1364/oj). 25 Directive (EU) 2023/1791 of the European Parliament and of the Council of 13 September 2023 on energy efficiency and amending Regulation (EU) 2023/955 (recast) ( OJ L 231, 20.9.2023, p. 1, ELI: http://data.europa.eu/eli/dir/2023/1791/oj). EN 25 EN resources in acceleration zones, ensuring fair, reasonable and non-discriminatory access that preserves effective competi tion and supports the timely and efficient development of acceleration zones, Member States should ensure that the allocation and use of resources within those zones takes place on fair, reasonable and non - discriminatory terms and does not give rise to any speculative reservation or foreclosure pr actices capable of impeding effective competition or the effective development or use of those zones. (40) To facilitate and accelerate the deployment of data centre projects in acceleration zones, Member States should designate single information point s or where possible, upgrade or integrate with those designated pursuant to Regulation (EU) 2024/ 1309 of the European Parliament and of the Council (26). (41) Regulation (EU) 202X/XX X [on speeding -up environmental assessments ] (27) establishes a common acceleration framework for environmental assessments to boost the Union’s roll-out of key technologies, reduce dependencies and increase competitiveness. Procedures linked to environmental assessments should be accelerated and streaml ined for plans, programmes and projects across all sectors of the economy while maintaining high levels of protection of human health and the environment. Some sectors may, however, require faster environmental assessments. To ensure the coherence of the l egal framework for environmental assessments, while accommodating the need for accelerated deployment in certain strategic sectors, Regulation (EU) 202X/ XXX [on speeding-up environmental assessments ] establishes a dedicated toolbox . Given their role in ens uring the achievement of the Union’s climate and environmental objectives through their contribution to improving energy efficiency, enabling clean energy integration, and providing the infrastructure needed for smarter grids, transport systems, and low-carbon technologies , and their contribution to the Union’s resilience and economic security by ensuring reliable infrastructure in the Union to protect critical services and strengthening the Union ’s capacity to operate independently , data centre proje cts deployed in acceleration zones should be considered strategic projects within the meaning of Regulation (EU) 202X/XXX [on speeding -up environmental assessments ] and therefore benefit from the dedicated toolbox established under that Regulation. Member States should establish an aggregated baseline permit reflecting the specific characteristics of each identified acceleration zon e. That aggregated baseline permit issued by public authorities should cover the permits commonly required for such activities within the area, excluding the grid connection permits. (42) It should be possible for the Commission to designate as strategic projects data centre projects that significantly contribute to the Union’s digital and energy sectors and that meet clear criteria. Considering the importance of the data centre strategic projects, Member States may, without prejudice to Articles 107 and 108 TFEU, apply support measures in a proportionate manner to those projects. When planning such support measures, Member S tates should, where applicable, make use of the relevant frameworks for providing public support. Strategic projects should address a market 26 Regulation (EU) 2024/1309 of the European Parliament and of the Council of 29 April 2024 on measures to reduce the cost of deploying gigabit electronic communications networks, amending Regulation (EU) 2015/2120 and repealing Directive 2014/61/EU (Gigabit Infrastructure Act) (OJ L 2024/1309, 8.5.2024, ELI: http://data.europa.eu/eli/reg/2024/1309/oj). 27 Add reference to the Regulation on speeding -up environmental assessments once adopted. See Commission proposal COM(2025) 984 final, https://eur-lex.europa.eu/legal- content/EN/TXT/?uri=celex:52025PC0984. EN 26 EN failure in a proportionate manner, without duplicating or crowding out private financing, while ensuring clear Union added value. (43) Data centre strategic projects should be granted support from Union programmes, funds and financial instruments, in accordance with the objectives set out in the regulation establishing those funds and programmes and without prejudice t o the next (2028-2034) multiannual financial framework. In particular, those strategic projects should be granted the competitiveness seal where they fulfil the conditions set out in Regulation (EU) 2026/XXX [on establishing the European Competitiveness Fu nd] (ECF’) ( 28), as high -quality projects that contribute to the objective of the European Competitiveness Fund. (44) To foster the strategic deployment of data centre capacity across the Union, the Commission should monitor the available compute capacity and the volume of demand for data centre capacity and identify the size of the capacity gap across the Union. Such monitoring may be used by the Commission to inform its possible recommendations. To guide Member States in accelerating the deployment of dat a centre capacity, the Commission may recommend, where appropriate, measures to address the identified Union capacity gap. In accordance with the Digital Decade Policy Programme 2030, the Commission should also review the digital decade targets to reflect the technical, economic or societal developments and the evolution of the Union’s priorities in that regard. (45) This Regulation should apply to Union institutions, bodies, offices and agencies (‘Union entities’) when carrying out procedures for the procurement of cloud computing services and AI systems falling within the scope of this Regulation. (46) The Union still remains critically dependent on a limited number of cloud computing service providers subject to the control of third countries or legal entities established in third-countries. This exposes the Union to critical strategic dependencies and concentration risks, including vulnerabilities arising f rom the extraterritorial application of third-country laws, potential disruptions affecting the continuity, quality and resilience of cloud computing services, reduced control and oversight over personal and non -personal data and infrastructure, and the risk of undue economic or political influence being exercise d through the control by third countries or legal entities established int third -countries of cloud computing services. Against this background, the ability of the Union and its Member States to retain control over infrastructure, data, assets and technolo gy systems under Union and national jurisdiction has become an imperative policy objective. (47) Existing Union law addresses cybersecurity, data protection, interoperability and data portability requirements which cloud computing services are subject to . However , there is no cross-cutting Union regulatory framework establishing a harmonised understanding of what constitutes a trusted cloud computing service for mitigating such risks. Some Member States have developed or are in the process of de veloping national approaches to identifying national sovereign services. However, national measures do not adequately address the cross-border issues related to the Union’s lack of sovereignty in the cloud computing ecosystem and risk fragmenting the Union internal market and undermining common goals of autonomy and sovereignty. 28 Add refe rence to Regulation on establishing the European Competitiveness Fund once adopted. See Commission proposal, COM(2025) 555 final/2, https://eur-lex.europa.eu/legal- content/EN/TXT/?uri=celex:52025PC0555R%2801%29. EN 27 EN (48) Cloud computing service providers have launched tailored versions of their service offerings in response to the Union’s growing concerns over sovereignty . However, those versio ns do not address the core sovereignty issues allowing for the extraterritorial reach of third -country laws and the possible degradation or disruption of the service . Consequently, the Union will not ensure autonomy or control over its data, assets and di gital infrastructure. The current framework therefore needs to be complemented by targeted actions at Union level by introducing a harmonised mechanism that can strengthen the Union’s long -term strategy for technological autonomy, control and resilience in the cloud and AI ecosystem. (49) Against this background, the significant increase in public order concerns – including, for example, economic security risks – requires effective and coherent implementation of safeguards for activities supported by the Union budget. In the context of Union entities, Article 136 of Regulation (EU , Euratom) 2024/2509 (29), sets out the scope, rules and procedures for identifying and implementing sensitive public procurement procedures. (50) To protect public order, it is t herefore necessary to specify the conditions that Union and Member State s’ contracting authorities should use in public procurement procedures of cloud computing services. The consideration of possible exposure to risk is fundamental when selecting appropriate mitigation measures to preserve the public order of the Union and Member States. The Union and Member States being critically dependent on a limited number of cloud computing service providers subject to the control of a third country or a legal entity established in a third-country may lead to risk s such as misuse (i.e. manipulation, remote access and control, sabotage, weaponisation), access to information (i.e. access to sensitive information, unauthorised communication, technology leakage, data manipulation or exfiltration, espionage) and dependency vulnerabilities (i.e. political and/or economic coercion, for example by using vendor or technology lock -ins, embargos or sanctions, monopoly pricing damaging the financial interest of the Union and Member States). (51) To address those risks and provide for the appropriate mitigation measures , it is necessary to establish a Union cloud computing sovereignty framework determining criteria for trusted cloud computing services. To cater for the nuan ced and layered nature of sovereignty, the framework should provide for four different levels of trusted offers (‘Union assurance levels’). (52) The Union assurance levels should provide for a proportionate framework to ensure that public order is preserved by maintaining control and agency by public-sector bodies. Most public services would not require the highest levels of assurance . In some specific cases Union assurance levels 3 or 4 may be considered necessary and proportionate in preserving public order . The risk assessment to be performed by Member States and Union entities ensures that the principles of proportionality and subsidiarity are complied with , by assessing the specific cases in which protection of public order requires the highest level of assurance. (53) It is important that national competent authorities of establishment of the cloud computing service provider can assess whether cloud computing service providers aiming to provide their cloud computing services to Union entities and public sector bodies offer the appropriate assurance level. A mechanism for recognition of cloud 29 Regulation (EU, Euratom) 2024/2509 of the European Parliament and of the Council of 23 September 2024 on the financial rules applicable to the general budget of the Union (recast) ( OJ L, 2024/2509, 26.9.2024, ELI: http://data.europa.eu/eli/reg/2024/2509/oj). EN 28 EN computing services that either have an EU statement of conformity against Union assurance level 1 or have received a ‘positive’ audit opinion and audit report by an auditing organisation has been established. Once the mechanism of recognition has been positively concluded, the cloud computing service is recognised across the Union as offering the appropriate Union assurance level. In the interest of clarity, simplicity and effectiveness, the powers to supervise and enforce the obligations relating to the cloud computing sovereignty fram ework should be conferred to the competent authorities in the Member State where the main establishment of the cloud computing service provider is located. (54) In order to demonstrate compliance with Union assurance level 1 , cloud computing service providers should have sole responsibility for carrying out conformity self - assessments by applying the relevant criteria for that Union assurance level. Such self- assessments should be based on documented evidence, internal contro l procedures and continuous monitoring that are sufficient to demonstrate that the applicable criteria have been fulfilled. (55) Independent audits are an important tool for monitoring the compliance of cloud compuring services provided by cloud computing service. Given the need to ensure that the applicable criteria for Union assurance levels 2, 3 or 4 are verified by third- party independent experts, cloud computing service providers should be accountable, through independent auditing, for their compliance with the criteria set out by this Regulation. Cloud computing service providers should be free to select the auditing organisation of their choice as long as the auditing organisation demonstrates the necessary independence and compliance with the requirements in this Regulation . To ensure that audits are carried out in an effective, efficient and timely manner, cloud computing service providers should provide the necessary cooperation and assistance to the organisations carrying out the au dits, including by giving the auditing organisations access to all relevant data and premises necessary to perform the audit properly and answering oral or written questions. Auditing organisations should also be able to make use of other sources of object ive information. Cloud computing service providers should not undermine the performance of the audit. Audits should be performed in accordance with best industry practices and high professional ethics and objectivity, with due regard for auditing standards and codes of practice. Auditing organisations should guarantee the confidentiality, security and integrity of the information, such as trade secrets, that they obtain when performing their tasks. That guarantee should not be a means to circumvent the appl icability of audit obligations in this Regulation. Auditing organisations should have the necessary expertise in risk management and technical competence to audit cloud computing services. They should comply with core independence requirements for prohibited non -auditing services, firm rotation and non -contingent fees. If their independence or technical competence of auditing organisations is not beyond doubt, they should abstain or resign from the audit engagement. (56) The audit report should be substantiated to give a meaningful account of the activities undertaken and the conclusions reached during the audit. It should help provide information for, and where appropriate suggest improvements to , the measures taken by the cloud computing service providers to comply with the applicable criteria and their obligations under this Regulation. The audit report should incl ude an audit opinion based on the conclusions drawn from the audit evidence obtained. A ‘positive opinion’ should be given where all evidence shows that the provider complies with the audit criteria and obligations set out by this Regulation. A ‘negative o pinion’ should EN 29 EN be given where the auditing organisations considers that the provider does not comply with the criteria set out in this Regulation. Where the audit opinion cannot reach a conclusion on specific aspects that fall within the scope of the audit , an explanation of the reasons why this was not possible should be included in the audit opinion. Where applicable, the report should include a description of specific points that could not be audited, and an explanation as to why they could not. (57) The establishment of a central repository of recognised Union-assured cloud computing services is necessary to facilitate the secure and efficient storage, access and exchange of relevant information between public sector customers of services offering Union assurance levels, auditing organisations, competent authorities and the Commission. (58) To ensure the continued accuracy and reliability of the status of cloud computing services as offering Union assurance levels pursuant to the cloud sovereignty framework, providers should be required to promptly report any relevant information or material changes in circumstances to the auditing organisation and the competent authorities of establishment. That information should enable the auditing organisation to re assess, amend or withdraw the audit report and opinion where necessary, with notifications subsequently being sent to the relevant competent authority of establishment for it to review its recognition of the cloud computing service as offering a certain Union assurance level. The information should also enable the same for the relevant competent authority regarding its recognition of the cloud computing service. (59) To ensure effective and consistent application of the cloud sovereignty framework, Member States should designate one or more competent authorities responsible for recognising the auditing procedure and framework and the supervision of recognised cloud computing service providers. Those authorities should be granted the necessary powers, resources, expertise and technical means to carry out their tasks in an effective, impartial and independent manner. Member States should ensure that the responsibilities of those authorities are clearly set out and that they cooperate closely with each other, with other relevant national authorities , including Data Protection Authorities and Cybersecurity Authorities , and with the Commission , where appropriate, to ensure cons istent supervision and facilitate the exchange of relevant information and best practices across the Union. It should be possible for Member States to designate one or more existing authorities as competent authorities. (60) The provision of mutual assista nce between competent authorities is essential to ensure the effective supervision and enforcement of this Regulation across the Union borders, including through the timely exchange of information, coordination of investigative measures and support in the execution of tasks within the Union. Furthermore, effective enforcement requires robust cross -border cooperation between competent authorities to ensure the consistent application of this Regulation across Member States and the timely sharing of relevant i nformation to address systemic risks within the Union (61) The Union’s objective of strengthening its autonomy should be pursued in a manner that remains open, cooperative and consistent with the Union’s international commitments and partnerships. The policy objectives pursued through Union assurance levels 1, 2, and 3 should therefore be understood as the Union’s capacity to act autonomously where necessary, while remaining engaged with its international partners and fostering mutuall y beneficial cooperation. Against this background, the EN 30 EN Commission may decide, for Union assurance level 3, that a cloud computing service subject to the control of a third country or a legal entity established in a third -country can still be audited agains t the audit criteria where the third country has implemented specific safeguards that ensure that there is no risk of unauthorised access to Union data or possible disruption of service quality or continuity. The Commission should assess whether the third country is covered by an adequacy decision adopted pursuant to Article 45 of Regulation (EU) 2016/679. In particular, it should be determined whether the adequacy decision applies generally to the third country as a whole or is limited to specific sectors or certified organisations. It should be further assessed whether the scope of the adequacy decision extends to the specific processing activities that are carried out in the context of the service provision, or whether transfers remain subject to the requirements to implement appropriate safeguards. (62) To ensure a coherent and risk -based approach to the autonomy of the Union, Member States and the Union entities should carry out one or more risk assessments to determine public-sector activities that concerns public order. The risk assessment should determine which Union assurance level is appropriate for the activities , due to their importance in preserving public order in sectors falling under Directive (EU) 2022/2555 and in the areas of national securit y, internal security, external border management, defence, justice or law enforcement, including the prevention, investigation, detection and prosecution of criminal offence . To ensure consistent application of this Regulation and preserve the inte grity of the digital single market, the Commission will provide guidance to assist Member States in carrying out their risk assessments. Whereas the determination of the level of sensitivity of information that may be hosted in a cloud computing service that offer s a Union assurance level lies within the competence and discretion of the Member States, to provide consistency across the Union, Union assurance levels 3 and 4 should allow for the secure hosting of EU classified information. (63) In their risk assessments, Union entities and Member State shall assess the sensitivity, criticality and magnitude of personal and non -personal data processed in cloud environment. Such processing may include ordinary business information, commercially sensitive information, operationally critical data, personal data within the meaning of Regulation (EU) 2016/679, and data that is subject to sector-specific obligations under Union law, including Directive (EU) 2022/2555 and Regulation (EU) 2022/2554. The guidance by the Commission allows for a degree of flexibility to Union entities and Member States in determining the appropriate Union as surance levels and the categories of information and users for which such levels are appropriate. At the same time, divergent national approaches to the classification and mapping of data sensitivity and assurance requirements may undermine the consistent application of the sovereignty framework across the Union. To ensure harmonised implementation across the Union, the Commission should, in cooperation with relevant authorities, provide centrally coordinated guidance on the mapping between Union assurance levels and categories of information, taking into account the sensitivity, criticality and magnitude of the data processed by the cloud environment, the systematic importance of the activities of the contracting authorities, and the applicable obligations arising from Union law. Furthermore, the criteria under the Union assurance levels should not affect obligations of cross -border cooperation provided by Union law. Where cloud computing services are used to process personal data, Regulation (EU) 2016/679 p rovides for an obligation to agree on organisational and technical measures to comply with that Regulation. Where the cloud computing service provider relies on subcontractors in the provision of the services, the same EN 31 EN agreements apply to the subcontractor s. Where specific technical and organisational measures should b e implemented pursuant to this Regulation to ensure that personal data are processed in line with this Regulation, such specific measures could be foreseen in the mandatory agreements pursuant to Regulation (EU) 2016/679 and could be relied on to demonstrate that the necessary Union assurance levels are met. (64) The free flow of data within the Union is an essential condition for the proper functioning of the internal market. To promote the f ree flow of data within the Union and to support the functioning of the internal market, it is appropriate that Member States ensure that data is not confined to the territory of a single Member State and may be stored and processed across the Union withou t unjustified restrictions. The Union maintains an open and non -discriminatory framework for market access, in accordance with the TFEU and subject to international commitments. Th ose include commitments under the World Trade Organization (WTO) Agreement on Government Procurement (GPA), as well as bilateral trade agreements. Nevertheless, where necessary and in duly justified circumstances, the Union retains the right, in accordance with Article III:2(a) of the WTO GPA, to adopt or maintain measures necessary to protect public morals, order or safety, allowing for necessary and proportionate restrictions on access to public procurement procedures. Indeed, identifying and addressing risks such as critical dependencies, unauthorised access to Union data, techno logy leakage, sabotage and espionage by third-country actors is fundamental for preserving Union public order . Preserving the protection of public order of the Union and its Member States requires a prudent but firm political, legal and operational response for both national and Union-level award procedures, in full respect of international commitments. To protect and preserve the public order of the Union and its Member States, contracting authorities whose activities have been identified on the basis of the Member State risk assessment should therefore procure only the cloud computing service providing the appropriate level of assurance between levels 2 and 4. A minimum assurance level , by mandating Union assurance level 1 across the Union , is necessary to establish a consistent baseline of safeguards for the public sector , thereby reducing vulnerabilities in the public sector to th ird country access to Union data and disruption of services. (65) To enhance resilience and limit dependency on a single cloud computing service provider, Union entities and Member States should, as part of their public procurement procedures, consider whether a multi -vendor or multi -cloud strategy may be appropriate. The decision to adopt and implement a multi -cloud architecture should be based on a context -specific risk assessment. The assessment should identify any relevant operational, regulatory or resilience -related circumstances that would support the adoption of a multi-vendor or multi-cloud strategy. (66) Public procurement frequently serves as a primary signal of market direction. Requirements imposed by or on pu blic authorities to adopt specific assurance levels offered by cloud computing services tend to be mirrored by private-sector entities operating in regulated industries, with subsequent spillover effects contributing to broader market realignment over time. Those developments underscore the importance of private-sector entities operating in the sectors in Annex I to Directive (EU) 2022/2555 to be able to carry out the same assessments as those carried out by Union entities and Member States. (67) In public procurement procedures for cloud computing services and AI systems , contracting authorities should include clear European added value as part of the quality evaluation of the tender. Such added value should consist in helping reinforce EN 32 EN the digital supply chain in the Union ; integrating Union technologies ; conducting the innovation required to deliver the service in the Union ; and delivering the service using hardware components designed or manufactured in the Union. The criterion relating to European added value should not be decisive for award of the contract and should be applied in a manner that preserves the primacy of technical and financial criteria directly connected to the performance requirements. For this purpose, contracting authorities could consider a maximum weighting of 15 out of 120 points to be allocated to European added value within the overall evaluation methodology, ensuring that it remains proportionate and subordinate to the core contract award criteria. (68) Innovation procurement in cloud computing services and AI systems is essential to foster technological development, strengthen digital resilience and competitiveness and enable public authorities to benefit from secure, efficient and trustworthy digital solutions that evolve with rapidly changing technological and societal needs. Member States should therefore aspire to award at least 25% of relevant cloud and AI procurement innovation procedures to SMEs . To that end, Member States should actively report on their uptake of innovative cloud computing services and AI systems to the Commission. (69) In the joint declarations ‘Building the next -generation cloud for businesses and the public sector in the EU ’ of 15 October 2020 (30) and the Berlin Declaration on Digital Society and Value -Based Digital Government of 8 December 2020 (31), Member States expressed great interest in determining a common approach to federating cloud capacities by interconnecting cloud computing infrastructures across the Union and working towards the deployment of a secure and interoperable European public -sector cloud federation. In its conclusions on the future of EU digital policy of 21 May 2024 (32), the Council of the European Union confirmed the relevance and importa nce of achieving this common approach by inviting the Commission to continue its support for the development of interoperable public digital services and the cross -border interconnection of public administrations’ infrastructure, including cloud and edge infrastructures, to increase their resilience, efficiency and sustainability. To achieve this common approach, it is necessary to establish the European public -sector cloud federation (‘the EuroCloud Federation ’). The EuroCloud Federation should bring together national and European cloud initiatives that provide highly trusted and secure public-sector cloud capabilities and facilitate the sharing of such capabilities between Union entities and public -sector bodies . When evaluating this Regulation, t he Commission may , at a later stage, assess the possibility for acceding countries, candidate countries and potential candidates , as well as for international organisations whose headquarters are in the Union, to participate in the EuroCloud Federation, in accordance with Union law. (70) The members of the EuroCloud Federation should comply with specific requirements to avoid any distortion of competition in relation to private economic operators by placing a private provider of services in a position of advantage over its competitors. 30 Joint declaration, ‘Building the next generation cloud for businesses and the public sector in the EU ’, 15.10.2020, https://digital-strategy.ec.europa.eu/en/news/towards-next-generation-cloud-europe. 31 Berlin Declaration on Digital Society and Value -based Digital Government , 8.12.2020, https://digital- strategy.ec.europa.eu/en/news/berlin-declaration-digital-society-and-value-based-digital-government. 32 Council conclusions on the Future of EU Digital Policy, 21.5.2024, https://data.consilium.europa.eu/doc/document/ST-9957-2024-INIT/en/pdf. EN 33 EN (71) Participation within the EuroCloud Federation should be limited to public entities, without direct participation of a private party . In this regard, direct private participation should be excluded where the sharing entity, either directly or indirectly through an intermediate legal entity, owns the hardware , as defined in Article 3, point (5), of Regulation (EU) 2024/2847 of the European Parliament and of the Council (33), over which the service is made available, and provides that service. The sharing entity should be deemed to exercise control over that intermediate legal entity where the following cumulative conditions are fulfilled. First, the sharing entity should exerc ise a decisive influence over both strategic objectives and significant decisions of the intermediate legal entity that owns the hardware and provides the services. Second, there should not be any direct private capital participation in that intermediate l egal entity. Third, more than 80% of the activities of the intermediate legal entity should be carried out in the performance of tasks entrusted to it by the sharing entity. (72) To ensure effective, secure and resilient provision of services, the sharing entity should put in place appropriate technical, operational and organisational measures. This should include, in particular, policies on risk analysis and information system security, including access control policies, policies on incident handling and b usiness continuity and policies supporting interoperability and connectivity. (73) Finally, the sharing of data centre services and cloud computing services within the EuroCloud Federation should be anchored in a public-sector cooperation. Such cooperation should be governed solely by considerations of public interest, and should not entail any form of consideration in exchange for another. In particular, the sharing of services within the EuroCloud Federation should be free of charge, except where the charges are limited strictly to what is necessary and proportionate to recover the costs incurred by the sharing entity for the beneficiary using entity. Those costs should be l imited to the additional costs incurred in the sharing of capacity, including for allocating and isolating resources, managing access, enabling the integration and interoperability of resources, ensuring compliance with the applicable requirements under Union law and managing the sharing relationship. The fees levied by the sharing entity to recover those costs should not be deemed as a consideration for the provision of a service and should not constitute a pecuniary interest or public contract within the meaning of Directive 2014/24/EU of the European Parliament and of the Council (34) and Regulation (EU, Euratom) 2024/2509. Under those conditions, the sharing of public-sector data centre services and cloud computing services within the EuroCloud Federation should not fall under Union public procurement rules. (74) Contracting authorities of Member States frequently encounter significant difficulties in procuring digital solutions such as data centre services , cloud computing services , software and AI systems. Limited financial resources, reduced purchasing power, insufficient technical or procurement expertise prevent public -sector bodies from effectively accessing such services. Procurement activities conducted by the Commission in concertation with the contracting authorities of Member States can play a decisive role in harnessing collective purchasing power and ensuring acc ess to 33 Regulation (EU) 2024/2847 of the E uropean Parliament and of the Council of 23 October 2024 on horizontal cybersecurity requirements for products with digital elements and amending Regulations (EU) No 168/2013 and (EU) 2019/1020 and Directive (EU) 2020/1828 (Cyber Resilience Act) ( OJ L, 2024/2847, 20.11.2024, ELI: http://data.europa.eu/eli/reg/2024/2847/oj). 34 Directive 2014/24/EU of the European Parliament and of the Council of 26 February 2014 on public procurement and repealing Directive 2004/18/EC ( OJ L 94, 28.3.2014, p. 65, ELI: http://data.europa.eu/eli/dir/2014/24/oj). EN 34 EN those services and supplies on favourable terms. The Commission may already carry out joint procurement procedures with contracting authorities of Member States pursuant to Article 168(2) of Regulation (EU, Euratom) 2024/2509 . The Commission may also already act as a wholesaler by buiying, stocking, and reselling or donating supplies and services to partner organisations selected by it. In order to enable those entities to full y exploit the potential of the internal market, in particular as regards economies of scale and benefit sharing, the possibilities for the Commission to act as a central purchasing body should be extended to contracting authorities of Member States and to partner organisations selected by the Commission , as a form of procurement additional to those in Article 168(3) of the Regulation (EU, Euratom) 2024/2509. It should be possible for the Commission to use all the procurement procedures available for the benefit of contracting authorities of Member States and of partner organisations selected by the Commission and to include purchasing activities conducted by the Commission for Union institutions, bodies and agencies. Contracting authorities of Member States, partner organisations and Union institutions, agencies and bodies should be considered as ‘participating entities’ in those procurement procedures. (75) In order to increase flexibility and administrative efficiency, it is appropriate to provide, in a derogation from the Regulation (EU, Euratom) 2024/2509 , for the possibility of adding participating entities during the lifespan of a dynamic purchasing system. Under that derogation, participating entities that have acceded to the agreement after the establishment of a dynamic purchasing system should be permitted – subject to the prior approval of the Commission – to join that system at any point during its period of validity, before any future invitation to tender is issued . That possibility should be strictly limited to newly accedi ng participating entities and should not affect the rights and obligations of entities already participating in the system or the integrity of procurement procedures already concluded or ongoing. (76) The Commission should present to the Member States a dr aft agreement setting out the practical arrangements governing the procurement activities. Given the potentially large number of participating entities involved, that draft agreement should be negotiated and initially concluded between the Commission and t he Member States willing to participate. It should lay down the conditions and procedure by which Union entities as well as other Member States , contracting authorities of Member States and partner organisations selected by the Commission may subsequently accede to and benefit from it. The agreement will enter into force in accordance with its provisions, subject to the approval of at least two Member States. Although the Commission should, as far as possible, aim to address the common needs of participating entities, this should not be construed as an obligation to satisfy needs that are specific to a limited number of them. (77) Where participating entities enter into an agreement for the provision of central purchasing activities, including ancillary purchasing activities, they should not apply the public procurement procedures provided for in applicable Union law , in accordance with Directive 2014/24/EU and Regulation (EU, Euratom) 2024/2509 . Any contracting authority from Member States entering into such an agreement for the purpose of organising central purchasing activities should be deemed to fulfil its obligations pursuant to the national law transposing Directive 2014/24 /EU if it purchases works, supplies or services from a contracting authority responsible for the procurement procedure. EN 35 EN (78) The agreement should establish a steering committee composed of the Commission and representatives of Member States . The committee is responsible for strateg ic oversight of the procurement activities, including the strategic guidance of the agenda of public procurement activities and of each procurement procedure. The steering committee should also oversee the involvement of participating entities . The steering committee should not be responsible for the operations of procurement activities, which should remain the responsibility of the Commission, including the setting of fees. The steering committee should provide for the most adequate method to select additional representatives from Union entities, from contracting authorities from Member States and from partner organisations selected by the Commission. (79) The rules governing responsibility and the applicable public procurement framework between the Commission, acting as a central purchasing body , and the participating entities procuring through it should be clarified in the agreement. Where a participating entity conducts certain parts of the procurement procedure autonomously, it should remain solel y responsible for those stages of autonomous conduct . A contracting authority which acts as a central purchasing body and has acquired services or supplies through the Commission should be permitted to offer those services to other contracting authorities without applying the public procurement procedures provided for under applicable Union law. In that case, the contracting authority is bound to comply with the initial contractual provisions in any subsequent contract. (80) In order to ensure that the nece ssary resources remain available , the participating entities will contribut e to the costs incurred in the procurement procedures and any ancillary activity. To this end, the Commission should be entitled to charge fees to the participating entities. Those fees should be set at a level sufficient in principle to cover all the direct and indirect costs incurred by the Commission in connection with the procurement activities, including any ancillary services. Those fees should be established in accordance with practices of comparable procurement frameworks. Initial establishment costs may be borne by the general budget of the Union and reimbursed by the participating entities over a set period. Revenues generated by the fees should constitute internal assigned revenues within the meaning of Article 21(3)(a), of the Regulation (EU, Euratom) 2024/2509. (81) Open source plays an important role in ensuring transparency, security and efficiency in the use of digital technologies by the p ublic sector. Access to the source code enables auditability, foster s collaboration and reuse and reduce s dependency on a single vendor, thereby limiting the risk of vendor lock -in. Promoting the use of open source is therefore essential to support innovat ion, ensure better value for public expenditure and strengthen the Union’s digital autonomy. In that context, the choice of cloud computing services or software has significant implications not only for cost - efficiency, but also for security, interoperabil ity, accountability and technological autonomy (82) To ensure the efficient, transparent and interoperable use of digital technologies across the Union’s public sector, it is necessary for public administrations to promote open standards and components released under an open source licence when building their cloud and AI ecosystem or stack. (83) An increasing number of Union entities and public-sector bodies are sharing software developed by or for them and making it available for reuse under an open-source licence. This may be considered to be in the public interest and may maximise the EN 36 EN value of public expenditure , reduce duplication costs and foster innovation across the Union. However, software is often made availab le and accessible in different repositories or catalogue s, hampering searchability , discoverability and , ultimately, reuse. It is therefore necessary to require Union entities and public-sector bodies that voluntarily decide to make software available for reuse to do so in a catalogue or repository that is connected to EU Open Source Solutions Catalogue (‘the EU OSS Catalogue’). The OSS Catalogue should serve as a centralised catalogue for any public administration to search and access software made available for reuse by Union entities and public sector bodies. Hosting the EU Open Source Solutions Catalogue on the Interoperable Europe portal referred to in Article 8 of Regulation (EU) 2024/903 (35) will ensure that solutions can be easily linked to further relevant information and training. (84) In order to ensure effective and consistent implementation across the Union of the obligations to conduct an open-source assessment and to make software available for reuse, it is necessary to set up a network of open-source programme offices (‘the OSPO network’) bringing together the relevant structures within Union entities and Member States. This OSPO network should promote coordination between open - source programme offices established at local, regional or national level and by Union entities. The OSPO network should facilitate the exchange of information and best practices. (85) In order to take account of technol ogical development and maintain an efficient framework of measures for strengthening the cloud and AI ecosystem at Union level , the power to adopt acts in accordance with Article 290 TFEU should be delegated to the Commission in respect of: amending Annex I to reflect relevant market and technological developments regarding the Cloud and AI Leadership Initiatives and amending Annex II to update the criteria for Union assurance levels; supplementing this Regulation by laying down detailed rules for the performance of audits ; amending Annex III ; specifying a Union assurance level for a contracting authority ; and requiring an impact assessment and risk mitigation measures for private companies operating in sectors of high criticality. (86) When adopting delegated acts under this Regulation, it is of particular importance that the Commission carries out appropriate consultations during its preparatory work, including at expert level, and that those consultations are conducted in accordance with the principles set out in the Interinstitutional Agreement of 13 April 2016 on Better Law-Making (36). In particular, to ensure equal participation in the preparation of delegated acts, the European Parliament and the Council s hould receive all documents at the same time as Member States ’ experts, and their experts should always have access to meetings of Commission expert groups dealing with the preparation of delegated acts. (87) In order to ensure uniform conditions for the i mplementation of this Regulation, implementing powers should be conferred on the Commission . Those powers should 35 Regulation (EU) 2024/903 of the European Parliament and of the Council of 13 March 2024 la ying down measures for a high level of public sector interoperability across the Union (Interoperable Europe Act) (OJ L, 2024/903, 22.3.2024, ELI: http://data.europa.eu/eli/reg/2024/903/oj). 36 Interinstitutional Agreement between the European Parliament, the Council of the European Union and the European Commission on Better Law -Making (OJ L 123, 12.5.2016, p. 1, ELI: http://data.europa.eu/eli/agree_interinstit/2016/512/oj). EN 37 EN be exercised in accordance with Regulation (EU) No 182/2011 of the European Parliament and of the Council (37). (88) Due to the relevance of th is Regulation on the protection of personal data, t he European Data Protection Supervisor should be consulted, where necessary, i n accordance with Article 42(1) of Regulation (EU) 2018/1725 (38). (89) If any of the measures provided for by this Regulation constitute State aid, the provisions concerning such measures are without prejudice to the application of Articles 107 and 108 TFEU. (90) This Regulation should be without prejudice to the application of Articles 101 and 102 TFEU, and to the enforcement powers of competition authorities. (91) Since the objectives of this Regulation cannot be sufficiently achieved by the Member States, but can rather, by reason of the scale or effects of the action, be better achieved at Union level, the U nion may adopt measures, in accordance with the principle of subsidiarity as set out in Article 5 of the TEU. In accordance with the principle of proportionality, as set out in that Article, this Regulation does not go beyond what is necessary in order to achieve those objectives, HAVE ADOPTED THIS REGULATION: 37 Regulation (EU) No 182/2011 of the European Parliament and of the Council of 16 February 2011 laying down the rules and general principles concerning mechanisms for control by Member States of the Commission’s exercise of implementing powers, ( OJ L 55, 28.2.2011, p. 13, ELI: http://data.europa.eu/eli/reg/2011/182/oj). 38 Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1 247/2002/EC (OJ L 295, 21.11.2018, p . 39, ELI: http://data.europa.eu/eli/reg/2018/1725/oj). EN 38 EN TITLE I GENERAL PROVISIONS Chapter I Subject matter and definitions Article 1 Subject matter 1. This Regulation establishes a framework for strengthening the cloud and AI ecosystem at Union level, in particular through the following measures: (a) establishing the Cloud Leadership Initiative and the AI Leadership Initiative (‘the Cloud and AI Leadership Initiatives’); (b) setting the framework for the accelerated deployment of data centres across the Union; (c) enabling the availability of a sovereign cloud and artificial intelligence ( AI) offer to safeguard the Union’s public order; (d) reducing dependencies on critical technologies; (e) fostering the adoption of cloud computing services across the public sector. 2. The first general objective of this Regulation is to ensure the conditions necessary for the competitiveness and innovation capacity of the Union’s cloud and AI ecosystem. 3. The second general objective, separate from and complementary to the first general objective in paragraph 2, is to improve the functioning of the single market by laying down a uniform Union legal framework for increasing the Union’s resilience and strategic autonomy in cloud and AI technologies. Article 2 Definitions For the purposes of this Regulation, the following definitions apply: (1) ‘cloud computin g service’ means cloud computing service as defined in Article 6 , point (30), of Directive (EU) 2022/2555; (2) ‘cloud computing service provider’ means a legal entity which provides a cloud computing service; (3) ‘AI system’ means an AI system as defined in Article 3 , point (1), of Regulation (EU) 2024/1689; (4) ‘frontier AI’ means AI models or AI systems built upon such models that can perform a wide variety of tasks and that approach, reach or exceed the current state of the art; (5) ‘AI agent’ means an AI system or a coordinated set of AI systems, that can perceive and act upon their environment, with a degree of autonomy, us ing tools as needed to achieve specific goals and adapt to changing inputs and contexts; EN 39 EN (6) ‘public sector body’ means public sector body as defined in Article 2, point (1), of Directive (EU) 2019/1024; (7) ‘Union entities’ means the Union institutions, bodies, offices and agencies set up by or pursuant to the Treaty on European Union, the Treaty on the Functioning of the European Union (TFEU) or the Treaty establishing the European Atomic Energy Community; (8) ‘small and medium -sized enterprise’ or ‘SME’ means a small or medium -sized enterprise as defined in Article 2 of Annex I to Commission Recommendation 2003/361/EC; (9) ‘small mid-cap’ or ‘SMC’ means a small mid -cap enterprise as defined in point 2 of the Annex to Commission Recommendation (EU) 2025/1099; (10) ‘data centre’ means data centre as defined in point 2.6.3.1.16 of Annex A to Regulation (EC) No 1099/2008 of the European Parliament and of the Council; (11) ‘data centre operator’ means data centre operator as defined in Article 2, point (7), of Delegated Regulation (EU) 2024/1364; (12) ‘data centre service’ means data centre service as defined in Article 6, point (31), of Directive (EU) 2022/2555; (13) ‘software’ means software as defined in Ar ticle 3, point (4), of Regulation (EU) 2024/2847; (14) ‘hardware’ means hardware as defined in Article 3, point 5, of Regulation (EU) 2024/2847; (15) ‘component’ means component as defined in Article 3, point (6), of Regulation (EU) 2024/2847; (16) ‘manufacturer’ means manufacturer as defined in Article 3 , point (13), of Regulation (EU) 2024/2847; (17) ‘auditing organisation’ means an individual organisation, a consortium or other combination of organisations, including any subcontractors, that the a udited cloud computing service provider has contracted to perform an independent audit; (18) ‘audited service’ means a cloud computing service being audited for the purpose of receiving an audit report and an audit opinion; (19) ‘audit criteria’ means the criteria, pursuant to Annex II to this Regulation , against which the auditing organisation assesses whether the audited provider and its audited service comply with each cumulative criterion to be met for it to be recognised as offering Union assurance levels 2, 3, or 4; (20) ‘audit evidence’ means any information used by an auditing organisation to support the audit findings and conclusions and to issue an audit opinion, including data collected from documents, databases or IT systems, interviews or testing performed; (21) ‘control’ means control as defined in Article 2 , point (6) , of Regulation (EU) 2021/697; (22) ‘contracting authorities’ means contracting authorities as defined in Article 2(1), point (1), of Directive 2014/24/EU; (25) ‘open source licence’ means open source licence as defined in Article 2, point (12), of Regulation (EU) 2024/903. EN 40 EN TITLE II RESEARCH, DEVELOPMENT AND DEPLOYMENT ACTIVITIES FOR THE CLOUD AND AI ECOSYSTEM Chapter I Cloud and AI Leadership Initiatives Article 3 General objective of the Cloud and AI Leadership Initiatives 1. The Cloud and AI Leadership Initiatives shall pursue the general objective of promoting research and innovation activities and achiev ing large-scale capacit y throughout the Union’s cloud and AI ecosystem, by: (a) supporting the development and deployment of cutting-edge cloud and AI technologies, including next -generation resource -efficient data centre technologies, open cloud computing stack technologies, frontier AI, and physical and industrial AI; (b) reinforcing the Union’s data centre and cloud capacity to meet the growing demands driven by AI, foster innovation and ensure the resilience of the digital infrastructure; (c) stimulating the U nion’s demand and promoting the deployment and uptake of cloud and AI technologies across the public sector, and the private sector, in line with the digital target of digital transformation of businesses , established by Decision (EU) 2022/2481. 2. The Clo ud and AI Leadership Initiatives shall pursue the following operational objectives: (a) supporting the development and deployment of advanced data centre technologies incorporating principles of energy efficiency and resource efficiency by design and throughout operations (operational objective 1); (b) supporting the development and deployment of cloud computing stacks supporting the Union’s technological autonomy (operational objective 2); (c) advancing Union’s capabilities in frontier AI (operational objective 3); (d) advancing Union’s capabilities in physical AI models and systems and fostering their deployment across the Union’s strategic sectors (operational objective 4); (e) accelerating the development and uptake of industrial AI across the Union ’s strategic sectors (operational objective 5); (f) supporting the development of advanced platforms for the large -scale deployment of AI agents (operational objective 6); (g) increasing the development and adoption of AI models and systems across the Union’s public sectors (operational objective 7); EN 41 EN (h) increasing the adoption of AI technologies at regional and local level, and the uptake of cloud computing services provided by European cloud computing service providers (operational objective 8). Article 4 Operational objectives of the Cloud and AI Leadership Initiatives 1. Under operational objective 1, the Cloud and AI Leadership Initiatives shall: (a) advance energy- and water-efficiency technologies for data centres, including innovative cooling, next -generation direct current data centres, waste heat utilisation solutions, and energy storage systems; (b) promote the integration of emerging quantum computing technologies for cloud and AI computing infrastructure operations; (c) develop AI -powered technologies for optimising server efficiency, utilisation rates and computing infrastructure operations; (d) design and optimise cloud and edge AI infrastructures to ensure effective integration with energy grids and to increase theirflexibility; (e) leverage data centres as anchor clients for advanced energy management systems harnessing diverse energy sources, including small modular reactors and clean hydrogen, alongside efficient energy storage solutions; (f) deploy test beds and pilot lines to integrate and test technologies developed under points (a) to (e), covering energy -efficient semiconductor and quantum computing prototypes. 2. Under operational objective 2, the Cloud and AI Leadership Initiatives shall: (a) develop and pilot secure, resilient and performant open cloud computing stacks covering on-device edge, connectivity, data and AI tools, backend and service layers for strategic sectors; (b) develop AI -optimised servers and baseline software based on processors, accelerators and quantum accelerators designed and manufactured in the Union, alongside next -generation ultra -high density and long -term data storage; (c) boost data availability for AI via open -source middleware platforms underpinning common European data spaces; (d) foster the creation of open-source software foundations supporting open-source components; (e) establish a catalogue of European open cloud computing solutions developed under points (a) to (d) of this paragraph. 3. Under operational objective 3, the Cloud and AI Leadership Initiatives shall support pioneering projects in frontier AI that develop frontier AI models and systems as strategic assets, including in key sectors such as cybersecurity. 4. Under operational objective 4, the Cloud and AI Leadership Initiatives shall: (a) accelerate the development of a European physical AI stack, supporting model training and system development and deployment, in particular for robotics and autonomous vehicles and drones; EN 42 EN (b) facilitate access to, and the collection and preparation of, specific datasets for physical AI; (c) support the development, testing and validation in real -world environments of physical AI models and systems. 5. Under operational objective 5, the Cloud and AI Leadership Initiatives shall: (a) accelerate the development and uptake of sectoral AI models and systems across the Union’s strategic industrial sectors; (b) facilitate access to the necessary computing resources and AI tools required to develop and operationalise AI models and systems tailored to industrial sector needs; (c) enable secure large -scale data pooling for collaborative AI training through technologies enhancing privacy and preserving confidentiality. 6. Under their operational objective 6, the Cloud and AI Leadership Initiatives shall: (a) support the development of advanced resilient and secure platforms for the development, deployment and orchestration of advanced AI agents at scale; (b) facilitate the development of targeted testing and experimentation methodologies of advanced AI agents and their orchestration throughout their lifecycle. 7. Under operational objective 7 the Cloud and AI Leadership Initiatives shall: (a) accelerate the technological development and uptake of AI models and systems in critical public sector domains; (b) develop AI models and systems that increase the effectiveness of public service delivery and accessibility for the general public, improve decision-making, and simplify administrative procedures; (c) promote the sharing and reusing of training data and AI models across the Union’s public services; (d) facilitate secure, privacy-enhancing health data reuse for AI models and tools in healthcare; (e) facilitate the developme nt, testing and deployment of AI models and tools in the automotive sector, including for autonomous driving. 8. Under operational objective 8 the Cloud and AI Leadership Initiatives shall: (a) promote the broad adoption of AI by private and public sector organisations, including SMEs and SMCs, through the network of Experience and Acceleration Centres for AI (‘Centres for AI’); (b) develop a common cloud and AI curriculum, drawing on the network of Centres for AI and other relevant European initiatives; (c) promote the sharing of public sector data centre services and cloud computing services by supporting a European public sector cloud federation (‘EuroCloud Federation’); (d) support the procurement of data centre services and cloud computin g services for Union entities and public sector bodies. EN 43 EN Article 5 Experience and Acceleration Centres for AI 1. Each Member State shall establish Experience and Acceleration Centres for AI (‘Centres for AI’). Those Centres for AI shall build on the European digital innovation hubs established under Article 16 of Regulation (EU) 2021/694 and, where applicable, any successor entities established under Union law. 2. The objectives of the Centres for AI shall be to: (a) support the integration and scaling-up of AI use cases in strategic industrial and public sectors; (b) accelerate the broad adoption of cloud and AI technologies at regional and local levels, notably for SMEs, SMCs and public sector bodies, in line with the ‘AI first’ principle; (c) leverage relevant infrastructure to accelerate the development and fine -tuning of AI models and systems. 3. The Centres for AI shall be tasked, in particular, with: (a) helping organisations accelerate their digital transformation through a ccess to and use of AI technologies, including by connecting organisations with European providers of cloud and AI technologies; (b) ensuring or providing access to relevant upskilling and reskilling schemes, in close collaboration with the AI Skills Academy; (c) facilitating the transfer of expertise across regions; (d) supporting the scaling-up of spin-offs and start-ups emerging from universities, incubators and other accelerators by facilitating access to clients, companies and organisations seeking specialised AI services. 4. The Commission may adopt implementing acts detailing the procedure for establishing Centre s for AI and further arrangements concerning the participant organisation profile, selection criteria and details on the implementation of the tasks and functions. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 46(2). 5. Centres for AI shall have substantial overall autonomy as regards their organisation, composition and working methods, in compliance with the objectives set out in this Regulation. 6. A network of Centres for AI shall be established to support collaboration and the exchange of best practices among Centres for AI, and to provide specialised services across regions where the required skills or compute capacity are not available locally. 7. Member States and the Commission shall cooperate with existing networks established under other Union initiatives , including Union initiatives in the field of semiconductors and data. Article 6 Implementation of the Cloud and AI Leadership Initiatives 1. The implementation of the Cloud and AI Leadership Initiatives’ operational objectives shall be entrusted to the Commission and the Member States and, where EN 44 EN relevant, to joint undertakings or any other structure s capable of achieving those objectives. 2. The Cloud and AI Leadership Initiatives’ operational objectives shall be implemented through large-scale, cross -sectoral initiatives addressing major technological and industrial challenges of strategic relevan ce for the Union (‘grand challenges’), as indicated in Annex I. 3. The Cloud and AI Leadership Initiatives may be supported by funding from Union programmes, including Horizon Eur ope and the Digital Europe Programme, in accordance with Regulation (EU) 2021/694 and Regulation (EU) 2021/695. 4. To reflect technological and market developments the Commission is empowered to adopt delegated acts in accordance with Article 45 to amend Annex I in a manner consistent with the objectives of the Cloud and AI Leadership Initiatives set out in Article 4. Article 7 National cloud and AI strategies 1. By [same day as entry into force plus one year], Member States shall establish national cloud and AI strategies (the ‘national strategies’). 2. The national strategies shall include at least the following: (a) key objectives and priorities for cloud and AI adoption, in line with the ‘AI first’ principle, as well as a governance and monitoring framework to achieve those objectives and priorities; (b) measures to accelerate the development and adoption of cloud and AI at national, regional and local level, particularly among public sector bodies, SMEs and SMCs, including by supporting the Centres for AI referred to in Article 5 as entry points to the European AI innovation ecosystem; (c) measures to support the broad deployment and uptake of AI in strategic industrial and public sectors, including in healthcare, energy and mobility; (d) measures to support the deployment of data centre capacity, with a particular focus on high -value data centres delivering significant economic and societal benefits while adhering to high environmental and energy-efficiency standards; (e) measures to invest in high -intensity computing infrastructure, including AI factories, AI gigafactories and quantum computers as strategic national and cross-border assets supporting research, development and industrial AI deployment across strategic sectors; (f) measures to support the development of cloud and AI capabilities and promote excellence and innovation, including through public procurement me asures, and public procurement of innovation measures set out in Article 33; (g) measures to support the development of cloud computing stack technologies built upon open hardware and software to strengthen technological sovereignty and enhance the competitiveness of strategic European industries; (h) measures to ensure the accessibility of high -quality data for AI development, notably by preventing data bottlenecks encountered by organisations. 3. National strategies shall be consistent with the objectives of this Regulation EN 45 EN 4. Member States shall ensure that their national strategies are consistent with, and contribute to, the associated digital targets established under Article 4 of Decision (EU) 2022/2481. 5. The Member States shall notify the Commission of their national strategies within three months of their adoption. Member States shall assess their national strategies at least every three years on the basis of key performance indicators and, where necessary, update them. The Commission shall monitor the adoption and revision of the national strategies. 6. The European Artificial Intelligence Board established by Regulation (EU) 2024/1689 (the ‘AI Board’) shall advise and assist the Member States as regards the coordination of national strategies . T he AI Board shall facilitate exchange of best practices among Member States. Article 8 Criteria for frontier AI priority projects The Commission may , by means of a decision, recognise as frontier AI priority projects, projects selected through open calls for expression of interest that support grand challenge 3 set out in Annex I, provided that the following criteria are fulfilled: (a) it is a pioneering project, focused on the support and scaling -up of frontier AI technologies; (b) it is undertaken by a European digital infrastructure consortium established pursuant Decision (EU) 2022/24 81 or another legal entity eligible for funding under Union law and it involves the participa tion of at least three Member States; (c) the participating Member States pool computing time and other relevant resources to support the implementation of the designated project. Article 9 Computing support for AI projects 1. The Union and the Member States shall ensure th at sufficient AI computing resources from their compute capacities are allocated to support the development of frontier AI priority projects that fulfil the criteria set out in Article 8, within the limits of available capacity. 2. The Union shall at least match the AI computing resources contributed by Member States to frontier AI priority projects to the extent that sufficient AI comput ing capacity is available within the Union’s share of European high performance computing access time. 3. The Union and the Member States shall endeavour to provide sufficient computing resource for AI industrial innovation, physical AI and public sector AI projects. EN 46 EN TITLE III DATA CENTRE CAPACITIES Chapter I Data centre acceleration zones Article 10 Designation of data centre acceleration zones 1. Where data centre capacity is being deployed within the territory of a Member State, that Member State shall designate at least one data centre acceleration zone (‘acceleration zone’) within its territory by [P.O. insert the date of entry into force of this Regulation plus 6 months]. Member States shall consider the following aspects when designating acceleration zones: (a) the location and dimension of the site or area, and the minimum and maximum size of the facilities that could be built on that site or area; (b) the available and future power grid capacity and the possibility and conditions for on-site storage and clean energy generation; (c) the available and future network connectivity capacity; (d) the capacity of the zone to support the phasing out of legacy copper networks; (e) the available and future facilities that can reuse data centre waste heat; (f) all the measures taken to accelerate the granting of the necessary permits for constructing and operating data centres within the given zone; (g) the preference for reusing brownfield sites over using greenfield sites; (h) the ability of the site or area to function sustainably, particularly as regards preventing or minimising environmental impacts and support ing the reduction of carbon emissions and its climate resilience. 2. Member States , where appropriate to facilitate t he development of acceleration zones, shall: (a) conduct, and review at least every three years, a comprehensive analysis of the energy needs and their respective impacts on greenhouse gas emissions, of current and future acceleration zone s and identify the required energy infrastructure capacity for the proper functioning and development of data centre projects located in the acceleration zones. Such analysis shall be conducted, at least, when designating the acceleration zones pursuant to paragraph 1; (b) ensure that the network development plans prepared by transmission system operators pursuant to Article 51 of Directive (EU) 2019/944 of the European Parliament and of the Council and distribution system operators pursuant to Article 32 o f Directive (EU) 2019/944 take due account of the analysis prepared pursuant to point ( a) of this paragraph, considering the potential of anticipatory investments to accommodate future system needs. 3. National, regional and local authorities responsible for preparing spatial and development plans shall consider including , in those plans, provisions for the EN 47 EN development of data centre projects deployed in acceleration zones, and of the necessary infrastructure. Member States shall ensure that all relevant spatial planning data are available to data centre operators . Where those plans are subject to an assessment pursuant to Directive 2001/42/EC of the European Parliament and of the Council and Article 6 of Directive 92/43/EEC, those assessments s hall be combined. Where applicable, the combined assessment shall also address the impact on potentially affected water bodies referred to in Directive 2000/60/EC of the European Parliament and of the Council. 4. When designating acceleration zones, Member States shall ensure the involvement of and coordination among all relevant national, regional and local authorities and entities, including operators as defined in Article 2, point (29), of Directive (EU) 2018/1972 of the European Parliament and of the Council , transmission system operators as defined in Article 2, point (35), of Directive (EU) 2019/944 and distribution system operators as defined in Article 2, point (29), of Directive (EU) 2019/944. Article 11 Conditions within acceleration zones 1. When setting sustainability requirements for data centres deployed in acceleration zones, Member States shall use the key performance indicators specified in Delegated Regulation (EU) 2024/1364 pursuant to Directive (EU) 2023/ 1791 under Annex II, from (a) to (n). 2. Member States shall ensure that the allocation and use of resources within acceleration zones takes place on fair, reasonable and non -discriminatory terms and does not give rise to speculative reservation or foreclosure practices capable of impeding effective competition or the effective development or use of those zones. Article 12 Single information points 1. The data centre operator shall have the right , upon request, to be assisted by a single information point throughout the entire lifecycle of the data centre project in a n acceleration zone with respect to all authorisations required for the deployment of the data centre. For that purpose, Member Stat es shall designate one or more single information points for data centre operators of data centre projects in acceleration zones. The Member States may designate for this purpose a single information point established under Regulation (EU) 2024/1309. The functions, procedures and mechanisms applicable to such single information points under Regulation (EU) 2024/1309, including those relating to digital access, administrative coordination and dispute settlement, shall also apply. 2. The role of a single information point may include, among other things, coordinating, facilitating, monitoring and sharing information on the procedure relating to: (a) spatial planning and building permits; (b) environmental assessments, in accordance with Regulation (EU) 2026/XXXX [on speeding-up environmental assessments]; (c) authorisations regarding water abstraction, wastewater discharge, and heat utilisation and recovery; (d) compliance with applicable administrative and reporting obligations; EN 48 EN (e) information to the public, with the aim of increasing public acceptance of the data centre project; (f) applications for connection to the electricity, heat or communications networks, or to other relevant networks. 3. The single information point shall assist in assessing whether a data centre project may qualify as a strategic project under Article 14. 4. When providing the administrative support and the assistance referred to in this Article, the single point of contact shall pay particula r attention to SMEs and, where appropriate, establish a dedicated channel for communication with SMEs to provide guidance and respond to queries related to the implementation of this Regulation. Article 13 Facilitating administrative and permit-granting processes 1. Data centre projects deployed in acceleration zones shall be considered as strategic projects within the meaning of Article 14 of Regulation (EU) 2026/XXX [on speeding-up environmental assessments] and shall benefit from the toolbox set out in the Annex to that Regulation. 2. For each designated acceleration zone, Member States shall prepare and issue an aggregated baseline permit authorising the deployment of data centres in that acceleration zone . This aggregated baseline permit shall cover the permits and administrative authorisations required for the data centre projects located within the acceleration zone, excluding installation-specific permits. 3. Before issuing the aggregated baseline permit referred to in p aragraph 2 , Member States shall carry out all necessary procedures and assessments, including any relevant environmental assessments, planning procedures and evaluations applicable at the level of the acceleration zone. 4. Data centres deployed in acceleration zones shall be required to obtain additional permits only for activities falling outside the aggregated baseline permit referred to in paragraph 2. 5. Member States shall ensure that administrative applications relate d to the planning, construction and the operation of data centre deployed in acceleration zones are processed in an efficient, transparent and timely manner. The permit -granting procedure for data centre projects deployed in data centre acceleration zones shall not exceed 12 months, from the moment a comprehensive application has been submitted. The time limit shall be without prejudice to any shorter time limits set by Member States. Where such a status exists in national law, data centre projects shall be allocated the status of highest national significance possible and be treated as such in permit -granting processes. This paragraph shall apply only where such status exists in national law and shall not create an obligation for Member States to introduce such status. EN 49 EN Chapter II Strategic projects SECTION 1 DESIGNATION OF DATA CENTRE STRATEGIC PROJECTS Article 14 Designation of data centre strategic projects 1. The Commission may, by means of a decision, designate as strategic projects, data centre projects selected through open calls for expressions of interest that fulfil at least two of the following criteria: (a) the project establishes and operates infrastru cture that directly supports and enhances essential public sector functions, including research and education, healthcare, public safety and security; (b) the project includes highly sustainable or innovative features, including technologies and solutions developed under Title II; (c) the project contributes to the security, safety, and stability of the electricity grid and contributes to the electricity system needs as evaluated by the relevant system operator, in particular for projects involvin g the colocation of large clean energy generation and storage facilities; (d) the project supports the integration of chips, processors and accelerators, servers or quantum computers designed and/or manufactured in the Union into data centre systems or data centre facility management, thereby strengthening the Union semiconductor, quantum and data centre supply chains and contributing to the objectives of this Regulation and of Regulation (EU) 2023/1781; (e) the project addresses a major shortage of compute capacity in an area identified as having such a shortage under Article 15 and contributes significantly to the growth, development and promotion of the local economy. 2. In its proposal, the applicant shall provide all the necessary and relevant information to demonstrate that the project fulfils the relevant criteria. 3. The duration of the designation as a strategic project shall be based on the predicted lifetime of the project. The applicant shall includ e in the proposal the information necessary to substantiate the predicted lifetime of the project, on the basis of which the duration of the designation as strategic project shall be determined. 4. Where the Commission finds that a project designated as a strategic project no longer fulfils the relevant criteria, or where its designation was based on an application containing incorrect information affecting compliance with those criteria, it may withdraw the designation of that project by me ans of a decision. Projects for which the designation as a strategic project has been withdrawn shall lose all rights connected to that status under this Regulation. EN 50 EN Chapter III Monitoring Article 15 Monitoring the capacity gap 1. For the purpose of monitoring progress in the achievement of the objective s of Decision (EU) 2022/2481, the Commission shall identify and monitor: (a) the comput e capacity available in the Union, including edge computing capacity; (b) the volume of demand for data centre capacity; (c) the size of the capacity gap and underserved areas that could be identified by the Commission, in cooperation with the Member States, and subsequently used as acceleration zones for the deployment of data centre capacity. EN 51 EN TITLE IV AUTONOMY Chapter I Cloud computing sovereignty framework SECTION 1 UNION ASSURANCE LEVELS Article 16 Scope 1. This Chapter establishes a Union cloud computing sovereignty framework comprising four Union assurance levels, the criteria for which are set out in Annex II, that cloud computing service providers shall meet in order to provide their cloud computing services to Union entities and public sector bodies. 2. The Commission is empowered to adopt delegated acts in accordance with Article 45 to amend the Union assurance levels set out in Annex II and the evidence set out in Annex III. 3. To ensure Annex II and Annex III remain up to date with new legal or technical developments, the Commission shall review them at least every 18 months. Article 17 Recognition of cloud computing service providers 1. A cloud computing service provider that aims to be recognised as offering a Union assurance level, shall submit an application for recognition to the national competent authority of establishment. When submitting an application for recognition, the cloud computing service provider shall include all the relevant evidence required under paragraphs 3 or 4. 2. The competent authority of establishment shall be the evaluating national competent authority. An evaluating national competent authority that has received an application for a candidate recognition, may, where necessary, request one or more competent authorities of the other Member States to collaborate in the procedure for a candidate recognition under this Article. Within 15 days of receiving such a request, the national authority that has received a request for coll aboration shall either provide confirmation that it agrees to collaborate with the evaluating national competent authority or refuse the request. 3. For Union assurance level 1, the candidate cloud computing service provider shall submit to the evaluating national competent authority the EU statement of conformity referred to in Article 19(2) and all the necessary evidence. By way of derogation from the first subpragraph, the EU statement of conformity issued under Article 19(2) by cloud computing service providers that are SMEs shall be directly and automatically recognised in all Member States without the need for prior recognition by the evaluating national competent authority. EN 52 EN 4. For Union assurance levels 2, 3 and 4, the candidate cloud computing service provider shall submit to the evaluating national competent authority the audit report, the ‘positive’ audit opinion referred to in Article 2 0 and all the evidence provided to the auditing organisation during the audit procedure. 5. Within 60 days of accepting an application pursuant to paragraph 1 , the evaluating national competent authority shall assess the evidence submitted pursuant to paragraphs 3 or 4 and shall either: (a) prepare a draft recognition decision and notif y, as soon as possible, the competent authorities of the other Member States for a 60-day review period to confirm its intended recognition of the cloud computing service across the Union as offering the applicable Union assurance level. The notification to the competent authorities of the other Member States of the review period shall include the evidence referred to in paragraphs 3 or 4; or (b) where the evidence submitted is insufficient to allow the evaluating competent authority to recognise the cloud computing service, it may request further information from the applicant and request that the applicant submit such information within a specified time limit. The period of 60 days referred to in this paragraph shall be suspended from the date of issue of the request until the date the information is received. Th e suspension shall not exceed 30 days in total unless it is justified by the nature of the information requested or by exceptional circumstances; or (c) reject the request for recognition. Prior to rejecting the request for recognition, the evaluating competent authority shall give the candidate cloud computing service provider the opportunity to provide written comments on the conclusions of the evaluation within 30 days. The evaluating competent authority shall take due account of tho se comments when finalising its conclusions. 6. During the review period referred to in paragraph 5, point (a), the national competent authority of another Member State may submit a reasoned objection or request for clarification to the evaluating national competent authority, where it considers that the draft recognition decision does not comply with the applicable Union assurance level set out in Annex II. 7. Where no reasoned objec tion or request for clarification is submitted within the review period referred to in paragraph 5, point (a), the conclusions by the evaluating national competent authority shall be deemed accepted by all Member States , the evaluating national competent authority shall adopt the recognition decision and the audited service shall be recognised throughout the Union at the appropriate Union assurance level. 8. Where a request for clarification is submitted within the review period referred to in paragraph 5, point (a), the evaluating national competent authority shall take due account of such request and, where applicable, request new information from the applicant as per paragraph 5 , point (b) or confirm or modify its original draft decision. Where the requesting competent authority is not satisfied, it may submit a reasoned objection. 9. Where a reasoned objection is submitted within the review period referred to in paragraph 5, point (a), or following the procedu re referred to in paragraph 8 , the evaluating national competent authority shall assess the objection and shall either EN 53 EN maintain or revoke its original draft decision . The evaluat ing national competent authority shall inform the competent authorities of the other Member States within 15 days after the end of the review perioed referred to in paragraph 5, point (a), or within 15 days after receiving the reasoned objection following the procedure referred to in paragraph 8, whichever is applicable. 10. In case the evaluating national competent authority intends to maintain its draft decision, the concerned national competent authority may refer the matter to the Commission. The Commission shall assess the referral and may request information from the national competent authorities concerned . The Commission shall adopt a binding decision determining whether the evaluati ng national competent authority may adopt the recognition decision. 11. The evaluating national competent authority may revoke its recognition where it finds that a cloud computing service provider, whose service was recognised across the Union as providing a specific Union assurance level, intentionally or negligent ly, supplied incorrect or misleading information. 12. The Commission may adopt implementing acts concerning the practical arrangements for the procedures referred to in this Article. Those implementing acts shall be adopted in accordance with the examinati on procedure referred to in Article 46(2). 13. The Commission may, in order to carry out the tasks assigned to it under paragraph 10 , require that national competent authorities of establishment provide, as soon as possible and within a reasonable period, any relevant information relating to the concerned cloud computing service provider and the application for recognition. 14. When sending a request for information , the Commission shall state the purpose of the request, specify what information is required and set the period within which the information is to be provided. Article 18 Associated third countries 1. The Commission may adopt decision s, by means of implementing acts, identifying third countries for which cloud computing service providers subject to the control of that third country or a legal entity established in that third country may be audited against the criteria for Union assuranc e level 3 pursuant to Annex II, provided that that third country fulfils the following cumulative criteria: (a) it is subject to a relevant adequacy decision adopted under Article 45 of Regulation (EU) 2016/679; (b) it has no measures in place that enable it to exercise control over the cloud computing service provider in a way that would conflict with the requirements for lawful access to non -personal data set out in paragraphs 2 and 3 of Article 32 of Regulation (EU) 2023/2854; (c) it has no measures in p lace to compel the cloud computing service provider to degrade or disrupt service continuity or provision. It also has no measures in place to oblige the cloud computing service provider to implement, enforce, give effect to, or comply with restrictive mea sures such as sanction regimes, embargoes, or any equivalent legal or administrative measures, unless these EN 54 EN specific measures are legitimate under the national laws of Member States or Union law; (d) it has no measures in place to impede the provision of s tate-of-the-art technologies and services provided by the cloud computing service provider; (e) it maintains an open market to Union cloud computing services; (f) the third country grants equivalent levels of access to public procurement procedures of cloud computing services subject to the control of a Union Member State or entity or a legal entity established in the Union. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 46(2) 2. Where available information reveals that the third country no longer fulfils the requirements under paragraph 1, the Commission shall repeal, amend or suspend the decision referred to in paragraph 1. 3. The Commission shall publish on its website a list of third countries that fulfil the requirements under paragraph 1 and those that no longer do so. SECTION 2 CONFORMITY ASSESSMENT PROCEDURES Article 19 Conformity self-assessment 1. Cloud computing service providers seeking recognition in accordance with Article 17 as offering Union assurance level 1, shall carry out a c onformity self-assessment of compliance with the criteria for Union assurance level 1 set out in Annex II. 2. Following the self -assessment referred to in paragraph 1, t he cloud computing service provider shall issue an EU statement of conformity stating that compliance with the criteria for Union assurance level 1 have been demonstrated. By issuing such a statement, the cloud computing service provider shall assume responsibility for the compliance of the cloud computing service with the criteria for Union assurance level 1set out in Annex II. 3. The cloud computing service provider shall make the EU statem ent of conformity publicly available. SECTION 3 INDEPENDENT THIRD-PARTY AUDITS Article 20 Independent audit 1. Cloud computing service providers seeking recognition in accordance with Article 17 as offering Union assurance level 2, 3, or 4 , shall undergo at their own expense, independent third-party audits to obtain an audit report and an audit opinion from an auditing organisation. An audited provider undergoing an audit procedure at a higher Union assurance level shall satisfy all the applicable cumulative criteria under Annex II applicable to the lower Union assurance levels. Failure to meet any requirements of a lower assurance level shall preclude conformity with the higher Union assurance levels. EN 55 EN 2. Audited providers shall cooperate with aud iting organisations and provide them assistance necessary to enable them to conduct those audits in an effective, efficient and timely manner, including by giving them access to all relevant data and premises and by answering oral or written questions. Audited providers shall refrain from hampering, unduly influencing or undermining the performance of the audit. 3. Auditing organisations shall ensure an adequate level of confidentiality and professional secrecy in respect of the information obtained from th e audited providers and third parties as part of the audits, including after the audits have ended. That requirement shall not adversely affect the performance of the audits and other provisions of this Regulation. Under Article 23, the auditing organisation shall only share information that are necessary for the reporting purposes and do not contain any information that could reasonably be considered confidential. 4. Audits referred to paragraph 1 shall be performed by auditing organisations that: (a) are independent from, and do not have any conflicts of interest with, the cloud computing service provider concerned, and any legal person connected to that provider, in particular: i. have not provided non-audit services related to the matters audi ted to the cloud computing service provider concerned or to any legal person connected to that provider in the 12-month period before the beginning of the audit, and have committed to not providing them with such services in the 12-month period after the completion of the audit; ii. have not provided auditing services pursuant to this Article to the cloud computing service provider concerned or any legal person c onnected to that provider in the 10-year period before the beginning of the audit; iii. are not performing the audit in return for fees that are contingent on the result of the audit; (b) have proven expertise, technical competence and capabilities in aud iting cloud computing services; (c) have proven objectivity and professional ethics, based in particular on adherence to codes of practice or appropriate standards. 5. Auditing organisations that perform the audits shall prepare an audit report for each audit. That report shall be substantiated, in writing, and shall include at least the following: (a) the name, address and point of contact of the provider subject to the audit , and the period covered; (b) the name and address of the auditing organisa tion or organisations performing the audit; (c) a declaration of interests; (d) a description of the specific aspects audited, and the methodology applied; (e) a description and a summary of the main findings drawn from the audit; (f) a list of the third parties consulted as part of the audit; (g) a ‘positive’ or ‘negative’ audit opinion and any information on whether the audited service of the audited provider complies with the applicable audit criteria for Union assurance level 2, 3 or 4 pursuant to Annex II; EN 56 EN (h) where the audit opinion is ‘ negative’, operational recommendations on specific measures to achieve compliance and the recommended timeframe to achieve compliance; (i) where the audit opinion is ‘positive’, the Union assurance level that needs to be recognised under Article 17, issued to the audited service of the audited provider pursuant to the applicable criteria set out in Annex II. 6. Where the auditing organisation was unable to audit certain aspects or to express an audit opinion based on its investigations, the audit report shall include an explanation of the circumstances and the reasons why those aspects could not be audited. 7. The auditing organisation may revoke its audit report and audit opinio n where the audited provider, intentionally or negligently , supplied incorrect or misleading audit evidence. 8. The audited provider shall annually sub mit for review the audit report and the associated ‘positive’ audit opinion to the same or a different auditing organisation which shall assess the continued compliance of the audited service with the applicable criteria set out in Annex II. On the basis of the annual review, the auditing organisation may confirm, update, or revoke the initial audit report and audit opinion. 9. The Commission is empowered to adopt delegated acts in accordance with Article 45 to supplement this Regulation by laying down rules on the performance of audits on the procedural steps, rules for auditing organisations and their technical competences, auditing methodologies and templates for the audit reports. Article 21 Content and quality of audit evidence 1. To prepare the audit report and audit opinion, the auditing organisation shall assess the compliance of the audited service with the criteria set out in Annex II on the basis of the audit evidence listed in Annex III. The Commission is empowered to adopt delegated acts in accordance with Article 45 to amend Annex III by laying down the necessary evidence needed to assess the audit criteria under Annex II. 2. The audit evidence shall be: (a) relevant and sufficient to enable the auditing organisation to prepare an audit report and provide an audit opinion; and (b) reliable, according to the auditing organisation’s professional judgment and scepticism. Article 22 Central repository of cloud computing services 1. The Commission shall establish and maintain a dedicated repository of cloud computing services that have been recognised in accordance with Article 17 (‘central repository’). 2. The national competent authority of establishment that recognised a cloud computing service under Article 17 shall register the cloud computing service in the central repository. EN 57 EN 3. The revocation of an audit report and audit opinion by an auditing organisation or the revocation of a recognition by a competent authority shall be published in the central repository and shall remain available there for five years. 4. The central repository shall be publicly available and regularly updated by the Commission and the national competent authorities of establishment on a dedicat ed and easily accessible website. Article 23 Transparency obligations 1. On becoming aware of any information or any material change in circumstances that may affect the audit report and the ‘positive’ opinion under Article 2 0 or the recognition under Article 17, the recognised cloud computing service provider shall , as soon as possible , notify the auditing organisation and the national competent authority of establishment. 2. On the basis of the notification under paragraph 1 , the auditing organisation shall assess whether the audit report or the audit opinion need to be amended or revoked. Where the auditing organisation amends or revokes the audit report or the audit opinion, it shall, as soon as possible, notify the national competent authority of establishment. 3. On the basis of the notification referred to in paragraph 1 or 2 , the national competent authority of establishment shall assess whether its recogni tion needs to be amended or revoked. Where the national competent authority of establishment amends or revokes it recognition of the cloud c omputing service, it shall, as soon as possible, notify the national competent authorities of the other Member States and the Commission. Article 24 Penalties and compensation 1. Member States shall lay down the rules on penalties applicable to infringements of this Chapter by cloud computing service providers within their competence and shall take all measures necessary to ensure that they are implemented. The penalties provided for shall be effective, proportionate and dissuasive. Member States shall, as soon as possible , notify the Commission of those rules and of those measures and shall notify the Commission of any subsequent amendment affecting them. 2. Member States shall take into account the following non -exhaustive criteria for the imposition of penalties for infringements of this Regulation: (a) the nature, gravity, scale and duration of the infringement; (b) any action taken by the infringing party to mitigate or remedy the damage caused by the infringement; (c) any previous infringements by the infringing party; (d) the financial benefits gained or losses avoided by the infringing party due to the infringement, insofar as such benefits or losses can be reliably established; (e) any other aggrava ting or mitigating factor applicable to the circumstances of the case; (f) infringing party’s annual turnover in the preceding financial year in the Union. EN 58 EN 3. Recipients of the cloud computing services shall have the right to seek, in accordance with Union and national law, compensation from cloud computing service providers for any damage or loss suffered due to an infringement by those providers of their obligations under this Chapter. SECTION 4 NATIONAL COMPETENT AUTHORITIES Article 25 National competent authorities 1. By [P.O. insert date of entry into force plus 1 year ], Member States shall designate one or more national competent authorities responsible for enforcing this Chapter. To that effect, Member States may designate an existing authority or existing authorities (‘competent authorities’). 2. Member States shall notify the Commission of the names of the competent authorities and of their tasks and powers . The Commission shall maintain a public register of those authorities. 3. Member States shall ensure that their competent authorities perform their tasks under this Regulation in an impartial, transparent and timely manner. Member States shall ensure that their competent authorities have all necessary resources to carry out their tasks, including sufficient technical, financial and human resources to adequately supervise all cloud computing service providers within their competence. 4. The Member State in which the cloud computing service provider has its main establishment, that is, where the cloud computing service provider has its head office or registered office from which the principal financial functions and operational control are exercised, shall have exclusive competence for enforcing this Chapter. Article 26 Powers of the national competent authorities 1. Where needed to carry out their tasks under Article 17, competent authorities of establishment shall have the following investigative powers: (a) the power to require any cloud computing service provider, as well as any other persons acting for purposes related to their trade, business, craft or profession , who may reasonably be expected to be aware of information relating to a suspected infringement of this Regulation, including auditing organisations, to provide that information as soon as possible; (b) the power to carry out, or to request a judicial authority in their Member State to order , inspections of any premises that those providers or those persons acting for purposes related to their trade, business, craft or profession , use for purposes related to their trade, business, craft or profession, or to request other public authorities to d o so, in order to examine, seize, take or obtain copies of information relating to a suspected infringement in any form, irrespective of the storage medium; (c) the power to ask any member of staff or representative of those providers or those persons acting for purposes related to their trade, business, craft or profession, to give explanations in respect of any information relating to a EN 59 EN suspected infringement and, with their consent, to record their answers by any technical means. 2. Where needed to carry out their tasks under Article 17, national competent authorities of establishment shall have the following enforcement powers: (a) the power to order the cessation of infringements and, where appropriate, to impose remedies proportionate to the infringement and necessary to bring the infringement effectively to an end, or to request a judicial authority in their Member State to do so; (b) the power to impose fines, or to request a judicial authority in their Member State to do so, for failure to comply with this Regulation, including with any of the investigative orders issued pursuant to paragraph 1; (c) the power to impose a periodic penalty payment, or to request a judicial authority in their Member State to do so, in accordance with Article 24 to ensure that an infringement is terminated in compliance with an order issued pursuant to point (a), or for failure to comply with any of the investigative orders issued pursuant to paragraph 1. 3. Measures taken by national competent authorities of establishment in exercising their powers listed in paragraphs 1 and 2 shall be effective, dissuasive and proportionate, having regard, in particular, to the nature, gravity, recurrence and duration of the infringement or suspected infringement to which those measures relate, and, where relevant, the economic, technical and operational capacity of the service provider concerned. 4. Member States shall set out specific rules and procedures for the exercise of the powers pursuant to paragraphs 1 and 2 and shall ensure that any exercise of those powers is subject to adequate safeguards under applicable national law in compliance with the general principles of Union law. Those measures shall be taken only in accordance with the right to respect f or private life and the rights of defence, including the rights to be heard and to have access to the file, and shall be subject to the right of all affected parties to an effective judicial remedy. SECTION 5 MUTUAL ASSISTANCE AND COOPERATION Article 27 Mutual assistance 1. Competent authorities and the Commission shall cooperate closely and provide each other with mutual assistance to apply this Chapter in a consistent and efficient manner. Mutual assistance shall include the exchange of information. 2. A competent authority may request other competent authorities to provide specific information in their possession relating to a specific cloud computing service provider to exercise its investigative powers under Article 26 regarding specific information located in their Membe r State. Where appropriate, the competent authority receiving the request may involve other competent authorities or other public authorities of the Member State in question. 3. The competent authority receiving the request pursuant to paragraph 2 shall co mply with such request and inform the competent authority of establishment about the EN 60 EN action taken, as soon as possible and no later than two months after receipt of the request, unless duly justified. Article 28 Cross-border cooperation 1. Where a competent authority of destination has reason to suspect that a cloud computing service provider no longer fulfils the requirement under Annex II to this Regulation, it may request the competent authority of establishment to assess the matter and to take the necessary investigatory and enforcement measures to ensure compliance. 2. The Commission may also request the competent authority referred to in Article 25 to assess the matter and take the necessary investigatory and enforcement measures to ensure compliance. 3. Requests pursuant to paragraph 1 or 2 shall be duly reasoned and shall be duly taken into account by the competent authority of establishment. Wher e the competent authority of establishment considers that the information provided is insufficient, it may either request additional information. The period set out in paragraph 4 shall be suspended until that additional information is provided 4. The competent authority of establishment shall, as soon as possible and in any event not later than two months after receipt of the request pursuant to paragraph 1 or 2, communicate to the competent authority that sent the request, and the Commission, its assessment of the suspected infringement and an explanation of any investigatory or enforcement measures taken or envisaged in relation to the matter to ensure compliance with this Regulation. Chapter II Demand-side measures SECTION 1 PUBLIC PROCUREMENT Article 29 Risk assessments 1. By [date of entry into force plus 1 year], and thereafter every two years, or whenever necessary, Member States and Union entities shall carry out risk assessments that shall: (a) identify the public sector activities that use or will make use of c loud computing services, that contribute to the preservation of public order in sectors falling under Annex I or II of Directive (EU) 2022/2555 and in the areas of national security, internal security, external border man agement, defence, justice or law enforcement, including the prevention, investigation, detection and prosecution of criminal offence; (b) determine which Union ass urance level 2, 3, or 4 set out in Annex II of this Regulation is appropriate for the identified public sector activities. EN 61 EN Where Union entities and Member States share responsibilities in relation to the public sector activities , they shall, where appropriate, consider carrying out the relevant risk assessment or assessments jointly. 2. In carrying out their risk assessments, Member States and Union entities shall consider at least the following aspects: (a) the sensitivity, criticality, and magnitu de of the non -personal data processed, including the potential impact on public order and the nature, scope, context and purpose of processing of personal data, as well as the risk of varying likelihood and severity for the rights and freedoms of data subjects; (b) the risk and consequent impact on public order of unlawful access under Union law to such data by a third country or a legal entity established in a third country; (c) the risk and consequent impact on public order of possible service disruption; 3. The Commission shall, by means of implementing acts in accordance with Article 46(2), specify the methodology to be applied , the templates to be used and the elements to be taken into account by the Member States and Union entities for the purpose of carrying out the risk assessments referred to in paragraph 1. The methodology shall specify how Member States use the highest level of assurance for the most critical public sectors activities including, but not limited to, defence. 4. Within three months of carrying out the risk assessment s referred to in paragraph 1 , Member States shall provide the Commission with the results of th ose risk assessments, indicating where they depart from th e implementing acts referred to in paragraph 3. 5. If the Commission concludes , after reviewing the results of the risk assessment or assessments of a Member State, that the Union assurance level identified for the public sector activity in a risk assessment is not appropriate or does not adequately address the public order concerns, the Commission may adopt implementing acts in accordance with Article 46(2) specifying the Union assurance levels needed for the public sector activity. 6. Where the risk assessment requires the migration to another cloud computing service, the Member State or Union entity shall migrat e within a reasonable transition period that shall not exceed 12 months , taking into account technical feasibility, continuity of service and data portability requirements applicable to such migration. 7. Member States shall cooperate with each other and with the Commission through established consistency mechanisms and promo te cooperation and effective exchange of information and best practices. 8. For the purpose of paragraph 3 , t he Commission shall be empowered to request cloud computing service providers to provide all the necessary information. 9. In their risk assessments, Member States and Union entities shall consider whether a multi-vendor or multi -cloud strategy is appropri ate as part of their procurement of cloud computing services. EN 62 EN Article 30 Public procurement 1. This Article applies to contracting authorities that procure cloud computing services for their exclusive use . Without prejudice to Article 136 of Regulation (EU, Euratom) 2024/2509, this Article also applies to Union entities that procure cloud computing services for their exclusive use. 2. Union entities and public sectors bodies whose public sector activities have not been identified as contribut ing to the preservation of public order under the risk assessment referred to in Article 29(1) shall use cloud computing services that have been recognised under Article 17 as having a Union assurance level 1. 3. Contracting authorities, including the entities acting on their behalf, whose activities have been identified as contributing to the preservation of public order under Article 29(1) in sectors falling under Annex I or II of Directive (EU) 2022/2555 and in the areas of national security, internal security, external border management, defence, justice or law enforcement, including the prevention, investigation, detection and prosecution of criminal offence, shall only procure cloud computing services that have been recognised as having a Union assurance level 2, 3 or 4. 4. By derogation from paragraphs 2 or 3, on an exceptional basis and where duly justified, contracting authorities may decide not to procure cloud computing services recognised as having a Union assurance level 1, 2, 3, or 4 where one or more of the following circumstances applies: (a) the subject matter of the tender cannot be supplied by recognised cloud computing services available in the central repository referred to in Article 22, and no adequate or reasonable alternative or comparable cloud computing service exists, and such absence is not the result of an artificial narrowing down of the parameters of the public procurement procedure; (b) the contracting authority has launched a similar procurement process within the previous year but did not receive any suitable tenders or suitable participants; (a) applying the requirements of this Regulation would require the contracting authority to procure services at disproportionate cost. SECTION 2 PRIVATE SECTOR ENTITIES Article 31 Impact assessments 1. Entities referred to in Annex I of Directive (EU) 2022/2555 who are not public sector bodies may carry out similar assessments as those set out in Article 29. 2. The Commission may issue guidance on the methodology for carrying out the impact assessments under this Article and possible mitigation measures to be adopted by private sector entities operating in sectors of high criticality. 3. Where, because of specific circumstances, and where duly justified and in consultation with the Member States, the Commission concludes that entities who are not public sector bodies operating in sectors of hi gh criticality require an impact assessment, the Commission may adopt delegated act s to supplement this Regulation in accordance with Article 45 specifying the need for such impact assessment and the EN 63 EN risk mitigation measures that those entities who are not public sector bodies shall take. SECTION 3 OTHER PROCUREMENT-RELATED MEASURES Article 32 Union added value 1. In public procurement procedures for innovative cloud computing services and AI systems, contracting authorities shall include, as part of the quality evaluation of the tender, non -price award criteria that allow them to evaluate the tenderer’s contribution to the development of a European cloud and AI ecosystem. 2. When applying non -price award criteria under paragraph 1, contracting authorities shall ensure that non-price award criteria are: (a) linked to the subject matter of the contract; (b) not conferring unrestricted freedom of choice on the contracting authority; (c) expressly set out in the procurement documents or in the contract notice; (d) ancillary and not decisive in the award of the contract. 3. Without affecting contracting authorities’ discretion to apply additional criteria, the non-price award criteria referred to in paragraph 1 shall enable cont racting authorities to evaluate the extent to which: (a) the tenderer contributes to strengthening the digital technology supply chain in the Union, including the use of software or hardware designed or manufactured in the Union; (b) the tenderer has integrated technologies developed in the Union , including research and development results stemming from Union funded research and development program mes and makes use of tools, such as standards, specification, software, models or other technology developed in the Union; (c) the innovation required to deliver the service contributes to strengthening the security of supply and the development of a European cloud and AI ecosystem; (d) the service is delivered, to the greatest extent feasible with regard to market availability and technical requirements, through critical computing, storage and networking hardware components designed and/or manufactured in the Union, or, where this is not feasible, through hardware components from a third country that contribute s to strengthening the security of supply and the development of a European cloud and AI ecosystem. Article 33 Monitoring of procurement of innovation in cloud and AI 1. Member States shall monitor and report on their use of procurement of innovation in cloud computing services and AI systems. 2. Member States shall take appropriate measures to ensure that the monitoring and reporting referred to in paragraph 1 are actively used to identify barriers to SME s participation in procurement procedures, to improve access of SMEs to procurement markets, support the design of simplified, proportionate and SME -friendly EN 64 EN procurement strategies, including division into lots , where appropriate , promote the participation of SMEs in the innovation procedure foreseen under Directive 2014/24/EU and pre -commercial procurement of cloud computing services and AI systems. 3. Based on the monitoring referred to in paragraph 1 , Member States shall inform the Commission, on a yearly basis, of the following information: (a) the size of the economic operators participating in such procurement; (b) SMEs participation trends , including the number of contracts awarded to SMEs, their share of the total contract value, as a percentage, and, where available, the share of cross-border SMEs participation; (c) measures taken to improve SMEs access to public procurement procedures. 4. Member States shall pursue as objective that at least 25% of their procurement for cloud computing services and AI systems be awarded to innovative SMEs. Member States shall include, in their national strategies referred to in Article 7, plans on how they intend to achieve this objective. 5. Union entities and contracting authorities shall promote: (a) preliminary market consultations; (b) matchmaking between public buyers and innovative solutions provided by European SMEs and start-ups; (c) development of public contract clauses that are favourable for innovative SMEs. Chapter III European public sector cloud federation Article 34 Establishment of the European public sector cloud federation 1. The European public sector cloud federation (the ‘EuroCloud Federation’) is hereby established. The EuroCloud Federation shall be open for the participation of Union entities and public sector bodies on a voluntary basis. Union entities and public sector bodies may request the Commission to join the EuroCloud Federation. 2. The EuroCloud Federation shall facilitate the sharing of public sector data centre services and cloud computing services between Union entities and public sector bodies under the conditions set out in Articles 35 and 36. 3. The Commission shall establish a platform for the EuroCloud Federation providing at least: (a) a catalogue providing information on available public sector data centre services and cloud computing services; (b) a service platform for the exchange and orchestration of comput ing, storage and network resources and services; 4. The Commission is empowered to adopt implementing acts to specify the procedure to participate in the EuroCloud Federation and template concerning the content and EN 65 EN other details of the request for participation. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 46(2). Article 35 Sharing of public sector data centre services and cloud computing services 1. A member of the EuroClou d Federation (the ‘sharing entity’) may share data centre services and cloud computing services with another member of the EuroCloud Federation (the ‘using entity’) where the sharing entity directly, or indirectly through an intermediate legal entity, owns the hardware through which the service is made available and provides the service that is made available to the using entity. Where the sharing entity indirectly owns the hardware and provides the service s through an intermediate legal entity, the sha ring entity shall exercise control over that intermediate legal entity. 2. The sharing entity shall put in place appropriate technical, operational and organisational measures to ensure an effective, secure and resilient provision of services. 3. Prior to sharing data centre services and cloud computing services within the EuroCloud Federation, the sharing entity shall demonstrate to the Commission that it fulfils the conditions set out in paragraphs 1 and 2. 4. The Commission shall assess the information provided by the sharing entity and allow the sharing entity to share data centre services and cloud computing services within the EuroCloud Federation where the conditions laid down in paragraphs 1 and 2 are fulfilled. 5. The sharing entity may charge a fee to the using entity. The amount of the fee shall be limited to the costs that the sharing entity incurs in relation to the sharing of the service and shall not constitute a pecuniary interest within the meaning of Article 2 of Directive 2014/24/EU and Regulation (EU, Euratom) 2024/2509. 6. The Commission is empowered to adopt implementing acts to specify the technical, operational and organisational measures referred to in paragraph 2. Those implementing acts s hall be adopted in accordance with the examination procedure referred to in Article 46(2). Article 36 Fees for the administration of the EuroCloud Federation 1. The costs arising from the activities carried out by the Commission pursuant to this Chapter shall be jointly finance d by the member s of the EuroCloud Federation through fees levied by the Commission. 2. If the costs are initially borne by the general bud get of the Union, they shall be reimbursed by the EuroCloud members over a period not exceeding three years from the date on which the costs were borne by the Union. 3. Revenues generated by the fees shall constitute internal assigned revenues within the meaning of Article 21(3), point (a), of Regulation (EU, Euratom) 2024/2509 . Those revenues shall be assigned to cover the costs of the activities carried out by the Commission pursuant to this Chapter, including assessing request to join the EuroCloud Federation and the establishment of the platform referred to in Article EN 66 EN 34(3). Any revenue remaining after covering those costs shall be entered into the general budget of the Union. 4. The Commission shall adopt implementing acts laying down detailed rules for determining the estimated costs, the individual amount of the fees, and the manner and conditions under which the fees are to be paid . Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 46(2). Chapter IV Procurement of data centre services, cloud computing services, software and AI systems by the Commission Article 37 Procurement activities of the Commission 1. The Commission may carry out procurement activities to procure data centre services, cloud computing services, software and AI systems for itself and for Union entitiesand for contracting authorities of Member States , in accordance with Regulation (EU, Euratom) 2024/2509 , subject to the exceptions set out in this Chapter. By way of derogation from Article 168 of Regulation (EU, Euratom) 2024/2509, partner organisation s referred to in Article 168(3) of that Regulation selected by the Commission may also participate in the procurement activities set out in this Chapter. Contracting authorities of Member States, Union entities, and partner organisations selected by the Commiss ion, shall be considered as ‘participating entities’ under this Chapter. 2. Contracting authorities may participate in the procurement procedures on their own behalf, or as central purchasing bodies within the meaning of Article 2 (1), point (16) of Directive 2014/24/EU when they qualify as such . Specific rules and obligations governing their participation may be imposed where they participate as central purchasing bodies in the agreement referred to in Article 38. 3. In addition to the procuremen t activities provided for in Article 168 of Regulation (EU, Euratom) 2024/2509, the Commission may act as a central purchasing body for contracting authorities of Member States and partner or ganisations selected by the Commission, by: (a) procuring data ce ntre services , cloud computing services , software and AI systems on behalf of, or in the name of, one or more contracting authorities of Member States and partner organisations selected by the Commission, by concluding framework contracts or operating dyna mic purchasing systems for services intended for the participating entities; (b) acting as a wholesaler by acquiring such services and supplies and reselling them or, in exceptional circumstances, donating them to one or more contracting authorities of Member States. 4. In carrying out procurement activities, the Commission may provide ancillary support to participating entities, including: (a) technical infrastructure enabling participating entities to use awarded contracts or award contr acts, including specific contracts under concluded framework agreements, for data centre services , cloud computing services , software and AI systems; EN 67 EN (b) advice and support on preparing and implementing procurement procedures; (c) preparation and conduct of procurement procedures on behalf of, or in the name of, the entities concerned; (d) invoicing and other administrative services relating to the contracts awarded. 5. Such ancillary support may be provided directly by the Commissi on, through a subcontractor, or by delegation to Union bodies or agenc ies. Accession of participating entities to the agreement referred to in Article 38 may be subject to the acceptance of one or more ancillary support services. 6. The Commission may esta blish and manage a common procurement platform including services that may be used to facilitate the procurement activities under this Chapter. Article 38 Arrangements for the procurement activities by the Commission 1. Before any procurement activity to be carried out under Article 37, the Commission and at least two Member States shall enter into an agreement laying down the practical arrangements for the procurement activities carried out by the Commission under this Chapter. The agreement sha ll cover procurement procedures to be carried out during its period of validity and shall be deemed to satisfy the requirements of the joint procurement agreement and mandate referred to in Article 168(2) and (3) of Regulation (EU, Euratom) 2024/2509. 2. The agreement shall constitute a mandate for the Commission to procure on behalf of, or in the name of, the participating entities within the meaning of Article 168(3) , point (e), of Regulation (EU, Euratom) 2024/2509. 3. The agreement shall include the practical arrangements for the participation of entities, the decision -making process for the choice of procedure and the applicable conditions, the evaluation of requests for participation and tenders, the award of contracts, and the applicable law and c ompetent jurisdiction. The Commission shall remain responsible for the operation and management of procurement activities, including for deciding on the launch of a procurement procedure, the type of procedure and of contract, and the award of contracts. 4. The agreement shall establish a Steering Committee composed of the Commission and one representative from each participating Member States at national level. Member States may accede to the agreement at a later stage and shall then be represented in the Steering Committee. The Steering Committee may appoint additional representatives of other Union entities, of contracting authorities of Member States and of partner organisations selected by the Commission. 5. The Steering Committee shall be responsible for the strategic oversight of the procurement activities, including for proposing the strategic direction of the procurement agenda for a fixed period, and for approving the strategic direction of each procurement procedure before it is launched by the Commission , to ensure its compliance with the framework established by this Regulation. 6. Once the agreement has entered into force, contracting authorities of participating Member States, Union entities and partner organisations selected by the Commission may accede to and benefit from it and shall be considered as participating entities in EN 68 EN the procedures in which they elect to participate. The Steering Committee may determine that the agreement shall take the form of a contract of adhesion. 7. The participation of a contracting authority of a Member State shall not be conditional on that Member State’s participation. 8. The Steering Committee shall set transparent and non -discriminatory conditions for contracting authorities of Member States to accede to the agreement, in particular as regards size, minimum amounts and other objective criteria. The Steering Committee shall also set out the rules and procedures governing the termination of participation in the agreement of a contracting authority of a Member State that has failed to comply with its obligations under the agreement. 9. By way of derogation from Article 168(2) of Regulation (EU, Euratom) 2014/2509, the Steering Committee may approve the participation of contracting authorities from EFTA States and Union candidate countries without the need for a bilateral or multilateral treaty provided for such possibility. 10. The Steering Committee may make access ion to the agreement conditional on participating entities accepting one or more ancillary support services, as set out in Article 37. 11. The Steering Committee shall adopt its rules of procedure, following a proposal from the Commission. Article 39 Applicable public procurement framework 1. A participating entity shall be deemed to have fulfilled its obligations under applicable Union public procurement law where it acquires supplies or services by means of contracts awarded by the Commission under this Chapter, including through framework contracts concluded by or dynamic purchasing systems operated by the Commission acting as a central purchasing body, or any ancillary support services referred to in Article 37. 2. The procedural provisions applicable to Union institutions shall apply to the procedures for the award of specific contracts under framework contracts or dynamic purchasing systems. 3. A contracting authority that has acquired data cen tre services , cloud computing services, software and AI systems from the Commission as a central purchasing body shall ensure, in its agreements with the contracting authorities it serves, compliance with any contractual requirements by which it is itself bound. 4. The Commission may decide to launch a procurement procedure open to participating entities without a prior specific request from them. 5. By way of derogation from Article 168 of Regulation (EU, Euratom) 2024/2509 , participating entities may request from the Commission, throughout the period of validity of a dynamic purchasing system, the possibility to participate in the system. Such request shall be approved by the Commission provided that the cumulative requests d o not exceed 50% of the initial estimated quantities of the envisaged purchases. The participation shall be approved within 10 working days of receipt of the request and shall allow the participating entities to be included in any future invitation to tender. EN 69 EN 6. The possibility referred to in paragraph 5 shall be available only to participating entities that accede to the agreement referred to in Article 38 after the dynamic purchasing system has been launched. Article 40 Fees for procurement activities 1. The costs arising from the procurement activities carried out pursuant to this Chapter shall be jointly financed by the participating entities through fees levied by the Commission. 2. The costs incurred in establishing th e common procurement activities referred to in Article 37, including the development of the common procurement platform , may be initially borne by the general budget of the Union . In such case, they shall be reimbursed by the participating entities over a period not exceeding three years from the date on which they were borne by the Union. The Commission may adopt implementing acts laying down the practical and operational arrangements for reimbursement by the participating entities. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 46(2). 3. Revenues generated by the fees shall constitute internal assigned revenues within the meaning of Article 21(3), point (a), of Regulation (EU, Euratom) 2 024/2509. Those revenues shall be assigned to cover the costs of the procurement activities carried out pursuant to Article 37. Any revenue remaining after covering those costs shall be entered into the general budget of the Union. 4. The fees shall be set in advance , shall be proportionate to the estimated costs of the activities for which fees are chargeable as determined in a cost -effective way , reflecting practices of comparable procurement frameworks, and shall be sufficient to cover those costs. 5. 5. The Commission shall adopt implementing acts laying down detailed rules for determining the fees, specifying the following: (a) the estimated costs attributable to the procurement activities for which fees are chargeable; (b) the individual amounts of the chargeable fees; (c) the manner and conditions under which the fees are to be paid; (d) the conditions under which the fees are to be paid. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 46(2). Chapter V Open source Article 41 Promoting open source solutions andopen source first The Union and Member States shall take the necessary measures to encourage Union entities and public sector bodies to use and facilitate the reuse of open standards and components released under an open source licence when building their cloud and AI ecosystem or stack, EN 70 EN taking into account functionalities, including security, total cost, and other relevant , duly justified objective criteria. Article 42 Share and reuse of software When making software to which the y hold intellectual property rights available for reuse under an open source licence , a Union entity or public sector body shall do so using a catalogue or repository that is connected to , and made accessible through, the EU OSS Catalogue referred to in Article 43. Article 43 EU Open Source Solutions Catalogue 1. The Commission shall provide and maintain an EU Open Source Solutions Catalogue (‘EU OSS Catalogue’) as a centralised catalogue to access software made available for reuse by Union entities and public sector bodies. 2. The EU OSS Catalogue shall be hosted on the Interoperable Europe portal referred to in Article 8 of Regulation (EU) 2024/903 and shall be accessible electronically free of charge. 3. The Commission shall, on the basis of objective and relevant criteria, decide on the request of any Union entity or public sector body owning or maintaining a catalogue or repository to have that catalogue or repository connected to and made accessible through the EU OSS Catalogue. Article 44 Network of Open Source Programme Offices 1. The Commission shall establish a network of Open Source Programme Offices (‘OSPO Network’) to facilitate cooperation on the implementation of the obligations under this Chapter. 2. Open Source Programme Offices established by public sector bodies at local, regional or national level in a Member State , and those established by Union entities, may request from the Commission to join the OSPO Network. 3. The OSPO Network shall have the following tasks: (a) facilitating the exchange of information, experience and best practices between Member States and the Commission, in particular by discussing common technical, legal and organisational challenges, including those related to licensing, security, maintenance and procurement of open-source software; (b) promoting the sharing and reuse of open -source software by public sector bodies; (c) contributing, on a voluntary and non -binding basis, to the development of guidance, templates or recommendations on the shari ng and reuse of open - source software; (d) collaborating on and exchanging open -source projects of common interest to Union entities and public sector bodies. 4. The Commission shall support and coordinate the OSPO Network. EN 71 EN 5. The Commission shall convene and chair a meeting of the members of the OSPO Network at least twice a year. The meetings of the OSPO Network may be organised online. EN 72 EN TITLE V FINAL PROVISIONS Article 44 Exercise of the delegation 1. The power to adopt delegated acts is conferred on the Commission subject to the conditions laid down in this Article. 2. The power to adopt delegated acts referred to in Article 6(4), Article 16(2), Article 20(9), Article 2 1(1), and Article 31(3) shall be conferred on the Commission for an indeterminate period of time from [date of entry into force]. 3. The delegation of power referred to in Article 6(4), Article 16(2), Article 2 0(9), Article 2 1(1), and Article 31(3) may be revoked at any time by the European Parliament or by the Council. A decision to revoke shall put an end to the delegation of the power specified in that decision. It shall take effect the day following the publication of the decision in the Official Journal of the European Union or at a later date specified therein. It sha ll not affect the validity of any delegated acts already in force. 4. Before adopting a delegated act, the Commission shall consult experts designated by each Member State in accordance with the principles laid down in the Interinstitutional Agreement of 13 April 2016 on Better Law-Making. 5. As soon as it adopts a delegated act, the Commission shall notify it simultaneously to the European Parliament and to the Council. 6. Delegated act adopted pursuant to Article 6(4), Article 16(2), Article 2 0(9), Article 21(1), and Article 31(3) shall enter into force only if no objection has been expressed either by the European Parliament or by the Council within a period of two months of notification of that act to the European Parliament and to the Council or i f, before the expiry of that period, the European Parliament and the Council have both informed the Commission that they will not object. That period shall be extended by three months at the initiative of the European Parliament or of the Council. Article 46 Committee procedure 1. The Commission shall be assisted by a committee . That committee shall be a committee within the meaning of Regulation (EU) No 182/2011. 2. Where reference is made to this paragraph, Article 5 of Regulation (EU) No 182/2011 shall apply. Article 47 Review 1. By [ date of entry into force plus 4 years ], and every 5 years thereafter, the Commission shall evaluate this Regulation, and report to the European Parliament , the Council and the European Economic and Social Committee. 2. Where appropriate, the report referred to in paragraph 1 shall be accompanied by a proposal for amendment of this Regulation. EN 73 EN 3. In carrying out the evaluation referred to in paragraph 1, to Commission shall take into account the positions and findings of the European Parliament, of the Council, and of other relevant bodies or sources , and shall pay specific attention to small and medium-sized enterprises and the position of new competitors. Article 48 Entry into force and application This Regulation shall enter into force on the twentieth day following that of its publication in the Official Journal of the European Union. It shall apply from [same day and month as date of entry into force plus 1 year]. This Regulation shall be binding in its entirety and directly applicable in all Member States. Done at Brussels, For the European Parliament For the Council The President The President EN 1 EN LEGISLATIVE FINANCIAL AND DIGITAL STATEMENT 1. FRAMEWORK OF THE PROPOSAL/INITIATIVE ................................................. 3 1.1. Title of the proposal/initiative ...................................................................................... 3 1.2. Policy area(s) concerned .............................................................................................. 3 1.3. Objective(s) .................................................................................................................. 3 1.3.1. General objective(s) ..................................................................................................... 3 1.3.2. Specific objective(s) ..................................................................................................... 3 1.3.3. Expected result(s) and impact ...................................................................................... 3 1.3.4. Indicators of performance ............................................................................................ 3 1.4. The proposal/initiative relates to: ................................................................................. 4 1.5. Grounds for the proposal/initiative .............................................................................. 4 1.5.1. Requirement(s) to be met in the short or long term including a detailed timeline for roll-out of the implementation of the initiative ............................................................ 4 1.5.2. Added value of EU involvement (it may result from different factors, e.g. coordination gains, legal certainty, greater effectiveness or complementarities). For the purposes of this section 'added value of EU involvement' is the value resulting from EU action, that is additional to the value that would have been otherwise created by Member States alone. ................................................................................. 4 1.5.3. Lessons learned from similar experiences in the past .................................................. 4 1.5.4. Compatibility with the multiannual financial framework and possible synergies with other appropriate instruments ....................................................................................... 5 1.5.5. Assessment of the different available financing options, including scope for redeployment ................................................................................................................ 5 1.6. Duration of the proposal/initiative and of its financial impact .................................... 6 1.7. Method(s) of budget implementation planned ............................................................. 6 2. MANAGEMENT MEASURES................................................................................... 8 2.1. Monitoring and reporting rules .................................................................................... 8 2.2. Management and control system(s) ............................................................................. 8 2.2.1. Justification of the budget implementation method(s), the funding implementation mechanism(s), the payment modalities and the control strategy proposed .................. 8 2.2.2. Information concerning the risks identified and the internal control system(s) set up to mitigate them............................................................................................................ 8 2.2.3. Estimation and justification of the cost-effectiveness of the controls (ratio between the control costs and the value of the related funds managed), and assessment of the expected levels of risk of error (at payment & at closure) ........................................... 8 2.3. Measures to prevent fraud and irregularities ................................................................ 9 3. ESTIMATED FINANCIAL IMPACT OF THE PROPOSAL/INITIATIVE ............ 10 3.1. Heading(s) of the multiannual financial framework and expenditure budget line(s) affected ....................................................................................................................... 10 EN 2 EN 3.2. Estimated financial impact of the proposal on appropriations ................................... 12 3.2.1. Summary of estimated impact on operational appropriations.................................... 12 3.2.1.1. Appropriations from voted budget ............................................................................. 12 3.2.1.2. Appropriations from external assigned revenues ....................................................... 17 3.2.2. Estimated output funded from operational appropriations......................................... 22 3.2.3. Summary of estimated impact on administrative appropriations ............................... 24 3.2.3.1. Appropriations from voted budget .............................................................................. 24 3.2.3.2. Appropriations from external assigned revenues ....................................................... 24 3.2.3.3. Total appropriations ................................................................................................... 24 3.2.4. Estimated requirements of human resources.............................................................. 25 3.2.4.1. Financed from voted budget....................................................................................... 25 3.2.4.2. Financed from external assigned revenues ................................................................ 26 3.2.4.3. Total requirements of human resources ..................................................................... 26 3.2.5. Overview of estimated impact on digital technology-related investments ................ 28 3.2.6. Compatibility with the current multiannual financial framework.............................. 28 3.2.7. Third-party contributions ........................................................................................... 28 3.3. Estimated impact on revenue ..................................................................................... 29 4. DIGITAL DIMENSIONS .......................................................................................... 29 4.1. Requirements of digital relevance .............................................................................. 30 4.2. Data ............................................................................................................................ 30 4.3. Digital solutions ......................................................................................................... 31 4.4. Interoperability assessment ........................................................................................ 31 4.5. Measures to support digital implementation .............................................................. 32 EN 3 EN 1. FRAMEWORK OF THE PROPOSAL/INITIATIVE 1.1. Title of the proposal/initiative Proposal for a Regulation of the European Parliament and Council establishing a framework of measures for strengthening Europe’s cloud and AI ecosystem (Cloud and AI Development Act). Short title: The Cloud and AI Development Act (CADA) (Text with EEA relevance) 1.2. Policy area(s) concerned The proposal concerns policy areas linked to the development of cloud computing services, with a focus on ensuring a smooth and timely transition toward high -value, resilient and future oriented digital ecosystems. It aims to set the regulatory conditions for a Single Market in cloud computing services, incentivising investment in cloud infrastructure, AI research and development and supporting emerging requirements arising from innovative technologies. By modernising e xisting frameworks, the initiative aims to facilitate efficient investment, promote sustainable competition, and reduce technological dependencies, thereby supporting the EU’s long-term competitiveness and resilience in the global cloud and AI landscape. T he proposal also aims to remove persisting barriers to the cross -border provision of cloud computing services and improve regulatory coherence and predictability across Member States. 1.3. Objective(s) 1.3.1. General objective(s) The general objective of t his initiative is to ensure the functioning of the internal market for cloud computing services and to secure the conditions necessary for the Union’s competitiveness and strategic autonomy. 1.3.2. Specific objective(s) Specific objective No 1: Increase c omputing capacity deployed in the EU through innovative and sustainable technologies. By 2030, the EU should at least triple its current data centre capacity, prioritising energy -efficient technologies in new installations. As demand continues growing, thi s should be considered an intermediate objective so that by 2035, the computing capacity in the EU should meet its needs. Specific objective No 2: Ensure attractive conditions for the deployment of sustainable and innovative computing capacity. While the f irst objective is aimed at the deployment of capacity, this one targets the conditions for such investment and deployment. By 2030, operators should be able to obtain all permits to build and run a data centre in less than 18 months throughout the EU, incl uding access to land, permits for energy access, and connectivity, which are a major attention point for investors. Specific objective No 3: Decrease the overall reliance on non -European cloud computing services. By 2035, this intervention should increase the market share of European cloud computing service providers in the European market. Strengthening the Union’s strategic autonomy requires reducing dependencies and ensuring that EN 4 EN European users have credible European alternatives to non -European incumbents. A stronger European supply base improves the Union’s capacity to act autonomously and enhances long-term resilience, competitiveness, and security of supply. Specific objective No 4 : Contribute to the protection of public order by enhancing the resilience of supply of cloud computing services, in particular in the public sector. By 2035, highly critical use cases in the public sector shoul d be operated using sovereign cloud and AI computing services to ensure data confidentiality, operational autonomy and prevent harms that could undermine public order. Highly critical use cases are those of particular systemic importance that underpin esse ntial functions or involve the processing of sensitive data. Ensuring that, for these, data is protected, and service continuity is guaranteed, is a key element of attaining strategic autonomy. That is why these use cases are a priority for the move toward s services whose provision is outside of the reach of third -country policies that could result in data access or interruptions to service continuity, i.e. sovereign services. 1.3.3. Expected result(s) and impact Specify the effects which the proposal/initiative should have on the beneficiaries/groups targeted. The proposed Cloud and AI Development Act is expected to have a relevant impact on several beneficiaries, including the public sector, the European cloud and AI ecosystem and citizens. The initiative aims to strengthen the cloud and AI ecosystem at Union level, pioneering energy and resource efficiency for data centres, develop European open cloud and AI stacks, and promote the uptake of cloud computing services. This is expected to lead to the develop ment of advanced AI technologies and frontier AI, the acceleration of industrial AI models and systems in strategic sectors, and the support of cross sectoral initiatives addressing major technological and industrial challenges. Furthermore, the proposal s eeks to accelerate data centre deployment across the Union, tripling the EU’s data centre capacity within the next five to seven years and ensuring the deployment of resource -efficient data centres. The Act also aims to promote autonomy, reduce dependencie s on critical technologies and increase the adoption of cloud computing services across the public sector, enabling critical sectors to use sovereign cloud computing services. Additionally, the proposal will lead to the establishment of a European public sector cloud federation, common procurement activities and the promotion of open -source solutions. Overall, the proposal seeks to empower these beneficiairies, fostering a competitive, innovative and autonomous European cloud and AI ecosystem that drives economic prosperity, social wellbeing and strategic autonomy. The proposal is envisioned to have positive effects on the global competitivess of the European AI and cloud sector, and the attractiveness of the EU for third countries’ businesses and researchers. 1.3.4. Indicators of performance Specify the indicators for monitoring progress and achievements. Objective 1 : Increase computing capacity in the EU through innovative and sustainable technologies. (a) Installed computing capacity (MW IT load) by MS (b) Aggregate general purpose and AI -optimised compute, measured also in FLOPs (c) EU share of global installed computing capacity EN 5 EN (d) Utilisation rate of EU computing capacity; measures on PUE, WUE, location - based emissions and related environmental impact of data centres (e) Deployment of innovative and energy -efficient technologies (pilots launched and uptake of new solutions) (f) Share of clean energy in data centres and waste-heat reuse (g) Total annual public and private investment in EU-based DCs (h) Share of new data centre capacity deployed outside existing hubs and in underserved regions Objective 2: Ensure attractive conditions for the deployment of sustainable and innovative computing capacity. (a) Average permitting time for new data centre projects (b) Total administrative burden for operators (c) Share of projects delayed/cancelled due to regulatory or infrastructure barriers (d) Number of MS with simplified permitting frameworks (e) Cost competitiveness index Objective 3: Decrease the reliance on non -European cloud and AI computing services. (a) Share of total EU cloud computing services revenue captured by European service providers (b) Number of public sector authorities served by sovereign providers per MS (c) Share of installed EU DC capacity owned by European providers (d) Share of idle capacity across MS Objective 4: Contribute to the protection of public order by enhancing the resilience of supply of cloud computing services, in particular in the public sector. (a) Number of cloud services audited under levels 2,3,4 (b) Compliance rate by contracting authorities (%) with the sovereignty scheme (c) Annual value of EU public procurement of sovereign cloud computing services (d) Number of public sector solutions rel eased as open source in the repository, and their downloads by third parties. 1.4. The proposal/initiative relates to:  a new action  a new action following a pilot project / preparatory action39  the extension of an existing action  a merger or redirection of one or more actions towards another/a new action 1.5. Grounds for the proposal/initiative 1.5.1. Requirement(s) to be met in the short or long term including a detailed timeline for roll-out of the implementation of the initiative The Cloud and AI Development Act will be expected to enter into force within 20 days from the publication in the Official Journal. The entry into application should be within one year of publication, with notable exceptions for rules that require additional transition period. 39 As referred to in Article 58(2), point (a) or (b) of the Financial Regulation. EN 6 EN 1.5.2. Added value of EU involvement (it may result from different factors, e.g. coordination gains, legal certainty, greater effectiveness or complementarities). For the purposes of this section 'added value of EU involvement' is the value re sulting from EU action, that is additional to the value that would have been otherwise created by Member States alone. The development of computing capacity in the EU currently takes place along national lines. Each Member State operates under a distinct f ramework, with different processes and requirements for data centre deployment, reflecting local conditions and needs. However, national policies for data centre acceleration risk further fragmentation and race -to-the-bottom with respect to sustainability. Moreover, an increasing number of low-latency applications require close computing capacity. More generally, the EU faces a shortage of computing capacity, a problem that risks negatively affecting its competitiveness and requires EU -level action to maintain a regulatory and investment environment that is easy to navigate for data centre operators and investors, including across borders. Closing this capacity gap and allowing European businesses and public administrations to leverage compute capacity whi le ensuring sustainability requires action at EU level. The dependence on cloud computing services supplied by non - European providers has the same root causes across the EU and affects businesses and public administrations in all Member States. European se rvice providers face difficulties to scale up across the EU, for example due to different national trustworthiness standards, particularly in public procurement. Divergent national procurement practices complexify the market for European providers and the underlying situation of imperfect information is a market failure requiring an EU - level response. Calls for EU-action to address these challenges were also made in the public consultation. EU action is expected to have a clear added value in addressing the problem of limited and geographically concentrated availability of computing capacity. By providing a common approach to data centre deployment, it would enable the coherent planning and deployment of computing capacity in a geographically balanced way, w hile avoiding a race to the bottom and reducing regulatory complexity for investors and data centre operators. The EU is uniquely positioned to ensure that investment and acceleration policies reflect collective priorities and avoid fragmentation. EU -level action would ensure that all businesses and public administrations can access sufficient compute capacity to meet their needs and is a prerequisite for Europe to become an AI continent. In addressing the dependence on cloud computing services supplied by non- European providers, EU action is expected to deliver benefits that exceed what Member States could achieve individually, especially in addressing the underlying market failures of imperfect information. This would improve the functioning of the internal market and enable cloud computing service providers to grow beyond their national markets. 1.5.3. Lessons learned from similar experiences in the past The proposal is informed by the practical experience in the implementation of existing regulations in t his field. Past experience has shown that legal safeguards are needed but not sufficient to change dependence on non -EU providers. GDPR and EDPS enforcement pushed public bodies and providers towards stronger contractual EN 7 EN controls and tighter rules on inter national transfers. However, these measures produced compliance solutions rather than concrete changes. Similarly, the need for data localisation proved to only partially solve some of the sovereignty requirements needed for specific use cases, especially in the public sector. The EUCS cloud certification preparatory work also demostrated that cybersecurity must be distinguished from sovereignty requirements. The regulation also builds on and complements the Cybersecurity Act 2.0, as well as provisions of t he Data Act, which focuses on switching costs, interoperability, portability and unfair contractual terms. Finally, the proposal was informed by an extensive stakeholder consultation strategy. 1.5.4. Compatibility with the multiannual financial framework and possible synergies with other appropriate instruments The proposal is compatible with the multiannual financial framework as it would primarily provide a new legal framework while relying on existing or planned EU instruments for financing. Its main f unding synergies should be with FP10 and the European Competitiveness Fund (ECF), especially under the Digital Leadership window. FP10 should support the upstream research and innovation dimension under Pillar I, while ECF should serve as the main deployme nt instrument, thus contributing to translate FP10 research outputs into operational capabilities. Other instruments could further reinforce these efforts. IPCEIs would continue to support large-scale, cross -border pr ojects where cloud, edge, chips, cybers ecurity or AI infrastructure require coordination among Member States and private invesment. EDICs could provide useful governance vehicles for groups of Member States wishing to jointly operate common digital infrastructure. Cohesion policy instruments, e .g. ERDF and the Cohesion Fund contribute to and may support regional competitiveness and address territorial disparities by co -financing digital infrastructure in less -developed regions. Synergies are also expected with InvestEU by improving the investment environment, supporting bankable projects and complementing financial instruments to mobilise private and public investment. Where relevant, the proposal would also build on reforms and investments set out in national RRPs, including National Re form Programmes and country -specific recommendations. Finally, other ECF policy windows could support sector -specific applications. 1.5.5. Assessment of the different available financing options, including scope for redeployment The assessment of available financing options has considered both redeployment within existing Commission resources and the need for additional financing. The implementation of the initiative is estimated to require 25 FTEs in total. Of these, 8 FTEs from DG DIGIT and 7 FTEs from DG CNECT are considered to fall within the scope of redeployment, reflecting tasks that can be covered through the reprioritisaton of existing activities and use of existing policy expertise. This means that 15 of the 25 estimated FTEs could be covered throu gh redeployment. These redeployed posts would mainly support activities close to existing mandates, such as policy coordination, legal analysis, stakeholder engagement, internal market monitoring, programme management, administrative support and cooperatio n with Member States. For the remaining tasks, alternative financing options have been examined. These include targeted reinforcement of relevant budget lines and use of existing programme envelopes. However, given that several tasks may entail significant operational costs, fees are also introduced as an important financing EN 8 EN mechanism and to limit the impact on the EU budget. In particular, such fees had been evisaged to cover activities related to common procurement activities and administration of the EuroCloud Federation for sharing idle capacity among interested Member States. The remaining 10 FTEs would require additional financing as they related to new or substantially expanded reponsibilities that go beyond current workload assumptions. Overall, th e proposed approach combines redeployment, fee -based financing and limited additional resources. Redeployment would ensure budgetary discipline and use of existing Commission expertise. Fees are expected to reduce pressure on the EU budget and support budg et neutrality for most resource -intensive tsasks. Additional appropriations are thus reserved for new functions that cannot be financed through fees or internal reallocation. EN 9 EN 1.6. Duration of the proposal/initiative and of its financial impact  limited duration –  in effect from [DD/MM]YYYY to [DD/MM]YYYY –  financial impact from YYYY to YYYY for commitment appropriations and from YYYY to YYYY for payment appropriations.  unlimited duration – Implementation with a start-up period from 2028 to 2030, – followed by full-scale operation. 1.7. Method(s) of budget implementation planned  Direct management by the Commission –  by its departments, including by its staff in the Union delegations; –  by the executive agencies  Shared management with the Member States  Indirect management by entrusting budget implementation tasks to: –  third countries or the bodies they have designated –  international organisations and their agencies (to be specified) –  the European Investment Bank and the European Investment Fund –  bodies referred to in Articles 70 and 71 of the Financial Regulation –  public law bodies –  bodies governed by private law with a public service mission to the extent that they are provided with adequate financial guarantees –  bodies governed by the private law of a Member State that are entrusted with the implementation of a public -private partnership and that are provided with adequate financial guarantees –  bodies or persons entrusted with the implementation of specific actions in the common foreign and security policy pursuant to Title V of the Treaty on European Union, and identified in the relevant basic act – bodies established in a Member State, governed by the private law of a Member State or Union law and eligible to be entrusted, in accordance with sector -specific rules, with the implementation of Union funds or budgetary guarantees, to the extent that such bodies are controlled by public law bodies or by bodies governed by private law with a public service mission, and are provided with adequate financial guarantees in the form of joint and several liability by the controlling bodies or equivalent financial guarantees and which may be, for each action, limited to the maximum amount of the Union support. EN 10 EN 2. MANAGEMENT MEASURES 2.1. Monitoring and reporting rules The Regulation will be reviewed and evaluated five years from its entry into force. The Commission will report on the findings of the evaluation to the European Parliament and the Council. To support the consistent implementation and monitorting of this Regulation, Member States should also ensure that the relevant information concerning their activities is available to the Commission in a timely manner. 2.2. Management and control system(s) 2.2.1. Justification of the budget implementation method(s), the funding implementation mechanism(s), the payment modalities and the control strategy proposed The Regulation establishes a new policy framework for harmonised rules governing the procurement of cloud computing services in the internal market and the deployment of data centres across the EU, while supporting the Union’s policy objectives of consumer trust, industrial competitiveness, security and resilience and sustainability. The Cloud and AI Development Act aims to simplify and improve coordination of the regulatory framework for the develop ment of data centres and procurement of cloud computing services. These objectives require reinforced EU - level coordination and operational capacity, which in turn require targeted and proportionate budgetary resources. The proposal introduces proportionat e changes, establishing a governance system with new EU -level tasks with a Single Market dimension, while ensuring that decision -making remains at the most efficient level. The chosen governance model aims to build on existing structures and mandates, thereby limiting the need for new entities and allowing the budget to be implemented through established administrative and financial arrangements, ensuring cost - effectiveness and predictability of expenditures. In order to carry out these new tasks, addition al human resources are required. The implementation and enforcement of the Regulation is estimated to require 6 additional FTEs for the DG CNECT and 4 FTEs for DG DIGIT. The proposed staffing levels are proportionate to the volume and complexity of the new responsibilities and reflect the most cost -efficient option, avoiding duplication at national level. Payments will follow standard EU budgetary procedures, including commitments and payments made annually, in accordance with the Financial Regulation and within the ceilings of the applicable Multiannual Financial Framework. This will be supported by the annual contributions from the fees covering the costs from additional tasks and long term costs. Expenditure will be subject to the Commission’s internal co ntrol framework, including ex ante checks, ex post audits, performance monitoring and reporting. This will be performed with the aim to ensure sound financial management, legality and regularity fo expenditure and effective use of Union funds, while ensuring the timely implementation of the Regulation. 2.2.2. Information concerning the risks identified and the internal control system(s) set up to mitigate them The activities proposed in the Act involve different Union entities and some execution risks that require monitoring, oversight, coordination and guidance effort EN 11 EN for their mitigation. The commission will dedicate staff to, among other activities, elaborate guidance documents, delegated acts, dependency assessments, comitology secretariat, and oversight of the implementation of the initiative, including monitoring its progress against established KPIs and milestones. This would allow to promptly identify possible issues and risks in the execution of activities. In particular for the common procurement activities, a Steering Committee shall be established, composed of the Commission and representatives of Member States, and will be responsible for strategic oversight of the procurement activities, including the strategic orientations of the agenda of public procurement activities, and the strategic orientation of each procurement procedure, ensuring compliance with this Regulation, and transparent and non -discriminatory conditions for accession of contracting authorities. In the case of the European public sector cloud federation, it is important to ensure broad participation from Union entities, while ensuring the highest level of security in the provision of services, in accordance with Union law, to ensure feasibility, effectiveness and con tinuity. Therefore, it should be open for the participation of voluntary Union institutions, bodies and agencies, as public sector bodies from Member States willing to interconnect their cloud computing infrastructures and deploy interoperable cloud comput ing services across the Union. The Commission would establish a platform to facilitate the sharing of data centre and cloud computing capacity accessible to its members. Due to the likely criticality and sensitivity of the data and applications hosted in t hat shared capacity, the platform would include services and mechanisms for secure access and incident management, including shared identity management, mutual authentication tools and incident reporting tools, and capabilities supporting the operation of the provided services, including monitoring of service provision, resource allocation, service activation and performance. 2.2.3. Estimation and justification of the cost -effectiveness of the controls (ratio between the control costs and the value of the related funds managed), and assessment of the expected levels of risk of error (at payment & at closure) The cost of controls for this initiative have been estimated at Commission level. The source of this information is the Commission’s internal manageme nt and control system. The costs were estimated based on the staff and resources dedicated to the activities foreseen as part of this initiative. The expected total costs for such controls can be relatively high due to the comp lexity of the activities prop osed and the need for dedicated resources to mitigate execution risks. The control intensity will be adapted to the nature of the expenditure, the type of beneficiaries or contractors foreseen, the amount of financial resources concerned, and the level of risk. Specific actions such as common procurement, EuroCloud Federation, funding management and repository of sovereign services will require specific resources and controls, including strategic oversight, monitoring and incident management. The cost of su ch controls has been estimated to ensure that it remains proportionate to the value of the funds managed, the complexity of each activity and the identified risks. In terms of expected error rate, the aim is to maintain this below the 2% threshold. This w ill be achieved through standard ex ante and ex post controls mentioned above, including e.g. verification of eligibility and legality of expenditure, procurement and contract management checks, monitoring of deliverables, risk - based controls, audits, and recovery procedures where needed. Any deviation from EN 12 EN this would require a coordinated approach and would be discussed on a case -by-case basis. 2.3. Measures to prevent fraud and irregularities The existing fraud prevention measures applicable to the Comm ission will cover the additional appropriations necessary for this Regulation. EN 13 EN 3. ESTIMATED FINANCIAL IMPACT OF THE PROPOSAL/INITIATIVE 3.1. Heading(s) of the multiannual financial framework and expenditure budget line(s) affected • Existing budget lines In order of multiannual financial framework headings and budget lines. Heading of multiannual financial framework Budget line Type of expenditure Contribution Number Diff./Non- diff.40 from EFTA countries 41 from candidate countries and potential candidates 42 From other third countries other assigned revenue MFF headings and budget lines to be determined43 Diff./Non -diff. YES NO NO NO Fee revenue (COM will collect the fee) Diff./Non -diff. YES NO NO YES • New budget lines requested In order of multiannual financial framework headings and budget lines. Heading of multiannual financial framework Budget line Type of expenditure Contribution Number Diff./Non- diff. from EFTA countries from candidate countries and potential candidates from other third countries other assigned revenue [XX.YY.YY.YY] Diff./Non -diff. YES/NO YES/NO YES/NO YES/NO [XX.YY.YY.YY] Diff./Non -diff. YES/NO YES/NO YES/NO YES/NO [XX.YY.YY.YY] Diff./Non -diff. YES/NO YES/NO YES/NO YES/NO 40 Diff. = Differentiated appropriations / Non-diff. = Non-differentiated appropriations. 41 EFTA: European Free Trade Association. 42 Candidate countries and, where applicable, potential candidates from the Western Balkans. 43 Budget lines for the new MFF are not yet known EN 14 EN 3.2. Estimated financial impact of the proposal on appropriations 3.2.1. Summary of estimated impact on operational appropriations –  The proposal/initiative does not require the use of operational appropriations –  The proposal/initiative requires the use of operational appropriations, as explained below The amounts indicated below are provisional and remain subject to the final outcome of the 2028-2034 MFF negotiations. This initiative will be financed by redeployment within the operational programmes of the next MFF, and partially by administrative expenditu re for staff. At this stage, it is not possible to indicate t he contribution from each MFF heading and programme, while it is expected that a significant contribution will come from programmes under heading 2 of the 2028 -2034 MFF (e.g. the European Competitiveness Fund , especially under the Digital Leadership window ). These estimates have been prepared based on the information currently available and are intended to provide accurate budget estimates. 3.2.1.1. Appropriations from voted budget EUR million (to three decimal places) Heading of multiannual financial framework Number DG CNECT Year Year Year Year Year Year Year TOTAL MFF 2028- 2034 POST 2034 GRAND TOTAL 2028 2029 2030 2031 2032 2033 2034 Operational appropriations Budget line Commitments (1a) 2.386 0.727 2.118 0.427 0.427 0.427 0.427 6.941 6.941 Payments (2a) 1.193 1.557 1.422 1.272 0.427 0.427 0.427 6.727 0.214 6.941 TOTAL Commitments =1a 2.386 0.727 2.118 0.427 0.427 0.427 0.427 6.941 0.000 6.941 EN 15 EN DG CNECT Year Year Year Year Year Year Year TOTAL MFF 2028- 2034 POST 2034 GRAND TOTAL 2028 2029 2030 2031 2032 2033 2034 appropriations for DG CNECT Payments =2a 1.193 1.557 1.422 1.272 0.427 0.427 0.427 6.727 0.214 6.941 DG DIGIT Year Year Year Year Year Year Year TOTAL MFF 2028- 2034 POST 2034 GRAND TOTAL 2028 2029 2030 2031 2032 2033 2034 Operational appropriations Budget line Commitments (1a) 2.382 2.382 2.382 Payments (2a) 1.191 1.191 2.382 2.382 TOTAL appropriations for DG DIGIT Commitments =1a 2.382 0.000 0.000 0.000 0.000 0.000 0.000 2.382 0.000 2.382 Payments =2a 1.191 1.191 0.000 0.000 0.000 0.000 0.000 2.382 0.000 2.382 From 2029, the VOBU request is the net amount for which the foreseen cloud federation and joint procurement fees have been deducted. Total (DIGIT + CNECT) Year Year Year Year Year Year Year TOTAL MFF 2028-2034 POST 2034 GRAND TOTAL 2028 2029 2030 2031 2032 2033 2034 EN 16 EN TOTAL operational appropriations Commitments (4) 4.768 0.727 2.118 0.427 0.427 0.427 0.427 9.323 0.000 9.323 Payments (5) 2.384 2.748 1.422 1.272 0.427 0.427 0.427 9.109 0.214 9.323 TOTAL appropriations of an administrative nature financed from the envelope for specific programmes (6) 0 0 0 0 0 0 0 0 0 0 TOTAL appropriations under HEADING 2 Commitments =4+6 4.768 0.727 2.118 0.427 0.427 0.427 0.427 9.323 0.000 9.323 of the multiannual financial framework Payments =5+6 2.384 2.748 1.422 1.272 0.427 0.427 0.427 9.109 0.214 9.323 Heading of multiannual financial framework 4 ‘Administrative expenditure’ EUR million (to three decimal places) DG CNECT Year Year Year Year Year Year Year TOTAL MFF 2028-2034 2028 2029 2030 2031 2032 2033 2034  Human resources 1.810 1.810 1.810 1.810 1.810 1.810 1.810 12.670  Other administrative expenditure 0.000 0.000 0.000 0.000 0.000 0.000 0.000 0.000 TOTAL DG CNECT Appropriations 1.810 1.810 1.810 1.810 1.810 1.810 1.810 12.670 DG: DIGIT Year Year Year Year Year Year Year TOTAL MFF 2028-2034 2028 2029 2030 2031 2032 2033 2034  Human resources 1.794 1.794 1.794 1.794 1.794 1.794 1.794 12.558  Other administrative expenditure 0.000 0.000 0.000 0.000 0.000 0.000 0.000 0.000 EN 17 EN DG CNECT Year Year Year Year Year Year Year TOTAL MFF 2028-2034 2028 2029 2030 2031 2032 2033 2034 TOTAL DG DIGIT Appropriations 1.794 1.794 1.794 1.794 1.794 1.794 1.794 12.558 TOTAL appropriations under HEADING 4 of the multiannual financial framework (Total commitments = Total payments) 3.604 3.604 3.604 3.604 3.604 3.604 3.604 25.228 EUR million (to three decimal places) Year Year Year Year Year Year Year TOTAL MFF 2028- 2034 POST 2034 GRAND TOTAL 2028 2029 2030 2031 2032 2033 2034 TOTAL appropriations under HEADINGS 1 to 4 of the multiannual financial framework Commitments 8.372 4.331 5.722 4.031 4.031 4.031 4.031 34.551 0.000 34.551 Payments 5.988 6.352 5.026 4.876 4.031 4.031 4.031 34.337 0.214 34.551 3.2.1.2. Appropriations covered from fees (EuroCloud and Joint Cloud Procurement) EUR million (to three decimal places) Heading of multiannual financial framework Number DG CNECT Year Year Year Year Year Year Year TOTAL MFF 2028- 2034 POST 2034 GRAND TOTAL 2028 2029 2030 2031 2032 2033 2034 Operational appropriations financed by fees Budget line Commitments (1a) 0.000 2.940 4.410 5.880 2.570 2.570 2.570 20.939 20.939 EN 18 EN Payments (2a) 0.000 2.940 4.410 5.880 2.570 2.570 2.570 20.939 20.939 Appropriations of an administrative nature financed by fees Budget line (3) TOTAL appropriations Commitments =1a+3 0.000 2.940 4.410 5.880 2.570 2.570 2.570 20.939 0.000 20.939 for DG CNECT Payments =2a+3 0.000 2.940 4.410 5.880 2.570 2.570 2.570 20.939 20.939 DG DIGIT Year Year Year Year Year Year Year TOTAL MFF 2028- 2034 POST 2034 GRAND TOTAL 2028 2029 2030 2031 2032 2033 2034 Operational appropriations financed by fees Budget line Commitments (1a) 0.000 3.027 4.317 6.037 6.342 6.663 7.001 33.387 33.387 Payments (2a) 0.000 3.027 4.317 6.037 6.342 6.663 7.001 33.387 33.387 Appropriations of an administrative nature financed from fees Budget line (3) 0 0 TOTAL appropriations Commitments =1a+3 0.000 3.027 4.317 6.037 6.342 6.663 7.001 33.387 0.000 33.387 for DG DIGIT Payments =2a+3 0.000 3.027 4.317 6.037 6.342 6.663 7.001 33.387 33.387 Year Year Year Year Year Year Year TOTAL MFF 2028-2034 POST 2034 GRAND TOTAL 2028 2029 2030 2031 2032 2033 2034 TOTAL operational appropriations Commitments (4) 0.000 5.967 8.727 11.917 8.912 9.233 9.570 54.326 0.000 54.326 Payments (5) 0.000 5.967 8.727 11.917 8.912 9.233 9.570 54.326 54.326 EN 19 EN DG DIGIT Year Year Year Year Year Year Year TOTAL MFF 2028- 2034 POST 2034 GRAND TOTAL 2028 2029 2030 2031 2032 2033 2034 TOTAL appropriations of an administrative nature financed from the envelope for specific programmes (6) TOTAL appropriations under HEADING 2 Commitments =4+6 0.000 5.967 8.727 11.917 8.912 9.233 9.570 54.326 0.000 54.326 of the multiannual financial framework Payments =5+6 0.000 5.967 8.727 11.917 8.912 9.233 9.570 54.326 0.000 54.326 3.2.2. Estimated output funded from operational appropriations (not to be completed for decentralised agencies) Commitment appropriations in EUR million (to three decimal places) Indicate objectives and outputs  Year 2024 Year 2025 Year 2026 Year 2027 Enter as many years as necessary to show the duration of the impact (see Section1.6) TOTAL OUTPUTS Type44 Avera ge cost No Cost No Cost No Cost No Cost No Cost No Cost No Cost Total No Total cost SPECIFIC OBJECTIVE No 145… - Output - Output - Output 44 Outputs are products and services to be supplied (e.g. number of student exchanges financed, number of km of roads built, etc .). 45 As described in Section 1.3.2. ‘Specific objective(s)’ EN 20 EN Subtotal for specific objective No 1 SPECIFIC OBJECTIVE No 2 ... - Output Subtotal for specific objective No 2 TOTALS EN 21 EN 3.2.3. Summary of estimated impact on administrative appropriations –  The proposal/initiative does not require the use of appropriations of an administrative nature –  The proposal/initiative requires the use of appropriations of an administrative nature, as explained below 3.2.3.1. Appropriations from voted budget VOTED APPROPRIATIONS Year Year Year Year Year Year Year TOTAL 2028 - 2034 2028 2029 2030 2031 2032 2033 2034 HEADING 4 Human resources 3.604 3.604 3.604 3.604 3.604 3.604 3.604 25.22Ff8 Other administrative expenditure 0.000 0.000 0.000 0.000 0.000 0.000 0.000 0.000 Subtotal HEADING 4 3.604 3.604 3.604 3.604 3.604 3.604 3.604 25.228 Outside HEADING 4 Human resources 0.000 0.000 0.000 0.000 0.000 0.000 0.000 0.000 Other expenditure of an administrative nature 0.000 0.000 0.000 0.000 0.000 0.000 0.000 0.000 Subtotal outside HEADING 4 TOTAL 3.604 3.604 3.604 3.604 3.604 3.604 3.604 25.228 The estimated impact on expenditure and staffing for 2028 and beyond is added for illustrative purposes only and does not pre -judge the next Multiannual Financial Framework. The source of financing and scope of Union financial commitment in the post -2027 period remain subject to the outcome of interinstitutional nego tiations on the MFF 2028 -2034 and thereafter shall be determined through the annual budgetary procedure. All appropriations and staffing allocations as of 2028 are indicative. 3.2.3.2. Appropriations from external assigned revenues Not applicable. 3.2.3.3. Total appropriations See table above. 3.2.4. Estimated requirements of human resources –  The proposal/initiative does not require the use of human resources –  The proposal/initiative requires the use of human resources, as explained below 3.2.4.1. Financed from voted budget Estimate to be expressed in full-time equivalent units (FTEs) VOTED APPROPRIATIONS Year Year Year Year Year Year Year 2028 2029 2030 2031 2032 2033 2034  Establishment plan posts (officials and temporary staff) 20 01 02 01 (Headquarters and Commission’s Representation Offices) 11 11 11 11 11 11 11 20 01 02 03 (EU Delegations) 0 0 0 0 0 0 0 01 01 01 01 (Indirect research) 0 0 0 0 0 0 0 EN 22 EN 01 01 01 11 (Direct research) 0 0 0 0 0 0 0 Other budget lines (specify) 0 0 0 0 0 0 0 • External staff (inFTEs) 20 02 01 (AC, END from the ‘global envelope’) 14 14 14 14 14 14 14 20 02 03 (AC, AL, END and JPD in the EU Delegations) 0 0 0 0 0 0 0 Admin. Support line [XX.01.YY.YY] - at Headquarters 0 0 0 0 0 0 0 - in EU Delegations 0 0 0 0 0 0 0 01 01 01 02 (AC, END - Indirect research) 0 0 0 0 0 0 0 01 01 01 12 (AC, END - Direct research) 0 0 0 0 0 0 0 Other budget lines (specify) - Heading 7 0 0 0 0 0 0 0 Other budget lines (specify) - Outside Heading 7 0 0 0 0 0 0 0 TOTAL 25 25 25 25 25 25 25 The estimated impact on expenditure and staffing for 2028 and beyond is added for illustrative purposes only and does not pre -judge the next Multiannual Financial Framework. The source of financing and scope of Union financial commitment in the post -2027 period remain subject to the outcome of interinstitutional negotiations on the MFF 2028 -2034 and thereafter shall be determined through the annual budgetary procedure. All appropriations and staffing allocations as of 2028 are indicative. 3.2.4.2. Financed from external assigned revenues Not applicable. 3.2.4.3. Total requirements of human resources The staff required to implement the proposal (in FTEs): To be covered by current staff available in the Commission services Exceptional additional staff* To be financed under Heading 7 or Research To be financed from BA line To be financed from fees Establishment plan posts 5 6 N/A External staff (CA, SNEs, INT) 10 4 * The estimated impact on expenditure and staffing for 2028 and beyond is indicative and does not pre-judge the next Multiannual Financial Framework. The source of financing and scope of Union financial commitment in the post -2027 period remain subject to the outcome of interinstitutional negotiations on the MFF 2028-2034 and annual budgetary procedure and the steering mechanism. Overall, 15 FTEs requested for the initiative are already in place and will be redeployed with the following repatriation: – DG CNECT: 2 FTEs in establishment plan posts and 5 FTEs in external staff EN 23 EN – DG DIGIT: 3 FTEs in establishment plan posts and 5 FTEs in external staff In addition to these existing resources, the initiative requires 10 FTEs of exceptional additional staff. These consist of 6 officials and 4 contract agents and have the following split between DG CNECT and DG DIGIT: – DG CNECT: 3 FTEs in establishment plan posts and 3 FTEs in external staff – DG DIGIT: 3 FTEs in establishment plan posts and 1 FTE in external staff These are requested on top of the current staffing levels to ensure full and effective implementation of the initiative. The new tasks introduced by the proposal cannot be absorbed by the respective DGs’ existing human resources. The additional human resources required for this proposal cannot be covered by redeployments within the DG/service or from redeployments from the limited Commission redeployment pool. Description of new tasks to be carried out by DG CNECT and DG DIGIT: Officials and temporary staff Official and temporary staff will be tasked to: 1. Determine and manage the Work Programmes under Pillar 1 of the initiative, including the development of detailed project plans, budgets, resource allocati on, KPIs and monitoring mechanisms. 2. Produce guidance documents, delegated acts, dependency assessments, comitology secretariat, and oversee the implementation of the initiative, including: a. Development of comprehensive guidelines, recommendations, templates and tools to support Member States in their implementation efforts on Pillar 2 and Pillar 3 of the initiative b. Development of implementing acts, where needed, e.g. on the requirements applicable to the members of the EuroCloud Federation and the procedure to assess their application c. Drafting market monitoring reports to identify cloud computing services where the Union has a high level of dependence on a single or limited number of third country legal entities for such services d. Providing secretariat servic es including the development of documents and reports, coordination with stakeholders e. Monitoring progress of the initiative against the established KPIs and milestones, identifying possible issues and risks and providing technical assistence and support to Member States as needed f. Establishment of a knowledge management system to capture and share best practices, lessons leadrned and expertise across the initiative 3. Draft tender specifications for an external provider to build, develop and maintain the repository of sovereign services, and evaluate and determine subsequent governance procedures. After setup, regularly audit/assess a sample of certified services, which are part of the repository, including the development of audit protocols and assessment methodologies and/or quality control procedures to ensure the reliability of the information provided. 4. Procure the EuroCloud Federation platform and support the setup of the federation. Manage the governance mechanisms of the federation, e.g. certification of requirements for membership in the federation, evaluation of applications from Member States and other public sector bodies to join the federation, development an d enforcement of common rules and policies for participation in the federation. 5. Setting up systems not currently in place, as part of the joint procurement framework, including managing the complexity of AI procurement, relationships with Member States an d contracting authorities and ensuring that the framework is effective and efficient. This will include tasks such as, setting up and managing the procurement processes for cloud, software, and AI s ystems, coordinating with participating organi sations and service providers, managing the contracts and agreements with service providers, ensuring compliance with EU regulations and policies. EN 24 EN 6. Develop and maintain relationships with stakeholders, including Member States, industry representatives, and other releva nt parties, to ensure that the initiative is well-coordinated, effective, and responsive to the needs of its stakeholders, including the organisation of regular meetings, workshops, and conferences to facilitate communication and collaboration. This would also include close cooperation with competent authorities on investigative and enforcement measures to ensure compliance with Title IV of the Act. External staff External staff will be tasked to: 1. Regularly manage the projects awarded under Pillar 1 work programmes, including the monitoring of their progress, coordination with beneficiaries, and verification of project deliverables and milestones to ensure they are delivered on time, within budget and with the required quality standards. The initiativ e will be implemented in the next MFF and will build on the results of existing projects already approved under Horizon Europe and the Digital Europe Programme, e.g. Simpl and the Smart Networks and Services Join t Undertaking, including in coordination with other Units. 2. Establish and operate support mechanisms to provide guidance to Member States for the deployment of data centre acceleration zones, particularly during the first two years of the initiative. This will involve the provision of ad hoc suppor t to Member States as they develop and implement their national strategies and plans. After the initial period, this will transition to a more ad hoc coordination role, focusing on providing targeted support to Member States as needed, and ensuring that the initiative remains aligned with the needs and priorities of its stakeholders. 3. Set up and manage a study each year to monitor the computing capacity across Europe, including setting out the scope and methodology of the study, verifying the data collected, reviewing deliverables. 4. Manage the joint procurement activities, in particular in relation to strategic sourcing and market shaping, i.e. vendor management office and drafting of specifications and technical requirements for cloud, AI and software services. 5. Manage the repository of sovereign services on a yearly basis, including by overseeing the contractor activities related to the repository’s operations, including technical project management, i.e. ensuring that the contractor delivers the repository according to the agreed technical specifications, timelines, and budget, while also monitoring the contractor's processes to ensure that the repository meets the required standards. 6. Manage the external contractor covering the administrative, technical and operational activities of the EuroCloud Federation platform each year, as well as the technical aspects of the EuroCloud Federation platform, including oversight of technical architecture and infrastructure. 3.2.5. Overview of estimated impact on digital technology-related investments Compulsory: the best estimate of the digital technology-related investments entailed by the proposal/initiative should be included in the table below. Exceptionally, when required for the implementation of the proposal/initiative, the appropriations under Heading 7 should be presented in the designated line. The appropriations under Headings 1-6 should be reflected as “Policy IT expenditure on operational programmes”. This expenditure refers to the operational budget to be used to re-use/ buy/ develop IT platforms/ tools directly linked to the implementation of the initiative and their associated investments (e.g. licences, studies, data storage etc). The information provided in this table should be co nsistent with details presented under Section 4 “Digital dimensions”. EN 25 EN TOTAL Digital and IT appropriations Year Year Year Year Year Year Year TOTAL MFF 2028 - 2034 2028 2029 2030 2031 2032 2033 2034 HEADING 4 IT expenditure (corporate) 0 0 0 0 0 0 0 0 Subtotal HEADING 4 0 0 0 0 0 0 0 0 Outside HEADING 4 Policy IT expenditure on operational programmes 0 0 0 0 0 0 0 0 Subtotal outside HEADING 4 0 0 0 0 0 0 0 0 TOTAL 0 0 0 0 0 0 0 0 3.2.6. Compatibility with the current multiannual financial framework The proposal/initiative: –  can be fully financed through redeployment within the relevant heading of the multiannual financial framework (MFF) Without prejudice to the negotiations on the next MFF, the appropriations allocated to the Cloud and AI Development Act related activities from 2028 onwards will be covered via redeployments from ECF under the 2028 -2034 MFF and partially from fees. –  requires use of the unallocated margin under the relevant heading of the MFF and/or use of the special instruments as defined in the MFF Regulation –  requires a revision of the MFF 3.2.7. Third-party contributions The proposal/initiative: –  does not provide for co-financing by third parties –  provides for the co-financing by third parties estimated below: Appropriations in EUR million (to three decimal places) Year 2028 Year 2029 Year 2030 Year 2031 Year 2032 Year 2033 Year 2034 Total Specify the co - financing body TOTAL appropriations co- financed EN 26 EN 3.3. Estimated impact on revenue –  The proposal/initiative has no financial impact on revenue. –  The proposal/initiative has the following financial impact: –  on own resources –  on other revenue –  please indicate, if the revenue is assigned to expenditure lines EUR million (to three decimal places) Budget revenue line: Appropriation s available for the current financial year Impact of the proposal/initiative46 Year 2028 Year 2029 Year 2030 Year 2031 Year 2032 Year 2033 Year 2034 Joint Cloud Procurement service fee (DG DIGIT) 0.000 3.027 4.317 6.037 6.342 6.663 7.001 Cloud Federation fee (DG CNECT) 0.000 2.940 4.410 5.880 2.570 2.570 2.570 For assigned revenue, specify the budget expenditure line(s) affected. Joint Cloud procurement service fee: The assigned revenue will be used to cover the budget expenditure linked to the brokerage system put in place for the Joint Procurement scheme. The revenue will be allocated to support the operational costs of the system, including the costs of external staff, tools, and systems. The breakdown of the assigned revenue will be on average as follows: around 50% will be allocated to cover operational and administrative costs, e.g. studies and research to inform procurement decisions, community management tools and systems to support co mmunication and collaboration among participating organisations, technical enablers and platform integration; around 30% will be allocated to cover the costs of developing and maintaining the necessary tools and systems, such as procurement platforms and m arketplaces, contract life -cycle management systems, portfolio and demand management tools; around 20% will be allocated to cover the costs of additional specialised external staff, e.g. for software procurement, data protection activities, Back -office, Fi nOps and ContractOps to manage contractual aspects, portfolio and demand management. This allocation aims to ensure that the assigned revenue is used to cover only the operational costs of the system and the budget expenditure linked to the brokerage system. These costs will be allocated based on effective demand needs, ensuring that the resources are used efficiently to support the Joint Procurement scheme. Cloud Federation Fee: 46 As regards traditional own resources (customs duties, sugar levies) , the amounts indicated must be net amounts, i.e. gross amounts after deduction of 20% for collection costs. EN 27 EN The assigned revenue will be used to cover the budget expenditure linked to t he services and platform put in place for the EuroCloud Federation. The revenue will be allocated to support the operational costs of the system, including the costs of external staff, tools, and systems. The expenditure required to finance the federation consists of operational and development-related costs. A significant share relates to the development and maintenance of the platform. Development costs are expected to be highest during the first years, reflecting the initial deployment phase. From year 4 onwards, costs would cover ongoing operations, technical support and periodic upgrades. The maintenance contract would include quality assurance and performance assessment carried out by an external contractor, estimated at around 10% of the total procurement value, based on similar procurement contracts. Operational costs include the cost of external technical experts (10 profiles) on top of the internal FTEs which would be responsible for coordination and project management (see above under the descripti on of new tasks to be carried out by DG CNECT). Their involvement would ramp up progressively, with approximately 40% of capacity in year 1, 80% in year 2, and reaching full capacity from year 3 onwards, in line with the increasing operational needs of the federation. Further expenditure includes IT infrastructure costs, such as hosting services and security -related tooling, which are necessary to ensure the reliability, scalability and protection of the platform. This allocation aims to ensure that the ass igned revenue is used to cover the operational costs of the system and the budget expenditure linked to the services provided. These costs will be allocated based on effective demand needs, ensuring that the resources are used efficiently to support the EuroCloud F ederation. Initial establishment costs may be borne by the general budget of the Union and reimbursed by the participating authorities over a defined period through the fees. Other remarks (e.g. method/formula used for calculating the impact on r evenue or any other information). Joint Cloud procurement service fee: The fee is meant to cover the operational costs for the procurement activities (interinstitutional procurement, joint procurement and central purchasing activities) and the possible ancillary procurement activities. The payers of the fee would be participating contracting authorities. The fee would increase the price for contracting authorities. However, this will be set in a way to cover only the necessary costs for administering the p rocurement activities, as the objective of this common procurement would be to be able to negotiate better conditions, lower prices for all contracting authorities and facilitating the adoption at scale of technologies that evolve constantly. The fees are calculated pro -rata per transaction or via a flat fee per subsequent awarded contract, as specified in the procurement document. The fees will be computed based on a yearly forecast of the beneficiaries’ consumption and will be perceived yearly before the execution of the contracts. The fees charged to the participating contracting authorities shall not exceed the verifiable costs incurred by the Commission. It shall be recomputed each year, proportionally to the volume of work foreseen and costs incurred. The starting data of collection of the fee would be 2029, to allow for an initial setup process. The fee will be collected through existing EN 28 EN online services for invoicing and collecting payments from participating contracting authorities. Projected annual revenue depends on both the number of participating authorities (beneficiaries) and their average expected purchases. The fee revenue will need to reach approximately EUR 6 million per year to cover the forecast average annual costs. Based on estimates on participation, it should be reachable with an average annual fee rate of 2% applied to the spending per authority . If total spending exceeds this level, e.g. because more authorities participate, average spending per authority is higher, or both, the fee rate would decrease proportionately. R evenue from the fee will be used to finance the entire operational costs of the procurement mechanism, explained above. The Commission shall report to the European Parliament and the Council on the overall amount of the costs incurred for the procurement activities and the total amount of the fees charged. Cloud Federation fee: The fee is meant to cover the operational costs for establishing and managing the EuroCloud federation, including assessing membership applications and facilitating the sharing of data centre services and cloud computing services through the development of the EuroCloud Federation platform. The payers of the fee would be members of the federation. The fee would slightly increase the overall costs for participants. However, it shall be calibrated strictly to cover the essential administrative and operational costs of running the federation. This is expected to create efficiencies and cost savings. By enabling members to exchange capacity and make use of otherwise idle resources, participants can access services at more favourable rates than those available on the open market. This shared model can reduce the need for external procurement and improve overall resource utilisation, especially in the short to medium term. While the fee introduces a marginal cost, it is balanced by the economic benefits derived from collaboration, improved capacity usage and more competitive pricing within the federation. The Commission shall adopt implementing acts laying down detailed rules relating to determining the fees to be levied by the Commission, specifying the estimated costs attributable to the activities for which fees are chargeable, the individual fee amounts chargeable, as well as the ways and conditions under which the fees should be paid. The membership fee would be structured as a cost -recovery mechanism, proportionate to the number of participating entities in the federation. The goal is to cover costs while progressively reduci ng the financial burden on each member as participation increases. The uptake is assumed to grow over time, with approximately 20% of possible entities joining in the first year, 40% in the second year, 60% in the third year, around 80% in year 4 before a chieving full participation in the fifth year. The first year would be dedicated to setting up the federation so no full membership fee would apply. Based on the estimations done, from year 2 onward, the membership fee could be set at around EUR 75 000 per member, reflecting the relatively low number of participants. As more entities join and the cost base is shared across a larger group, the fee could gradually decrease and reach around EUR 30 000 per member once full capacity is achieved. The scheme is expected to reach a break-even point around year 4. At that stage, the fee structure would stabilise at a level sufficient to sustain EN 29 EN operations without generating considerable surplus, in line with the cost -recovery principle. The starting data of collectio n of the fee would be 2029, to allow for an initial setup process. The fee will be collected through online services for invoicing and collecting payments from participating authorities. The estimated annual revenue would depend on the number of participating members and the applicable membership fee. Based on an average membership fee of around EUR 75 000 per member, annual revenues would reach around EUR 4.4 million per year to cover the forecasted average annual operating costs of the federatio n, including the initial fixed costs. As participation increases, the costs of administering the federation would be distributed across a larger number of members. Consequently, the fee per member would decrease proportionately, with annual revenues stabilising at a lower level, e.g. of around EUR 2.6 million per year. The Commission shall report to the European Parliament and the Council on the overall amount of the costs incurred for the federation activities and the total amount of the fees charged. The period for reporting is still to be determined. The use of assigned revenue for the joint procurement and Euro Cloud federation offers a budgetary policy opportunity to ensure a dedicated and stable funding stream for these initiatives. By earmarking the re venue from the fee for specific purposes, the Commission can guarantee that the funds are used efficiently and effectively to support the development of a European cloud ecosystem. This approach is justified by the need to provide a clear and predictable financial framework for both initiatives under CADA, which will allow to plan and implement them in a strategic and long - term manner. In terms of compliance with the budgetary principles of universality and unity, the use of assigned revenue is justified by the fact that the se initiatives are designed to support specific and clearly defined policy objective s, i.e. the development of a European cloud ecosystem for sharing idle capacity among Member States and the joint procurement of cloud services to achieve efficiencies and economies of scale . The revenues from the fees will be used to finance specific items of expenditure that are directly related to the achievement of th ese objectives, as specified above in the respective sections covering both activities. By using assigned revenue, the Commission can ensure that the funds are used in a targeted and efficient manner, without affecting the overall balance of the Union's budget. Furthermore, the use of assigned revenue is consistent with the principle of unity, as it will enable the Commission to implement the se initiatives in a coherent and coordinated manner, avoiding duplication of efforts and ensuring that the funds are used to support a common European objective. The Commission will also ensure that the use of assigned revenue is transparent and accountable, with regular reporting and evaluation of the initiative's progress and impact. In addition, the Commission will take into account the need to avoid any potential distortions or inequal ities in the treatment of different cloud service providers, and will ensure that the use of assigned revenue is fair, proportionate, and non - discriminatory. The Commission will also consult with relevant stakeholders to ensure that the initiative is desig ned and implemented in a way that is responsive to their needs and concerns. EN 30 EN It is important to note that only the operational costs of the two initatives, as outlined above, will draw on the assigned revenue generated by the fees. Administrative costs, on the other hand, will not be covered by the assigned revenue. In the event that the fees do not materialise in the amount and timing assumed, the Commission has taken a cautious approach to mitigate the risks. In the case of joint procurement, if the fees do not materialise, it would mean that no system would be put in place, and the initiative would not incur any significant costs. On the other hand, the EuroCloud Federation builds on pre -existing studies and current evidence of Member State interest in t his initiative. Moreover, the major costs associated with the initaitive are already covered under the current Multiannual Financial Framework under the budget already assigned to the Commission, which altogether reduces this financial risk. Overall, this approach will allow the Commission to adjust its plans, without incurring significant financial risks and be more flexible to adapt its resource allocation as needed, in order to ensure the success of these initiatives. EN 31 EN 4. DIGITAL DIMENSIONS 4.1. Requirements of digital relevance High-level description of the requirements of digital relevance and related categories (data, process digitalisation & automation, digital solutions, and/or digital public services). Reference to the requirement Requirement description Actors affected or concerned by the requirement High-level processes Categories TITLE II RESEARCH, DEVELOPMENT AND DEPLOYMENT ACTIVITIES FOR THE CLOUD AND AI ECOSYSTEM Article 7 National cloud and AI strategies Member States shall notify the Commission of their national strategies. European Commission National competent authorities Notification Data TITLE III DATA CENTRE CAPACITIES Article 14 Designation of data centre strategic projects Applications for designation of data centre strategic project shall provide all the necessary and relevant information to demonstrate that the project fulfils the relevant criteria. Project operators European Commission Application insights monitoring Data EN 32 EN Reference to the requirement Requirement description Actors affected or concerned by the requirement High-level processes Categories TITLE III DATA CENTRE CAPACITIES Article 15 Monitoring the Capacity Gap The Commission shall monitor the compute capacity available in the Union, including edge computing capacity; the volume of demand for data centre capacity; the size of the capacity gap. European Commission National competent authorities Data collection Data TITLE IV AUTONOMY Article 17 Recognition of cloud computing service providers A cloud computing service provider that aims to be recognised as offering a Union assurance level, shall submit an application for recognition to the national competent authority of establishment. Cloud computing service providers National competent authorities Oversight mechanism Data TITLE IV AUTONOMY Article 19 Conformity self-assessment The cloud computing service provider may issue a conformity self-assessment to demonstrate compliance with Union assurance level 1. These are to be made publicly available. Cloud computing service providers National competent authorities European Commission Oversight mechanism Data TITLE IV AUTONOMY Article 20 Independent audit Establishes the possibility of independent audits for Union assurance levels 2, 3, and 4. Provisions related to data aspects in the context of such audits. Cloud computing service providers Auditing organisations European Oversight mechanism Data EN 33 EN Reference to the requirement Requirement description Actors affected or concerned by the requirement High-level processes Categories Commission TITLE IV AUTONOMY Article 21 Content and quality of audit evidence Audits to be based on Annexes II (Criteria for Union Assurance Levels) and III (Audit evidence for the audit procedure). To be sufficiently complete and reliable. Cloud computing service providers Auditing organisations European Commission Data quality Data TITLE IV AUTONOMY Article 22 Central repository of cloud computing services The Commission shall establish and maintain a dedicated repository of cloud computing services that have received recognition against a Union assurance level. The verifying national competent authority of establishment shall register the audited services in the central repository. Any revocation of a recognition shall be published, and remain published, in the central register for 5 years. The central repository shall be made publicly available by the Commission and regularly updated by the Commission and the national competent authorities of establishment on a dedicated and easily accessible website. European Commission National competent authorities Repository Digital solution Data Digital public service EN 34 EN Reference to the requirement Requirement description Actors affected or concerned by the requirement High-level processes Categories TITLE IV AUTONOMY Article 23 Transparency obligations On becoming aware of information or material change in circumstances concerning the cloud computing services that may affect the audit report / opinion, the service provider shall without undue delay notify the auditing organisation and the national competent authority of establishment. If the results of the audit report and opinion need to be amended or cancelled, the auditing organisation shall without undue delay notify the national competent authority and the Commission. If the results of the recognition need to be amended or cancelled, the national competent authority of establishment shall without undue delay notify the national competent authorities of the other Member States and the Commission. Cloud computing service providers Auditing organisations National competent authorities European Commission Notification Data TITLE IV AUTONOMY Article 24 Penalties and compensation Member States shall notify, as soon as possible, notify to the Commission the rules on penalties and compensation and any subsequent amendment affecting them. National competent authorities European Commission Notification Data EN 35 EN Reference to the requirement Requirement description Actors affected or concerned by the requirement High-level processes Categories TITLE IV AUTONOMY Article 25 National competent authorities Each Member States shall designate one or more national competent authorities. Members States shall notify the list of authorities to the Commission. The Commission shall maintain a public register of the authorities. European Commission National competent authorities Designation of competent authorities Data TITLE IV AUTONOMY Article 27 Mutual assistance Data flows in the context of cooperation between national competent authorities. National competent authorities European Commission Data exchange Data TITLE IV AUTONOMY Article 89 Cross- border cooperation Data flows in the context of cross-border cooperation. National competent authorities European Commission Data exchange Data TITLE IV AUTONOMY Article 29 Risk Assessments Member States must perform a risk assessment or assessments, taking utmost account of the guidance issued by the Commission. Member States shall communicate the risk assessment results to the Commission. For the purpose of the guidance, the Commission is entitled to request information from cloud service providers. Member States European Commission Cloud service providers Risk assessment Data TITLE IV Member States shall communicate annually to the Commission certain information pertaining to the Member States Reporting Data EN 36 EN Reference to the requirement Requirement description Actors affected or concerned by the requirement High-level processes Categories AUTONOMY Article 33 Monitoring of procurement of innovation in cloud and AI monitoring of procurement of innovative cloud computing services and AI systems. European Commission TITLE IV AUTONOMY Article 34 Establishment of the European public sector cloud federation The Commission shall establish a platform for the EuroCloud Federation. European Commission Union entities Public sector bodies Requirements for a digital solution Digital public service Digital solution TITLE IV AUTONOMY Article 37 Procurement activities of the Commission The Commission may establish and manage a common procurement platform including services which may be used for facilitating the performance of the procurement activities under this Chapter. European Commission Requirements for a digital solution Digital solution TITLE IV AUTONOMY Article 42 Share and reuse of software When making available for reuse under an open-source licence software on which they hold intellectual property rights, a Union entity or public sector body shall make the software available for reuse on a catalogue or repository that is connected to the EU OSS Catalogue. Union entities Public sector bodies European Commission Catalogue Digital solution EN 37 EN Reference to the requirement Requirement description Actors affected or concerned by the requirement High-level processes Categories TITLE IV AUTONOMY Article 43 EU Open Source Solutions Catalogue The Commission shall provide and maintain an EU Open Source Solutions Catalogue as a centralised catalogue to access software made available for reuse by Union entities and public sector bodies The EU OSS Catalogue shall be hosted on the Interoperable Europe portal. The Commission shall decide on the request of any Union entity or public sector body owning or maintaining a catalogue or repository to connect to and be made accessible through the EU OSS Catalogue. European Commission Catalogue Digital solution 4.2. Data High level description of the data in scope Type of data Reference to the requirement(s) Standard and/or specification (if applicable) Member State National Strategies TITLE II RESEARCH, DEVELOPMENT AND DEPLOYMENT ACTIVITIES FOR THE CLOUD AND AI ECOSYSTEM Article 7 National cloud and AI strategies Minimum content requirements for the national strategies. Data related to applications for recognition as a strategic project TITLE III DATA CENTRE CAPACITIES Article 14 Designation of data centre strategic projects Provide all the necessary and relevant information to demonstrate that the project fulfils the relevant EN 38 EN criteria. Statistics and data required for the monitoring of the capacity gap TITLE III DATA CENTRE CAPACITIES Article 15 Monitoring the Capacity Gap N/A Data in the context of the submissions of applications by service providers that aim to be recognised as offering a Union assurance level TITLE IV AUTONOMY Article 17 Recognition of cloud computing service providers N/A EU statement of conformity TITLE IV AUTONOMY Article 19 Conformity self-assessment N/A Audit report submitted for recognition and related exchanges TITLE IV AUTONOMY Article 20 Independent audit Article 21 Content and quality of audit evidence Data quality: sufficiently complete and reliable; minimum content for audits. Data on services that receive a recognition TITLE IV AUTONOMY Article 22 Central repository of cloud computing services The central repository shall contain information of cloud computing services that have been recognised under a specific Union assurance levels Notification of becoming aware of information or material change in circumstances concerning the cloud computing services that may affect the audit report / opinion / recognition and related data flows TITLE IV AUTONOMY Article 23 Transparency obligations N/A EN 39 EN Notification of rules and measures on penalties TITLE IV AUTONOMY Article 24 Penalties and compensation N/A Data on the designated national competent authorities TITLE IV AUTONOMY Article 25 National competent authorities N/A Data used in the context of cooperation between national competent authorities TITLE IV AUTONOMY Article 27 Mutual assistance N/A Data used in the context of cross-border cooperation TITLE IV AUTONOMY Article 28 Cross-border cooperation N/A Risk assessments performed by Member States TITLE IV AUTONOMY Article 29 Risk Assessments N/A Information provided to the Commission by providers for guidance TITLE IV AUTONOMY Article 29 Risk Assessments N/A Data pertaining to the monitoring of procurement of innovative cloud services and AI systems TITLE IV AUTONOMY Article 33 Innovation procurement N/A Alignment with the European Data Strategy Explanation of how the requirement(s) are aligned with the European Data Strategy EN 40 EN The proposal is consistent with the rules on switching between data processing services introduced by the Data Act. By enabling switching and removing key sources of vendor lock-in, the Data Act seeks to ensure that cloud service providers in the EU compete on quality, innovation, and price. It seeks to enable cloud users to freely choose the provider that best meets their needs and combine offers of different providers in a multi -cloud approach. However, the Data Act does not contain elements to shape up a more competitive offer of EU cloud services or encourage the entry into the market of a more diverse set of cloud service providers. The Data Act opens the path towards a possible reduction of dependencies on non -EU providers but does not build the road towards a more so vereign and trusted EU cloud computing sector. The cloud switching and interoperability provisions, however, make it possible for users to embrace European cloud computing services more strongly. The Data Act is thus an enabler for the proposal. Alignment with the once-only principle Explanation of how the once-only principle has been considered and how the possibility to reuse existing data has been explored The once -only principle has been duly considered and will systematically be enforced wherever relevant. This is in particular the case for: (a) The statistics and data required for the monitoring of the capacity gap (b) The data on services that receive a recognition (c) The information provided to the Commission for market analysis Explanation of how newly created data is findable, accessible, interoperable and reusable, and meets high-quality standards Digital solutions will be provided to ensure the findability, accessibility, interoperability, and reusability of newly created data . Minimum content requirements will promote high - EN 41 EN quality standards for the data. Data flows Type of data Reference to the requirement(s) Actors who provide the data Actors who receive the data Trigger for the data exchange Frequency (if applicable) Member State National Strategies TITLE II RESEARCH, DEVELOPMENT AND DEPLOYMENT ACTIVITIES FOR THE CLOUD AND AI ECOSYSTEM Article 7 National cloud and AI strategies Member States European Commission Within three months of the adoption of a national strategy Per adoption/ revision Data related to applications for recognition as a strategic project TITLE III DATA CENTRE CAPACITIES Article 14 Designation of data centre strategic projects Applicant for designation of a strategic project European Commission Application during open calls for expression of interest // Data in the context of the submissions of requests by cloud computing services wishing to provide services to Union entities and public sector bodies TITLE IV AUTONOMY Article 17 Recognition of cloud computing service providers Requesting cloud computing service provider National competent authority of their establishment Request being made to provide services to Union entities and public sector bodies // EN 42 EN Type of data Reference to the requirement(s) Actors who provide the data Actors who receive the data Trigger for the data exchange Frequency (if applicable) Data in the context of the submissions of requests by cloud computing services wishing to provide services to Union entities and public sector bodies: Outcome of request (reject, ask for additional evidence, recognise the provider’s service) TITLE IV AUTONOMY Article 17 Recognition of cloud computing service providers National competent authority Requesting cloud computing service provider Conclusion reached on initial recognition // Data in the context of the submissions of requests by cloud computing services wishing to provide services to Union entities and public sector bodies: Distribution of conclusion for review TITLE IV AUTONOMY Article 17 Recognition of cloud computing service providers National competent authority All national competent authorities Cloud computing service provider notified of a recognition // Data in the context of the submissions of requests by cloud computing services TITLE IV AUTONOMY Article 17 Recognition of cloud computing service All national competent authorities National competent authority National competent authority has objections to a conclusion made by a national competent // EN 43 EN Type of data Reference to the requirement(s) Actors who provide the data Actors who receive the data Trigger for the data exchange Frequency (if applicable) wishing to provide services to Union entities and public sector bodies: Objections providers authority of establishment Data in the context of the submissions of requests by cloud computing services wishing to provide services to Union entities and public sector bodies: Cases referred to the Commission TITLE IV AUTONOMY Article 17 Recognition of cloud computing service providers National competent authorities European Commission National competent authorities cannot reach an agreement // Data in the context of the submissions of requests by cloud computing services wishing to provide services to Union entities and public sector bodies: Commission decision on a referred case TITLE IV AUTONOMY Article 17 Recognition of cloud computing service providers European Commission National competent authorities Commission reaches a decision on a case where national competent authorities were in disagreement // Data in the context of the submissions of TITLE IV National competent authorities European Commission National competent authorities decide to use // EN 44 EN Type of data Reference to the requirement(s) Actors who provide the data Actors who receive the data Trigger for the data exchange Frequency (if applicable) requests by cloud computing services wishing to provide services to Union entities and public sector bodies: Information request AUTONOMY Article 17 Recognition of cloud computing service providers their right to an information request Data in the context of the submissions of requests by cloud computing services wishing to provide services to Union entities and public sector bodies: Reply to an information request TITLE IV AUTONOMY Article 17 Recognition of cloud computing service providers European Commission National competent authorities Information request from national competent authorities received // EU statement of conformity TITLE IV AUTONOMY Article 19 Conformity self- assessment Cloud computing service providers Public Self-assessment used // Audit report submitted for validation and related exchanges: information TITLE IV AUTONOMY Article 20 Independent audit Article 21 Content and Cloud computing service providers Auditing organisation Audit being performed // EN 45 EN Type of data Reference to the requirement(s) Actors who provide the data Actors who receive the data Trigger for the data exchange Frequency (if applicable) required for the audit quality of audit evidence Audit report submitted for validation and related exchanges: audit reports TITLE IV AUTONOMY Article 20 Independent audit Article 21 Content and quality of audit evidence Cloud computing service providers Auditing organisation and national competent authorities Audit finished // Data on services that receive a recognition: Central repository of cloud computing services TITLE IV AUTONOMY Article 22 Central repository of cloud computing services Verifying national competent authority Central repository of cloud computing services (European Commission) Recognition granted // Data on services that receive a recognition: Publicly available website provided by the European Commission TITLE IV AUTONOMY Article 22 Central repository of cloud computing services European Commission National competent authority of establishment Public Recognition granted // Notification of becoming aware of information or material change in circumstances concerning the cloud computing services TITLE IV AUTONOMY Article 23 Transparency obligations Cloud computing service providers Auditing organisation National competent authority European Commission Material conditions change on the side of the provider // EN 46 EN Type of data Reference to the requirement(s) Actors who provide the data Actors who receive the data Trigger for the data exchange Frequency (if applicable) that may affect the audit report / opinion and related data flows: Initial notification Notification of becoming aware of information or material change in circumstances concerning the cloud computing services that may affect the audit report / opinion and related data flows: Notification of the audit outcome changing TITLE IV AUTONOMY Article 23 Transparency obligations Auditing organisation National competent authorities (of the establishment and of other Member States) European Commission Outcome of audit changing // Notification of rules and measures on penalties TITLE IV AUTONOMY Article 24 Penalties and compensation Member States European Commission Member States set/amend the framework for imposing penalties // Data on the designated national competent authorities: Notification by TITLE IV AUTONOMY Article 25 National competent authorities Member States European Commission National competent authorities designated (within a year of date of entry into force) // EN 47 EN Type of data Reference to the requirement(s) Actors who provide the data Actors who receive the data Trigger for the data exchange Frequency (if applicable) Member States Data on the designated national competent authorities: Data in the public register of authorities TITLE IV AUTONOMY Article 25 National competent authorities European Commission Public National competent authorities designated and Commission notified // Data used in the context of cooperation between national competent authorities: Information Exchange TITLE IV AUTONOMY Article 27 Mutual assistance National competent authorities National competent authorities Cooperation (exchange of information) between national competent authorities needed // Data used in the context of cooperation between national competent authorities: Requests for assistance (and replies to such requests) TITLE IV AUTONOMY Article 27 Mutual assistance National competent authorities National competent authorities Assistance deemed necessary // Data used in the context of cross- border cooperation: Request for assessment – TITLE IV AUTONOMY Article 28 Cross-border cooperation National competent authorities of a service’s destination National competent authorities of a service’s origin Suspicions of non- compliance giving rise to a request for assistance // EN 48 EN Type of data Reference to the requirement(s) Actors who provide the data Actors who receive the data Trigger for the data exchange Frequency (if applicable) suspicion of non- compliance Data used in the context of cross- border cooperation: Commission informed of suspicions of non- compliance TITLE IV AUTONOMY Article 28 Cross-border cooperation National competent authorities of a service’s destination European Commission A competent authority decide to ask the competent authority of establishment for information to assess suspicions of non- compliance // Data used in the context of cross- border cooperation: Request for assessment – suspicion of non- compliance (Commission) TITLE IV AUTONOMY Article 28 Cross-border cooperation National competent authorities of a service’s origin European Commission National competent authorities Suspicion of noncompliance by other competent authorities or the Commission // Data used in the context of cross- border cooperation: Outcome of a request for assessment – suspicion of non- compliance TITLE IV AUTONOMY Article 28 Cross-border cooperation Competent authorities of origin Requestors European Commission Within two months of a request being made // Risk assessments performed by Member States TITLE IV AUTONOMY Member States European Commission Risk assessment occurring within one year of entry into force Bi-annually EN 49 EN Type of data Reference to the requirement(s) Actors who provide the data Actors who receive the data Trigger for the data exchange Frequency (if applicable) Article 29 Risk Assessments Information provided to the Commission for guidance TITLE IV AUTONOMY Article 29 Risk Assessments Cloud service providers European Commission // // Data pertaining to the monitoring of the procurement of innovative cloud services and AI systems TITLE IV AUTONOMY Article 33 Monitoring of procurement of innovation in cloud and AI Member States European Commission // Annually 4.3. Digital solutions Repository of recognised cloud computing services Digital and/or sectorial policy (when these are applicable) Explanation on how it aligns AI Act Not applicable EU Cybersecurity framework The repository will follow cybersecurity best practices of the Commission eIDAS The repository will re-use, in so far as relevant, the eIDAS framework Single Digital Gateway and IMI Not applicable EN 50 EN Others (e.g., Interoperable Europe Act) The need for another interoperability assessment under the Interoperable Europe Act (Regulation EU 2024/903) will be evaluated once the operational details for the repository of recognised cloud computing services become available. EuroCloud platform Digital and/or sectorial policy (when these are applicable) Explanation on how it aligns AI Act Not applicable EU Cybersecurity framework The platform should include mechanisms for secure access and incident management, such as shared identity management, mutual authentication tools, and incident reporting tools. The platform will follow cybersecurity best practices of the Commission eIDAS This will be specified by the Commission at a later stage. Single Digital Gateway and IMI Not applicable Others (e.g., Interoperable Europe Act) The need for another interoperability assessment under the Interoperable Europe Act (Regulation EU 2024/903) will be evaluated once the operational details for the EuroCloud platform become available. Common procurement platform Digital and/or sectorial policy (when these are applicable) Explanation on how it aligns EN 51 EN AI Act Not applicable EU Cybersecurity framework The platform will follow cybersecurity best practices of the Commission eIDAS This will be specified by the Commission at a later stage. Single Digital Gateway and IMI Not applicable Others (e.g., Interoperable Europe Act) Not applicable Catalogue or repository of reusable software that is connected to the EU OSS Catalogue Digital and/or sectorial policy (when these are applicable) Explanation on how it aligns AI Act Not applicable EU Cybersecurity framework The platform will follow cybersecurity best practices of the Commission eIDAS The repository will re-use, in so far as relevant, the eIDAS framework Single Digital Gateway and IMI Not applicable Others (e.g., Interoperable Europe Act) Not applicable EU Open Source Solutions Catalogue Digital and/or sectorial policy (when these are applicable) Explanation on how it aligns EN 52 EN AI Act Not applicable EU Cybersecurity framework The platform will follow cybersecurity best practices of the Commission eIDAS The catalogue will re-use, in so far as relevant, the eIDAS framework Single Digital Gateway and IMI Not applicable Others (e.g., Interoperable Europe Act) Article 4 of the Interoperable Europe Act (Regulation EU 2024/903) mandates the share and reuse of interoperability solutions between Union entities and public sector bodies. The EU Open Source Solutions Catalogue delivers upon this requirement. 4.4. Interoperability assessment Digital public service or category of digital public services Description References(s) to the requirement(s) Interoperable Europe Solutions(s) Other interoperability solution(s) Union repository of recognised sovereign services A dedicated Union repository of cloud computing services that have received recognition. To be established and maintained by the Commission. National competent authorities shall register the relevant services in this repository. TITLE IV AUTONOMY Article 22 Central repository of cloud computing services // NA EuroCloud Federation Article 34 establishes the European public sector cloud federation (EuroCloud Federation). The EuroCloud Federation should bring together national cloud TITLE IV AUTONOMY Article 34 Establishment of NA NA EN 53 EN initiatives providing highly trusted and secure public sector cloud capabilities and facilitate the sharing of such capabilities between Union entities and public sector bodies. This should be done via a platform accessible to all Federation Members – the EuroCloud Platform. the European public sector cloud federation Impact of the requirement(s) as per digital public service on cross-border interoperability Union repository of recognised sovereign services Assessment Measure(s) Potential remaining barriers (if applicable) Alignment with existing digital and sectorial policies Please list the applicable digital and sectorial policies identified The implementation of the Union repository of recognised sovereign services will take utmost account of existing policies and the building blocks stemming from them. Organisational measures for a smooth cross-border digital public services delivery Please list the governance measures foreseen The European Commission is tasked with establishing and maintaining the repository. The verifying national authority is responsible for uploading the relevant data into the repository. The organisational measures will need to be detailed by the Commission, at a later stage. Measures taken to ensure a shared understanding of the data Please list such measures Semantic measures will be specified by the Commission at a later stage. EN 54 EN Use of commonly agreed open technical specifications and standards Please list such measures Technical measures will be specified by the Commission at a later stage. EuroCloud Federation Assessment Measure(s) Potential remaining barriers (if applicable) Alignment with existing digital and sectorial policies Please list the applicable digital and sectorial policies identified The implementation of EuroCloud federation will take utmost account of existing policies and the building blocks stemming from them. In particular: NIS2 for cybersecurity, Simpl, Data Spaces. NA Organisational measures for a smooth cross-border digital public services delivery Please list the governance measures foreseen The detailed governance of the Eurocloud platform will be dealt with through secondary legislation. NA Measures taken to ensure a shared understanding of the data Please list such measures Semantic measures will be specified by the Commission at a later stage. NA Use of commonly agreed open technical specifications and standards Technical measures will be specified by the Commission at a later stage. NA EN 55 EN Please list such measures 4.5. Measures to support digital implementation Description of the measure References(s) to the requirement(s) Commission role Actors to be involved Expected timeline The Commission is empowered to adopt implementing acts specifying (i) the technical, operational and organisational measures and (ii) the procedure to participate in the EuroCloud Federation as referred to in Article 40(2). Article 40, Article 41 Drafting one or more implementing acts European Commission Participating Member States TBD --- [Bilagor (annexes) till förslaget till förordning om utveckling av moln och AI KOM (2026) 502.pdf] EN EN EUROPEAN COMMISSION Brussels, 3.6.2026 COM(2026) 502 final ANNEXES 1 to 3 ANNEXES to the REGULATION OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL establishing a framework of measures for strenghtening Europe's cloud and AI ecosystem (Cloud and AI Development Act) {SEC(2026) 502 final} - {SWD(2026) 502 final} - {SWD(2026) 503 final} EN 1 EN ANNEX I GRAND CHALLENGES 1. Grand Challenge 1: Environmental sustainability , performance and security of the Union’s data centres   Testing and deploying technologies for data centres across the Union to surpass state-of-the- art energy-efficiency and resource efficiency. This includes achieving lower Power Usage Effectiveness (PUE) and enabling significantly higher server utilisation rates. Examples include: (1) Lowering a verage Power Usage Effectiveness : improving the environmental sustainability and performance of the Union's cloud and edge data centres to an average Power Usage Effectiveness (PUE) of 1.15 across the Union. The main focal areas include enabling the development of: (a) advanced data centre energy efficiency technologies such as cooling, waste heat recovery; (b) quantum computing technologies for cloud and compute infrastructure operations; (c) grid integration and advanced energy management systems; (d) pilot lines for the validation of next -generation energy-efficient technologies at operational scale.  (2) Raising a verage server utilisation rates of data centres: raising average server utilisation rates across the Union’s data centres to wards 50%, by integrating for example, AI -powered technologies for dynamic server utilisation management, runtime workload management and scheduling or for balancing utilisation, energy cost, thermal constraints, and latency requirements.  (3) Enhancing the security and resilience of data centres: enhancing the security and resilience of data centres ’ value chain and supply by integrating semiconductor technologies and quantum technologies designed and manufactured in the Union, and by improving their resistance to physical and cybersecurity threats, including targeted attacks. 2. Grand Challenge 2: Cloud stacks  Building end-to-end hardware and software cloud stack s, including AI tools , infrastructure, services and management layers to bridge the Union's critical capacity gaps. This includes building AI servers powered by semiconductors and quantum technologies designed and manufactured in the Union for distributed and decentralised cloud and edge computing for AI. Pilot programmes could help demonstrate the capabilities of the European open cloud stack s in strategically important sectors.    3. Grand Challenge 3: Frontier AI Developing the next generation of multimodal frontier AI models and systems and pioneering novel capabilities. The focus will be on the architectural design and development of next -generation multimodal models and systems that push the boundaries of current algorithmic capabilities for achieving superior performance in advanced reasoning, cross -modal understanding and agentic EN 2 EN capabilities; investigating novel approaches to model efficiency, cognitive modelling, and alternative computational structures, etc. The potential applications could include foundational science such as scientific discovery and complex data interp retation, and the development of world models for improved reasoning, automated management simulation and planning. 4. Grand Challenge 4: Physical AI  Developing advanced physical AI models and systems that operate autonomously and safely for delivering robust, manipulation and navigation in unstructured environments. The focus will be on co -designing software and its underlying hardware architectures and on combining frontier AI techniques with world models supporting physical reasoning for delivering robust manipulation, navigation, and interaction capabilities with minimal human supervision. The potential applicatio ns could include autonomous robots, industrial systems and drones operating in dynamic real-world environments. 5. Grand Challenge 5: Industrial AI Accelerate the development and deployment of European industrial AI across the Union’s strategic sectors. The focus will be on developing European industrial AI models and systems capable of serving high-value industrial applications. Such models and syst ems should be adaptable to sector-specific use cases and enable secure deployment. The initiatives launched under this grand challenge should rely on specialised computing resources and testing facilities necessary to validate AI systems in real -world envi ronments before supporting their large -scale deployment and uptake, including at regional and local level. In the automotive sector, those initiatives may facilitate the development and deployment of innovative software platforms and AI models for automated driving, while in manufacturing, they may enable the creation of specialised models that optimise production processes. Other strategic sectors that could benefit from industrial AI may include healthcare, energy , agri - food and defence. 6. Grand Challenge 6: Cooperative European Industrial Models Developing cooperative European industrial AI models and systems for strategic sectors by enabling collaboration at European industrial scale without expos ing commercially sensitive data between participants. The focus will be on advanced confidentiality -preserving technologies . Those mechanisms include federated and distributed training approaches where algorithms are brought to the data rather than data being transferred centrally; secure execution environments, encryption -based processing, anonymisation and pseudonymisation techniques, access compartm entalisation, and protections against the extraction of commercially sensitive information from trained models. Strategic sectors that could benefit from cooperative European industrial AI models and systems may include aerospace, pharmaceutics, cybersecurity, mobility, autonomous vehicles and drones, energy and defence. EN 3 EN 7. Grand Challenge 7: AI Agents Platform Developing a European AI agent orchestration framework, providing the essential middleware for the resilient and secure deployment of autonomous agents at scale. The focus will be on (i) exploring innovative technological paradigms that enable multiple AI agents to collaborate effectively, surpassing the capabilities of standalone systems while maintaining rigorous security standards; and (ii) on the creation of resilient, cloud-based open platforms dedicated to the large-scale management of AI agents. The potential applications could include healthcare (such as clinical decision support and research coordin ation), cybersecurity (such as threat detection and response ), as well as foundational science. 8. Grand Challenge 8: Public Sector AI Developing AI models and systems, based on high -quality data from the public sector targeting critical domains (such as h ealthcare, public administration, law and crisis management as well as public services) The focus will be on public service solutions that are expected to have a high positive impact on the most critical public services and are shared across different levels of public sector organisations. One target will be to enable data sharing and frontier model development across national public services to increase the impact on the overall Union’s public sector , including also in areas handling sensitive data. Privacy-preserving frameworks, (such as federated learning and high-fidelity synthetic data generation ), that make it possible to train of models without compromising the confidentiality of underlying datasets, and measures to accelerate the broad uptake of those modems , including at regional and local level , will also help achieve this target. EN 4 EN ANNEX II CRITERIA FOR UNION ASSURANCE LEVELS This Annex sets out the criteria to be met by cloud computing service providers and their cloud computing services in order to be recognised as offering services at Union assurance levels 1, 2, 3 and 4. For the purpose of the criteria under Union assurance levels 1, 2, 3, and 4, ‘software’ within the meaning of Regulation (EU) 2024/2847, Article 3, point (4) falls within the scope of this Annex and Annex III to this Regulation. ‘Hardware’ within the meaning of Regulation (EU) 2024/2847, Article 3, point (5) is outside of the scope. 1. Union assurance level 1 1.1. For Union assurance level 1, cloud computing service providers must meet the following cumulative criteria: (a) the cloud computing service provider is established in the Union; (b) the infrastructure and assets of the cloud computing service prov ider, including those of its subcontractors which are involved in the provision of the service, are located in the Union unless the public sector body explicitly requires otherwise; (c) the customer data , including metadata and telemetry data, that is processed, stored and transferred by the cloud computing service provider, and by the subcontractors , which are involved in the provision of the service, remain exclusively within the Union, unless the public sector body explicitly requires otherwise and at any time, including before, during or after the configuration or use of the service; (d) where the cloud computing service provider outsources the technical and operational support or assistance , including an y subsequent sub -outsourcing arrangements, to third-party service providers outside of the Union, the necessary legal, technical and organisational measures are implemented to ensure traceability, security and governance of those operations and those operations do not, in any way, compromise the operational autonomy of the cloud computing service provider; (e) the cloud computing service provider demonstrates that the service complies with the state-of-the-art cybersecurity standards; (f) the cloud computing service provider provides full transparency around the use of subcontractors. The cloud computing service provider subjects subcontractors to due diligence, contractual obligations and ongoing oversight to meet Union legal obligations; (g) Where the cloud comp uting service provider is subject to the control of a third country or a legal entity established in a third -country, the cloud computing service provider guarantees that there are no existing laws and practices in that third country, demonstrated by indep endent sources, that require the cloud computing service provider to report information on software vulnerabilities to authorities of that third country prior to those vulnerabilities being known to have been exploited. 1.2. For Union assurance level 1, the subcontractors referred to in the first paragraph must be subcontractors that are third parties that have a direct contractual relationship with the cloud computing service provider and that contribute to the provision and the delivery of the cloud computing service. 2. Union assurance level 2 EN 5 EN 2.1. For Union assurance level 2, cloud computing service providers must meet the following cumulative criteria: (a) the audited provider and the subcontractors which are involved in the provisi on of the audited service are established in the Union; (b) the infrastructure, assets, and personnel of the audited provider, including those of its subcontractors which are involved in the provision of the service are located in the Union; (c) the customer data, including metadata and telemetry data, that is processed, stored and transferred by the audited provider and the subcontractors which are involved in the provision of the service, remain exclusively within the Union , unless the public sector body explicitly requires otherwise and at any time, including before, during or after the configuration or use of the service; (d) if the public sector body determines that imposing additional personnel screening and Union citizenship requirements are necessary, the audited provider should ensure that presonnel meeting those requirements are available; (e) the audited service obtains a European cybersecurity certificate of at least assurance level ‘substantial’ under a European cybersecurity certification scheme covering cloud computing services to be established under Regulation (EU) 2019/881, provided that such a scheme has been established under that Regulation and is available to cloud computing service providers. Until the establishment of such a scheme, national cybersecurity certification schemes shall apply , where they exist. Where no Union or national cybersecurity certification schemes exist, the audited provider is to demonstrate that the service complies with the highest cybersecurity standards under applicable Union law; (f) the data generated by using the audited service are not used to train or fine -tune any AI system operated by a third country or a legal entity established in a third-country , and are not transferred outside the Union in any case; (g) if the audited provider and the subcontractors which are involved in the provision of the audited service are subject to the control of a third country or a legal entity established in a third-country, they demonstrate that the necessary legal, technical and organisational measures have been implemented to ensure that the: i. control of the third country or the legal entity established in a third-country over the audited provider is not exercised in a manner that restrains or restricts the provider’s ability to perform and deliver the service, imposes limitations on the infrastructure, assets, and personnel required for the service provision, or undermines the capabilities and standards necessary to perform the audited service; ii. access by a third country or by a legal entity established in a third -country to customer data is prevented; iii. possibility of disruption of the service continuity and/or the degradation of the service quality by a third country or a legal entity established in a third country is prevented; iv. control of the third country or the legal entity esta blished in a third-country over the audited provider is not exercised in a manner that obliges the audited provider to implement , enforce, give effect to, or comply with restrictive measures such as sanction regimes, embargoes, or any equivalent legal or EN 6 EN administrative measures adopted by a third country , unless such measures are legitimate under the national laws of Member States or Union law (h) the technical and operational support or assistance related to the audited service, including subsequent sub -outsourcing arrangements, are initiated and performed exclusively within the Union; (i) the audited provider demonstrates that the following software supply chain measu res are in place: i. a complete and up -to-date software bill of materials ( SBOM), as defined in Article 3 , point (39) , of Regulation (EU) 2024/2847,and a list of identified dependencies relevant to the provision of the service are documented and made available to the auditing organisation; ii. where software components as defined in Regulation (EU) 2024/2847 Article 3, point 6 or products are provided, owned, and licensed by a legal entity established in a third country, controls are implemented and docum ented to block any remote features that could materially tamper with or disrupt a device, system, or software (including during updates) and to ensure that the security - relevant components from third -country software manufacturers, as defined in Regulation (EU) 2024/2847 Article 3, point 13, are subject to source code audits, and have a documented migration plan in the event that the vendor fails or a third country imposes restrictions; iii. where the cloud computing service provider is subject to the control of a third country or a legal entity established in a third -country, the clou d computing service provider guarantees that there are no existing laws and practicesin that third country, demonstrated by independent sources, that require the cloud computing service provider to report information on software vulnerabilities to authorities of that third country prior to those vulnerabilities being known to have been exploited; (j) where software released under an open-source licence is used for the provision of the service, the audited provider demonstrates that it has implemented and docu mented the appropriate controls to prevent the use of any remote features or mechanisms that could be used to materially tamper with or disrupt a device, system, or software; (k) to the extent that the audited provider provides its services globally and maintains a subsidiary in a third country, the audited provider has implemented the necessary measures to ensure and enforce the effective legal, technical and organisational separation between the Union parent company and any such third-country subsidiary. 2.2. For Union assurance level 2, the subcontractors referred to in the first paragraph must be subcontractors that are third parties that have a direct contractual relationship to the cloud computing service provider and that contribute to the provision and delivery of the cloud computing service. 3. Union assurance level 3 3.1. For Union assurance level 3, cloud computing service providers must meet the following cumulative criteria: (a) the audited provider and the subcontractors which are involved in the provision o f the audited service are established in the Union; EN 7 EN (b) the infrastructure, assets, and personnel of the audited provider, including those of the subcontractors which are involved in the provision of the service, are located in the Union; (c) the customer data, i ncluding metadata and telemetry data, that is processed, stored and transferred by the audited provider and the subcontractors which are involved in the provision of the service, remain exclusively within the Union unless the public sector body explicitly requires otherwise and at any time, including before, during or after the configuration or use of the service; (d) the personnel, including the personnel of the subcontractors which are involved in the provision of the audited service are Union citi zens and w here appropriate, the personnel must also have the necessary national security clearance issued by a Member State when handling classified information , as defined in Article 2, point (21), of Regulation (EU) 2021/697; (e) the audited service obtains a European cybersecurity certificate of at least assurance level ‘substantial’ under a European cybersecurity certification scheme covering cloud computing services to be established under Regulation (EU) 2019/881, provided that such a scheme has been established under that Regulation and is available to cloud computing service providers. Until the establishment of such a scheme, national cybersecurity certification schemes shall apply, wher e they exisit. Where no Union or national cybersecurity certification schemes exist, the audited provider is to demonstrate that the service complies with the highest cybersecurity standards under applicable Union law; (f) the data generated by using the audi ted service are not used to train or fine -tune any AI system operated by a third country or a legal entity established in a third-country and are not transferred outside the Union in any case; (g) the audited provider and the subcontractors which are involved in the provision of the audited service are not subject to the control of a third country or a legal entity established in a third-country. By way of derogation to this criterion, a cloud computing service provider and its subcontractors which are involved in the provision of the audited service that are subject to the control of a third country or a legal entity established in a third-country may be audited for Union assurance level 3 where the Commission has adopted an implementing act under Arti cle 19. Where the Commission has adopted an implementing act under Article 19, the audited provider and the subcontractors which are involved in the provision of the audited service must also demonstrate that the necessary legal, technical and organisation al measures have been implemented to ensure that the: i. control of the third country or the legal entity established in a third -country over the audited provider is not exercised in a manner that restrains or restricts the provider’s ability to perform and deliver the service, imposes limitations on the infrastructure, assets, and personnel required for the service provision, or undermines the capabilities and standards necessary to perform the audited service. The audited provider should allow for reasonable access to the code; ii. access by a third country or by a legal entity established in a third -country to customer data is prevented; iii. possibility of disruption of the service continuity and/or the degradation of the service quality by a third country or a legal entity established in a third country is prevented; EN 8 EN iv. control of the third country or the legal entity established in a third -country over the audited provider is not exercised in a manner that obliges the audited provider to implement , enforce, give effect to, or comply with restrictive measures such as sanction regimes, embargoes, or any equivalent legal or administrative measures adopted by a third country, unless such measures are legitimate under the national laws of Member States or Union law; (h) the technical and operational support or assistance related to the audited service, including subsequent sub -outsourcing arrangements, are initiated and performed exclusively within the Union , by personnel that are Union residents, and by third parties that are not subject to the control of a third country or a legal entity established in a third country; (i) the audited provider demonstrates that the following software supply chain measures are in place: i. a complete and up-to-date SBOM and a list of identified dependencies relevant to the provision of the service are documented and made available to the auditing organisation; ii. where software components or products are provided, owned, and licensed by a legal entity established i n a third country, controls are implemented and documented to block any remote features that could materially tamper with or disrupt a device, system, or software (including during updates) and to ensure that the security -relevant components from third -country manufacturers are subject to source code audits, and have a documented migration plan in the event that the vendor fails or a third country imposes restrictions; iii. where the cloud computing service provider is subject to the control of a third country or a legal entity established in a third -country, the cloud computing service provider guarantees that there are no existing laws and practices in that third country, demonstrated by independent sources, that require the cloud computing service provider to report information on software vulnerabilities to authorities of that third country prior to those vulnerabilities being known to have been exploited; (j) where software released under an open-source licence is used for the provision of the service, the audited provider demonstrate s that it has implemented and documented the appropriate controls to prevent the use of any remote features or mechanisms that could be used to materially tamper with or disrupt a device, system, or software; (k) to the extent that the audited provider provides its services outside of the Union and maintains a subsidiary in a third country, the audited provider demonstrates that it has implemented the necessary measures to ensure and enforce the effective legal, technical and organisational separation between the Union parent company and any such third-country subsidiary. 3.2. For Union assurance level 3, the subcontractors referred to in the first paragraph must be subcontractors that a re third parties that have a direct contractual relationship to the cloud computing service provider and that contribute to the provision and the delivery of the cloud computing service, and that may require access to classified or sensitive information , a s defined in Article 2, point (22), of Regulation (EU) 2021/697. 4. Union assurance level 4 EN 9 EN 4.1. For Union assurance level 4, cloud computing service providers must meet the following cumulative criteria: (a) the audited provider and the subcontractors which are involved in the provision of the audited service are established in the Union; (b) the infrastructure, assets, and personnel of the audited provider, including the subcontractors , which are involved in the provision of the service, are located in the Union; (c) the customer data , including metadata and telemetry data, which, following a risk assessment, is identified as sensitive, that is processed, stored and transferred by the audited provider and the subcon tractors which are involved in the provision of the service, remain exclusively within the Union and at any time, including before, during or after the configuration or use of the service; (d) the personnel, including the personnel of the subcontractors , which are involved in the provision of the audited service are Union citizens and, where appropriate, the personnel must also have the necessary national security clearance issued by a Member State when handling classified information; (e) the audited service obtains a European cybersecurity certificate of at least assurance level ‘high’ under a European cybersecurity certification scheme covering cloud computing services to be established under Regulation (EU) 2019/881, provided that such a scheme has been established under that Regulation and is available to cloud computing service providers. Until the establishment of such a scheme, national cybersecurity certification schemes shall apply, where they exist. Where no Union or national cybersecurity cer tification schemes exist, the audited provider is to demonstrate that the service complies with the highest cybersecurity standards under applicable Union law; (f) the data generated by using the audited service are not used to train or fine -tune any AI system operated by a third country or a legal entity established in a third-country, and are not transferred outside the Union in any case; (g) the audited provider and the subcontractors which are involved in the provision of the audited service are not subject to the control of a third country or a legal entity established in a third-country; (h) the technical and operational support or assistance related to the audited service, including subsequent sub -outsourcing arrangements, are initiated and performed exclusively within the Union , by personnel that are Union residents, and by third parties that are not subject to the control of a third country or a legal entity established in a third country; (i) the audited provider demonstrates that the following software supply chain measures are in place: i. a complete and up-to-date SBOM and a list of identified dependencies relevant to the provision of the service are documented and made available to the auditing organisation; ii. measures in place to retain effectiv e control over the software components or products by demonstrating that a third country or a legal entity established in a third country does not hold or exercise effective control over the design, development, maintenance, and evolution of those componen ts or products. Effective control includes the ability to materially influence the technical EN 10 EN evolution, maintenance priorities, security remediation, and long -term continuity of the component; (j) where software released under an open -source licence is used, t he audited provider demonstrates that it has implemented and documented the appropriate controls to prevent the use of any remote features or mechanisms that could be used to materially tamper with or disrupt a device, system, or software; (k) to the extent th at the audited provider provides its services outside of the Union and maintains a subsidiary in a third country, the audited provider demonstrates that it has implemented the necessary measures to ensure and enforce the effective legal, technical and orga nisational separation between the Union parent company and any such third-country subsidiary. 4.2. For Union assurance level 4, the subcontractors referred to in the first paragraph must be subcontractors that are third parties that have a direct contractual relationship to the cloud computing service provider, that contribute to the provision and delivery of the cloud computing service, and that may require access to classified or sensitive information in order to carry out the service provision. EN 11 EN ANNEX III AUDIT EVIDENCE FOR THE AUDIT PROCEDURE Auditing organisations should request the audit evidence listed in this Annex from the audited provider when assessing the compliance of the audited service against the applicable audit criteria under Annex II. This Annex is indicative and does not limit the evidence that may be requested or considered by the auditing organisations . Auditors may seek any additional information necessary to ensure a comprehensive and accurate assessment of compliance to conduct audits. While the evidence requested may be the same, the aspects that need to be analysed will differ depending on the assurance level criteria and their strictness. 1. Audit criterion A – Union establishment The auditing organisation should assess the audit criterion listed under Union assurance levels 2, 3, and 4 paragraph (a) of Annex II based on the following: (1) Any evidence demonstratin g that the audited provider is incorporated under the law of a Member State in the Union or otherwise constituted in line with company law of a Member State in the Union. (2) Any evidence that the registered office, central administration, and main establishment of the audited provider is established within the Union. (3) The auditing organisation should verify the applicable Union legal framework of the audited provider and verify whether their establishment is genuine and stable or whether the audited provider instead qualifies only as a non -EU provider offering services in the Union. (4) The auditing organisation should verify whether the provider is legally incorporated in a Member State of the Un ion. Evidence of this could include, but is not limited to, the national company extracts, tax residency documentation, business licen ces, VAT registration, verification of whether the provider is registered in the Business Registers Interconnected System (BRIS) and the VAT information Exchange System (VIES). (5) The auditing organisation should verify the stable and effective presence in the Union of the audited provider. The auditing organisation should therefore verify that: (a) EU physical offices or operational premises exist (for example, through lease contracts, utility bills or property documents); (b) permanent staff is located in the Union and that customer support operations are carried out in the Union (for example, through employment contract s, payroll records, personnel timesheets); (c) contractual operations are handled in the Union (for example, through activity management records, incident reporting records); (d) banking and accounting functions are exclusively in the Union (for example, through financial statements and statutory audit reports). (6) The auditing organisation should verify the presence of EU Member State establishment units or branches (for example , through lease contracts, utility bills , property documents, employment contracts, timesheets, payroll records or purchase orders). EN 12 EN 2. Audit criterion B – Location of infrastructure, assets, and personnel The auditing organisation should assess the audit criterion listed under Union assurance levels 2, 3, and 4 paragraph (b) of Annex II based on the following evidence: (1) Location of infrastructure (a) A list with relevant details of the location of the infrastructure and data storage locations used in the provision of the audited service. This list should include the precise location (number, street, city, postal code and country) of the infrastructure demonstrating that all elements remain within the Union for the provision of the audited service. This includes the location for the primary , backup, disaster recovery and log storage. (b) Any other evidence that the IT infrastructure is located in the Union such as lease agreements , property deed s, maintenance contracts, service contracts , facility access logs. (c) Network diagrams and architecture documents illustrating the exclusive use of Union-based infrastructure for data storage and processing , including backup and replicated data. (2) Location of assets (a) A list and relevant details of the assets used in the provision of the audited service, such as an asset register. (b) Evidence that servers, equipment, and operational assets are located in the Union, such as records identifying the server and its location, purchase invoices, delivery notes, licence agreements, subscription contracts, or invoices for software purchases or subscriptions , invoices with delivery proofs for hardware. (c) Evidence that service delivery capabilities are based in the Union , such as deployment records, i nstallation records , service status reports, configuration reports, monitoring outputs, admin logs showing usage of the service. (3) Location of personnel (a) A list and relevant details of the personnel involved in the provision of the audited service. (b) Evidence that the personnel involved in the provision of the audited service are located in the Union, including employment contracts, payroll records, timesheets, activity records, and organisati onal charts showing Union -based staff with operational responsibilities. (4) Considerations regarding the infrastructure, assets and personnel (a) The auditing organisation should also assess where such infrastructure, assets, or personnel: i. store, transmit, access, process or otherwise handle customer data; ii. provide, enable, or could enable administrative access to, control over, configuration of, or visibility into customer data; iii. if compromised, misconfigured, made unavailable or disrupted could reasonably result in the disruption or unavailability of the audited service. EN 13 EN NB: ‘Infrastructure’ means physical infrastructure, including but not limited to, data centre infrastructure or colocation infrastructure, network, cooling, and IT systems that allow for the management of the datacentre. ‘Assets’ means hardware and software, including, but not limited to, libraries, the internal network needed for software components to communicate, cryptographic materials that enables the provision of the cloud computing service. ‘Personnel’, including personnel managed by subcontractors, means individuals who support the delivery, administration, security, availability, or operation of the audited service. 3. Audit criterion C – Data localisation in the Union The auditing organisation should assess the audit criterion listed under Union assurance levels 2, 3, and 4 paragraph (c) of Annex II based on the following evidence: (1) Evidence demonstrating that customer data are stored and processed exclusively in the Un ion and that third -parties or subcontractors that do not meet the conditions under this Annex are in no circumstances technically or operationally able to access, obtain, make unavailable, destroy or more generally process customer data without prior authorisation. Examples include access logs, support access policies, privileged access records, backup retention policy, data flows diagram demonstrating where the customer data are stored, processed, replicated and backed up . When processing personal dat a, contracts with the subcontractors that demonstrate compliance with Regulation (EU) 2016/679. (2) Evidence of logs and monitoring records demonstrating that all data are stored and processed exclusively within the Union. Examples include master service agreements, data processing agreements, data residency contractual agreements or any EU data boundary. (3) Evidence (such as contractual agreements, logs, and procedures offered to public sector bodies ) demonstrating that the audited provider and the subcontractors which are involved in the provision of the audited service have put in place the necessary measures to ensure that: (a) no customer data , including encrypted data, are transferred outside of the Union without public sector body approval; (b) no data are transferred to any third -party other than subcontractors which are involved in the provision of the service or recipients expressly authori sed by the public sector body. (4) A data flow diagram showing the flows of data between the cloud computing service provider and customer data, as well as with third -party services and subcontractors. The diagram must clearly identify the source and destination of data and demonstrate that the data does not leave the Union. NB: For the purpose of this Annex, a customer means a public sector body who has entered into a contractual or other legally binding arrangement with the cloud computing service provider for the purpose of accessing or using the cloud computing service. ‘Customer data ’ could mean any data under the control of the cloud computing service customer, whether by legal, contractual, or other means, that are: EN 14 EN (a) input into the cloud computing service by or on behalf of the customer, including authentication credentials; (b) produced through the customer’s use of the cloud computing service. Customer data may also include data under the audited providers control that are derived as a result of interaction with the audited service by the cloud service customer. This includes customer data and any data resul ting from the usage of the cloud computing services (i.e. telemetry, metadata). ‘Cloud compunting service derived data’ includes the portion of log data containing records of who used the service, at what times, which functions, types of data involved and so on. It can also include information about the numbers of authorised users and their identities. It can also include any configuration or customi sation data, where the cloud computing service has such configuration and customisation functionalities. 4. Audit criterion D – Union citizenship The auditing organisation should assess the audit criterion listed under Union assurance levels 2, 3, and 4 paragraph (d) of Annex II based on the following evidence: (1) The audited provider should provide the auditing organisation with proof that it has implemented the measures to ensure that, if a public sector body were to request Union citizenship, the personnel involved in the provision of the audited service are Union citizens. This can be demonstrated through valid official government issued documents (e.g. valid passport and national identity card); (2) The audited provider should provide organi sational charts and job descriptions confirming that it can ensure, where requested, that only personnel with Union citizenship have access to the audited service's operation, management, maintenance, and support. (3) The audited provider should provide documen ts demonstrating access control policies and audit trails showing that only authorised personnel who are Union citizens can access the service's systems and data. (4) The audited provider should demonstrate that i t has put in place procedures describing how ci tizenship is verified before assignment and how compliance with this audit criterion is maintained throughout employment. NB: Personnel involved in the provision of the audited service could include personnel who have logical or physical access to infrastructure and assets used to operate the cloud computing service, as well as those who are responsible for customer support, and all personnel who have management control of the cloud compunting service provider. 5. Audit criteria E – European cybersecurity certification scheme adopted under Regulation 2019/881 The auditing organisation should assess the audit criterion listed under Union assurance levels 2, 3, and 4 paragraph (e) of Annex II based on the following evidence: (1) A valid European cybersecurity certificate issued by a competent conformity assessment body demonstrating that the audited service has been assessed and found compliant with the requirements corresponding to the ‘basic’, ‘substantial’ or ‘high’ assurance levels under a European cybersecurity certification scheme adopted under Regulation (EU) 2019/881, provided that such shas been established ; EN 15 EN (2) A certification report including a description of the main components used for the development and operat ion of the cloud computing service that is covered by the audit certificate. (3) Until the European cybersecurity certification scheme covering cloud computing services has been established, the audited provider can demonstrate compliance through valid cybersecurity certifications. This can include, but is not limited to, the following: (a) a valid certificate issued by a competent conformity assessment body (in line with CEN/CLC/TS 18072:2025) demonstrating that the cloud computing service has been assessed and found compliant with the requirements corresponding to the ‘basic’ or ‘substantial’ or ‘high’ assurance levels defined under CEN/TS 18026:2024; (b) A valid certificate issued by the relevant national competent authority demonstrating that the cloud computing service has been assessed and found compliant with the requirements under the national cybersecurity scheme currently in place in the Member State; (c) in the absence of a national scheme, evidence demonstrating adherence to the highest level of cybersecurity standards available on the market. 6. Audit criterion F – AI systems operated by a third country or third country legal entity The auditing organisation should assess the audit criterion listed under Union assurance levels 2, 3, and 4 paragraph (f) of Annex II based on the following evidence: (1) Contractual clauses stating that data processed or generated by using the audited service, including customer-derived data, logs and telemetry, will not be used to train or fine-tune any AI model or system operated by a third country or a third -country legal entity, and are not transferred outside the Union in any case. (2) Contractual clauses specifying that data are processed solely for the delivery of the audited service and not for service improvements or model or system enhancements or any other secondary purpose. (3) Data flow diagrams doc umenting the end -to-end flow of data, covering data ingestion, storage, processing and deletion. The diagrams should also show where the AI pipelines or machine learning operations ( MLOps) connect with customer data. (4) MLOps or deployment records demonstrating that the build, test and release locations are in the EU. (5) Model or system cards covering the model or system name, version, training and validation sources, including statements that the data generated by using the aud ited service does not leave the Union. (6) Data lineage polices and related implementation documentation that shows that the provider operates data lineage and provenance tools and that can demonstrate (per record) what the data has been used for. (7) A list of the subcontractors (indicating their country of establishment) that access the data generated by using the audited service. EN 16 EN 7. Audit criterion G – Absence of third -country control or third -country entity control The auditing organisation should assess the audit criterion listed under Union assurance levels 2, 3, and 4 paragraph (g) of Annex II based on the following evidence: (1) The auditing organisation should identify and analyse: (a) all direct and indirect shareholders, up to the ultimate owners; (b) the cap table documenting the company’s ownership structure; (c) the body or bodies empowered to take strategic decisions (general assembly of shareholders, supervisory board, board of directors, etc.); (d) the rules for the appointment/election/removal of governing bodies and the actual composition of the governing bodies (e.g. to identify if any shareholder is entitled to nominate a board representative or has majority seats in the board); (e) the quorums and majority required f or adopting strategic decisions, in order to determine if any shareholder can take a strategic decision (either because they have the required majority to approve such a decision or because they can block such a decision through a veto or other specific rights even if they cannot impose such a decision on their own, etc.); (f) the possible influence on strategic decisions through commercial links, financial links or other means, etc. (2) The audited provider should request all the above information from its subcontractors and make it available to the auditing organisation. 7.1. Assessment of ownership and control: (1) The audited provider should provide the auditing organisation with the following evidence related to the headquarters: (a) the location and full address of the global headquarters and/or head office; (b) the locations of the executive management structures. (2) The audited provider should provide the auditing organisation with the following evidence related to the ownership structure and specific rights: (a) A detailed list describing any owners that: i. hold, directly or indirectly, at least 5% of the capital or at least 5% of the voting rights, including through any content, understanding, relationship or intermediary. This includes voting agreements between shareholders that would together have more than 5% of the voting rights or 5% of the capital; ii. have one or more of the following specific rights in relation to their ownership: (a) right to veto a transfer of shares; (b) pre -emption rights; (c) right to purchase additional shares or investment subject to conditions. (b) The auditing organisation should request the following supporting documents to assess the elements in paragraph 2(a): EN 17 EN i. commercial registry extracts and shareholders ’ books of the organisation and any other relevant document that clearly indicate the shareholders and their voting rights or percentage of interest; ii. shareholders’ agreement, memorandum of understanding among shareholders, statutes, articles of association or other relevant documents regarding the decision -making procedures within the legal entity, investment agreements between the shareholders, etc.; iii. for any shareholders that are legal persons that hold at least 5% in the capital or at least 5% of the voting rights: (1) a graph describing the different ownership layers/chain of control until the ultimate owners; (2) the articles of association , bylaws or equivalent constitutional documents; (3) a register of directors, officers and signatories. (3) The audited provider should provide the auditing organisation with the following evidence related to the corporate governance: (a) The audited provider should provide the auditing organisation with a description of: i. the decision -making bodies, their composi tion as well as their nationality or place of establishment (where applicable); ii. the rules regarding election, appointment, nomination or tenure of members of the decision -making bodies or other management positions; iii. the decision-making procedures, including information on the required majority and/or quorum needed for decisions; iv. internal governance policies describing how ownership and control decisions are recorded and approved; board and management decisions reflecting the stated control structure; board minutes and resolutions for control changes. (b) The audited provider should provide the auditing organisation with s upporting documents setting out or describing: the decision-making bodies and the rules on their election, appointment, nomination or tenure, decision -making procedures, voting rights, veto rights, appointment rights, approval rights within the legal entity (e.g. articles of association bylaws, reports on corporate governance, etc .). The supporting documents a nd information should be provided for each intermediate legal entity that directly or indirectly holds 5% or more of the capital or voting rights, up to the ultimate owners of all the layers involved. (4) The audited provider should provide the following control-related evidence to the auditing organisation: (a) The audited provider should provide the auditing organisation with the evidence of the commercial links conferring control. This includes, but is not limited to, a list of individuals or legal entities with whom the audited providers (or the owners of the audited provider, including intermediate layers EN 18 EN until the ultimate owners) have a commercial relationship that (a) leads to a similar level of control on management and resources as the ownership of shares or assets; and (b) is of very long duration (e.g. very important long -term supply agreements or credits provided by software manufacturers/customers, coupled with structural links). (b) The s upporting documents should include cooperation agreements with the public sector body or software manufacturers , etc. (5) The audited provider should provide the auditing organisation with the following evidence related to the financial links conferring control: (a) The audited provider should list the individuals or legal entit ies (including controlling shareholders or owners) on whom the audited provider (or the owners) are financially dependent in a way that could allow them to obtain concessions in strategic business areas. (b) The supporting documents should include loan documents, by-laws, documents showing the financial link; etc. (6) The audited provider should provide the auditing organisation with the following evidence related to other sources of control: (a) The audited providers should indicate to the audited organisation if ther e is any other mean s, process or link ultimately conferring control to another third country or a legal entity established in a third country (similar level of control on management and resources as the ownership of shares or assets and of long duration). (b) Supporting documents should provide evidence of any such control or a declaration that there is no such control (this declaration may come from the management board of the service provider). NB: The elements that should be taken into account when assessing control are the ownership structures and specific rights, corporate governance, commercial links conferring control, financial links conferring control and any other sources of control. 7.2. Additional steps based on the conclusion of the ownership and control test If the auditing organisation determines that the audited provider is subject to the control of a third country or a third -country legal entity, it should request the following additional evidence: (c) Demonstrating that the Commission has adopted a decision pursuant to Article 19 regarding the third country for which the cloud computing service provider is subject to the control of; (d) All evidence demonstrating that the audited provider and any subcontractorinvolved in the provision of the audited service has implemented the necessary measures to enforce the effective legal, technical and organisational separation between the cloud computing service provider and any third country or legal entity established in a third country, ensuring that the cloud computing service provider is unable to comply , legally, technically and operationally, with any request to access customer data , including encrypted data, or to disrupt service continuity or to degrade service quality. EN 19 EN (e) All evidence demonstrating that the public sector body will be informed of any such request and a confirmation that the request has been refused; (f) All evidence demonstrating the maintenance of an up -to-date record of any request to access customer data, to disrupt service continuity or to degrade service quality from a third country or a legal entity established in a third country, containing at least the request and the response to the request. 8. Audit criterion H – No technical and operational support outside of the Union The auditing organisation should assess the audit criterion listed under Union assurance levels 2, 3, and 4 paragraph (h) of Annex II based on the following evidence: (1) evidence that the audited provider has implemented binding contractual cla uses stating that all support, administration, maintenance, monitoring, incident response, and operational activities must be initiated and performed exclusively in the Union. This could include contractual clauses requiring advanced disclosure of all subcontractors and support locations, prior written approval before engaging any new subcontractors, and a right to reject any subcontractors located outside of the Union; (2) evidence that the audited provider maintains an up-to-date subcontractor register; (3) evidence that t he audited provider does not subcontract or transfer such activities outside of the Union; (4) evidence that the audited provider has implemented the necessary legal, technical and organisational measures to ensure that there can be no remote access for technical and operational support from outside the Union for the audited service. (5) evidence that the audited provider’s help desk/support services, infrastructure administration, operations of its security operations centre ( SOC) or network operations centre (NOC), privileged access, backup handling, and disaster recovery operations of the audited service are exclusively provided from the Union, including the access path to operate the service; (6) evidence that the audited provider ensures that the personnel upon the departure from the company have no further access to the audited service and revokes all access policies; (7) evidence that the audited provider has implemented the necessary technical and organisational measures to ensure that administrative access to systems used to operate the audited service is provided through access paths located within the Union. This can be demonstrated through the implementation of geographically restricted network controls, Union -based administrative infrastructure, privile ged access management controls, and monitoring mechanisms; (8) evidence that the audited provider has procedures in place that there is no effective control of a third country or a legal entity established in a third country, including for subsequent sub-outsourcing. 9. Audit criterion I - Ensuring the transparency of the software supply chain The auditing organisation should assess the audit criterion listed under Union assurance levels 2, 3, and 4 paragraph (i) of Annex II based on the following evidence: (1) The audited provider should make available to the auditing organisation a complete and up -to-date software bill of materials (SBOM) for all software components, including open-source software (OSS). EN 20 EN (2) The audited p rovider should make available to the auditing organisation a list of dependencies. This should include: (a) all software modules, libraries or application programming interfaces ( APIs) used, as well as development tools; (b) origin of software: where (country of o rigin) and by whom the software is designed, developed and maintained, the location and jurisdiction governing the software distribution, and updates; (c) degree of reliance on non -EU vendors, facilities, or proprietary technologies ; for level 3, evidence that in case the software stack is provided by a third coutnry entity, no unduly unjustified licensing restrictions are in place. (d) degree of reliance on open-source software; (e) visibility into the entire software manufacturer and sub -manufacturer chain, including audit rights. N.B. The requirements above imply that joint ventures made, e.g., of a Union entity with a legal entity established in a third country can qualify for this level (3) The audited provider should provide: (a) evidence of a risk -based process for identifying and mitigating dependencies on external software manufacturers relevant to the operation of the cloud computing service; (b) evidence that it has identified one or more alternative software solutions, including open-source software. If equivalent software cannot be identified, a solution ensuring minimal viable functionality must be identified. Tests must be implemented and a switchover plan enabling migration to such alternative solutions; (c) evidence that it can migrate to an alternative solution in the event of any defect or failure of the vendor or restrictions from a third country or a legal entity established in a third country; (d) provide a list of open standards that are followed as part of the audited providers policies regarding the audited service; (4) The audited provider should ensure transparency through remote access and source code auditability by: (a) making available to the auditing organisation a list of evidence to prove that there is no use of any r emote features or mechanisms that could be used to materially tamper with or disrupt a device, system, or software. This should include: i. evidence related to the testing of the software component to prevent the use of any remote features or mechanisms t hat could be used to materially tamper with or disrupt a device, system, or software (test procedure, test reports, test plan, etc.); ii. evidence that the organi sation’s change management procedures cover any change in firmware, bios and software update s as well as integration of a new components to prevent the use of any remote feature or mechanism; EN 21 EN iii. evidence that the maintenance procedure is updated to include preventing any remote feature or mechanism that could be used to materially tamper with or disrupt a device, system or software. (b) The audited provider must ensure that the third -party independent auditor is granted the right to access and audit the source code of such software. The audited provider must also ensure that all documentation, technic al material, information necessary to evaluate and audit the source code are made available to the auditing organisation in a complete, accurate, and accessible format. 10. Audit criterion J – Open-source software The auditing organisation should assess the audit criterion listed under Union assurance levels 2, 3, and 4 paragraph (j) of Annex II based on the following evidence: (1) The audited provider should ensure transparency through remote access and source code auditability by: (a) making available to the auditing organisation a list of evidence to prove that there is no use of any remote features or mechanisms that could be used to materially tamper with or disrupt a device, system, or software. This should include: i. evidence related to the testing of the software component to prevent the use of any remote features or mechanisms that could be used to materially tamper with or disrupt a device, system, or software (test procedure, test reports, test plan, etc.); ii. evidence that the organi sation’s change management procedures include any change in firmware, bios and software updates as well as integration of new components to prevent the use of any remote feature or mechanism; iii. evidence that the maintenance procedure is updated to include preventing any remote feature or mechanism that could be used to materially tamper with or disrupt a device, system or software; (2) The audited provider should provide: (a) evidence of a risk-based process to identify and mitigate: (i) a weak ecosystem and community support of the OSS ; (ii) a failure to continuously monitor the updates released; (iii) cases where the OSS is deprecated or is no longer maintained. (b) evidence that the audited provider has applied the up-to-date OSS with out undue delay; (c) evidence that the audited provider has identified one or several alternative open-source solutions. If the audited provider cannot identify an equivalent software, it must identify a solution ensuring minimal viable functionality. The audited provider must implement t ests must and a switchover plan enabling migration to the alternative solutions. (3) Where the audited provider uses software released under an open -source licence, the audited provider should implement mechanisms to detect and provide timely notice to the public sector body if the software is acquired by or comes under control of a third country or a legal entity or foundation established in a third country. EN 22 EN 11. Audit criterion K – Global services and subsidiaries in third-countries The auditing organisation should assess the audit criterion listed under Union assurance levels 2, 3, and 4 paragraph (k) of Annex II based on the following evidence: (1) The auditing organisation should verify that the subsidiary is legally and operationally independent from the audited provider. (2) The audited provider must demonstrate that the subsidiary has no access to systems processing or storing the customer data. (3) The audited provider must demonstrate that the subsidiary has no privileged accounts within the Union production environments, including cloud administration, Identity and Access Management (IAM), Privileged Access Management (PAM), monitoring or database administration privileges. (4) The auditing organisation should verify that the personnel of the subsidiary cannot obtain access to Union customer data. (5) The auditing organisation should verify that the subsidiary has no authority to instruct Union operational staff to disclose customer data or bypass security procedures. (6) The auditing organisation should verify that all foreign government requests received by the subsidiary are formally redirected to the competent Union entity for legal assessment under Union and Member State law. --- [Bilaga - Konsekvensbedömningsrapport, del 1 av 2.pdf] EN EN EUROPEAN COMMISSION Brussels, 3.6.2026 SWD(2026) 502 final PART 1/2 COMMISSION STAFF WORKING DOCUMENT IMPACT ASSESSMENT REPORT Accompanying the document Proposal for a REGULATION OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL establishing a framework of measures for strengthening Europe’s cloud and AI ecosystem (Cloud and AI Development Act) {COM(2026) 502 final} - {SEC(2026) 502 final} - {SWD(2026) 503 final} i Table of contents 1. INTRODUCTION: POLITICAL AND LEGAL CONTEXT ............................................................... 4 1.1. Political context ................................................................................................. 4 1.2. Legal context ..................................................................................................... 5 2. PROBLEM DEFINITION .................................................................................................................... 6 2.1. Problem context ................................................................................................. 6 2.2. What are the problems? ..................................................................................... 9 2.3. What are the problem drivers? ......................................................................... 15 2.4. How likely is the problem to persist? .............................................................. 25 3. WHY SHOULD THE EU ACT? ........................................................................................................ 26 3.1. Legal basis ....................................................................................................... 26 3.2. Subsidiarity: Necessity of EU action ............................................................... 27 3.3. Subsidiarity: Added value of EU action .......................................................... 27 4. OBJECTIVES: WHAT IS TO BE ACHIEVED? ............................................................................... 28 4.1. General objectives ........................................................................................... 28 4.2. Specific objectives ........................................................................................... 28 5. WHAT ARE THE AVAILABLE POLICY OPTIONS? ..................................................................... 29 5.1. What is the baseline from which options are assessed? .................................. 29 5.2. Description of the policy options ..................................................................... 31 5.3. Options discarded at an early stage ................................................................. 56 5.4. Possible combination of options ...................................................................... 56 6. WHAT ARE THE IMPACTS OF THE POLICY OPTIONS? ........................................................... 57 6.1. Economic impact ............................................................................................. 57 6.2. Social impact ................................................................................................... 73 6.3. Environmental impact ...................................................................................... 74 7. HOW DO THE OPTIONS COMPARE? ............................................................................................ 78 7.1. Effectiveness .................................................................................................... 78 7.2. Efficiency ......................................................................................................... 85 7.3. Coherence ........................................................................................................ 86 7.4. Subsidiarity and proportionality ...................................................................... 89 7.5. Sensitivity analysis .......................................................................................... 89 7.6. Comparison per criteria ................................................................................... 90 8. PREFERRED OPTION ....................................................................................................................... 93 8.1. Outcome of comparison of policy options....................................................... 93 8.2. Application of the “One In One Out” (OIOO) Approach................................ 95 9. HOW WILL ACTUAL IMPACTS BE MONITORED AND EVALUATED? .................................. 97 ANNEX 0 - ENDNOTES ........................................................................................................................... 100 ii Glossary Term or acronym Meaning or definition AI Artificial Intelligence AZ Availability Zone CEN European Committee for Standardization CENELEC European Committee for Electrotechnical Standardization CfE Call for Evidence Colocation data centre A data centre in which one or more customers install and manage their own network or networks, servers and storage equipment and service Colocation data centre operator An organisation who manages and leases/sells space, security, network access, power and cooling capacity from a colocation data centre to one or more customers who install and manage their own network or networks, servers and storage equipment and services CSP Cloud service provider Data Centre (DC) A data centre (DC) is defined as a structure or a group of structures used to house, connect and operate computer systems/ servers and associated equipment for data storage, processing and/or distribution, as well as related activities. DSO Distribution System Operators operate and manage local and regional distribution networks, delivering electricity to end users from the transmission system, such as Data Centres up to a given size. See also TSO. EC European Commission Enterprise data centre operator Enterprise data centre operator is a physical or legal person who manages the entire enterprise data centre, including the building and the use of the information technology services delivered EED Energy Efficiency Directive EU European Union FLAPD Refers to the data centre markets located in Frankfurt, London, Amsterdam, Paris and Dublin. iii FTE Full Time Employee Hyperscaler Hyperscalers are very large cloud and AI computing service providers. They are characterized by their ability to provide cloud computing at very large scale. Hyperscalers include Amazon (Amazon Web Services), Microsoft (Azure), and Google (Google Cloud Platform). IA Impact Assessment ICT Information and Communication Technology IPCEI Important Project of Common European Interest MS Member State(s) OSS Open Source Software is software that is released under a license that allows users to view, modify, and distribute the source code. PUE Power Usage Effectiveness, or PUE, is a metric used to measure the energy efficiency of data centres. It is defined as the ratio of total facility energy to the energy used by IT equipment. A PUE of 1 .2 implies that for each unit of energy spent in powering IT equipme nt, 0.2 units are spent for non -IT equipment such as cooling. A lower PUE indicates better energy efficiency, as it means less energy is being used for non- IT purposes. Simpl Smart middleware platform for data spaces SME(s) Small- and Medium-sized Enterprise(s) TFEU Treaty on the Functioning of the European Union TS Technical Specification TSO Transmission System Operators, or TSOs, manage the high - voltage transmission networks that transport electricity over long distances, ensuring stability and reliability across regions. Above a given size, Data Centres connect to the grid directly through TSOs. See also DSO. 4 1. INTRODUCTION: POLITICAL AND LEGAL CONTEXT Today, cloud computing and AI are more than enablers of innovation. They have become the driving forces reshaping industry, public service, and daily life in the EU. The c loud provides the backbone necessary for al l to access and deploy digital solutions efficiently, while AI unlocks unprecedented opportunities for automation, data -driven decision -making, and personalised services. A strategic approach to their uptake is thus essential for a competitive, secure, sov ereign and future-ready EU. Annex 8 explains the technical terms used in this assessment such as the notion of cloud and AI computing services, which, in the context of this assessment, means offering computing resources for the running (inference) of AI systems. 1.1. Political context The Draghi report on the future of European competitiveness i recognised the importance of sufficient access to cloud services and of increasing computational capacity in the EU, particularly for the EU’s ability to develop and adopt AI ii. The Competitiveness Compass calls for the EU to provide sufficient cloud and data infrastructure required for AI leadership, as enablers of competitivenessiii. The Economic Security risk assessment on AI technol ogies identified dependencies on a limited number of foreign cloud providers and frontier AI providers as significant vulnerabilities in the European AI ecosystem iv. The Cloud and AI Development Act (CADA) is a headline digital policy initiative listed in the Mission letter to EVP Virkkunen, alongside a single EU -wide cloud policy for public administrations and public procurement v. The Competitiveness Compass calls for action in Europe to provide sufficient cloud and data infrastructure required for AI lea dership, as enablers of competitiveness vi. Furthermore, the AI Continent Action Plan vii announces the goal of tripling the EU’s data centre (DC) capacity within the next five to seven years and emphasi ses that sovereignty and operational autonomy ne ed a greater reliance on highly secured EU -based cloud capacity. The Digital Decade Policy Programme (DDPP) sets the target of 75% of EU businesses adopting cloud services and of 10 000 edge nodes being rolled out by 2030viii. The European Parliament ’s own-initiative report (tabled for plenary since June 2025) on European technological sovereignty and digital infrastructure voices concerns about the EU's excessive dependence on non-European actors in critical areas like cloud infrastructure. It calls on the Commission to introduce the CADA to strengthen European data infrastructure, promote European cloud service providers (CSP), build a European single market for cloud and AI, and propose a definition for sovereign cloud and its scope of application ix. In its conclusions of December 2025 on European Competitiveness in the Digital Decade, the Council calls for CADA to include common criteria for sovereign cloud services, allowing for addressing market transparency and risks associated with dependencies, i ncluding extraterritorial effects of legislation adopted by third countries for highly critical use casesx. Several non -EU countries have adopted policy initiatives to develop AI computing capacity, including DCs. In the US, building on a long tradition o f supporting their cloud sector with policiesxi and large public contracts xii, the July 2025 AI Action Plan xiii massively boosts US DC capacity and cloud services. An Executive Order on accelerating federal permitting of DC infrastructurexiv establishes nation -wide fast -track procedures, lowers environmental protections, and makes federal land available for DC build-out. The Executive Order on promoting the export of the American AI Technology Stack establishes federal support for full -stack AI export packages bundling AI-optimised computer hardware, DC storage, cloud services, and networking, which will be exclusively sold in US -providers-only packages xv. China launched the infrastructure project “Eastern Data, Western Computing” in 2022, coordinating DC construction by concentrating facilities in the West of the country. This led to a surge in government procurement of DCsxvi. In July 2025, the UK proposed AI Growth Zones to better equip the UK 5 for running training and inference and support UK companies in developing sovereign, sustainable and secure compute technologies and services xvii. The UAE pursues investments in renewable energy, power transmission, and hyperscale-ready infrastructure to expand its DC capacityxviii. 1.2. Legal context The EU lacks a framework to foster the strategic investment in computing capacity beyond AI Factories and Gigafactories 1. The DDPP xix only sets a deployment target for edge nodes , but not for DCs. The legislative framework for DCs focuses on enhancing their sustainability through transparency measures without explicitly incentivis ing deployment. The Energy Efficiency Directive (EED) xx establishes an annual sustainability reporting and lays the basis for a rating scheme. The Taxonomy for Sustainable Finance enhances transparency on DC sustainability for financial market participants xxi. DCs must comply with minimum performance and information rules of the Ecodesign Regulation xxii. While DC projects are not subject to mandatory environmental impact assessments based on EU rules, such assessments are often required by Member States 2. The upcoming Industrial Accelerator Act will create clusters for accelerating industrial activity for the manufacturing sector, from which DCs will not benefit . Other EU initiatives target key input factors for DC deployment: the upcoming Digital Networks Actxxiii will improve connectivity; t he Grids Package xxiv will ensure that electricity grids can serve growing demands, with focus on improving permitt ing, planning but also providing tools to accelerate grid connections procedures via a dedicated guidance on grid connections; t he Savings and Investments Union xxv will improve access to capital in the EU. While these frameworks can benefit DC deployment, t hey are not tailored to the sector’s specific needs. The upcoming Regulation on accelerating and streamlining environmental assessments establishes a toolbox with provisions for faster environmental assessments, applicable to strategic sectors when sectora l legislations refer to it, something that CADA will leverage for DC projects. Similarly, the EU lacks a framework for incentivising the uptake of European cloud and AI computing services and for ensuring security of supply. T he DDPP sets high -level adopt ion targets3, and the Apply AI strategy xxvi supports AI adoption in strategic sectors , but without concrete measures geared at European services. Other existing frameworks address market practices: the Data Act xxvii regulates cloud switching and interoperability . The Digital Markets Actxxviii considers cloud services as core platform services where providers can be designated as gatekeepers and subject to specific obligations 4. The Digital N etworks Act will address the scenario where a CSP operates a connectivity network. The AI Actxxix sets out risk-based rules for providers and deployers of AI systems and general-purpose AI models, fostering trustworthy AI but without addressing computing. Other frameworks address cybers ecurity: the Cybersecurity Act (CSA) xxx, currently under review, enables the adoption of an EU -wide cybersecurity certification scheme for cloud services 5 and addresses supply chains by tackling high -risk vendors but without addressing public procurement . The Digital Operational Resilience Act xxxi targeting financial entities, and the NIS2 Directive xxxii defining sectors of high criticality, require entities like CSPs to implement risk management and other security measures. The use of cloud and AI computing ser vices in the public sector is horizontally governed by the Public Procurement framework, currently under revision, which enshrines transparency, equal treatment, open 1 These initiatives focus on High Performance Computing (HPC) and do not address the need for more decentralised computing capacity. 2 According to the Environmental Impact Assessment (EIA) Directive, changes to which may come from the Environmental Omnibus: Directive - 2014/52 - EN - EIA - EUR-Lex. 3 75% business adoption of cloud, AI, or big data by 2030. 4 So far, no provider has been designated as a gatekeeper for the provision of cloud services, but on 18 November 2025, the Com mission opened three market investigations on cloud computing services under the DMA. 5 This requires an Implementing Regulation. ENISA has been working on developing the European cybersec urity certification scheme for cloud services (EUCS) since 2019, which has not been adopted yet. Two technical specifications by CEN-CENELEC have resulted from this work on the security requirements and the accreditation of the conformity assessment bodies and the conformity assessment methodology. 6 competition and sound procedures as well as respect for EU’s international commitments xxxiii. However, these initiatives fall short of addressing sovereignty considerations in this sector. 2. PROBLEM DEFINITION The analysis conducted identified two key problems that warrant policy attention. This chapter presents these problems in detail, exploring their underlying root causes structured around four main problem drivers. It further assesses the associated risks and potential consequences should these issues remain unaddressed . To better define and characte rise the identified problems, it is useful to first examine the competitive dynamics in the cloud computing market and the functioning of cloud service demand and supply, as a critical contextual element. 2.1. Problem context Cloud computing emerged in the ear ly 2000s in the United States, with Amazon Web Services (AWS) being established in 2002 and commercial cloud offers from AWS, Google and others becoming popular from 2008 onwards. The early 2010s set the stage for the massive adoption of cloud services xxxiv, which accelerated further in subsequent years . The global cloud and data infrastructure market grew by around 3 5% per year since 2016xxxv, with expected growth rates above 20% for subsequent years. In the EU, this high-growth environment led the share of enterprises buying cloud services to increase from 18% in 2014 to 53% in 2025, with adoption almost tripling in a decade ; for large firms, the figure exceeds 80% xxxvi. This rapid growth in market demand can be linked to three major trends: • The d igitalisation of the economy and a structural shift from on-premises IT models: businesses across sectors have migrated from traditional on-premises infrastructure to cloud solutions, considered to offer lower upfront costs, more flexibility and a richer ecosystem of services in a single interface. Part of this cloudification has also been supply -driven, as providers pushed from installed licen ces to cloud subscription models6. Major CSPs , massively supported by system integrators, expanded their service portfolios, pricing models and migration programmes in ways that created and deepened the demand for cloud services. This initial trend from on -premises to infrastructure-as-a-service ( IaaS) has seen a second wave towards more advanced platforms deployed as platform-as-a-service (PaaS) and software-as-a-service (SaaS). The growing weight of PaaS and the shift towards AI (mostly deployed as SaaS) has been a key market dynamic in the last years and remains so to date. • The emergence of new cloud native digital services : demand has increased with the rise of cloud-native platforms such as social media, video and music streaming, and a broad range of SaaS applications such as Customer Relations Management tools. • Artificial Intelligence and data-driven business models: the diffusion of AI, advanced analytics and data -intensive applications have increased demand for compute power , often requiring processing capacity close to end -users to meet low -latency requirements, thus rein forcing the shift towards cloud and edge solutions. From 2017 to 2021, the European cloud market expanded rapidly, notably during Covid-19, which increased the use of digital services and boosted demand for cloud computing across the EU. However, most of t he incremental demand was captured by US hyperscalers, whose share rose from around half to two -thirds of the market, while European providers’ collective share nearly halvedxxxvii. During this period, European CSPs were predominantly national or regional play ers serving domestic markets. They reacted to foreign competition by either specialising in use cases 6 For example, Office 365 monthly active users grew from around 60 m in 2015 to 200 m in 2019, while traditional Office product revenues fell by around 21%. See: Office 365 Number of Users Reaches 345 Million Paid Seats and FY23 Q4 - Productivity and Business Processes Performance - Investor Relations - Microsoft 7 with stronger data sovereignty and privacy demands xxxviii or by developing partnerships with the hyperscalers7, rather than matching the broad footprint of US providers. This was the case too of European Telco providers who ventured into cloud services, but mostly partnering with US CSPs , becoming de facto resellers . The 2021 European industrial technology roadmap for the next generation cloud -edge offering, prepared by key European players, argued that the European digital market was “ fragmented into local realms, individually lacking the critical mass for players to scale and compete ” with the US and China xxxix. Despite strong revenue growth, the market share of European providers declined. By contrast, l arge US providers have been able to benefit given their early, large -scale deployment of cloud offerings, which put them in a position to capture this market growth. This was made possible by three elements. Firstly, US CSPs were able to build on an early growth driven by US government adoption. In 2013, the Central Intelligence Agency awarded a USD 600 m contract to AWSxl, followed by the award of a fifteen -year multi-billion-dollar contract for the development of the “Commercial Cloud Enterprise” to AWS, Google, IBM, Microsoft and Oracle. The Department of Defence awarded additional siz eable contracts to these providers for developing secure cloud services or enabling the migration to the cloud of agencies like DARPA 8. These early and large -scale public contracts ensured fixed revenues and allowed these providers to grow their portfolio, often with particularly secure services resulting from the stringent require ments of the US administration. These providers carried their first -mover advantage to Europe demand for cloud services was just emergingxli, driving early European cloud users to turn to US providers 9. As well, in the shift from on-premises to cloud solut ions, hyperscaler s extensively used partner networks. By offering dedicated training and skill certification s, they engaged in partnerships with consulting firms and resellers, through which they could rapidly expand in local marketsxlii. Secondly, the absence of a thriving tech industry in the EU prompted US CSPs to leverage their domestic advantage by partnering with large global technology companies when expanding into the European market. Indeed, figures show that cloud adoption in the EU is driven by companies working in the ICT sector xliii, which are often not European and tend to buy the same cloud services as they buy domestically, i.e. US CSPs . Some examples: Netflix, which serves more than 50% of the European video-on-demand market , relies exclusively on AWS for its core cloud infrastructurexliv; the Amazon (retail) Marketplace serves as an anchor customer for AWS , its own cloud services offering. With respect to market dynamics, competition in cloud services , like other capital -intensive network industries, is characterised by distinct supply and demand side elements. On the supply side, cloud markets are defined by considerable sunk costs associated with data centre deployment, with long investment times an d substantial economies of scale and scope. These characteristics tend to benefit large providers wh ich can fund expensive compute capacity and distribute costs across a wide customer base and a diverse service portfolio. When looking at infrastructure, high fixed costs constitute a major barrier to entry. The cloud and AI infrastructure market is capital-intensive: building and equipping data centres requires large upfront investment, and providers are able to secure financing if they expect sufficient demand and market share gains. Differences in deployment procedures among Member States create transaction costs within the single market, affecting the profitability of new projects. These costs are more easily absorbed by 7 For example, German provider plusserver working with AWS, Azure and Google Cloud in 2019 by offering hybrid solutions interco nnected with hyperscalers. See: https://www.juniper.net/content/dam/www/assets/case-studies/us/en/plusserver.pdf 8 An excerpt of awarded contracts from different US Departments and agencies to US hyperscale cloud providers: C2E - $600 m (CIA, 2013- present), Wild & Stormy – USD 10 bn (NSA, 2021 – 2023), JWCC – USD 9 bn (DoD, 2022 – 2028). See also : DARPA plans shift from AWS and on-prem to fully cloud by 2022; General Dynamics again wins DOD's cloud email & collaboration contract; Big Tech and the US Digital-Military- Industrial Complex - Intereconomics. 9 In the Netherlands, for example, the strong reliance of the public sector on hyperscalers is laid down by the Netherlands Court of Audit , which analyses selected critical cloud contracts awarded by the Dutch central government. 8 larger providers but remain prohibitive for smaller firms . Access to funding is also slower and more complex for small enterprises. By contrast, AWS, Microsoft and Google were able to collectively invest around EUR 12 bn in European infrastruct ure in 2020 alone, marking a 20% increase compared to the previous yearxlv. This investment capacity was underpinned by vertically integrated businesses and diversified revenue streams. The French Autorité de la Concurrence, in its 2023 opinion on cloud ser vices, emphasised that hyperscalers benefit from “conglomerate” structures, i.e. their presence in multiple digital markets allows them to develop credit systems and discounts using their market power to accelerate cloud growth. Similarly, a more recent wo rk by the OECD on competition in the cloud market notes that hyperscalers are best equipped to mitigate the risks of aggressive cloud expansion by “portfolio diversification or cross -subsidising losses”10. On the innovation side, the asymmetry with European players is also evident. The EU Industrial R&D Investment Scoreboard showed that by 2018 -2020 Amazon, Alphabet and Microsoft were among the top global corporate R&D investors, each spending in the order of billions of dollars per year. In the same period, Europe’s largest R&D spenders were concentrated in the automotive and pharmaceutical sector, while European cloud providers like OVHcloud were small companies with revenues in the hundreds of millions and modest R&D budgets xlvi. This disparity in innovation spending, combined with hyperscalers large capital expenditures, projected to reach USD 335 bn in 2025xlvii, has given them an important advantage over smaller providers to offer broader service portfolios and integrated ecosystems. On the demand side, customer choices are shaped by two key factors: the value placed on flexibility and the breadth of services available through single platforms operating seamlessly. On these two key factors, hyperscalers have been better placed than European providers from the start. Although European cloud offerings encompass a diverse range of services, customers need to collaborate with multiple providers to match the quality and breadth of services offered by leading global cloud providers. End -users desire simplicity and have grown accustomed to one - stop shops delivering everything from Infrastructure -as-a-Service (IaaS) to Software -as-a-Service (SaaS) on a global scale, a level of integra ted service that hyperscalers readily supply. In contrast, European providers typically have more limited catalogues, often focused on specific infrastructure or industry niches, making it challenging to secure substantial, multi -country enterprise deals. In several European industries , value chains are organised around networks of smaller providers that combine their specialised products across the single market, supported by common standards and technical specifications. This was achieved in the telecom s ector after the introduction of the GSM standard. However, a similar market structure has not materialised in t he cloud sector . As mentioned above, instead of pooling resources and federating, European providers decided to (i) build partnerships with US hyperscalers, (ii) focus on a specific region, or (iii) specialise in a single layer of the cloud stack, e.g. IaaS or Saas offerings, rather than offering a comprehensive portfolio. By contrast, US hyperscalers deliver an integrated, end-to-end service, operating as “IT supermarkets” xlviii. The French competition authority clearly noted that hyperscalers’ large ecosystem of offers implies that, for several workloads, competition takes place “for the market” rather than “on the market” as c ustomers tend to choose a single supplier able to cover their entire needs. The repercussions of these competition dynamics result in a rigidity when it comes to switching providers and considering alternative offers. Leading providers impose complex pricing structures, egress fees and restrictive licensing terms. When switching providers, customers face high costs stemming from egress charges, the use of proprietary data formats or APIs and long -term contractsxlix, i.e. different forms of vendor lock -inl. Even if a better or cheaper provider exists, customers may therefore not switch, weakening competitive pressure s and resulting in alternative 10 OECD, “Competition in the provision of cloud computing services” 9 providers struggl ing to attract customers due to factors outside of their control 11. The Dutch competition authority’s cloud market study concludes that users encounter technical hurdles to portability and incur significant financial costs for data transfer, which collectively make switching providers challenging and effectively lock users into the chosen cloud provider for lengthy periods, contributing to market consolidation li. Moreover, once a provider becomes the ‘default’ or ‘safe choice’, the customer starts creating the tooling and culture around this provider, resulting in inertia as an effec tive blocker of new incumbents. In this context, EU providers struggle to a ttract customers away from well -established US providers . The challenges described above, along with difficulties in partnering with system integrators , consultancies and intermediaries to promote European solutions, have collectively contributed to the gradual erosion of market share for EU CSPs. Last but not least, there are signals of new opportunities for European providers to gain market shares. AI adoption , the third demand dr iver identified above, is bringing change to the market landscape, and competitive positions could change. While US providers are already well established mostly thanks to their integrated offers , European providers might still find opportunities to capture growth, especially in relation to more specialised, sector -specific offers, where their proximity to customers and ability to provide safeguards in terms of data localisation and integrity are important. The Apply AI strategy adopt ed by the Commission is a signal in that direction. AI has the potential to alter industry business models, with cloud and AI services extending beyond basic IT commodity functions to become integral parts of a company’s competitive edge. Furthermore, the issue of sovereignty, exacerbated by geopolitical considerations, has gained prominence and could be a n opportunity for European cloud and AI providers. According to Gartnerlii the sovereign cloud IaaS market is forecast to grow at a yearly rate of 38% in the next five years, with developments in terms of moving away from global cloud providers and new business migrating to a sovereign cloud environment. The positioning of European cloud and AI providers as sovereign is, however, today hindered by a lack of clarity and lack of harmonisation in the market in terms of how sovereign services are defined. 2.2. What are the problems? 2.2.1. Problem 1 - Limited and geographically concentrated availability of computing capacity in the EU AI is driving an unprecedented demand for computing capacity, not only for the High - Performance Computing (HPC) capacity required to train models, but also for the capacity to enable inference, fine -tuning and service integration liii. The European AI market is projected to exceed EUR 300 bn by 2030liv, growing at more than 26% between 2025 and 2030 12. Beyond AI, adoption of cloud computing and other digital services continues to accelerate, adding further pressure on the available computing capacity13. In 2025, uptake of new DC capacity in Europe14 is expected to reach a new high of 854 MW 15, exceeding new supply for the third consecutive year lv. Vacancy rates in major EU DC hubs have declined to historical lows, and the share of co -location 11 While these contextual factors are referred to in the problem drivers described below, they are not themselves considered as drivers for this analysis as they are addressed through a dedicated intervention under the Data Act (see section 7.3 and annex 7) and through competition cases. See for example the European Commission’s investigation into Microsoft Teams: Statement of Objections to Microsoft. 12 Enterprise adoption of AI technologies remains limited at 13.5% according to the latest data from the Digital Decade Policy P rogramme, partly due to infrastructure constraints and cost barriers. The Digital Decade 2025 report highlights the need for the data centre i ndustry to expand and adapt to support the rapid growth of AI technologies. 13 In 2025, per Eurostat, EU business cloud uptake stood at 52.7% - far from the 2030 target of 75%, but that also includes the adoption of cloud, AI or data analytics. As more European businesses adopt cloud and AI computing services, demand for DCs is thus expected to rise further. 14 When looking at the DC market, Europe typically includes the UK. 15 DC capacity is typically expressed in megawatts (MW) or gigawatts (GW) becau se power availability plays a key role for both the operation of the servers and the cooling systems. 10 capacity that is pre-leased16 before becoming operational continues to rise. These are clear signs of high demandlvi. Across the EU27, the expansion of data centre capacity is not keeping pace with this rapidly growing demand. Despite increased i nvestmentlvii and installed capacity expected to reach 12.4 GW in 202517, available supply remains insufficient, resulting in an estimated gap of almost 3 GW relative to current demand. Moreover, the existing capacity is concentrated in a limited number of established hub s, mostly in Northern and Western Member States: in 2025, Germany (Frankfurt), France (Paris), the Netherlands (Amsterdam) and Ireland (Dublin) account for 65% of the EU27 DC market18 (Figure 119). These locations have historically provided more favourable factors for DC deployment, e.g. strategic geographic location, proximity to end users, and connectivity to other world regions . Ireland, for example, is geographically positioned as a gateway between Europe and the US, with extensive undersea fibre -optic cable networks. This makes it an ideal location for low -latency transatlantic data transfers for US CSPs serving European markets from overseas. Ireland’s low corporate tax rate and supportive government policies have attracted significant foreign direct investment, particularly from US tech companies. These companies, including the cloud hyperscalers, have established major operati ons in Ireland, contributing to the rapid expansion of nearby data centre infrastructure20. Figure 1. Data centre capacity across EU 27 MS in 2025 Source: Technopolis et al. (2025)lviii Expressed per 100 000 inhabitants, overall capacity amounts to 2.75 MW per 100 000 people and is concentrated in a few Member States, with Ireland, the Netherlands, Denmark, Sweden , Finland and Luxembourg standing out ( Figure 2). 16 Pre-leased capacity in DC means that customers commit to renting space and power before the facility becomes operational. Market information points to a growing share of data centre spaces already reserved before delivery, reflecting very high demand and tight supply. 17 Technopolis Group, Wavestone, Timelex, STL Partners, OpenFor um Europe and KAPA Research (2025), "Study: Cloud and AI". The methodology is based on all known commercial data centre sites listed in the Data Center Map, additional sites identified through the survey and any publicly known hyperscaler sites. The figures do not include private enterprise sites, under which most dedicated HPC facilities fall. 18 Technopolis Group et al. (2025), "Study: Cloud and AI". 19 Core EU DC hubs include Frankfurt, Amsterdam, Paris and Dublin. This concentration is explained by operators leveraging metro areas and exploiting the best locations in terms of connectivity (Dublin, Paris, Frankfurt, Amsterdam), proximity to economic hubs (Par is, F rankfurt, Amsterdam) or low corporate tax (Dublin). 20 In a second phase, hyperscalers made substantial investments in locations with strong sectoral demand, such as Frankfurt for banking services and Belgium for the pharmaceutical industry. 11 Figure 2. Data centre capacity per 100 000 people across EU 27 MS in 2025 Source: Technopolis et al. (2025)lix In addition, the EU lags behind other regions in both scale and ownership of digital infrastructure (see Figure 3). In 2022, Europe had approximately 1 MW of installed data centre capacity per 100 000 people, while the US had 12 MW lx. The situation persists today: d espite similar GDPs, in 2025 the EU accounts for only 20% of global installed data centre capacity compared to the US (42%)lxi. Figure 3. Comparison of GDP and data centre capacity for leading markets in 2025 Source: Technopolis et al. (2025)lxii The existing capacity gap and strong geographical concentration point to structural inefficiencies in the allocation of resources in the market for data centre capacity, with effects already visible today: The limited supply has led to rising prices for existing capacity, negatively affecting businesses which rely on such capacity . Since 2022, average asking prices in the European colocation markets have increased by 51% for 100 kW leases lxiii. New co-location capacity is often leased to large service provi ders: Amazon Web Services (AWS), Microsoft, Google 21. By 2028, they are expected to drive 65% of the demand for DCs in Europe, an increase of 1 2% during the same timeframelxiv. This reinforces the competition dynamics discussed above: when most of the new capacity is effectively reserved by a handful of players, they can shape where and how new infrastructure is built, secure access to suitable sites and further capitalise on economies of scale. Already today, vacancy rates in Europe’s top DC markets are at a record low of 7.4% lxv. Due to a lack of available space, co -location providers are expected to raise prices in 2025 by 10% in leading DC markets lxvi. The negative effects on businesses’ ability to access capacity are 21 Co-location data centre operators often lease their facilities to hyperscalers to obtain a quicker return on investment. 12 particularly pronounced in regions with a high concentration of DCs, where businesses are faced with higher prices. As noted above, geographic concentration puts a strain on affected regio ns: in Ireland, DCs accounted for 22% of electricity demand in 2025, up 5% from 2015. The resulting grid stress has led local TSOs to enact a de facto moratorium for new DC applications in Dublin due to fears of overloading the grid and compromising energy securitylxvii. Municipalities in Noord-Holland have also enacted several moratoria on building new DCs, the latest one in 2023 in Amsterdamlxviii. In the case of Dublin, the moratorium has reportedly stalled EUR 8 -10 bn in planned DC investments. The effects of grid stress also impact other user groups 22. In Luxembourg, the plans for a large DC by Google have been subject to a review of its energy grid planning that includes a new connection to Germany lxix because local electric ity generation was not sufficient . This situation, with the s aturation of existing infrastructure , has further slowed deployment, raised energy system pressures and diverted investment, rather than leading to an efficient redistribution of capacity across the Union. While cloud and AI com puting services can be technically delivered cross-border, regions with a low DC presence are also disadvantaged by this geographic imbalance , as exemplified by the higher prices in regions with low DC presence lxx. Moreover, the lack of nearby computing capacity drives up latency, limiting the availability and quality of low -latency services, thus placing local end -users at a competitive disadvantage compared with regions that have better access to DC capacity 23 (see also section 2.3) . It also points to under exploited investment opportunities if comprehensive business cases can be built around these cases. Over time, this can slow digital transformation in the affected Member States and weaken overall competitiveness within the Digital Single Market . Stakeholders have also warned that this limited availability of computing capacity in the EU acts as a barri er for the development and uptake of cloud and AI computing services: for instance, Mistral AI has warned that a lack of DC capacity could become a roadblock for developing and applying AI models in Europe lxxi. Current market dynamics risk reinforcing existi ng concentrations, increasing regional disparities and limited access to computing resources for business and public authorities outside main hubs. 2.2.2. Problem 2 - Dependence on cloud and AI computing services supplied by non - European24 providers The European cloud services market is growing significantly. It was worth around EUR 70 bn in 2022 and is estimated to reach over EUR 200 bn by 2028lxxii. In 2024, the European Infrastructure as a Service (IaaS) and Platform as a Service (PaaS) market was dominated by three US companies, the so-called hyperscalers (Table 1). Worldwide, AWS held a market share of 32% in Q2 2024, Microsoft 23% and Google Cloud 12%. No other provider held more than 4%lxxiii. In Europe, those three providers account for around 70% of the market, while the largest European providers (SAP and Deutsche Telekom) each serve 2% lxxiv. The European cloud market has grown, but the market share of European providers has decreased from 29% in 2017 to 15% in 2022 and has since remained stablelxxv. A recent study for the European Parliament reaches the same conclusion, noting that US firms dominate all major software layers, including cloud, and that European pr oviders account only for a small share of the infrastructure market lxxvi. Despite 22 In Ireland, for example, interest representatives point to increasing delays for electricity connection of housing projects: Govt warned of rising household bills as data centres strain grid. 23 Taking the example of Microsoft’s Azure regions, round-trip latency (the time it takes for a data pack to travel from one point in the network to another and back again) from Poland (Central Europe) to Frankfurt (Western Europe) is ca. 10 –15ms, and latency from Poland to Amsterdam or London is ca. 15–20ms. By contrast, latency within Western Europe (e.g. Frankfurt to Amsterdam) is typically <5ms. A fintech business in Warsaw thus faces significantly higher latency than a competitor in Western Europe. 24 Whereas section 2.1.1. deals with the presence of computing capacity in the EU, including capacity provided by non -EU companies; this section deals with services provided by companies headquartered in the EU. 13 European providers playing an important role in some Software as a Service market segments, non-EU providers dominate in important fields, such as office automation and producti vity software25. Table 1. Market leaders for cloud services (IaaS, PaaS and hosted private cloud revenues), Q2 2024 World US China26 Rest of APAC Europe Rest of World #1 Amazon Amazon Alibaba Amazon Amazon Amazon #2 Microsoft Microsoft Tencent Microsoft Microsoft Microsoft #3 Google Google China Telecom Google Google Google #4 Alibaba Oracle Huawei NTT Oracle Salesforce #5 Oracle Salesforce China Unicom Alibaba Salesforce Oracle #6 Salesforce IBM China Mobile Fujitsu IBM IBM Source: Synergy Research Group Hyperscalers thrive in the European cloud market thanks to their global scale, significant financial resources, and overall ecosystem gravity , composed of integrated digital ecosystems lxxvii, partnership programmes and marketplaces, among others. On the supply side, this problem impacts European providers of cloud and AI computing services in terms of foregone commercial opportunities. Astères approximates the ir magnitude by estimating that EU companies’ annual purchases of cloud software add EUR 264 bn to the US economylxxviii. On the demand side, this problem impacts private and public sector users of cloud and AI computing services. Some reports suggest that, by relying so strongly on a small number of providers, users pay more for their cloud and AI computing services than by relying on alternatives27. In its most basic form, this d ependence can lead to significant economic costs . Without alternative, users are d efenceless in light of price increases. This is illustrated by Broadcom’s acquisition of VMWare (a provider of leading virtualisation technology, for which little European alternatives exist), which resulted in unilateral licensing changes and price increases of 800% to 1500% according to users 28. More generally, there is evidence suggesting that the dependence on non-European providers may cause European users to over-pay, with some reports suggesting that European providers offer digital resources at lowe r prices29 and with lower egress charges. European AI computing service providers lag their global competitors lxxix, also due to their competitive disadvantage in accessing computing service providerslxxx. Dependence also introduces significant tail risks: where users rely on a small number of providers, cloud outages can have far -reaching consequences, including business interruptions, and substantial financial or data losseslxxxi. Strong reliance on a small set of providers also means that a single failure can simultaneously affect several critical services, as seen in the recent Crowdstrike incident or AWS outages lxxxii. It also limits the EU’s operational autonomy and system resilience as these providers may be exposed to third -country policies restricting service access, for example in the context of sanctions or economic coercion. This risk recently materialised in the suspension of service provision to the Chief prosecutor of the International Criminal Court, on whom the US had previously imposed san ctionslxxxiii. This case illustrates the challenges which exposure to third-country policies can cause to operational autonomy and system resilience in the EU. Another illustrative example is the planned takeover of the Dutch cloud provider Solvinity by the US I T 25 For example, in 2023, SAP held 49.6% of the specialised market for Travel and Expense Management Software. 26 In China, foreign invested companies are not allowed to provide so -called Internet Data Centre Services according to the Promulgating the Classification Catalogue of Telecommunications Services and must rely on local Chinese partners in the form of a technology cooperation. q For example, Leitmotiv Digital finds that European providers offer digital resources at prices that are five to ten times low er than the current incumbents: Leitmotiv - Toward our Digital Future. 28 https://www.theregister.com/2025/05/22/euro_cloud_body_ecco_says_broadcom_licensing_unfair/ 29 https://leitmotiv.digital/publications/breaking-the-cloud-monopoly 14 company Kyndryl lxxxiv. Solvinity offers cloud services to the IT company of the Dutch administration, including the back -end of digital wallet, used by 16.5 million Dutch citizens to verify their identities in order to get access to the tax administration and other departments. A non- European policy affecting the provision of Kyndryl’s services in the EU would thus cause disruption for 90% of Dutch citizens. Threats to operational autonomy and of data access are particularly concerning in highly critical use cases relying on cloud and AI computing serviceslxxxv. For example, their use in healthcare, defence and certain public sector services often involves the processing of highly sensitive data. Service interruptio n in these sectors can have significant adverse effects on the EU economy and society. Some public sector actors are undertaking steps to limit exposure to such risks. For example, the Dutch parliament called on the government to reduce its reliance on US cloud serviceslxxxvi, and France mandates sensitive data to be exclusively stored and processed using SecNumCloud certified services 30 provided either solely by EU providers or Joint Ventures between EU undertakings and US CSPs (see section 2.3.4). This issue was also recently illustrated by the postponement of Finland’s electoral management system cloudification 31, previously awarded to AWS, and France’s switch from US solutions to open source equivalents to serve public sector video conferencing needs 32. The European Central Bank requires banks to use hybrid architectures and a multi -cloud approachlxxxvii. The US requires Federal Agencies to use only cloud services authorised under the Federal Risk and Authorization Management Program (FedRAMP)33. While dependence is widely considered as a critical risk to service continuity and operational autonomy, and demand for sovereign cloud solutions is growing 34, a coherent framework to address this challenge is still lacking at EU level. Dependence on US providers also exposes EU user data to extraterritorial laws and potential US government access resulting from the US Clarifying Lawful Overseas Use of Data (CLOUD) Act35 in the context of criminal proceedings, or Section 702 of the US Foreign Intelligence Surveillance Act36. Access can be granted unilaterally, without the involvement of EU judicial or public authorities. In a sworn testimony before the French Senate, a representative of Microsoft affirmed that the company could not guarantee that French data would not be transmitted to US authorities, even in the absence of explicit authorisation lxxxviii. Any data managed by a US - headquartered provider or its subsidiaries is potentially exposed, including sensitive business information, intellectual property, and personal data of EU citizens. Such exposure, especially of sensitive business or public data, can raise significant concerns when considering strategic entities, public authorities, and high -profile individuals . More generally, a lack of trust in cloud and AI computing services is slowing down European users’ adoption of other digital services lxxxix. This lack of trust is also caused by technical aspects such as not having control over the supply chain, 30 For instance, the platforms for electron ic invoices shall be ISO/IEC 27001 certified and stored on one of the providers qualified by SecNumCloud: Facturation électronique et plateformes partenaires. 31 See Finland's Ministry of Justice delays plans for cloud migration - DCD 32 Souveraineté numérique : l’État généralise « Visio », sa solution de visioconférence sécurisée et souveraine à destination de s agents publics – Presse – Ministère des Finances 33 FedRAMP is an authorisation process for cloud services used by US federal agencies. Obtaining such authorisation is mandatory for all CS Ps wishing to work with US federal agencies. It provides a standardised approach for the security assessment of cloud services i n three impact levels (low, medium, high). In terms of European providers, three SAP products are authorised at level ‘moderate’ and the Accenture Insights Platform (originating in US, headquarters in Ireland) is authorised at level ‘high’. 34 84% of European cloud users are already using or planning to use sovereign cloud solutions. See: How Digital Sovereignty Is Influencing Cloud Solution Choice 35 The CLOUD Act facilitates the access of US law enforcement authorities to electronic data held by service providers that fall within US jurisdiction in the context of criminal proceedings. It affects providers of electronic communication services and remote computing services that are subject to the authority of US courts, either because they are established in the US or because they have a sufficient presen ce to be subject to US personal jurisdiction. When presented with a valid legal process, including a warrant for the content of communications meeting the high standards of probable cause, these entities can be obliged to disclose the contents of electronic communication and any related record or other information pertaining to their customers, regardless of whether the data are located within or outside of the US. 36 FISA Section 702 permits the US government to conduct targeted surveillance of foreign persons located outside the US to acqu ire foreign intelligence information. Under Section 702, the US At torney General and Director of National Intelligence may issue directives compelling US electronic communication service providers to provide such information, including via bulk data collection. 15 not being able to carry out audits and penetration testing, or the uncertainty of where the data is locatedxc. 2.3. What are the problem drivers? The two iden tified problems are closely interlinked, as they relate to consecutive stages of the same value chain , with a clear supply -demand relationship: cloud and AI computing services require adequate underlying infrastructure, while data centre investments rely on expected demand for such services. Problem 1 concerns the physical infrastructure layer, involving data centre operators, utilities, local authorities and investors. Problem 2 relates to the downstream market for cloud and AI computing services, characte rised by distinct market structures, competitive dynamics and regulatory frameworks. Accordingly, the analysis of the root causes behind these two problems is presented separately, while acknowledging their interdependence. Four underlying drivers are identified: one specific to Problem 1, two specific to Problem 2 and one common driver that affects both problems. Problem 1 relates to the limited and geographically concentrated distribution of compute capacity in the EU. It stems from two underlyin g factors: one related to market dynamics and the other to regulatory fragmentation. On the first one, first-mover advantage of non -EU providers reinforced by path dependency and network effects has led to market entry barriers that limit the scale and scope of EU cloud and AI computing service providers (PD1), thus hindering the deployment of capacity in the EU territory. As for the second factor, regulatory fragmentation and bottlenecks of a different nature have further slowed down the expansion of data centres (PD2), reduc ing international investors’ interest, and thus contribut ing to the limited computing capacity , while also reinforcing geographical imbalances. Problem 2 concerns the dependence on cloud and AI computing services sup plied by non - European providers. Like problem 1, it is driven by the lack of scale and scope of EU cloud service providers (PD1), which makes reliance on non -European providers inevitable. The limited public sector uptake of cloud and AI computing services supplied by European providers (PD3) , even in segments where local presence is essential , further hampers the creation of a large, unified demand for such services. This weakens EU providers’ ability to invest, which results in foregone economic opportunities and deepens dependence. Finally, the absence of clarity around the concept of sovereign cloud and AI computing services (PD4) keeps European providers from commercially leveraging sovereignty as a distinguis hing factor for themselves , further contributing to the problem. Figure 4. Problem tree 16 2.3.1. Problem Driver 1 (PD1): Lack of scale and scope of European cloud and AI computing service providers An important driver behind the limited a nd geographically concentrated availability of EU-native computing capacity and services is rooted in the comparatively small scale of European providers relative to global hyperscalers, as a result of the rapid development of the data centre and cloud sector in the EU . N otably between the years 2017 and 2021 , this led to a significant market concentration around only a few non-European market incumbents well-placed to respond to the growing demand at scale which was out of reach for their European competitors. As discussed under section 2.1, historically, the earlier cloud computing services were developed in the United States . Their early scale advantage reinforced their position as the world’s leading data centre hub xci, which US providers leverag ed for global service provision. H yperscalers invested aggressively in infrastructure, and building networks of data centres connected via submarine cables that enabled data flows into European markets xcii. This first-mover advantage reinforced their leadership in the continent, setting a high entry and growth barrier for European providers. Hyperscalers leveraged their scale to standardise services, invest in innovation and accumulate the financial resources to deploy compute capacit y globally: today the AWS cloud spans 117 availability zones (AZs) within 37 geographical regions xciii. By comparison, OVHcloud has 37 AZsxciv. Due to their comparatively higher scale and financing advantages xcv, the ongoing expansion of data centre capacity in the EU is driven by non -European CSPsxcvi. As demand for local capacity grows, hyperscalers are able to secure land and grid access for their own data centres and (pre)lease large amounts of co -location data centre space, thus becoming anchor tenants for larger sites, while European CSPs struggle to access the same resources for developing digital infrastructurexcvii and are relegated to residual capacity under less attractive conditions. This is visible in the geography of Europe’s data centres: the FLAPD hubs (Frankfurt, London, Amsterdam, Paris and Dublin) comprise over 60% of operational capacity and around half of the new and planned capacity is mainly drive n by hyperscalers pre -leasing and committed projectsxcviii. Scale and scope advantages of large providers reinforce the convenience of building in existing hubs. Faced with these market dynamics, m ost European providers remain smaller, specialised and nationally fragmented, lacking the scale, scope or cross -border integration to deliver comparable cloud services. Comparatively lower revenues reduce the ir ability to invest in infrastructure expansion or innovation xcix. Google, for example, spent USD 9.6 bn on DCs across the globe in Q3 2025 only c. The capital expenditure of OVHCloud for the entire financial year 2025 amounts to EUR 361.4 m with EUR 51 m devoted to infrastructure and networks ci. Taken together, these factors (a) reinforce the structural advantage of large non -EU providers in securi ng key resources at scale, (b) further constrain the ability of European providers to expand , and (c) contribute to the current shortage and spatial concentration of computing capacity in a few established hubs , leaving significant areas of the Union under-served in terms of local compute. The lack of scale and scope of European cloud and AI computing service providers is also closely linked to the second problem, i.e. the dependence on cloud and AI computing services supplied by non-European providers. As mentioned under section 2.1, hyperscalers leverage bundles of services to operate as “walled gardens” meeting “all” customer needs, often within their own closed marketplaces cii. The convenience of accessing all cloud -related services from a single provider is a key driver for customer choice ciii. AWS and Microsoft Azure each have 200+ services across their portfolios, and Google Cloud delivers 100+ speciali sed offerings available at their proprietary marketplaces. The absence of a comprehensive vendor -neutral marketplace creates an imperfect information environment about available services and their characteristics and negatively affect the 17 comparability of services across providers and general awareness of users about the services offered by smaller, including European, providers (discovery problem). End-users desire simplicity and have grown accustomed to one -stop shops delivering everything from Infrastructure-as-a-Service (IaaS) to Software -as-a-Service (SaaS) on a global scale, a level of integrated service that hyperscalers readily supply. Customers may therefore make suboptimal choices because they cannot easily compare offers. Imperfect information constitutes a failure in the market for cloud and AI computing services and reduces competitive pressure on incumbents. Hyperscalers also offer dedicated professional training37 and certification programmes38, including through partnerships with key IT consultants and system integrators tailoring hyperscaler tools to specific customer needs civ that re-sell or promote their services cv. This has led to high transaction costs of leaving the hyperscalers ecosystems and a form of skills lock-in39. Lock-in practices and the absence of technical interoperability further bolster the hyperscalers’ market position by making it less likely for customers to switch to another provider 40. In a market characterised by network effects and high switching costs cvi, the initial choice of cloud and AI computing service provider limits future possibilities for diversification. This has posed high entry barriers for ‘late’ entrants, notably European ones 41. Large providers leverage their strong position in the cloud market to attract customers with low entry prices, for example through cloud credits42, but also to expand into th e emerging market of AI computing services cvii, through tying and bundling practices - linking together new AI applications with existing cloud products - and preferential access to computing power cviii. Their extensive service portfolio is also a competitive advantage for attracting AI companies as customers since they rely on the advanced offering of large providers to provide better usability. European providers do not offer the same breadth of servi ces. OVH cloud and Scaleway, for example, offer around 80 services cix whereas the US hyperscalers, such as Amazon, offer around 200. Annex 13 provides a comp arative analysis of a sample of service of European vs American, demonstrating that EU providers usually cover well core IaaS and PaaS services but also highlight the actual gaps which tend to be more specific. These relate mainly to native AI/ML platforms, serverless, and integrated analytics pipelines where European providers have not yet reached hyperscaler maturity. A smaller catalogue of services does not equate to lower quality, as argued later in this section. Gap analyses sho w that European providers offer equivalent quality in their services to th ose offered by the hyperscalers 43 but with rather a more limited integration: To obtain access to a similar breadth of services as those offered by a single hyperscaler, a customer m ust combine 37 During the COVID-19 pandemic, for example, AWS and Google Cloud offered free resources for training cloud skills and getting them certified: See here and here. AWS offers exam vouchers for certifying one’s cloud skills to participants of EU -certified cloud courses for SME employees and jobseekers: Free EU-certified Cloud & Gen AI courses for SME employees and jobseekers — now open for enrolment! | Digital Skills & Jobs Platform. 38 AWS for example reports 1.05m of individuals certified to their products. AWS Certification. 39 See Ofcom’s Cloud Services market study – October 2023. This structural dependence on non -EU proprietary solutions has also been cited by several SMEs as part of their Call for Evidence contribution. 40 Competition authorities are increasingly scrutinising be haviours such as switching barriers of technical, contractual, and financial nature (including egress charges). Other relevant factors are a lack of standardisation and interoperability among services and the ability of large providers to attract customers through free credits and volume discounts. As discussed in section 1.2 and Annex 7, the Data Act creates a right for customer s to switch and tackles relevant barriers. 41 The entry barriers for EU providers are, for example, described in the Autorité de la Concurrence’s opinion on competition in the cloud sector: Avis 23-A-08 du 29 juin 2023. 42 Cloud credits are typically offered as short-term credits to attract new customers or motivate existing customers to adopt a new service or as long- term credits for selected customers, especially start-ups, to allow them to grow a cloud -native business in the environment of a given CSP. See: Report Covers. Ofcom has found that AWS offers up to $100k, Microsoft offers up to $150k, and Google offers up to $100k for each year over two years (so a total of $200k), as part of their credit programs for ‘start-ups’. See: Cloud services market study final report. 43 As discussed in this section, the simple fact of widespread uptake does not equate to a super ior quality of services by non -European providers. Instead, the breadth and integrated nature of services is a major factor of distinction. 18 solutions from multiple providers cx – each requiring different skills 44, using different tooling, and employing different operational procedures. In the absence of tools that easily enable such combination of resources, such as cloud brokers45, customers must invest their own resources to integrate services from different providers through custom developments. A broader and a better integrated catalogue offers an advantage to US providers but this comes with a caveat. The latest Eurostat data shows that the services EU enterprises actually rely on most are email, office software , file storage , database hosting, and compute power 46, which are core IaaS workloads: virtual machines, managed databases, object storage, and nowadays also Paa S, with managed Kubernetes (orchestration). This points t o the fact that customers seldom use a service catalogue to its full extent, something confirmed through interviews with European CIO public and private organisations, as well as by reports that find that only few customers use a large breadth of services from hyperscalers.47 Another factor for the low adoption of European offers is the limited visibility of said offers, as exemplified by market reports which rarely mention European providerscxi. All this places a high commercial barrier to greater uptake of European cloud and AI computing services. The hyperscalers’ size also allows them to better overcome barriers for offering their services across the EU 48. Consequently, European providers often focus on highly specialised market segments, such as the treatment of sensitive workloads requiring high -quality and secure servicescxii. For example, the Polish provider CloudFerro supports space-related use cases such as the ESA Civil Security programme and CODE-DE, a German Copernicus Data and Exploitation Platform. Italy’s leading provider Aruba provides the country’s eID services. The general high quality of services is highlighted, for example, by the recognition of OVHCloud and Scaleway in Gartner’s list of best Strategic Cloud Platform Services cxiii. Nevertheless, European CSPs are typically geared towards their home market . For example, OVHcloud generates 48% of its revenues in France compared to 29% in other European countries and 26% in the rest of the world. Similarly, IONOS generated 56% of its revenue in 2024 in Germany , as compared to only 8% in Spain, 5% in France, and 3% in Poland as the next biggest markets in the EU49. This phenomenon is even more pronounced in the Italian market. 89.7% of Aruba customer base is in Italy, followed by only 0.6% in Spain and 0.5% in France 50. In 2021, the European Alliance on Industrial Data, Edge and Cloud gathering all main European cloud providers pointed out their lack of ability to exploit the S ingle Market and offer their services across borders efficiently as one of the main barriers to scaling up and being able to compete with non-European providers51. This, paired with the absence of effective interoperability mechanisms across services or solutions that allow for a federation of cloud resources among CSPs , prevents European providers from achieving economies of scale (see also section 2.2.2). Taking the considerations above, and under the same market conditions, US hyperscalers have been able to thrive in the EU while their local competitors have not. The hyperscalers are able to exploit massive economies of scale, integrated ecosystems with default interoperability across services and high capital expenditure, which allow them to offer cheaper and broader services. 44 SMEs have also pointed to workforce certifications being skewed towards non -EU vendors, thus reducing the possibl e adoption of European alternatives. 45 A cloud broker is a 3 rd-party that adds value to cloud services on behalf of cloud service consumers. It delivers: 1) aggregation from multiple cloud services (from possibly different providers) into a unified offerin g 2) arbitration, allowing switch among multiple providers dynamically based on e.g. cost 3) intermediation. Gartner, Alonso et al. “Federated Cloud Service Broker (FCSB): An Advanced Cloud Service Intermediator for Public Administrations” . 46 See Eurostat 47 See the blog post introducing the Civo 2024 report ‘Has Cloud Computing lost its way to complexity and cost?’ 48 Diverging national cloud cybersecurity certification schemes require providers to get certified several times. 49 https://firmsworld.com/ionos-group-comprehensive-profile 50 List of Aruba Cloud Customers 51 European_CloudEdge_Technology_Investment_Roadmap_for_publication_pMdz85DSw6nqPppq8hE9S9RbB8_76223.pdf 19 Due to their glo bal scale and capital, hyperscalers are able to spread compliance costs across the different national markets over a large revenue base , amortizing them across scale so the average compliance cost per unit of revenue (e.g. service) falls with scale. Conversely, European providers remain sub-scale and confined to niche segments, focused mainly on their own national markets and legal regime s. The services offered by EU providers , while equal in innovation and quality, are not as integrated as the services offered by the hyperscalers nor they benefit from a large ecosystem gravity , which prevent s demand from pooling into contracts large enoug h to justify more investments. Due to the sub -scale, compliance costs for EU providers remain higher, which may slow them the release of advanced features that would allow them to meet the expectations of customers operating in certain critical markets. The outcome is a Single Market failure : in a genuinely unified market, all providers should be able to scale across borders with relatively uniform rules, standards, and buying channels, allowing efficient firms to grow and compete on equal footing. However, persistent regulatory and contractual heterogeneity and fragmentation (see also next sections ), as well as siloed demand , mean that the EU’s market remains de facto segmented, so network effects and economies of scale accrue disproportionately to alread y scaled non -EU incumbents rather than enabling EU -based providers to reach competitive size. 2.3.2. Problem Driver 2 (PD2): Bottlenecks slowing down data centre expansion The second driver concerns bottlenecks and regulatory fragmentation, which have contributed to slowing the expansion of data centre deployment, reducing attractiveness of Europe for investors and as a result contributed to limited computing capacity and persistent geographic imbalances. Companies seeking to build data centres in the EU are faced with a fragmented policy and regulatory environment 52. For example, Germany’s Energy Efficiency Act imposes Germany - specific obligations on data centres related to the use of renewable energy and heat recovery 53. In the Netherlands, stricter rules are applied on new facilities in the Amsterdam region as opposed to other parts of the country 54. In Poland, different permits are needed for different types of data centres55. Bulgarian zoning regulations altogether lack an adequate category for data centre s. In the context of infrastructure buildout , the most relevant bottlenecks and frictions are found in permitting, availability of suitable land, grid access, and access to capital. Permitting procedures for infrastructure development – which encompass zoning and land allocation, building permits, utilities and grid connection authorisations, and environmental permitting – involve multiple, often inconsistent layers of national and local regulations with multiple uncoordinated stakeholders and non -centralised processes. DCs are often not mentioned in national or municipal planning regulations, creating uncertainty and requiring additional rezoning processes in some jurisdictions cxiv. Permitting regimes typically ignore the strategic dimension of DCs for the E U economy, notably their enabling role for the EU uptake of digital solutions. Most jurisdictions require environmental review, ranging from basic assessments to full Environmental Impact Assessments that further lengthen the permitting process cxv. In most Member States, permitting involves repetitive requests and lengthy timelines, which can be aggravated by community opposition and appeals56. 52 For the complete analysis on the different regulations concerning data centre deployment in 12 MS, see Annex 4 section 9. See also here pp 19- 20: 2025-Data-Center-Site-Selection-Dynamic-Brief.pdf 53 Watson Farley & Williams (2024). Data centres: An international legal and regulatory perspective —Spotlight on Germany. Available at: https://www.wfw.com/articles/data-centres-an-international-legal-and-regulatory-perspective-spotlight-on-germany 54 Royal HaskoningDHV (2023Navigating Dutch data centre challenges and opportunities. https://www.haskoning.com/en/newsroom/blogs/2023/navigating-dutch-data-centre-challenges-and-opportunities 55 Dudkowiak, M. (2025). Data Center Investments in Poland | Law & Development Guide 2025. Dudkowiak Kopeć & Putyra. https://www.dudkowiak.com/invest-in-poland/data-centers-investments-in-poland/ 56 See as an example, the case of Apple in Athenry in Ireland. 20 The example of Germany illustrates well how and why permitting has emerged as a bottleneck for data centre deployment in light of the recent significant increase in demand for data centre capacity (see section 2.1.1). Germany’s central location in Europe and its proxi mity to business users have made it a major data centre hub, despite comparatively long timelines for permitting. Early investments have resulted in strong path dependency and network effects, with new capacity continuing to cluster around established hubs despite rising congestion costs, grid limitations, and regulatory barriers. However, with demand for data centre s growing, permitting is now a bottleneck holding back the fast expansion of data centre capacity that would be necessary to reduce the capacit y gap. Illustrative cases in Ireland and Luxembourg show how administrative delays caused 57data centre projects to be cancelled or delayed . In response, Member States or regions have adopted policies to accelerate DC deployment, for example by offering t ransparent planning procedures (Denmark), pre -designating areas (France), naming DC projects as of “strategic economic interest” (Spain at regional level), enabling parallel rather than sequential permitting (Germany), encouraging DCs to locate within exis ting industrial areas (Finland) or through tax incentives for DC operators (Sweden). While these acceleration measures facilitate short-term capacity expansion at national level , they contribute further to the regulatory fragmentation across the Single Market. Another factor slowing down data centre expansion is land availability , the difficulty for DC operators to identify suitable sites. DC sites must display specific characteristics in terms of access to utilities (energy, water) and connectivi ty, making suitable real estate scarce . Connectivity is a particularly relevant pull factor for selecting appropriate sites for DC deployment58, thus reinforcing concentration in existing hubs cxvi. Land scarcity is aggravated by large cloud service providers acquiring land and reserving energy capacity, without building DCs on the sitecxvii. Energy availability . With respect to energy needs, d ifferent modelling approaches indicate that DC energy consumption is foreseen to grow at an average annual rate of 13% between 2023 and 2030, twice the 2018-2023 growth rate cxviii. Energy prices in Europe are two to three times higher than in the US and China, as shown in the table below, while they amount for 40 -50% of DCs’ operational costs, creating a competitive disadvantage for the EUcxix. Table 2. Industrial electricity prices (€/kWh – all data 2025, except China 2024) US59 China60 EU-2761 Ireland Germany Italy Sweden Finland € 0.090 € 0.081 € 0.190 € 0.296 € 0.275 € 0.271 € 0.121 € 0.101 Access to energy grid constitutes an important bottleneck in the construction of DCs62. In parts of Europe, grid constraints have resulted in moratoria on new DC connections, especially close to established hubscxx. Connecting a DC to the grid can take between 3 and 10 years, depending on the Member State: around 3 -5 years in emerging markets (Italy or Spain) and 7 -10 years in established hubs (Frankfurt, Amsterdam, Paris or Dublin), with some projects experiencing delays of up to 1 3 years due to grid congestion 63cxxi. In the case of brownfield sites where there is a 57 Apple: see e.g., Guardian (2018), available ( here) & Data Centre Dynamics (2022), available ( here). Google: see e.g., Delano (2025), available (here) & RTL (2024), available (here). 58 Access to connectivity was also mentioned as a key problem by most of the SMEs in the public consultation. 59 Average Price of Electricity to Ultimate Customers by End-Use Sector, available here. 60 China's Industrial Power Rates 2025: A Guide for Investors. 61 Eurostat’s non -household prices refer to the standard medium industrial band (annual consumption 500 to 1999 MWh) including all non - recoverable taxes and levies. These are widel y used as an official benchmark for industrial power costs and for comparing Member States. Available here. 62 This was also flagged by all the SMEs responding to the questionnaire as an important or highly important problem their organ isation has encountered when expanding or building their infrastructure in the EU. SME also underlined that availability and affor dability of (low carbon) energy, and of a utility provider’s infrastructure nearby where the key factors that have driven their decision to select a DC’s location. 63 It is important to note that these delays are the result of grid congestion and limited a vailability. When it comes to grid connection, a 3 months deadline for receiving information on treatment of the connection request (i.e., the result of the permitting procedure) has been introduced by 2024 amendments to the Directive (EU) 2019/944. 21 previous power grid connection, this interval is highly reduced cxxii, but these sites can be insufficient to meet the needs of large DC projects. To overcome grid interconnec tion delays, DC operators are increasingly considering producing their own energy, with a dedicated microgrid. In some cases, such energy production could be based on gas turbinescxxiii, which would significantly increase their scope 1 greenhouse gas emissions64. Another bottleneck holding data centre expansion at the necessary speed is limited access to capital: over the past five years 58% of global DC investment occurred in the US with a record in 2023cxxiv, with Europe accounting for a smaller sharecxxv. AI computing infrastructure can be ten to thirty-times more expensive than general -purpose DCscxxvi, requiring massive capital investment. The EU’s fragmented financing landscape lacks the depth of an integrated capital market. Compared to the US, the UK cxxvii and Chinacxxviii, European investors have treated DCs as a niche market rather than a distinct asset cxxix. In addition, many parameters affect the bankability of DC projects65 such as the size of the operator, permitting and access to grid. Combined with Europe’s fragmented capital markets 66 and the high risk associated with smaller EU CSPs, notably outside the FLAPD markets, these challenges slow down capital mobilisation for DCs. In parallel to these bottlenecks across EU markets, water availability can be a critical factor for DC deployment for DCs that use cooling technologies which rely on water. With evaporative cooling techniques, a 1-megawatt DC can use up to 25.5 m litres of water annually cxxx, a potential issue in water -stressed locations cxxxi. While this is not a systematic investment bottleneck in Europe compared with other constr aints67, its importance in site selection and environmental assessments highlights the need to consider water risk as a relevant aspect of future infrastructure planning. In responding to this unprecedented demand growth, the factors highlighted above are holding the EU back from swiftly building the computing capacity needed to respond to the increase in demand, including for socially valuable infrastructure. The identified bottlenecks have historically not weighed as heavily as today: the demand for data centres has surged with the growing role of digital services and, more recently, with the advent of AI , which also require data centres located closer to users. This results not only in a capacity gap but also in the reinforcement of geographic imbalances, driven by regulatory fragmentation and the risk of regulatory arbitrage . This driver can be considered a coordination failure among investors, energy system operators, and public authorities, coupled with regulatory failures, as a result of fr agmented practices and divergent regulations. The first hinders effective communication of where new capacity could yield the greatest net benefits, while individual regulations have created obstacles to the proper functioning of the internal market, increasing compliance costs and preventing the cross -border scaling for smaller operators. Even though larger companies face the same rules, they are able to internalise such costs and regulatory heterogeneity given their global scale. 2.3.3. Problem Driver 3 (PD3): Limited public sector uptake of cloud and AI computing services supplied by European providers and diverging procurement practices This driver is innately linked to PD1. While some analysts cxxxii argue that the dependence on non - European cloud and AI comput ing services stems from the limited scale and scope of these 64 Today’s DC scope 1 emissions are largely limited to diesel back-up generators which typically operate only a few days per year for testing. 65 In the public consultation, most SMEs flagged having difficulties in getting funding to develop capacities. Among the respondents to follow-up questions, several flagged access to finance and/or high interest rates when procuring next generation GPUs as a key limitati on to expand capacity. On accessing finance, SMEs frequently underlined difficulties in accessing capital, such as loans or equity. 66 EU capital markets remain fragmented along national lines. The absence of a pan -European financing framework with common legal structures, or cross-border Real Estate Investment Trusts regimes underpin the difficulties of raising capital quickly. 67 Alternative cooling technologies can be used (often at the expense of a lesser energy efficiency). 22 services (PD1), other s argue that the scale and scope of these services can only grow based on stable anchor customerscxxxiii. As discussed in relation to PD1, the initial growth of today’s largest c loud and AI computing service providers was fuelled by public contracts. Similar opportunities did not emerge for European providers. Generally, public sector cloud uptake and corresponding spending on cloud and AI computing services is relatively low. Loo king at 2024 publicly available data from the portal of Tenders Electronic Daily, approximately 3.13% of ICT awards were dedicated to cloud and AI computing services. Out of all award notices published on the portal in 2024, 0.34% were related to cloud and AI computing services. Budgetary constraints and a shortage of a digitally skilled workforce to build their own private cloud constructs 68 make public authorities dependent on cloud and AI computing services from external providers cxxxiv. The systematic uptake of cloud and AI computing services by the public sector is still a relatively recent phenomenon. For example, Italy only set up it s Polo Strategico Nazionale to provide public administrations with access to cloud infrastructure in 2022cxxxv and Germany laun ched its government cloud in March 2025cxxxvi. While all Member States have developed national AI strategies and 21 of them have in place dedicated cloud policies, Member States vary widely in terms of maturity in the uptake of cloud services or in how they allocate and report public funding associated with these initiatives69. In some Member States, public procurement practices impede the procurement of pay -per-use cloud and AI computing services as they cater more towards fixed-price contracts cxxxvii. Beyond pricing modalities, t he lack of harmonised approaches to procuring cloud and AI computing services creates difficulties in developing and evaluating call for tenders 70. Moreover, the approach to using cloud and AI computing services laid down in clou d strategies and policies varies significantly, even within the same public entity and does not always include risk assessments71. Where they do purchase cloud and AI computing services, an increasing number of public sector entities relies on services pro vided by non -European companies 72, sometimes concluding direct partnerships73. For example, Finland's State Treasury uses Oracle and Microsoft Azure, Denmark's state public services use OpenStack's private cloud, Belgium's public authorities use a hybrid G-cloud, which runs on the clouds by IBM, Microsoft and Oracle, and the Dutch Tax Office uses Microsoft Azure cxxxviii. Similarly, the Flemish government recently partnered with Microsoftcxxxix. Some public tenders directly refer to services from leading cloud and AI computing service providers 74. A 2026 study by FOTI, the Future of Technology Institute , shows the pervasiveness of non-European providers also in the defence sector 75. This results in foregone economic opportunities for European CSPs and closes off one avenue for obtaining the stable public contracts that have allowed US CSPs to scale (see PD1). 68 Public authorities’ ability to develop and operate cloud and AI solutions in -house is also often hampered by lower salaries in the pu blic sector. Regarding limited ability to attract talent, see for example Strengthening the attractiveness of the public service in France – OECD – 2023, or the struggle by Italian data protection authority to recr uit AI experts. Regarding budgetary constraints, see for example Data foundations for government: From AI ambition to action – Capgemini – 2025, where 66% public sector respondents report limited budgets for on-premise solutions as a factor limiting widespread adoption of Generative AI. 69 OECD, 2025, Progress in Implementing the European Union Coordinated Plan on Artificial Intelligence (Volume 1) (EN) 70 SMEs responses to the Call for Evidence have highlighted how public tenders tend to be designed for non -EU incumbents with scarce consideration for European SMEs. 71 For the case of the Central government of the Netherlands, this is highlighted in a recent report by the Netherlands Court of Audit: Dutch central government in the cloud | Netherlands Court of Audit . Similarly, the 2022 EDPB Coordinated Enforcement Action on the Use of cloud -based services by the public sector reports that only 1/3 of the services procured by the Member States involved was subject to the necessary Data Protection Impact Assessment. 72 For example, the Netherlands’ Court of Audit has found that out of 1588 cloud services audited, more than half were pro cured from AWS, Microsoft and Google. See also: Trotz Abhängigkeit und Datenschutzrisiken: Behörden gehen in die Microsoft-Cloud | Heise Online. 73 See for example the recent announcement of the State of Bavaria: Vertrag soll bis Jahresende stehen: Bayern will in die Microsoft-Cloud | heise online. 74 See for example this tender for the provision of cloud services from the portfolio of the cloud provider AWS by an authorised cloud reseller: Bereitstellung von Cloud-Services für den Betrieb der Förderzentrale Deutschland (FZD) | BMWE. 75 Cloud Defence: an exposed European flank 23 While the described barriers to public secto r cloud adoption affect public sector demand for all service providers, they have particularly pronounced effects on comparatively smaller European providers which do not have the resources to navigate diverging approaches to public procurement, and that p revent them from the benefits of the Single Market (regulatory failure). Moreover, budgetary and human resources constraints 76 as well as a lack of awareness for alternative solutions drive the public sector towards the purchasing of integrated service pac kages from large incumbents cxl (see PD1). At the same time, public sector organisation s voice strong concerns related to the possible loss of operational autonomy and control over the data and associated infrastructure 77. Different national approaches have emerged to identify what constitutes a sovereign cloud provider and leveraging public procurement, as evidenced for example by the recent Franco -German sovereignty task force 78. Similarly, there are multiple and diverging national cybersecurity certification schemes, as described in section 2.2.1 of the report, with some of them integrating a sovereignty dimension, demonstrating a clear fragmentation in the internal market (systemic failure – fragmentation of the internal market ). While pote ntially effective in pursuing individual Member States’ policy objectives with respect to their enhanced autonomy, different national efforts come at the cost of increased regulatory fragmentation. This undermines the ability of comparatively smaller provi ders to easily navigate the European cloud market and offer their services across borders, including to public procurers. As discussed in the Draghi report, “multiple different national rules in public procurement generate high ongoing costs for cloud providers. The net effect of this burden of regulation is that only larger companies – which are often non -EU based – have the financial capacity and incentive to bear the costs of complying79.” This limited public sector uptake of cloud and AI computing services has spillover effects on the modernisation of public services. The adoption of cloud and AI is also a driver of public sector modernisation, as it enables administrations to move away from often fragmented, legacy IT systems toward more flexible, scalable, and interoperable digital infrastructures. By leveraging cloud and AI, public authorities can deploy new applications faster, improve service reliability, and respond more effectively to changing policy needs or crises. They also facilitate data sharing across departments and levels of government, supporting more integrated and user -centric public services. In addition, they reduces the burden of maintaining on -premises infrastructure, allowing resources to be redirected towards core missions. Overall, cloud and AI adoption underpins a shift toward a more agile, efficient, and digitally capable public administration. Finally, cloud and AI -savvy public authorities are increasingly embracing OSScxli, thanks to its overall lower total cost of ownership but their benefits remain to be scaled. While OSS deployed on EU-based data centres addresses some concerns over confidentiality of data and enable s custom-built solutions, it entails some difficulties regarding time, skills and lack of easily re - usable public procurement award criteria (regulatory failure – administrative burden ). This is exacerbated by public authorities lacking a common approach to open source, notably when agreeing to coordinated developments 80, or to the sharing and maintenance of existing code 81. 76 The 2023 Opinion 23-A-08 of the French Autorit é de la Concurrence on competition in the cloud sector points to a decline in organisations’ overall in-house IT skills, due to higher reliance on managed services provided by private operators, which allow for savings but affect negatively such organisations strength of negotiation, choice and mastery of IT tools. 77 64% of public sector organizations surveyed as part of the 2025 Capgemini Data foundations for government: From AI ambition to action study express concern about data sovereignty, 58% about cloud sovereignty, and 52% about AI sovereignty as a factor in deciding abo ut future technology choices. 78 https://uk.diplomatie.gouv.fr/en/summit-european-digital-sovereignty-delivers-landmark-commitments 79 97e481fd-2dc3-412d-be4c-f152a8232961_en, p. 13. 80 Several Member States (IT, FR) require a comparative analysis of existing open source and commercial solutions and mandate th at applications developed for public administrations be released in open, public repositories. Others take a more voluntary approach (CZ). 81 When public authorities release OSS, the maintenance and further development often end up depending on just one or two main contributors, undermining resilience and innovation. See for instance the log4J case where there was only one active member contributing to a library larg ely used to log actions in IT systems. 24 Additionally, many of the open source components widely used in today’s services and applications are maintained by single individuals and small teams, creating critical points of failure (see the log4j case , mostly maintain ed by one individual and which is considered the second most common ly exploited vulnerabilitycxlii). Thus, w hile open source offers more transparency by releasing code openly for more eyes to review and faster bug discovery, it requires constant and expert monitoring to avoid that vulnerabilities are exploited by malicious actors. 2.3.4. Problem Driver 4 (PD4): Absence of clarity around the concept of sovereign cloud and AI computing services In the absence of an agreed definition and criteria to evaluate sovereignty, users are left without the necessary information to assess whether a service is sovereign or not. At the same time, providers are left without a reliable opportunity to distinguish themselves commercially. ‘Sovereignty’ is often used in the ICT domain without a commonly accepted definition. Literature defines it as “possessing the ability and competences to have reliable access to a technology it deems critical for its own system, without any structural, uncontrollable dependency from third countries”cxliii. Currently, non -European s ervice providers, including US -based CSPs, are at the forefront of offering sovereign-branded solutions for the EU market based on diverse characteristics. For example, AWS European Sovereign Cloud guarantees data residency in Europe with physical and logical separation from other regions and operation entirely run by EU residentscxliv. Oracle’s EU Sovereign Cloud locates customer support, DC support, an d DC operations fully in the EU and ensures management by a dedicated EU entity cxlv. An alternative approach takes the form of joint ventures, such as Bleu (partnership between Capgemini and Orange offer ing Microsoft services) cxlvi or Clarence (joint venture be tween Proximus and LuxConnect based on Google technology)cxlvii. The price of sovereign cloud offers over traditional ones is subject to diverse points of view, something not surprising given their recent arrival to the market. An analysis carried out by BCG82 estimates that listed prices are 10% to 30% higher compared to the public cloud. According to BCG, “Google Sovereign Cloud is priced 10% to 20% over the public cloud, while Oracle EU Sovereign Cloud charges a 15% to 30% pr ice premium”, whereas “Microsoft Azure Government carries a 15% to 25% price premiu m”. An empir ical comparison of AWS pricing between the sovereign cloud offers and the eu-central-1 region (Frankfurt) of 6 AWS cloud services in January 2026 using AWS’ provided calculator shows that the average price premium for the previously mentioned sovereign services is of 15%83. Against these observations, European service providers, possibly because sovereignty in the EU is easier for them to reach, declare in bilateral interviews that their prices should not be affected by sovereignty requirements and could even be lower than non-EU non-sovereign services. Real observed prices in actual competitive tenders, to which this assessment had access in confidence, show price differences ranging from +12% to -10% for the same level of sovereign service. This can also be observed for “sovereign AI” : For example, Oracle advertises AI solutions running on its sovereign cloud as “sovereign AI” cxlviii, and OpenAI announced agreements with Germany as well as the UK Ministry of Justice, on the expansion of UK sovereign AI capabilitiescxlix. The descriptions of the se offers often also refer to high levels of cybersecurity . However, a technically cybersecure service may still be exposed to non-EU laws requiring the provider to grant data access to third -country authorities or to third -country policies intended to 82 See BCG Cloud Cover: Price Swings, Sovereignty Demands, and Wasted Resources 83 These are S3, FS X Windows, EC2, Lambda, RDS for PostgreSQL and DynamoDB. See : AWS European Sovereign Cloud (ESC) – Launch, Pricing, and What’s Next 25 limit service supply. Moreover, the processing of data in the EU does not in itself prevent the control over the software by a non-EU entity84. The above -mentioned sovereignty claims are currently made without demonstrating the safeguarding of operational au tonomy and the protection of data against foreign interference or access (see section 2.2.2). This imperfect information environment implies a failure in today’s market for cloud and AI computing services leading to an information asymmetry as users do not have a reliable means of verifying whether a service is truly sovereign or not85. At Member State level, existing schem es on cloud cybersecurity certification sometimes contain a sovereignty dimension. For example, t he French SecNumCloud aims to ensure the ‘sovereignty of CSPs’ based on strict technical cybersecurity requirements and non-technical – sovereignty - criteria. The adoption of SecNumCloud by cloud services remains rather low, and most European customers are unaware of the benefits in the services provided by European CSPs, despite an increased use of the notion of sovereignty to market their offers cl.However, in the absence of clarity around the concept, this has not yet translated into meaningful commercial advancementscli. Thus, t he lack of such a clear common understanding and enforceable criteria for sovereignty along with the solutions adopted by different Member States is resulting in further fragmentation of the Single Market . Announcements such as AWS investment of EUR 7.8 bn in an EU sovereign cloud clii indicate that today’s incumbents are likely to capture the nascent market for sovereign cloud and AI computing services. In the absence of clarity on what constitutes a sovereign service, the definition will de facto be set by today’s leading providers in a way that further enshrines today’s dependence. 2.4. How likely is the problem to persist? The problems can be expected to become increasingly acute. Despite continued investment in DCs, the gap between supply and demand of computing capacity will likely grow. The current timeline for DC deployment is likely to remain complex as rising demand puts additional strain on the already lengthy permitting processes. Member States’ national policies to attract DCs and accelerate their deployment will likely persist, complexifying the European market for operators and creating geographical imbalances regarding the deployment of DCs towards certain regions. Considering the importance of low latency, this will lead to unequal opportunities for businesses across the EU, notably in central and southern Europe where latency performance can fall short of AI or IoT solutions execution requirementscliii. Ultimately, insufficient access to computing capacity will limit businesses' ability to integrate AI into their operations, negatively affecting their competitivenesscliv. While lowering operating costs will incentivise DC operators to adopt energy efficient technologies, the industry’s demand for energy will continue to grow. Without strategic energy planning and a focus on sustainable infrastructures, DC expansion will particularly challenge existing DC hubs and regions with high strain on natural resources, at the risk of crowding out electrification objectives in other sectors and generating increasing public oppo sitionclv. The ongoing revision of the infrastructure planning under the TEN -E Regulation (2022/869) has a potential to reduce the scale of the problem. 84 Delos Cloud (an SAP subsidiary operating based on Microsoft software for use by public administrations), for example, is deemed by the Interior Ministry of the State of Baden -Württemberg to not be fully sovereign beyond its infrastructure. As the application layer remains Microsoft software, the Ministry cautions that the software and data processed remains subject to the requirements of the US CLOUD Act, giving rise to data access without the customer’s awareness. 85 This has given rise to the term ‘sovereignty washing’, see for example: Sovereignty Washing - When 'Sovereign Cloud' Isn't Really Sovereign – VSHN AG. Similarly, SMEs respondents to the Public Consultation have stressed that foreign -controlled firms market services as “European” despite extra-territorial dependencies. 26 Considering these factors, the expansion of DCs in the EU will continue, but at a slower pace than needed to meet growing demands. This will continue to raise prices, a trend already noticeable for colocation and access to GPU capacity in Europe clvi. This shortage of suitable computing capacity may even lead EU businesses to move overseas clvii or delay the deploy ment of low -latency services to the detriment of EU’s economic growth. Consequently, the provision of cloud and AI computing services to EU customers will continue relying on infrastructure located outside of the EU. Given the preference of many users for keeping their data in the EU, this bottleneck will slow down the adoption of cloud and AI computing services in the EU. Today’s stable market share of 15% for European CSPs shows no indication of change, despite a growing marketclviii. The largest European CSPs may be able to solidify their position as national players, but their smaller customer base will hinder their capacity to invest, scale up and innovate. Conversely, hyperscalers will continue to innovate and grow into the AI mar ket, with their solutions becoming indispensable, particularly for startups and SMEs and in MS where European CSPs lack a commercial presence. Current trends suggest that US dominance in development and adoption of AI technologies, with China catching up, will persist clix. European businesses and public authorities will continue to rely on US AI providers to the detriment of European service providers struggling to work at the frontier. Dependence on hyperscale cloud and AI computing service providers, partic ularly for highly critical use cases, will continue to expose data to third -country access and carry risks to service continuity, endangering operational autonomy. 3. WHY SHOULD THE EU ACT? 3.1. Legal basis Article 114 of the Treaty on the Functioning of the European Union (TFEU) empowers the EU to adopt measures aimed at improving the functioning of the internal market through the approximation of the provisions laid down by law, regulation or administrative action in Member States. These measures can take the form of a Regulation or a Directive. National approaches to expanding DC capacity risk creating a fragmented landscape on DC deployment and potentially a regulatory race to the bottom in sustainability and permitting requirements. Diverging public procurement practices for cloud and AI computing services and diverging sovereignty criteria may prevent providers from fully benefitting of the internal market. If EU intervention takes the form of a legislative proposal, it can be based on Article 114 TFEU. Article 173(3) TFEU is the basis for enhancing the EU’s competitiveness and innovation capacity. It enables measures to accelerate industry’s adaptation to structural changes; encourage an environment favourable to initiatives and to the development of und ertakings throughout the EU, particularly small and medium -sized undertakings and favourable to cooperation between undertakings; and foster better exploitation of the industrial potential of policies of innovation, research and technological development. The lack of computing capacity in the EU negatively affects the competitiveness of industry, keeping it from leveraging the full potential of adopting AI, particularly those that rely on low latency. By increasing the availability of compute capacity, this initiative aims to strengthen Europe’s competitiveness and innovation capacity. If it takes the form of a legislative proposal, it can thus also be based on Article 173(3) TFEU. Should the legislative proposal include elements associated with both i mproving the functioning of the internal market as well as addressing the competitiveness of the Union’s industry , the proposal would take form of a single act, building on the legal basis provided for under Articles 114 and 173(1) TFEU, to ensure a coherent ap proach to address, in different ways, the need for strengthening of the Union’s cloud and AI ecosystem. 27 3.2. Subsidiarity: Necessity of EU action Article 5(3) TFEU stipulates that action at EU level should be taken only when the envisaged objectives cannot be sufficiently achieved by Member States alone and, due to the scale or effects of the proposed action, can be better achieved at EU level. The development of computing capacity in the EU currently takes place along national lines. Each Member State operates under a distinct framework, with different processes and requirements for DC deployment, reflecting local conditions and needs. However, as mentioned above , national policies for DC acceleration risk further fragmentation and race -to-the-bottom with respec t to sustainability. Moreover, an increasing number of low -latency applications require close computing capacity. More generally, the EU faces an acute shortage of computing capacity, a problem that risks negatively affecting its competitiveness and requir es EU -level action to maintain a regulatory and investment environment that is easy to navigate for DC operators and investors, including across borders. Closing this capacity gap and allowing European businesses and public administrations to leverage co mpute capacity while ensuring sustainability requires action at EU level. The dependence on cloud and AI computing services supplied by non -European pro viders ha s the same root causes across the EU and affect s businesses and public administrations in all Member States. European service providers face difficulties to scale up across the EU, for example due to different national trustworthiness standards, particularly in public procurement. Divergent national procurement practices complexify the market for European providers and the underlying situation of imperfect information is a market failure requiring an EU-level response. Calls for EU-action to address these challenges were also made in the public consultation86. 3.3. Subsidiarity: Added value of EU action EU action would have a clear added value in addressing the problem of limited and geographically concentrated availability of computing capacity. By providing a common approach to accelerating DC deployment, it would enable the coherent planning and deployment of computing capacity in a geographically balanced way, while avoiding a race to the bottom and reducing regulatory complexity for investors and DC operators. The EU is uniquely positioned to ensure that investment and acceleration policies reflect collective priorities and avoid fragmentation. EU-level action would ensure that all businesses and public administrations can access sufficient compute capacity to meet their needs and is a prerequisite for Europe to become an AI continent. In addressing the dependence on cloud and AI computing services supplied by non -European providers, EU action would deliver benefits that exceed what Member States could achieve individually, especially in addressing the unde rlying market failures of imperfect information . This would improve the functioning of the internal market and enable cloud and AI computing service providers to grow beyond their national markets. 86 In replying to this topic, 80% of respondents emphasi sed the importance of the EU reducing its reliance on non -EU cloud and AI computing service providers. Public authorities stron gly supported coordinated EU-level action with 80% supporting EU -level actions such the establishment of cybersecurity guidelines; the adoption of standards, open specifications, and mechanisms to ensure interoperability; the c reation of a mechanism to federate cloud and AI computing services across public administration within and across MS, the creation of guidelines with stan dard criteria to procure cloud and AI computing services and guidelines with standard award criteria. In addition, 72% supported th e creation of clear environmental compliance requirement et EU level, and 66% were in favour of unified guidelines at EU level for energy efficie ncy for computing infrastructure. Finally, public authorities called for an EU-level definition of cloud sovereignty. 28 4. OBJECTIVES: WHAT IS TO BE ACHIEVED? 4.1. General objectives The general objective of the intervention is to ensure the functioning of the internal market for cloud and AI computing services and to secure the conditions necessary for the Union’s competitiveness and strategic autonomy. 4.2. Specific objectives Specific ob jective 1 (SO1): Increase computing capacity deployed in the EU through innovative and sustainable technologies. By 2030, the EU should at least triple its current DC capacity, prioritising energy-efficient technologies in at least 80% of new installations. As demand continues growing, this should be considered an intermediate objective so that b y 2035, the computing capacity in the EU should meet its needs. Specific objective 2 (SO2): Ensure attractive conditions for the deployment of sustainable and innovative computing capacity 87. While SO1 is aimed at the deployment of capacity, this SO targets the conditions for investment and deployment. By 2030, operators should be able to obtain all permits to build and run a DC in less than 18 months throughout the EU, including access to land, permits for energy access, and connectivity – which are also a major attention point for investors. Specific objective 3 (SO3): Decrease the overall reliance on non -European cloud and AI computing services. By 2035, this inter vention should increase the market share of European cloud and AI computing service providers in the European market to 30% . Strengthening the Union’s strategic autonomy requires reducing dependenc ies and ensuring that European users have credible European alternatives to non -European incumbents. A stronger European supply base improves the Union’s capacity to act autonomously and enhances long -term resilience, competitiveness, and security of supply. Specific objective 4 (SO4): Contribute to the protection of public order by enhancing the resilience of supply of cloud and AI computing services, in particular in the public sector. By 2035, 100% of the highly critical use cases in the public sector should be operated using sovereign cloud and AI computing services to ensure data confidentiality, operational autonomy and prevent harms that could undermine public order. Highly critical use cases are those of a particular systemic importance and that underpin essential functions or involve the processing of sensitive data. Ensuring that, for them, data is protected , and service continuity is guaranteed is a key element of attaining strategic autonomy. That is why these use cases are a priority for the move towards services whose provision is outside of the reach of third -country policies that could result in data access or interruptions to service continuity, i.e. sovereign services88. Figure 5. Illustrative summary of the problems, drivers and objectives associated with this initiative 87 An example would be a data centre using immersion cooling. This technology involves submerging servers in a non -conductive liquid, which is more efficient at dissipating heat than traditional air cooling. This approach not only reduces cooling energy consumption but also allows for higher server densities, making data centres more compact and efficient, generating more computing power while occupying less space and using fewer resources. 88 Defining what constitutes a sovereign service is part of this initiative. However, already at this stage of the assessment, it is important to point out that sovereignty should not be equated with ‘European’. 29 5. WHAT ARE THE AVAILABLE POLICY OPTIONS? 5.1. What is the baseline from which options are assessed? The baseline scenario assumes that today’s policies and regulations continue. Annex 9 presents the underlying assumptions. For the limited availability of computing capacity in the EU (P1), the baseline scenario considers the projection of EU DC capacity in the absence of additional intervention in the period 2025 - 2036. Growth in the EU’s total installed compute capacity, measured in DC IT load, is projected to reach around 42 GW by 2036, growing yearly by 12% over this period, yet demand for computing capacity is expected to increase by 13% over the same period, creating a structural capacity gap of 19 GW as seen in Figure 6 below, across all capacity growth scenarios89. Figure 6. Evolution of the gap between data centre demand and supply Source: Technopolis et al. (2025)clx 89 The study presents projections for data centre capacity and demand across the EU27 based on three sc enarios (low, central, and high). These projections illustrate the potential evolution of installed capacity and needs over the next decade, reflecting variations in natural resources, demand drivers, technological innovation, and market responsiveness. The study finds a structural capacity gap across all the different growth scenarios tested for this assessment, i.e. of 12 GW in the low growth scenario, 19 GW in the central scenario (used as the baseline) an d of 23 GW in the high growth scenario. Please see Annex 4, Section 2.3 for additional information. 30 DC acceleration policies and regulatory framework remain non-harmonised across Europe. Some Member States would develop national strategies to make specific locations more attractive for DC operators. Outside of these possible strategies, bottlenecks such as lengthy permitting processes would persist and capacity expansion is expected to follow existing market trends, i.e. concentrated around existing hubs. Permitting delays, grid -connection queues and land -use restrictions would persist, with localised alleviation through national ref orms. The Commission would continue pursuing greater transparency on the environmental performance of DC, notably under the EED and the upcoming review of the Taxonomy for Sustainable Finance. Industry may set additional sustainability targets, e.g. under the Climate Neutral Data Centre Pact. Electricity grid constraints would become a binding factor in several Member States by the early 2030s as total DC demand surpasses 200 TWh. Under current conditions, the International Energy Agency has estimated that around 20 % of announced projects worldwide are expected to experience significant delay or downsizing clxi. Public investment would remain focused on high -performance compute infrastructure for the training of large AI models (AI Factories, Gigafactories). Under policy option 0, the EU’s compute supply increases in absolute terms but lags well behind other regions, as shown in Figure 7 below. North America and Asia -Pacific expand faster , increasing their share of global compute. This trend risks constraining AI model training and cloud workloads within the EU, particularly for SMEs and public sector users. Figure 7. Forecast of data centre capacity in the EU-27 vs ROW from 2025 to 2030 Source: Technopolis et al. (2025)clxii For the dependence on cloud and AI computing services supplied by non -European providers (P2), the baseline scenario considers that the market share of European service providers (15%) will remain stable despite the opportunities that a growing market can offer. The Policy 0 scenario reflects continued efforts under the Data Act to ensure cloud switching or parallel use of several providers. Given the recent adoption of the Data Act, its full effects will take time to materialise. The standard clauses recommended will allow for an easier switching of cloud services , whose consequences will be observable as they are progressively adopted. For the interoperability aspects, the effects are expected to take longer to materialize given the low number of existing open specifications and harmonized standards addressing the issue , that would become of mandatory application for providers following the mechanisms envisioned in the Act. The Data Act empowers the Commission to further standardization requestions and the adoption of open specifications compliant with the Data Act and that are published at a later stage . Pursuant to the recently launched investigation, a potential designation of large CSPs as gatekeepers under the Digital Markets Act may further open the market clxiii. The revision of the CSA could enhance the security and resilience of ICT supply chains including for cloud and AI computing services. The IPCEI-CIS will continue to support the participating European providers in the development of a multi-tenant cloud -to-edge software paradigm. The activities of the European Alliance on Industrial Data, Edge and Cloud will continue to enhance cooperation among European providers. 31 The Commission would pursue investment in OSS, such as Simpl, or the Open Internet Stack. While these may positively affect the uptake of cloud and AI computing services, they should be balanced against the problems an d drivers spelled out in section 2. Without a common understanding of what a sovereign service entails, providers can promise a sovereign service to customers without clarity on its substance. This could lead to continuous uncertainty for service providers and users, particularly in the public sector. The absence of an EU -level cloud cybersecurity certification scheme is already resulting in national approaches , fragmenting the internal market. Finally, the ongoing parallel work on the Capital Markets Union strategy should address the question of availability of private capital more structurally. Against this backdrop, the baseline considers three scenarios of how the market share and revenues of European service providers will evolve in the period 2025 - 2036 without additional measures: Table 3. Baseline scenario for Problem 2 Scenario Market share of EU providers in 2036 Cumulative revenues of EU providers (2025 – 2036) (EUR bn) Cumulative revenues of non-EU providers (2025 – 2036) (EUR bn) Baseline (pessimistic scenario) 10% 438 33 212 Baseline (flat-share scenario) 15% 564 31 956 Baseline (optimistic scenario) 17% 611 31.483 The 15% baseline assumes European cloud providers maintain their current market share through a combination of modest revenue growth from rising customer interest in sovereignty and specialized use cases, offset by persistent structural barriers including vendor lock -in effects, hyperscaler bundling strategies, and the integration challenges that prevent easy switching. The 10% pessimistic scenario reflects the resumption of the downward trend observed until 2022 : as US hyperscalers dramatically accelerate investment in cloud and AI services, creating capabilities European providers cannot match, existing regulatory protections fail to meaningfully reduce lock-in or enable genuine data portability, while aggressive bundled pricing and occasional provider fai lures erode enterprise confidence in European alternatives. By contrast, the 17% optimistic scenario envisions a more favo urable environment where stronger existing regulations ensure genuine interoperability between cloud platforms, reliable data portabil ity safeguards reduce switching friction, and clearer security standards boost customer trust, enabling European providers to convert sovereignty conscious customers such as the public sector and expand into segments currently dominated by hyperscalers. 5.2. Description of the policy options This section structures the policy options by problems as identified in section 2. The options for problem 1 combine measures of different regulatory intensity and different calibrations of EU versus national delivery. The o ptions for problem 2 are presented along a gradient of intensity of the intervention. Problem 1 and 2 interplay with each other since they concern successive steps of the same value chain, and a supply -demand relationship naturally exists: cloud and AI com puting services can only be delivered if the underlying infrastructure exists. Conversely, DC operators only invest based on the expected uptake of their future capacity. The policy options are nevertheless dealt with separately as they correspond to very different realities (physical world vs. dematerialised services), contain policy measures of a different nature and mostly concern different stakeholders. Problem 1 concerns the provision of physical infrastructure (data centres, land availability, permitt ing, grid connection, connectivity, etc.) mainly involving data centre operators (i.e. colocation providers and, CSPs when they operate their own infrastructure), utilities, local authorities and investors. Conversely, problem 2 concerns the market for clo ud and AI computing services, which is shaped by very distinct market and competition dynamics. These two markets are governed by distinct regulatory and economic mechanisms, which call for 32 different sets of measures . This approach has allowed to assess the impacts of measures focusing on each of the two problems separately, i.e. infrastructure -related constraints vs market dynamics in the delivery of services, while still recognising their interdependence. 5.2.1. Policy Options to address the limited an d geographically concentrated availability of computing capacity in the EU Table 4. Overview of the first set of policy options, responding to Problem 1 Policy Option PO1-A Policy Option PO1-B Policy Option PO1-C Enhancing the existing collaborative framework Legislative and financial intervention enforced nationally Legislative and financial intervention enforced at EU-level PM1 - Cloud Alliance expansion PM2 - Data Centre Forum PM3 - Data Centre guidelines PM4 - National facilitator PM5 - Fast-track areas PM6 - National funding support PM7 - Deployment targets PM8 - EU R&D funding PM9 - EU deployment funding for strategic projects PM10 - EU-level fast-track Figure 8. Illustration of policy options to address the limited availability of computing capacity PO1-A could be combined with both PO1-B and PO1-C. However, PO1-B and PO-C are designed as mutually exclusive. PO1 -B packages measures that put Member States in the driving seat, whereas PO1-C places the implementation at the EU-level. See also section 7.7. Policy Option PO1-A: Enhancing the existing collaborative framework This policy option strengthens existing collaborative mechanisms between Member States, EU institutions, industry stakeholders and research bodies to support DC expansion. It addresses the identified regulatory and coordination failures through soft measur es. Participation and adherence to produced guidelines would remain voluntary. • Policy Measure 1 (PM1) creates a new working group for DC operators in the existing Alliance for Industrial Data, Edge and Cloud, enabling exchange of best practices on deployment, and regular institutionalised dialogue between DC operators, Member State representatives and European CSPs. The working group would be chaired by a representative of the DC industry, with the Commission providing the secretariat. • Policy Measure 2 ( PM2) establishes a broader forum for public -private stakeholders (DC operators, TSOs, connectivity providers, equipment manufacturers, and local authorities ), enabling coordination and dialogue on DC projects and on the integration of innovative solutions in DCs. It would be convened by the Commission and can build on existin g ad hoc DC grid integration roundtables. • Policy Measure 3 ( PM3) consists of adopting EU-level guidelines for deploying sustainable DCs. These would go beyond best practices on energy efficiency clxiv and would offer guidance on deploying a sustainable DC. They would include recommendations on identifying suitable 33 land for deployment. Leveraging the forum created under PM2, the guidelines would be co - developed by its participants and subject to periodic review. This option is a soft way of addressing PD2 (bottlenecks slowing down data centre build -out) While they do not dire ctly change factors like permitting or access to energy, they intend to make them less of a bottleneck by establishing direct links between the actors that are crucial for driving data centre build -out and improving information flows between them (e.g. bet ween data centre operators and TSOs on grid capacity needs ). The exchange of best practices among data centre operators will help the industry better navigate the deployment environment in the EU and guidelines will help industry identify, for example, the areas in which data centre deployment may unfold more quickly due to available grid capacity. Beyond specific projects, the interactions between relevant parties would feed into guidelines for data centre deployment – a collection of best practices to be leveraged for faster data centre build -out across the EU. This option would improve the connection between European CSPs (existing Alliance members) and key data centre players (future Alliance members under this option). This would improve opportunities f or European CSPs to access data centre capacity or participate directly in the build-out. The existing Cloud Alliance is a vibrant community of cloud companies wh ich collaborate around projects of common interest and are generally eager to extend membersh ip up/downstream, i.e. to DC operators and their equipment manufacturers . As part of the public consultation, 85% of business respondents (n=52) supported the development of EU guidelines. Policy Option PO1-B: Legislative and financial intervention enforced nationally This second policy option consists of legislative and financial intervention implemented at national level, where the EU-level intervention is limited to a coordination role. • Policy Measure 4 ( PM4) obliges Member States to designate a national facilitator for all DC projects. Member States would be free to designate as facilitator the entity that suits the task best within their own national structures, for example a service wi thin their central administration or an agency. The facilitator would accompany the applicants from start to finish of the DC project for all authorisations relevant to DC rollout, i.e. planning and building permits, environmental assessments, water and he at use authorisations, and grid connections. Where needed, the facilitator would escalate issues for rapid resolution and interact with the designated facilitator in another Member State if needed for a specific DC. • Policy Measure 5 (PM5) on the basis of a national data centre strategy, obliges Member States to identify suitable areas to fast-track the deployment of DCs. The identification process would follow commonly defined EU -level criteria and ensure that the area displays the necessary characteristics for DC deployment, e.g. connectivity and guaranteed existing or future grid availability. Within these areas, Membe r States would be required to enact – based on their choice - measures for accelerated DC deployment, beyond administrative acceleration for environmental screenings and communicate clearly on the applicable procedures and criteria. This could include a pa rticular end use for the Data Centre such as being part of a broader digital ecosystem implementing the Apply AI objectives of the Union. The toolbox established in the new Regulation on speeding -up environmental assessments would be leveraged for designated areas, to allow them to benefit from the additional favourable provisions in environmental assessments. In designating the area and designing the related acceleration measures, Member States would receive support from an EU -level coordination hub. Established within the Commission, the hub will offer technical assistance to Member States. The designation of acceleration zones could include a n EU-level mechanism to attract smaller users of collocation capacity. Where such status exists in the national con text and beyond environmental assessments, DCs would receive favourable status in administrative procedures as projects of highest national significance. In identified suitable sites, Member States would be 34 bound to the target of reaching a maximum timelin e of 18 months for all relevant permits beyond environmental assessments 90. Some fast-track areas would be reserved to DCs that are of a particular added value to the EU, for examples based on their innovation or sustainability performance (measured in line with the upcoming rating scheme under the EED) or because of the users they will serve. Accordingly, access requirements in terms of sustainability would be defined at EU level but would leave freedom to Member States to add criteria. • Policy Measure 6 ( PM6) consists of the possibility of Member States to voluntarily grant public support in line with applicable State aid rules to particularly innovative and sustainable DC projects located in the fast-track areas of PM5 (as with PM5, the sustainability performance would be in line with the EED’s rating scheme). Public support could take the form of tax incentives and consider rewarding DCs which contribute positively to grid flexibility and stability. • Policy Measure 7 ( PM7) sets an EU -wide DC capacity target which Member States must collectively reach by 2035 and an EU -level monitoring of the progress towards reaching the target. The capacity target would be formulated in MW of DC capacity and would aim to close the compute capacity gap while moni toring of capacity growth in underserved regions, thereby fostering a more geographically balanced distribution of such capacity over time. The monitoring would be integrated into the existing digital decade cycle which would result in an annual report on progress – both at EU and Member State level. This policy option would help overcome the identified bottlenecks currently slowing down data centre deployment (PD2) : The identification of suitable sites for DC deployment is a time - consuming and cumberso me step usually undertaken solely by DC investors who work on the basis of incomplete or inaccessible data (e.g. there’s no publicly accessible repository of areas with electricity a vailability). The national facilitator would help data centre operators navigate permitting requirements and help relevant authorities process requests as efficiently as possible . Rather than altering permitting procedures and changing local requirements, this option addresses regulatory complexity by making it more navigable for data centre operators and ensuring fastest possible treatment w ithin fast-track areas. The designation of fast -track areas would help data centre operators identify suitable land . These measures would also aim to improve transparency and coordination around zoning and grid access to facilitate more contestable access to key inputs. Through the option for national funding, this option allows the de -risking of investments in strategic data centre p rojects, helping overcome access -to-capital issues. This can prove particularly beneficial for European providers to gain access to data centre capacity or participate in the build -out themselves, which can boost the scale and scope of services provided by Europeans (PD1). Respondent views on Policy Option PO1 -B. Feedback from DC operators from the public consultation (n=30 respondents) on measures under this policy option: Measure Overall support One-stop-shop service to simplify infrastructure permitting procedures 83% Expedited approval mechanisms and clear conditions for strategic or critical projects 97% Public-private partnerships for large-scale data centres 63% Tax incentives for using sustainable technologies 73% There has been noticeable support in the Call for Evidence ( CfE) for measures within PO1 -B. Most companies and business associations favour simplification of permitting requirements, 90 Annex 4, section 8 presents the relevant permitting steps and their relative duration in 12 Member States. The necessary impr ovements to grid availability will be driven by the Grids package (see section 5.3). 35 introducing a national facilitator for DC projects, and fast -track mechanisms. Some respondents suggested faster grid connection and the creation of special DC deployment areas established at national level. Policy Option PO1-C: Legislative and financial intervention enforced at EU-level This third policy option introduces binding acceleration measures enacted at EU -level and supported with EU funding. • Policy Measure 8 ( PM8) identifies the key EU -level R&D funding challenges to the development of energy- and resource-efficient and secure DC technologies, including advanced cooling, renewable energy and storage integration, and AI -based optimisation tools 91. While a fictitious amount is set for modelling purposes, the initiative would not mention a specific amount, thus not pre-empting the MFF discussions. • Policy Measure 9 (PM9) creates the possibility, without prejudice to the outcome of the negotiations on the next MFF proposal, for strategic DC deployment projects to be supported by Union programmes, funds and financial instruments, in accordance with the objectives set out in the regulations establishing those funds and programmes , in particular those implementing the EU’s vision for an AI continent / Apply AI . The Cloud and AI Development Act would specify binding EU -level criteria in accordance with which strategic projects w ould be identified by the EC. As with PM8, a fictitious amount is used for modelling, while the initiative would only be declarative. • Policy Measure 10 (PM10) empowers the Commission to designate suitable areas for accelerated DC deployment following EU-level criteria and in consultation with Member States experts within an EU DC Acceleration Board . This Board would be created as a dedicated committee (comitology). Permit granting for DC projects would follow EU -wide rules and require approval from the Boar d. For these areas, Member States would be required to enact a set of acceleration measures prescribed at EU level. The toolbox established in the new Regulation on speeding -up environmental assessments would be leveraged for DC projects deployed in these areas, to benefit from the additional favourable provisions in environmental assessments. By centralising the designation of areas and processes for accelerated deployment under an EU expert body, this policy option would tackle the bottlenecks to DC expansion (PD2). Direct funding for the development of sustainable DC technologies and support to DC integrating such technologies would increase sustainable capacity. In terms of substance, this option has roughly the same thrust as PO1-B, but with EU -level decision-making and the use of EU funds for R&D and the deployment of strategic data centres. While open to all data centre operators , this option will also benefit European cloud and AI service providers where they themselves seek to build data centres or rent newly created co -location capacity. The measures thus also contribute to addressing the lack of scale and scope of EU cloud service provider s (PD1) whose ability to scale, as described in section 2.2.1., is – among other factors – restricted by their limited infrastructure presence and the high costs of expanding it. In response to the CfE, several companies, business associations and a Membe r State expressed support for R&D funding at national and EU level. Respondents generally showed strong support for measures that would advance the energy efficiency performance of data centres . In the questionnaire (n=243), 70% of respondents supported fu nding for R&D of energy -efficient technologies. 91 Such as AI solutions for optimising the operation of DCs. 36 5.2.2. Policy Options to address the dependence on cloud and AI computing services supplied by non-European providers Table 5. Overview of the second set of policy options responding to problem 2 Policy Option PO2-A Policy Option PO2-B Policy Option PO2-C Supporting measures to increase transparency and visibility of sovereign cloud and AI computing services Voluntary framework for advancing sovereign cloud and AI computing services EU-coordinated procurement and support framework for sovereign cloud and AI computing services PM11 – Creating EU-level harmonised criteria for sovereign cloud and AI computing services PM12 – EU guidelines on the requirements to be fulfilled by sovereign cloud and AI computing services PM13 – Annual conference on EU Digital Sovereignty PM14 – Interoperability flanking measures PM15 – Voluntary sovereign risk assessments for the use of cloud & AI computing services in the public sector PM16 – Voluntary award criteria PM17 – Public sector cloud federation and EU broker PM18 – Vendor-neutral cloud and AI training programme PM19 - Mandatory award criteria PM20 – Open Source use in the public sector PM21 – Mandatory sovereign risk assessments for the use of cloud and AI computing services PM22 – Joint EU-level procurement of cloud and AI PM23 – SME cloud and AI support scheme PM24 – Cloud and AI toolbox PO2-A packages measures which require EU action but without binding effects. PO2 -A can be implemented together with both PO2 -B and PO2 -C. PO2-B represents an increasing level of EU involvement. PO2-C strengthens this further and covers binding measures. PO2 -B and PO2-C are not per se mutually exclusive but some mea sures in PO2 -C represent a different gradient of intervention from similar measures in PO2 -B. Figure 9 illustrates how individual measures from each PO build on each other, making them mutually exclusive. The relationship between the options below and the identified problem drivers is discussed jointly at the end of this section. Policy Option PO2 -A: Supporting measures to increase transparency and visibility of sovereign cloud and AI computing services This policy option aims at establishing a common understanding of the notion of sovereignty for cloud and AI computing services and increasing their visibility on the market. It is complemented by a flanking measure to ensure the participation of European providers in the development of interoperability standards. • Policy Measure 11 (PM11) establishes a harmonised Union -level framework for sovereign cloud and AI computing servi ces. AI systems (which are products and not services) are not concerned by the measure, as they are already subject to the AI Act. Acknowledging that different use cases require varying degrees of ‘sovereignty’, the framework provides for four levels of so vereignty assurance. Services not meeting any of the conditions would not be classified with any sovereignty level but would obviously remain available in the market. To be considered ‘sovereign level 1’, a service must meet the following cumulative criteria: (i) the service provider must be established in the Union; and (ii) the service must be fully operated from computing infrastructure , personnel and assets located in the Union (meaning the EEA); and (iii) customer data, including metadata and telemetry data, is in the EU unless the customer explicitly requires otherwise; and (iv) the service provider demonstrates that it complies with state -of-the-art cybersecurity standards; and (v) if technical and operational support is outsourced to third-party providers outside of the Union, necessary measure are put in place to ensure that would not compromise the provider’s operational autonomy; and 37 (vi) there is full transparencey around the use of subcontractors , for which the clo ud service provider assesses that they meet Union legal obligations; and (vii) where the cloud service provider is subject to the control of a third country or a third country entity, it must be able to prove that the laws and government practices in that country do not require the provider to tell that country's authorities about software vulnerabilities before those vulnerabilities have been publicly discovered These requirements would allow service providers with a parent company headquartered outside of the Union to be considered as ‘sovereign level 1’. To be considered ‘sovereign level 2’, a service must meet the following cumulative criteria: (i) the service provider and subcontractors must be established in the Union; and (ii) the service must be fully operated from computing infrastructure , personnel and assets located in the Union; and (iii) provide available personnel complying with additional personnel screening and Union citizenship requirements , if the customer determines that imposing these additional requirements is necessary; and (iv) the service provider must be controlled by a legal entity in the Union. Alternatively, if the service is controlled by a third -country legal entity, it must demonstrate that it has in place the necessary technical, legal and organisational measures necessary to prevent third-country governmental access and transfer of data stored in the Union , to prevent or refuse any request from a third-country government, ensure that the control of the third -country or third -country entity is not exercised in a manner that restricts the provider’s ability to deliver the service, and to prevent the service disruption and/or degradation of the service by a third-country government92; and (v) the data generated by using the audited service shall not be re-used for the training or fine-tuning of an AI system operated by an entity outside the EEA and in any case are not transferred outside the Union; and (vi) the customer data, including metadata and telemetry data, remain in the Union unless the customer explicitly requests otherwise; and (vii) the service must demonstrate a high level of cybersecurity by being certified at least at level ‘ substantial’ under the European Cybersecurity Certification Scheme for Cloud Services (EUCS) 93; and (viii) the service provider must demonstrate a high degree of control over the software components that underpins the service. This notably implies that there exists a list of identified dependencies related to the provision of the service, and where the software components are provided by a third -country entity, the relevant code of the security relevant components of the service stack can be audited, and there exists a migration plan in the event a vendor fails or a third-country imposes restrictions; and (ix) if the subcontractors are from a third country or a third country entity, appropriate measures in place to demonstrate the absence of control; and 92 In the absence of a harmonised framework, non-EU service providers attempting to prevent third -country governmental access and transfer of data stored in the Union and to prevent or refuse any request from a third-country government are using a diverse technical, legal and organisational measures. This include technical architecture with segregated phy sical infrastructure, ensuring that the encryption keys are not accessible to the provider or are held exclusively by the customer , adding specific clauses in their EU employees’ contract that forbid them from taking instructions from outside of the EU, setting up independent boards to review extra-territorial data access requests, etc. 93 As part of the ‘ One Europe, one market’ roadmap agreed by the Parliament, the Council and the Commission, the co -legislator have agreed to finalise negotiation for this initiative ed by Q4 2027. Adding one year for the measures to take effect, this implies CADA en tering into force in early 2029 . EUCS technical work is finalized and has been adopted by CEN -CENELEC Technical Specifications. The candidate scheme has therefore reached an advanced stage of development, which now needs to be transformed into an Implementing Act adopted under the Cybersecurity Act, a process much shorter than CADA’s interinstitutional negotiations. 38 (x) operational and technical support , including outsourcing, are initiated and performed exclusively within the Union; and (xi) where the cloud service provider is subject to the control of a third country or a third country entity, it must be able to prove that the laws and government practices i n that country do not require the provider to tell that country's authorities about software vulnerabilities before those vulnerabilities have been publicly discovered These requirements would allow service providers controlled by a third -country or third - country entity to be considered as ‘sovereign level 2’ , but on the basis of some organisational efforts. Service providers owned and controlled by a legal entity in the Union would face less difficulties in complying with these criteria. To be considered ‘sovereign level 3’, a service must meet the following cumulative criteria: (i) the service provider and subcontractors must be established in the Union; and (ii) the service must be fully operated from computing infrastructure and assets located in the Union; and (iii) members of the board, executive team and personnel operating the service are Union nationals, located in the Union, and are security cleared where appropriate; and (iv) the service provider must be owned and controlled by a Union legal entity and the subcontractors are not subject to the control of a third country or a third -country entity. A cloud computing service subject to the control of a third country or a legal entity established in a third -country can still be audite d against the audit criteria where the third country has implemented specific safeguards that ensure that there is no risk of unauthorised access to Union data or possible disruption of service quality or continuity; and (v) the data generated by using the audited service shall not be re-used for the training or fine-tuning of an AI system operated by an entity outside the Union and in any case are not transferred outside of the Union, and (vi) the customer data, including metadata and telemetry data, remain in the Union unless the customer explicitly requests otherwise; and (vii) the service must demonstrate a high level of cybersecurity by being certified at least at level ‘ substantial’ under the European Cybersecurity Certification Scheme for Cloud Services (EUCS); and (viii) the service provider must demonstrate a high degree of control over the software components that underpin the service (software stack). This notably implies that there exists a list of identified dependencies related to the provision of the service, an d where the software components are provided by a third -country entity, the relevant code of the security relevant components of the service stack can be audited , and there exists a migration plan in the event a vendor fails or a third -country imposes restrictions; and (ix) operational and technical support, including outsourcing, are initiated and performed exclusively within the Union and by Union citizens, and by third parties that are not subject to the control of a third country or third country entity; and (x) where the cloud service provider is subject to the control of a third country or a third country entity, it must be able to prove that the laws and government practices in that country do not require the provider to tell that country's authorities about software vulnerabilities before those vulnerabilities have been publicly discovered. 39 These requirements would not allow service providers whose parent company is headquartered outside of the Union to be considered as ‘sovereign level 3’. To be considered ‘sovereign level 4’, a service must meet the following cumulative criteria: (i) the service provider, and subcontractors must be established in the Union; and (ii) the service must be fully operated from computing infrastructure and assets located in the Union; and (iii) members of the board, executive team and personnel operating the service are Union nationals, located in the Union, and are security cleared where appropriate; and (iv) the service provider must be owned and controlled by a Union legal entity and the subcontractors involved in the provision of the service are located in the Union , owned and controlled by a Union legal entity; and (v) the data generated by using the audited service shall not be re-used for the training or fine-tuning of an AI system operated by a third-country legal entity and in any case are not transferred outside of the Union; and (vi) the customer data, including metadata and telemetry data, remain exclusively in the Union; and (vii) the service must demonstrate a high level of cybersecurity by being certified at least at level ‘ high’ under the European Cybersecurity Certification Scheme for Cloud Services (EUCS); and (viii) the service provider must demonstrate effective control over the software components that underpin the service (software stack) by demonstrating that a third country or a third country entity does not have excessive control over the software lifecycle. This notably implies that the relevant code of the service stack can be audited and that effective control of the code exists by a Union legal entity; and (ix) operational and technical support, including outsourcing, are initiated and performed exclusively within the Union and by Union citizens, and by third parties that are not subject to the control of a third country or third country entity; and (x) where the clo ud service provider is subject to the control of a third country or a third country entity, it must be able to prove that the laws and government practices in that country do not require the provider to tell that country's authorities about software vulnerabilities before those vulnerabilities have been publicly discovered These requirements would not allow providers headquartered outside of the Union to be considered as ‘sovereign level 4’. These criteria above deal with sovereignty. Cybersecurity and sovereignty are closely related and are complementary. However, they do not focus on the same aspects nor pursue identical objectives. The Commission, through its own tendering for EUR 180 m of sovereign cloud services, was able to test the feasibility of such definitions established in different levels and could verify that it can be implemented. 40 Types of providers whose services could currently reach sovereignty Levels 1-4 Level 1: US hyperscalers generally all have offerings that would allow them to qualify under Level 1. They offer dedicated EU-based cloud services with strong cybersecurity credentials which rely exclusively on (data) ‘regions’ located in the EU, including for redundancy. Level 2: Several US hyperscalers have partnered with EU companies to provide additional sovereignty assurances – these partnerships are often called “sovereign joint ventures”. While the implementation models differ, such partnerships generally rely on majority EU ownership, operation by EU pe rsonnel, data centre region limited to a particular Member State, cloud software stack provided by a hyperscaler, with security layer controlled by the EU partner , auditable core software, with some reaching certification under the SecNumCloud scheme. Non-European companies , outside of joint ventures, could also qualify provided they demonstrate the absence of 3 rd country interference. Level 3: EU providers would easily satisfy the control criteria. They would have to pass the necessary cybersecurity controls to achieve the future EUCS certification at assurance level Substantial or High. The other difficulty would be to demonstrate a ‘very high’ control over the ir software supply chain, something demonstrated in the recently awarded contract by the Commission for sovereign cloud services. Level 4: This level differs from level 3 in stricter cybersecurity certification and full control over the software supply chain , something that some emerging EU offer ings propose, at least for some type of cloud services. 41 • Policy Measure 12 (PM12) foresees the adoption of guidelines on the harmonised EU-level criteria for sovereign cloud and AI computing services defined under PM11 to help implementation. These guidelines would be adopted by the Commission, addressing expectations towards providers and users about what constitutes a sovereign service. • Policy Measure 13 (PM13) addresses information asymmetries through awareness raising for the sovereignty common understanding and other measures. In particular, an annual week-long EU-organised conference on digital sovereignty, bringing together academic institutions, researchers, and overall public and private stakeholders to foster collaboration in cloud a nd AI innovation and the development of sovereign cloud and AI computing services. The EU - organised awareness raising efforts would centralise the currently scattered efforts of private sector entities to enhance the visibility of sovereign services and create a forum for providers to connect with prospective buyers from the private and public sector. • Policy Measure 14 (PM14) sets up measures ensuring the effectiveness of the interoperability provisions of the Data Act : A Commission-led coordination group w ith Member States and industry to drive progress on the development of interoperability standards. This would serve as a preparatory step to the standardisation requests which the Commission can issue under the Data Act. In addition, the measure creates a hook for possible financial support, in the context of the next MFF (but without prejudging the outcome of such negotiations) , for EU industry participation in EU standardisation organisations to ensure that the perspective of smaller European service providers is represented when these organisations work on a standardisation request issued under the Data Act. In response to the CfE, many European companies favoured a harmonised sovereignty criteria at EU level. Public authorities showed strong support for the development of operational sovereignty criteria. Some companies and business associations, especially located outside the EU, stressed that such criteria should not exclude providers merely based on headquarters location. Policy Option PO2 -B: Voluntary framework for advancing sovereign cloud and AI computing services This option contains measures which go beyond defining and making more visible sovereign services. They create a legislative framework for identifying such services, leaving its use voluntary. The measures also target the broader uptake of a more diverse set cloud and AI computing services in the public and private sector. • Policy Measure 15 (PM15) would recommend Member States to carry at least one sovereignty risk assessment and repeat it at least every four years but more frequent if deemed necessary. The purpose of the sovereignty risk assessment is to identify which public sector use cases within a Member Stat e require the use of which sovereignty level as described under PM11. The sovereignty risk assessment would assess, inter alia, the risks induced by the access to such data by a third -country authority or third -country legal entity; or the risk of possible service disruption due to dependence on a single or limited number of third -country services providers. On the basis of dedicated discussions conducted with 3 different public authorities representing about 200 NIS2-Annex 1 contracting authorities, operating at regional, national and European level (out of an estimate of 6 400 NIS2 entities across the EU), this assessment assumes that the matching of sovereignty levels to public sector demand follows the following pattern: 70% of use cases would require a sovereignty level 1; 20% for level 2; 9% for level 3; and 1% for level 4. Even though the scheme is novel and does not correspond to existing frameworks, this assessment fits with broad orders of magnitude that can be inferred from existing analyses 42 conducted in several Member States that have introduced risk assessments for their public sector clouds, such as France, Poland94 or Italy95. This approximation is anchored in the idea that a layered and progressively more demanding criteria is designed to tackl e a progressively smaller amount of use cases. For instance, a water supply public company might have separate IT systems to deal with non -critical use cases, but fewer to manage critical systems. Table 6. Illustrative distribution of criticality of IT systems within a fictitious public sector water company Non-critical use cases (candidate for level 1) Critical use case (candidate for levels 2-4) • Procurement • Stock management • Inventory • Helpdesk • Billing system • Accounting system • CRM • Workforce management: o Payroll o Timesheets o Training o Holidays o Recruitment o … • … • Water monitoring system • Incident response system • Early warning system In concrete terms, France’s SecNumCloud, the closest scheme to this sovereignty framework , was developed acknowledging that there is demand for even higher levels of sovereignty for the most sensitive use cases, estimated at 10% of all public sector use cases (which here correspond to sovereignty level 3 and level 4). Conversely, out of the remaining use cases (90% of all public sector use cases), the scheme was designed to address approximately only ⅕ to ¼ of them (that is approximately 18% to 22.5% of all public sector use cases). While the individual criteria under SecNumCloud are not the sam e, the compound effect of level 2 criteria under CADA allows the same type of providers (having implemented the same type of mitigating measures) to qualify for this level. The proportion of 20% (rounded up mean value of 18% and 22.5%) was therefore retained as a first approximation for the proportion of all public sector use cases where conformity with level 2 would be required. Critical use cases, defined as the use cases whose disruption would affect operational autonomy or public order, correspond to u se cases covered by level 2, 3 and 4, so 30%. The risk assessment would have to consider the reality of the supply market to avoid unrealistic outcomes, such as mandating the use of services that don’t exist (yet) in the market. The measure targets critical use cases, not individual public authorities, but it is likely that Member States would focus on the public sector entities of high criticality (as defined in NIS2 annex 1), which amount to 6 400 throughout the EU, an amount retained in this assessment w here such data point is needed. This figure results from the amount of NIS 2 entities in Europe (160 94 See Cloud in Government Services 95 See Strategia Cloud Italia 43 00096), from which 20% are essential entities under Annex I97, from which 20% are assumed to be public entities: 160 000 * 20% * 20% = 6 400 NIS2 Annex 1 public sector entities. To facilitate appropriate and coherent sovereignty risk assessments, the European Commission would develop guidelines for Member States to conduct such assessments and provide a sample risk assessment methodology (note that these guidelines concern the conduct of risk assessments and differ from PM12 , which consist in explaining the different levels of sovereignty). For Member States to have up-to-date information about the market conditions of cloud and AI sovere ign solutions, the Commission would also produce market monitoring reports that will point Member States to possible gaps in the coverage of some services. The Member State would be recommended to reflect the outcome of the risk assessment in applicable public tenders, unless duly justified. While PM11 only put s forward the definition of sovereignty level s, PM15 goes further by putting forward a framework through which the respective levels of sovereignty can be assessed. Verifying compliance against sovereignty level 1 would be based on self -assessments conducted by the service provider. Cloud computing service providers qualifying as SMEs would not be required to undergo the validation by the national competent authority. Verifying compliance of service against sovereignty level 2 -3-4 would be done through third party’s auditors and verified by national competent authorities designated by Member States .. The competent authorities will then verify the audit report, opinion and evidence and will provide the decision that would allow the service provider to participate in procurement procedure s across the Union that are limited to the respective assurance level. Other Member States shall be notified of the draft decision, to which they can object w ithin 60 days. If continued objections occur, the Commission will adopt a binding decision. The competent authorities should also register the audit approval in a Union repository , maintained by the Commission . The repository of sovereign cloud and AI computing services will be a public list of audited sovereign cloud and AI computing services that verifiably comply with the sovereignty requirements. The benefits are for providers and users alike : providers will enhance their visibility and users their market research. To cater for market evolutions, the sovereignty criteria of all levels and evaluation methodology would be modifiable by comitology. This evaluation methodology would help third party auditors in their assessment of the service and ensure full harmonisation in the way different auditors conduct their assessment and for Member States to ensure that the procedures have been followed. The outcome of the audit would be valid across the Union, with a r ecourse possibility for providers and Member States. Other Member States and the European Commission shall also have the possibility to request clarifications about certifications granted by other MS. The assessment would be renewable following the same evaluation methodology. This measure is primarily designed to contribute to the protection of public order by enhancing the resilience in the public sector, which is SO4. Nevertheless, European provide rs would face less costs and efforts to meet sovereignty conditions. W hen it comes to meeting the criteria to 96 See SWD published as part of the proposal for the Digital Omnibus 97 This is an extrapolation to the EU of France's NIS2 available data 44 demonstrate sovereignty level 1 and 2, EU providers can more readily substantiate that they are not affected by third -country policies affecting d ata access or limiting service continuity. As well, level 3 and level 4 sovereignty can only be served by service providers owned and controlled by EU entities. This implies that PM 15 will also contribute to decreasing the overall reliance on non-European cloud and AI computing services, which is SO3. • Policy Measure 16 (PM16), with a view to support the EU added value provided by public procurement of cloud and AI computing services , this measure establishes a set of voluntary non-price award criteria for the public procurement of cloud and AI computing services. The criteria should be of ancillary and non-decisive value in view of the overall tender and are to be included, voluntarily, by contracting authorities in the procurement of cloud and AI comp uting services that are not off the shelf, standardised or commercially available services . These criteria will earn additional points to tenderers that demonstrate: (i) That the tenderer contributes to reinforcing the digital technology supply chain in the Union, including the use of software or hardware designed or manufactured in the Union (ii) That the tenderer has integrated Union technologies, including the uptake of research and development results stemming from EU -funded research and development programs; (iii) That the innovation required to deliver the service being procured is conducted in the Union or in a third country that contributes to the development of a European cloud and AI ecosystem; (iv) That the service is delivered, to the greatest extent feasible with regard to market availability or technical requirements, through critical [computing, storage and networking] hardware components designed in the Union or manufactured in the Union, or both, or, where this is not feasible, through hardware components from a country or countries that contribute to strengthening security of supply and developing a European cloud and AI ecosystem; • Policy Measure 17 (PM17) establishes a voluntary public sector cloud federation of EU institutions, bodies and agencies, Member S tates and other public sector bodies. Members of the federation would be allowed to share the DC services, cloud and AI computing services which they own and control. This measure requires the Commission to create a platform providing a brokering service. The Commission and the Member States would adopt the required non-functional service level agreements (e.g. uptime) and the harmonised technical specifications. • Policy Measure 18 (PM18) creates a vendor -neutral cloud and AI training programme to upskill workers in the single market, particularly addressing the interconnection between these services and their underlying technologies . This implies developing curricula and certification mechanism and funding the institutions delivering the training. The initia tive would be declarative, without financial commitments. Among public authorities that replied to the public consultations, 77% support mechanisms to allow the federation of cloud and AI computing services between public administrations within and across Member States. In terms of EU -level action, 53% of total respondents support the inclusion of a criterion ensuring sovereignty, autonomy, resilience and availability to help public administrations in their procurement process. This measure was supported by 77% of public authorities. 85% were in favour of guidelines with standard criteria for procuring cloud and AI computing services. Several respondents expressed support for skills training programs in both the public and private sectors. 45 Policy Option PO2-C: EU-coordinated procurement and support framework for sovereign cloud and AI computing services This option leverages PO2-B (and by extension one element from PO2 -A, see Figure 9) to foster the uptake of cloud and AI computing services in the public and private sector, with a higher level of EU intervention and mandatory requirements for the public sector. • Policy Measure 19 (PM19): First, with a view to reducing critical dependencies, this measure makes the use of the non -price award criteria under PM16 mandatory. When procuring cloud and AI computing services for which the EU has been assessed as dependent, contracting authorities would be obliged to apply the award criteria established under PM16. Second, Member States would have to draft an action plan to explain how they intend to use public procurement, notably through pre -commercial procurement and procurement of innovation instruments, to increase t he uptake of highly innovative cloud and AI computing services from small-cap companies, notably start-ups and scale-ups. As a follow-up, the uptake of such services, would be monitored through a centralised, Commission -led monitoring exercise. This would avoid the need for separate reporting obligations and create synergies with other measures within this Policy Option that are aimed at assessing the market presence of EU providers (cf. PM21). PM19 will contribute to decreasing the overall reliance on non -European cloud and AI computing services, which is SO3. • Policy Measure 20 ( PM20) aims to encourage the share and, reuse of open source assets by the public sector. Under this measure, public authorities are encouraged to promote the use of open standards and available open source solutions where these demonstrate comparative merit to proprietary solutions and reuse digital assets, including code, configurations, and documentation, developed by other public administrations rather than comm issioning similar solutions from scratch, thereby eliminating duplication of efforts and redundant expenditure on functionally similar solutions; and to share software into a common repository, ensuring that investments made by public administrations in th e EU contributes to a pool of collectively maintained sovereign solutions. Therefore, first, this policy measure requires Member States to take the necessary measures to encourage the use of open standards and open source software by public sector organi sations taking into consideration aspects such as functionalities, total cost , user -centricity, cybersecurity or other relevant justified objective criteria. Second, public organisations will have to consider making the software for which they hold rights publicly available on an open source repositor y connected to the EU OSS catalogue maintained by the Commission. The released software should put in place the appropriate safeguards to protect security or intellectua l property rights. To ensure the quality and security of publicly released code, open source repositories will have clear governance and operational mechanisms, such as quality assurance (e.g. DevOps) and the continuous assessment of the cybersecurity post ure of the components (e.g. static and dynamic security testing) complemented by a Software Bill of Materials. The release of software as open source shall not be made in the case in which the cost of doing it would be disproportionate, there is a risk to the security of information systems of the Union or there is public order restriction. Third, this measure includes the creation and maintenance of Open Source Programme Offices (OSPOs) within the public sector to support the implementation and management of open source software. To facilitate the cooperation among these OSPOs, the Commission will establish a Network of OSPOs. • Policy Measure 21 ( PM21) consists of two elements. First, it turns what is only a Recommendation under policy measure 15 into a binding requirement for Member States. 46 Member States shall carry at least one sovereignty risk assessment and repeat it at least every four years but more frequent if deemed necessary. The purpose of the sovereignty risk assessment is to identify which public sector use cases within a Member State require the use of which sovereignty level as described under PM11. The sovereignty risk assessment would assess, inter alia, the risks induced by the access to such data by a third-country authority or third-country legal entity; or the risk of possible service disruption due to dependence on a single or limited number of third -country services providers . On the basis of dedicated discussions conducted with 3 different public a uthorities representing about 200 contracting authorities, this assessment is based on the finding that the matching of sovereignty levels to public sector demand follows the following pattern: 70% of use cases would require a sovereignty level 1; 20% for level 2; 9% for level 3; and 1% for level 4. Even though the scheme is novel and does not correspond to existing frameworks, this assessment fits with broad orders of magnitude that can be inferred from existing analyses conducted in several Member States that have introduced risk assessments for their public sector clouds, such as France, Poland98 or Italy99. This approximation is anchored in the idea that a layered and progressively more demanding criteria is designed to tackle a progressively smaller amo unt of use cases. For instance, a water supply public company might have separate IT systems to deal with non-critical use cases (e.g. procurement, stock management, inventory, helpdesk, billing system, workforce management, fleet management, etc), but few er to manage critical systems (e.g. water monitoring system). For instance, France’s SecNumCloud, the closest scheme to this sovereignty framework was developed acknowledging that there’s demand for even higher levels of sovereignty, estimated at 10% (which here correspond to level 3 and level 4) , and that for the remaining 90%, SecNumCloud was designed to cover 1/5 to 1/ 4 of the use cases, so somewhere in between 90% * 1/5 = 18 % and 90% * 1/ 4 = 22.5%. While the criteria for SecNumCloud and level 2 differ, this figure is nevertheless retained as a first approximation. Critical use cases, defined as the use cases whose disruption would affect operational autonomy or public order, correspond to use cases covered by level 2, 3 and 4. The risk assessment would have to consider the reality of the supply market to avoid unrealistic outcomes, such as mandating the use of services that don’t exist (yet) in the market. The measure targets critical use cases, not individual public authorities, but it is likely tha t Member States would focus on the public sector entities of high criticality (as defined in NIS2 annex 1), which amount to 6 400 throughout the EU, an amount retained in this assessment where such data point is needed. This figure results from the amount of NIS 2 entities in Europe (160 000100), from which 20% are essential entities under Annex I 101, from which 20% are assumed to be public entities: 160 000 * 20% * 20% = 6 400 NIS2 Annex 1 public sector entities. To facilitate appropriate and coherent sovereignty risk assessments, the European Commission would develop guidelines for Member States to conduct such assessments and provide a sample risk assessment methodology (note that these guidelines concern the conduct of risk assessments and d iffer from PM12, which consist in explaining the different levels of sovereignty). For Member States to have up-to-date information about the market conditions of cloud and AI sovereign solutions, the Commission would also produce market monitoring reports that will point Member States to possible gaps in the coverage of some services. 98 See Cloud in Government Services 99 See Strategia Cloud Italia 100 See SWD published as part of the proposal for the Digital Omnibus 101 This is an extrapolation to the EU of France's NIS2 available data 47 The Member States would have to determine which public authorities are required to procure specific levels of sovereignty and make this mandatory at national level, ensuring that procurement aligns with the risk assessment, unless duly justified. While PM11 only puts forward the definition of sovereignty levels, PM15 goes further by putting forward a framework through which the respective levels of sovereignty can be assessed. Cloud computing service providers qualifying as SMEs would not be required to undergo the validation by the national competent authority . Verifying compliance against sovereignty level 1 would be based on self -assessments conducted by the service provi der itself, while assessing the compliance of the service against sovereignty level s 2-3-4 would be performed through independent third party’s auditors and verified by national competent authorities designated by the Member States . The competent authorities will then verify the evidence pr ovided by the service providers, the audit report and opinion and will provide a decision: acce ptance, rejection or request for further information. If positive, the competent authority of the establishment of the service provider shall notify other MS for objections, which the evaluating competent authority will have to take into consideration for the final decision. This decision will allow the service provider to participate in procurement procedures across the Union. In the case of continued objections, the Commission will assess it and adopt a binding decision to settle the dispute. If the evaluating competent authority determines that there is not enough information to take a decision, it shall request the provider for additional information. Finally, in the case of a rejection, the cloud service provider will have the possibility to recourse, which the evaluating competent authority will have to ta ke into account for the final decision. Competent authorities should also register the audit approval in a Union repository, maintained by the Commission, as well as on the Digital Wallet of the service provider . The repository of sovereign cloud and AI computing services will be a public list of audited sovereign cloud and AI computing services t hat verifiably comply with the sovereignty requirements. The benefits are for providers and users alike : providers will enhance their visibility and users their market research. To cater for market evolutions, the sovereignty criteria of all levels and evaluation methodology would be modifiable by comitology. This evaluation methodology would help third party auditors in their assessment of the service and ensure full harmonisation in the way different auditors conduct their assessment and for Member States to ensure that the procedures have been followed. This measure is primarily designed to contribute to the protection of public order by enhancing the resilience in the public sector, which is SO4. Nevertheless, European providers wo uld face less costs and efforts to meet sovereignty conditions. When it comes to meeting the criteria to demonstrate sovereignty level 1 and 2, EU providers can more readily substantiate that they are not affected by third -country policies affecting data a ccess or limiting service continuity. As well, level 3 and level 4 sovereignty can only be served by service providers owned and controlled by EU entities. This implies that PM21 will also contribute to decreasing the overall reliance on non-European cloud and AI computing services, which is SO3. Second, private sector essential entities listed under Annex I of NIS 2 are encouraged to integrate into the cybersecurity risk assessment they already conduct, the assessment of the 48 risks stemming from their use of cloud and AI computing services. This includes an analysis of the laws applicable to the computing service and the extraterritorial reach of such laws; the risks associated to the possible unauthorised third country government access to and transfer of data; the risks associated to service continuity and quality; the operational dependency and possible loss of autonomy. • Policy Measure 22 ( PM22) establishes a voluntary framework for EU -level public procurement of cloud and AI computing service s for EU institutions, bodies and agencies, and Member States public sector organisations. The intention of the joint procurement framework is to enable participants to procure with a common voice. The joint procurement framework would complement Member St ates’ existing procurement practices. This measure is about creating a framework enabling joint procurement, but the participating contracting authorities are left with the power to decide the details of what they ultimately want to procure. This measure builds on the common platform under PM17. It will allow aggregation of demand for innovative solutions, allowing the EU to do what the US has done with a lot of success in the past, i.e. award large contracts which support early innovation and uptake (see P D1) and mitigate the lack of stable contracts holding European providers back from scaling up (see PD3). • Policy Measure 23 (PM23) creates a support scheme for SMEs to support through consultancy the adoption of cloud and AI computing services by SMEs , including European CSPs . While technically independent, this measure presents synergies with PM18. As with other measures that imply funding, this does not pre-empt the next MFF. • Policy Measure 24 (PM24) would imply that the Commission sets up an online toolbox for the private sector service providers to easily identify software tools, in particular open source ones, with the specific aim to help them in complementing their service offering. This toolbox would create visibility for lesser known tools and serve as a final repository for the outcome of projects funded by European programmes. Overall, all the categories of respondents showed strong support for measures that would promote open source, including to achieve sovereignty. Most EU citizens, public authorities and academic institutions would favour an obligation to release the code developed with public money in open source repositories, as well as a common EU open source licensing schema. Public auth orities showed strong support for a marketplace for cloud and AI computing services. In terms of EU - level action to prevent unlawful access to data, several public authorities favoured common criteria to help them during the procurement process to identify highly critical use cases. Several companies also supported this. Over 60 position papers received through the CfE stressed the importance of public procurement, including joint procurement and the strategic role the public sector could play as an anchor client. Figure 9. Illustrations of Policy Options to address the dependence on cloud and AI computing services supplied by non-European providers 49 In relation to the identified problem drivers, the above -mentioned measures are expected to intervene as follows: PM11 & PM12 would allow users of cloud and AI computing services to reliably identify the level of sovereignty of a service . PM15 and PM21 add a sovereignty risk assessment for the public sector to identify its sovereignty needs . These measures directly address PD4 (absence of clarity around the co ncept of sovereign cloud and AI computing services), with growing degrees of intensity. As European providers of cloud and AI computing services can be considered to be in a good starting position for meeting the benchmark of sovereignty, and because of th e public sector’s particular interest in relying on sovereign services, these measures also address PD3 (limited public sector uptake of cloud and AI computing services supplied by European providers) – with PM19 and PM21 being the most direct. PD3 refers in particular to the lack of stable contracts for European CSPs, which would be mitigated through PM15 and, more directly, through PM21 and PM 19. PM13, PM18, PM23 and PM24 enhance the visibility and usability of services provided by a more diverse set of cloud and AI computing service providers, including European ones. They make it more likely for users, including the public sector, to choose these solutions (meaning a contribution to tackling PD3) and contribute to addressing the factors summarised under PD1 (lack of scale and scope of EU cloud service providers). PM14 contributes to interoperability, thus addressing PD1 (enhanced interoperability is a way of arriving at more integrated service offerings and lower the threshold for users to combine multiple offerings from European providers). PM16 and PM19, allows for the recognition of an EU -added value in public procurement and PM1 5 and PM21 will shed light on sovereignty vulnerabilities in the public sector, likely to result in a growing turn towards sovereign, including European services and thus addressing PD1 (more public contracts can be expected to help European providers grow the scale and scope of their service offer). PM17 and PM22 will boost public sector uptake, including to the benefit of European providers. They can thus be seen as addressing PD3. PM22 would allow aggregation of demand for innovative solutions, allowing the EU to do what the US has done with a lot of success in the past, i.e. award large contracts which support early innovation and uptake (see PD1). PM20 boosts the public sector’s use of/contribution to open source, creating opportunities for smaller players, because op en source allows for a faster development of new solutions and allows new ideas to challenge existing market silos. It thus contributes to both PD3 and PD1. PM24 addresses the information imbalance currently affecting the cloud market by allowing for better visibility of smaller providers and comparability across provider ecosystems. 50 5.2.3. Relationship between policy options and policy measures Table 7. Overview of the Policy Options and links with the Problems, Problem Drivers, and Specific Objectives Problem driver(s) Problem Policy Option Policy Measures Specific objectives* PD1 PD2 SO1 SO2 ✓ P1: Limited and geographically concentrated availability of computing capacity in the EU 1A: Enhancing the existing collaborative framework PM1: Expanding the Alliance for Industrial Data, Edge and Cloud with a workgroup on data centres and extending membership to relevant players ✓ ✓ ✓ PM2: Creating a forum for exchanges between relevant public and private stakeholders involved in the buildout of data centres ✓ ✓ ✓ PM3: Adopting guidelines on building sustainable data centres in the EU ✓ ✓ ✓ ✓ 1B: Legislative and financial intervention enforced nationally PM4: National facilitator for data centre projects ✓ ✓ ✓ PM5: Mechanism for Member States to identify areas for fast -track data centre deployment ✓ ✓ ✓ ✓ PM6: Possibility for public support for data centres ✓ ✓ ✓ PM7: Set deployment targets and monitor progress ✓ ✓ ✓ 1C: Legislative and financial intervention enforced at EU level PM8: EU R&D funding ✓ ✓ ✓ PM9: EU deployment funding for strategic projects ✓ ✓ ✓ ✓ PM10: EU-level identification of areas for fast-track data centre deployment ✓ ✓ * SO1: Increase computing capacity deployed in the EU through innovative and sustainable technologies SO2: Ensure attractive conditions for the deployment of sustainable and innovative computing capacity PD1: Lack of scale and scope of European cloud and AI computing service providers PD2: Bottlenecks slowing down data centre expansion 51 Problem driver(s) Problem Policy Option Policy Measures Specific objectives* PD1 PD3 PD4 SO3 SO4 ✓ P2: Dependence on cloud and AI computing services supplied by non-European providers 2A: measures to increase transparency and visibility of sovereign cloud and AI computing services PM11: Creating an EU -level harmonized criteria for sovereign cloud and AI computing services ✓ ✓ ✓ PM12: EU guidelines on the requirements to be fulfilled by sovereign cloud and AI computing service providers ✓ ✓ ✓ ✓ PM13: Awareness raising on EU digital sovereignty ✓ ✓ ✓ PM14: Measures for effective interoperability of cloud and AI computing services ✓ ✓ ✓ ✓ 2B: V oluntary framework for advancing sovereign cloud and AI computing services PM15: V oluntary sovereign risk assessments for the use of cloud and AI computing services in the public sector ✓ ✓ ✓ ✓ PM16: V oluntary award criteria rewarding a European added value ✓ ✓ ✓ PM17: Public sector cloud federation and EU broker ✓ ✓ ✓ PM18: Creating vendor-neutral cloud and AI training ✓ ✓ ✓ 2C: EU- coordinated procurement and support framework for sovereign cloud and AI computing services PM19: Mandatory specific award criteria for the procurement of cloud and AI computing services ✓ ✓ ✓ PM20: Boosting open source use in and by public administrations ✓ ✓ ✓ ✓ ✓ PM21: Mandatory sovereignty risk assessment for the procurement of cloud and AI computing services ✓ ✓ ✓ ✓ PM22: Joint EU-level public procurement of cloud and AI computing services ✓ ✓ ✓ PM23: SME cloud and AI support scheme ✓ ✓ PM24: Cloud and AI toolbox ✓ *SO3: Decrease the overall reliance on non-European cloud and AI computing service providers SO4: Contribute to the protection of public order by enhancing the resilience of supply of cloud and AI computing services, in particular in the public sector PD1: Lack of scale and scope of European cloud and AI computing service providers PD3: Limited public sector uptake of cloud and AI computing services supplied by European providers 52 PD4: Absence of clarity around the concept of sovereign cloud and AI computing services 5.2.4. Relationship between Problem Drivers and Policy Measures Table 8. Aspects of the Problem Drivers addressed by the Policy Measures PD1: Lack of scale and scope of EU CSPs PD2: Bottlenecks slowing down data centre expansion PD3: Limited public sector uptake of cloud and AI computing servic es supplied by European providers and diverging procurement practices PD4: Absence of clarity around the concept of sovereign cloud and AI computing services PM1 - Cloud Alliance expansion Improved networking between colocation operators and European CSPs PM2 - Data Centre Forum Identification of suitable land; improved administrative awareness for individual DC projects; improved awareness for electricity grid needs PM3 - Data Centre guidelines Easier access to best practices by smaller scale operators Identification of suitable land; best practices on fast deployment PM4 - National facilitator Being accompanied through administrative processes is of particular benefit to smaller, including European, CSPs Acceleration of administrative processes; making regulatory environment easier to navigate PM5 - Fast-track areas Smaller scale operators stand to benefit proportionally more from accelerated administrative processes Identification of suitable land; acceleration of administrative processes; making regulatory environment easier to navigate PM6 - National funding support Lowering the infrastructure entry barrier Access to capital PM7 - Deployment targets Recognition of strategic importance PM8 - EU R&D funding Lowering the infrastructure/innovation entry barrier Access to capital 53 PD1: Lack of scale and scope of EU CSPs PD2: Bottlenecks slowing down data centre expansion PD3: Limited public sector uptake of cloud and AI computing servic es supplied by European providers and diverging procurement practices PD4: Absence of clarity around the concept of sovereign cloud and AI computing services PM9 - EU deployment funding for strategic projects Lowering the infrastructure entry barrier Access to capital PM10 - EU-level fast-track Smaller scale operators stand to benefit proportionally more from accelerated administrative processes Identification of suitable land; acceleration of administrative processes; making regulatory environment easier to navigate PM11 - EU-level harmonized criteria for sovereign cloud and AI computing services Improved identification of sovereign services PM12 – EU guidelines on requirements to be fulfilled by sovereign cloud and AI computing services Improved identification of sovereign services PM13 – Awareness raising on EU Digital Sovereignty Enhanced visibility and drive uptake of sovereign, including European, CSPs Improved identification and visibility of sovereign services PM14 – Interoperability flanking measures Improved opportunities for building integrated offers PM15 – Voluntary sovereign risk assessments for the use of cloud and AI computing services in the public sector Improved commercial opportunities for providers of sovereign services, including Europeans Recommended uptake of sovereign services, including those provided by European CSPs, for highly critical use cases Improved identification and visibility of sovereign services PM16 – Voluntary award criteria Improved commercial opportunities for providers from the EU (and countries with which the EU has no dependency) Facilitated access to EU providers (and from countries with which the EU has no dependency) PM17 – Public sector cloud Boosts uptake 54 PD1: Lack of scale and scope of EU CSPs PD2: Bottlenecks slowing down data centre expansion PD3: Limited public sector uptake of cloud and AI computing servic es supplied by European providers and diverging procurement practices PD4: Absence of clarity around the concept of sovereign cloud and AI computing services federation and EU broker PM18 – Vendor-neutral cloud and AI training programme Increased likelihood of uptake of services provided by smaller CSPs Upskilled workforce increases likelihood of switching PM19 – Mandatory award criteria Improved commercial opportunities for providers from the EU and countries with which the EU has no dependency Facilitated access to EU providers (and from countries with which the EU has no dependency) PM20 – Open Source use in the public sector Creates opportunities for smaller providers Boosts uptake PM21 – Mandatory sovereign risk assessments for the use of cloud and AI computing services Improved commercial opportunities for providers of sovereign services, including Europeans Mandatory uptake of sovereign services, including those provided by European CSPs Improved identification and visibility of sovereign services PM22 – Joint EU -level procurement of cloud and AI Enhanced possibilities for large contracts supporting early innovation and uptake Boosts uptake PM23 – SME cloud and AI support scheme Enhanced commercial opportunities for SME providers, including Europeans PM24 – Cloud and AI toolbox Enhanced visibility and comparability, including for European providers 55 5.3. Options discarded at an early stage • Mandating the digitalisation of permitting processes for DCs throughout the EU. While the Inter-institutional Better Regulation encourages to consider the digitalisation of processes when defining policies, digitalising the permitting process is intuitively perceived as something better tackled in a horizontal meas ure covering the whole spectrum of industrial installations rather than through a sectoral basis. • Introducing measures on tackling the lack of grid capacity: As the issue with the lack of available grids capacity in certain locations is not unique to DCs, and grid access is regulated by energy legislation, option introducing sector specific measures to tackle lack of grid capacity was discarded. Ensuring grids will be in place and ready to uptake future loads is dealt by on a horizontal level under the European Grids package. • Options to directly improve the availability of private capital have been discarded. First, because the policy measures under PO1 -A/B/C, by simplifying and accelerating the deployment of DCs, are already conducive to an improved investment landscape. • Creation of a national central and public repository where Member States can include all relevant information on areas designated for DC deployment. This option is discarded as it would favour real estate speculation and overall bring little benefit for DC investors. • Common Procurement Vocabulary (CPV) i.e. standardised tender vocabulary at EU -level for procuring cloud and AI computing services for a more precise monitoring of public sector capacity and demand. The existing CPV codes do not include a specific entry for cloud and AI computing services and are instead classified as ICT services or ICT infrastructure. This option is discarded as adding such a code would require a full re -think of the codes related to the procurement of ICT in general, something that is beyond the scope of this intervention. • The set up of an agency to implement several of the PMs laid d own in this assessment, such as the operating the coordination hub from PM5, operating the broker from PM17, conducting the procurements from PM22 or running the marketplace from PM24. This option was discarded at an early stage as perceived as institutionally difficult to deliver. • In the context of PM15/21, reverse the logic of the sovereignty framework where it would fall on contracting authorities to trigger sovereignty audits in the context of public tenders and only if a similar service is not already audited (as currently the case under FedRAMP). This option has been discarded as it would limit the number of services under levels 2, 3 or 4 , at least initially , and create an artificial barrier for providers to have their services assessed against the sovereignty framework. It also delays procurement procedures where a new service needs to go through the whole evaluation process. 5.4. Possible combination of options As discussed above, the first set of PMs are grouped by their regulatory nature and governance level, i.e. non -regulatory vs regulatory and national vs EU action. PO1-A focuses only on soft, non-regulatory instruments, whereas PO1-B and PO1-C are of a regulatory nature, enforced at national and EU level respectively. As such, some combinations of m easures are mutually exclusive, e.g. PM4 and PM5 (national regulation under PO1 -B) cannot coexist with PM10 (EU - level regulation under PO1 -C) as they address at different levels the bottlenecks to expand DC capacity in the EU. However, other measures under PO1-B and PO1-C can be complementary, for example potential public support for DCs (PM6) could align with EU -level instruments, such as those under PM8 and PM9, creating a multi -level financing framework to addresses a critical dependency from the EU . Similarly, all or selected elements of PO1 -A (e.g. guidelines, forum) could be combined with either PO1 -B or PO1 -C to enhance regulatory action with soft support. 56 The deployment targets to monitor the expansion of capacity in the EU under PM7 could also be adopted independently of PO1 -B, either in combination with PO1 -A, PO1-C or in the context of the forthcoming review of the Digital Decade Policy Programme. By contrast, PO2-A/B/C follow a deliberately incremental approach to intervention along sovereignty and federation of public resources (see section 5 and annex 4 for details). The related PMs are not designed to be combined with one another, but rather reflect the degree of intervention, with the higher levels of intervention building on the mechanis ms established in the preceding one. As best visualised in the graph at the end of section 5.2.2, PM15 builds on PM11; in turn, PM21 builds on PM15 . PM19 builds on PM16. Similarly, PM22 builds on PM17. Finally, PM23 has clear synergies with PM18. The remai ning PMs, i.e. PM12, PM13 and PM14 under PO2-A are stand-alone measures that could be retained independently 6. WHAT ARE THE IMPACTS OF THE POLICY OPTIONS? This section summarises the main expected economic, social and environmental impacts of each Policy Opt ion (PO) compared to the baseline. The assessment draws on multiple data sources, including stakeholder consultations (interviews and surveys) and desk resear ch in the context of the supporting study. To the extent possible, the impacts are quantified base d on available assessments or modelling. Where dedicated modelling /monetisation was not possible due to the lack of data, a qualitative assessment was performed , drawing on existing studies and input from stakeholders, to ensure transparency on the full range of potential effects. A sensitivity analysis is provided in section 7.5 to indicate the potential range of error and uncertainty for selected key estimates. Where central values were not sufficiently informative, or relied on an excessive number of assumptions, illustrative ranges are provided to inform of the expected consequences and impacts of the proposed measures. Annexes 3 , 4 and 12 provide further details on the methodological approach, detailed tables and estimates. In addition, it is worth mentioning that th is assessment found practical experience in the public procurement for sovereign cloud services conducted by the E uropean Commission . The tender was launched in October 2025, as part of Commission’s efforts to strengthen the digital sovereignty posture of the European Union Interinstitutional Bodies and Agencies . Even though they exist in different contexts, the sovereign non price award criteria used in the tender has some resemblance to the proposed sovereignty framework in PM15/PM21102. 6.1. Economic impact This section describes first the expected direct, quantifiable economic impact of the policy options on key identified stakeholders, i.e. industry, including SMEs, public authorities, and the European Commission. As part of the analysis, an assessment of wider economic effects is then provided , including impacts on in novation and technological sovereignty . This impact is assessed mainly based on literature, desk research and stakeholder evidence. 6.1.1. Impact on industry, including SMEs and private sector essential entities The impact of the policy options on industry was assessed based on the quantifiable expected costs and benefits for key business stakeholders. First, improving the availability of computing capacity in PO1-A, PO1-B, PO1-C, directly impacts DC operators and other enterprises building DCs. Second, reducing the dependence on cloud and AI computing services provided by non -EU 102 In the Commission tender, the non -price award criteria included a number of ‘sovereignty’ criteria against which tenders were scored by the evaluation committee. In PM15 and PM21, the harmonised sovereignty criteria are assessed by a third party auditor and subsequently verified by a public authority. This leads the service to obtaining a label which is necessary to participate to call for tenders where the contracting authority does not need to look again into the sovereignty aspects of the service (but can still request information). 57 cloud and AI service providers in PO2-A, PO2-B, PO2-C, is expected to have a direct impact on cloud and AI computing service provider s, on the public sector and on private sector essential entities in accordance to Annex I of NIS2 . This section outlines the quantifiable and expected direct costs and benefits for these stakeholders in present value over the next 10 years, while section 6.1.5 presents the anticipated wider economic effects that the proposed measures could have. The detailed explanations for the assumptions behind these estimates can be found in Annex 4, sections 2 and 3103. Adjustment and administrative c osts for data centre operators . PO1-A would only foresee adjustment costs for DC operators’ stemming from their participation in the new Alliance Working Group (PM1), forum for exchanges (PM2) and from their potential uptake and discussion of the guidelines on building sustainable DCs (PM3). These costs have been estimated as ranging between EUR 8-18 m. Under PO1-B, 400 estimated DC operators and CSPs active in building data centres are expected to face one -off administrative costs to comply with the conditions to access fast -track areas (PM5) , i.e. preparing the application file, completing standardised templates and submitting evidence of compliance with areas conditions. The total costs for this activity are estimated between EUR 1-3 m at present value over 10-years. Operators are also expected to face adjustment costs to adapt new projects for DC build out and comply with the related requirements. These adjustment costs are estimated to be approximately between EUR 6 and 26 m for these stakeholders over the assessment period. The participation in a potential funding scheme under PM6 would also generate administrative costs to account for the staff time spent on preparing applications to benefit from funding. Under PM7, businesses would face minor administrative costs to respond to surveys and/or provide additional information for reporting on DC capacity. Total costs under this option for data centre operators are thus estimated between EUR 7 and 31 m. Under PO1-C, similar activities would occur at EU level . C ompanies participating in EU funding programmes (PM8, PM9) would face administrative costs for preparing and managing proposals . 20 proposals every two years have been estimated for such purposes, leading to costs ranging between EUR 1 and 3 m. As in PO1-B, providers would also be expected to face both administrative and adjustment costs to access the areas and benefit from accelerated DC deployment under PM10. These costs have been estimated to range between EUR 5 and 25 m, catering for some uncertainty in the effort dedicated to such administrative and adjustment activities. The total value of costs for DC operators and CSPs active in building data centres are thus estimated to range between EUR 7 and 27 m under this option (discounted values over the 10-year assessment period). Adjustment and administrative costs for cloud and AI computing service providers . Under PO2- A, cloud and AI computing service providers would face adjustment costs, estimated as additional effort to discuss the new guidelines (PM12), participating to the annual conference (PM13) and in setting up and participating to the coordination group for standard s development (PM14). These activities are expected to generate total costs for providers ranging between EUR 16 and 19 m. Most of these costs would derive from PM13, where 300 participants have been accounted for. Under PO2-B, recurrent adjustment costs for providers would emerge mainly from complying voluntarily with the sovereignty risk assessment framework (PM15). These are estimated at service level because the audit procedure would apply to individual cloud and AI computing services, i.e. providers incur costs for each service that undergoes an a udit. These costs emerge 103 For readability purposes, direct administrative and adjustment costs and corresponding direct savings or economic benefits ar e merged, in the following sections but are further detailed in Annex 4 and broken down by cost type (one -off or recurrent). The policy options are assumed to be implemented from 2027 onwards, with the quantitative assessment covering the 2027-2036 period for the EU and all figures expressed in real 2025 euros. 58 from the one-off effort required to meet the neces sary legal, organisational and technical conditions to reach the sovereignty assurance levels 2 -4, undergo third-party audit, and pay audit and renewal fees. Recurrent audit-related administrative costs are also expected in subsequent years. Moreover, EU-based cloud and AI computing service p roviders are expected to incur one - off adjustment costs to comply with the non-price award criteria (PM16), e.g. rewarding EU-based R&D&I for innovative services, by altering their systems and processes to be able to participate in public procurement procedures. Additional administrative costs have been estimated as providers prepare their bids. Summing these costs leads to total costs ranging from EUR 67 m to EUR 160 m. Under PO2-C, the measures are estimated to generate similar administrative and adjustment costs for providers as PO2-B, but more services (600 compared to 150 in PO2 -B) are expected to undergo third-party audits to participate in public procurement procedures (PM21). This leads to higher costs for cloud and AI service providers across the EU that are estimated to range between EUR 233 and EUR 484 m. As above, these adjustment costs are personnel related, i.e. the effort needed to modify the providers’ policies and procedures and adjust the legal and organisational safeguards to be able to meet the criteria under sovereignty assurance levels 2-4. On top of this , private sector essential entities identified under Annex 1 of NIS2 would have to incur administrative costs to include non -technical risks in their risk assessments , i.e. adding sovereignty elements on their existing risk assessment activities. These costs could range between EUR 486 m and 2.6 bn, i.e. corresponding to the effort required per entity (from a minimum of 20 to a maximum of 110 days) and taking into account 25 600 private entities operating in sectors of high criticality across the EU. Focus box #1: costs for service providers to develop sovereign services Assessing the cost and benefits for providers to provide sovereign services is a complex task that involves many parameters and differs greatly from provider to provider. As well, in the absence of an established market for sovereign services, data sources are rather anchore d in providers’ business plans, not in ex post analysis of established businesses. Such data is confidential to companies, and the below considerations are based on targeted discussions with stakeholders that requested to remain anonymous. A first consider ation is that the consulted companies unanimously indicated that, in developing the business plan for these new services, they count on new large critical use cases that are today not in the cloud ; in other words, they see sovereign services to generate a new source of income, but not to substitute existing. Cost wise, new costs notably include the amortisation of all one-off adjustment costs such as the additional cost induced by using EU-located infrastructure, the additional compliance costs induced by the audits, the additional costs of being certified under EUCS ; and proper recurrent costs such as the higher salaries of employing EU workforce. As an illustration, speaking under the condition of anonymity for business secrecy reasons, an EU service provider specialised in sovereign services speaks of an overall investment of EUR 1.5 bn, including hardware, for a broad range of IaaS and PaaS services (for an unspecified computing capacity). Conversely, another EU service provider with an established range of non -sovereign services speaks of an overall investment in the range of EUR 20-40 m to adjust existing hardware and software to the stricter norms that a sovereign service entails , with plans to invest progressively should the market develops. The benefits for service providers to develop sovereign services are covered under section 6.1.5. 59 Economic benefits and cost savings for data centre operators . PO1-A would be expected to generate direct cost savings, via improved information and administrative burden reductions. Although voluntary, the new guidelines (PM3) would contribute to increase clarity , simplify procedures and reduce the incidence of mistakes, saving time for operators durin g the pre - operation phase of building a new DC, modelled as a central 10-day time saving. When multiplied by the expected number of facilities that could benefit from this time and consequent cost saving, the guidelines would generate discounted savings ranging between EUR 1 and 3.5 m over the assessment period. PO1-B would bring the largest direct economic impact for DC operators, modelled through a Net Present Value approach which compared the baseline permitting duration with the accelerated scenario to estimate the economic value of bringing constructions and commercial operations of a DC facility forward in time . Based on the evidence collected, the project facilitator for DC roll-out (PM4) combined with access to fast -track areas (PM5) are expected to reduce uncertainty on investment locations by excluding non -viable sites and decrease time to market for DC projects by on average 14 months. Under the baseline scenario, the total time to build a DC, i.e. from planning to entry into operation , was estimated at 32 months on average across the EU . This time is expected to decrease by 6 months from 2027 onwards due to the project facilitator and by an additional 8 months due to streamlined access to fast -track areas104. The estimated NPV gain is also associated with the expected reduction in PUE foreseen under this measure, as only the most sustainable DCs would be able to benefit from the fast - tracking. Therefore, the expected i mprovements in energy efficiency , modelled as a declining PUE, would also contribute to reducing operating costs over time . Over the 10 -year assessment, this option could result in discounted economic benefits ranging between EUR 8 and 27 bn, considering the uncertainty related to these time savings and their compounded imp act on project value. Under PO1-C, similar direct economic benefits are foreseen for operators thanks to the EU- level identification of fast -track areas (PM10). Based on discussions with industry and following the validation by the sector in the targeted w orkshop, t hese savings are expected to be less consistent than under PO1 -B, with an EU-level management of fast -track areas expected to produce time-savings of 3 months. This would in turn still generate consistent economic benefits that would range between EUR 5 and 12 bn over the 10-year period. Figure 10 shows the potential evolution of DC supply under each policy option and the expected reduction in the gap against projected demand in the baseline scenario105. 104 Based on study findings and validated by the sector in the targeted workshop. 105 Annex 4, Section 2.3.3 further explains how the capacity trajectories have been used as the quantitative basis for estimating how many new data centre could be built under each option and the share of this capacity that is expected to benefit from the policy intervention over time. 60 Figure 10. Forecasted evolution of data centre capacity (GW) under each PO, with respect to the baseline Source: Technopolis et al. (2025)106clxv Cost savings for cloud and AI computing service providers . Under PO2-A, administrative cost savings for providers would mainly stem from the use of the guidelines (PM12), saving time for operators during procurement, modelled as a modest 0.5 days saved per tender procedure , leading to total costs savings that could range between EUR 2 and 15 m (10-year, NPV). Under PO2-B, providers would face recurrent cost savings from the introduction of a clear and predictable sovereignty risk assessment framework across several Member States (PM15). Instead of responding to different requirements, controls or evidence requests from individual public authorities, service providers would benefit from a common audit procedure and recognised assurance levels with savings ranging from EUR 5 to 16 m per service, under an assumption that the provider operates in 3 to 10 markets. This would reduce duplication and simplify procurement procedures, while reducing costs related to tender documentation. Over time, this is expected to lower compliance costs and make it easier for providers to offer t he same audited services to a wider public sector market. This is expected to lead to total benefits for providers ranging between EUR 200 and 700 m, when discounted across 10 years. Under PO2-C, direct costs savings would stem from the same mechanism explained above, but extended to all MS, and an increased number of services being audited by providers under PM21, compared to PM15 , leading to total expected benefits ranging between EUR 2 and 5.1 bn, including those savings coming from savings of 1 to 3 working days per bid when drafting specifications by using standard non-specific award criteria (PM19). In the case of PO2 -C, savings in the audit process would range from EUR 8 to 25 m per service, assuming each provider run its business in 5 to 15 member states. Impact on SMEs. Though large businesses dominate the DC, cloud and AI markets, many SMEs in the EU still play a relevant role, particularly providers of cloud and AI services . Thus, the initiative is considered “relevant” for SMEs. Annex 6 contains the SME test. Given the lack of quantitative data, the impact on SMEs is assessed qualitatively below. PO1-A would generate value for SMEs with improved access to information and clearer frameworks, notably through the guidelines. Early visibility and clarity on applicable requirements 106 The capacity includes hyperscalers and colocation providers, but not enterprise DCs in the private or public sector. 48 54 60 0 10 20 30 40 50 60 2025 2026 2027 2028 2029 2030 2031 2032 2033 2034 2035 2036 GW Data centre supply evolution forecast (GW) under each Policy Option, with respect to the baseline Baseline PO1A PO1C PO1B Demand estimate 61 and collective voicing of SMEs would reduce costs linked to information asymmetries and coordination failures. As smaller operators, SMEs are disproportionately affe cted by complex permitting procedures and would benefit from administrative simplification. In PO1-B streamlined procedures are expected to reduce legal and consultancy expenses and would accelerate timelines, lowering entry barriers, reducing administrati ve costs and opening opportunities for SMEs in the DC value chain. The impacts of PO1-C on SMEs align to those of PO1-B, though EU -level approval might be perceived as more “distant”, raising language considerations of such mechanism. In addition, public f unding for R&D and innovation would enhance SME participation in advanced projects without requiring large upfront capital. Public funding for strategic deployment projects would improve SMEs’ access to contracts for large - scale projects, either directly o r within a consortium. PO2 would impact SMEs as providers of cloud and AI computing services, but also as consumers of these services. Under PO2-A, the non- prescriptive EU criteria of sovereign cloud and AI computing service s and the guidelines would reduce administrative burdens on SMEs while increasing clarity and transparency for sovereign services. The annual conference on EU digital sovereignty would allow SMEs to showcase their services and raise concerns collectively at lower costs. SMEs would also be the greatest beneficiaries of the interoperability measures as it simplifies the re-use of existing technology they lack. Under PO2-B, the sovereignty audit procedure with validity throughout the EU would reduce verification costs, especially for SMEs offering their services in critical sectors to public administrations in different Member States , albeit facing more burdensome compliance costs , voluntary public procurement criteria favouring specific characteristics could bo ost SME participation. Additionally, a vendor-neutral training would provide SMEs with a highly qualified workforce, capable of using and developing advanced cloud and AI solutions. PO2-C would entail the greatest direct and indirect net benefits for SMEs. The validity of audit reports across the EU would allow SMEs’ services would allow them to extend their commercial offers otherwise hindered. Beyond , remaining costs includ e funding programmes participation, which is also expected to enhance SMEs’ competitiveness. Open source access would reduce entry barriers, where solutions are evaluated on their merits . Encouraging open source would not disadvantage proprietary solutions where these genuinely represent the option on the best -value for money, but this would need to be properly demonstrated. Similarly, for companies , notably SMEs whose business models are built around the delivery of open source solutions and related services, this measure would provide them with the opportunity to p resent their solutions on equal terms removing barriers that have historically limited open source participation in public procurement procedures.Similarly, financial support would include improved funding rates for SMEs, and the service toolbox would help smaller providers find complementary solutions to their service offering. Ultimately, this would foster SMEs ’ access to innovation , seeking to increase their competitiveness and reduce their upfront costs. The SME cloud and AI adoption scheme would bring direct economic gains for SMEs applying cloud and AI technologies through improved competitiveness, and indirect gains for IT SMEs offering consultancy, reinforcing the ecosystem to drive a broader SME digital transformation. SMEs’ views on Policy Measures. Feedback from the public consultation shows the following: Table 9. SMEs and large companies views on Policy Measures Measure Support from SMEs* Support from large companies** Criterion ensuring sovereignty, autonomy, resilience for administrations procuring cloud and AI computing services 88% 31% Supporting an open source software ecosystem 82% 55% Guidelines with standard criteria to procure cloud and AI computing services for public administrations 82% 39% 62 Measure Support from SMEs* Support from large companies** Tax incentives for using sustainable technologies 76% 39% Funding for R&D of energy -efficient technologies, standardised energy efficiency benchmarks; addressing energy availability for data centres 71% 59% Expedited approval mechanisms and clear conditions for strategic projects 70% 81% *17 SMEs replied to the public consultation questionnaire ** 49 Large companies replied to the public consultation questionnaire 6.1.2. Impact on public authorities Costs for public authorities. In PO1-A, costs for authorities are estimated to be modest and would be limited to their participation in the forum (PM2) as well as to their contribution to drafting the guidelines (PM3), leading to total expected costs ranging between EUR 1 and 2 m over 10 years, assuming one authority representative per MS would participate in each activity . Under PO1-B, authorities are expected to face adjustment and administrative costs to establish and operate the project facilitator (PM4) 107 and identify areas for fast -track deployment as part of their national strategies for data centre deployment (PM5). This would lead to an estimated cumulative cost over 10-years ranging between 4 and 8 m per national authority . Additional costs are estimated for setting up and managing a potential support programme for strategic DC roll-out (PM6). Finally, authorities would face minor enforcement costs for periodic checks to verify data on compute capacity as well as the implementation of national data centre strategies under PM7. The option is expected to generate total costs for 27 national authorities ranging between EUR 106 m and 236 m over ten years . In PO1-C, authorities are expected to incur adjustment costs to adapt to the EU-level DC fast track platform (PM10), including the appointment of national representatives to the new board and periodic provision of data for identifying suitable fast -track areas . This is expected to generate costs ranging between EUR 84 and 90 m over ten years. Under PO2-A, the measures would generate modest adjustment costs for national authorities. The EU-level criteria of sovereign cloud and AI computing services (PM11) are expected to generate adjustment costs related to the review of national procurement templates, while guidelines (PM12) are expected to generate costs in relation to their adoption and prior consultation process. This would lead to total expected costs for authorities ranging from EUR 14 to 15 m in discounted terms over 10 years . Under PO2-B, authorities would face increasing costs regarding the sovereignty risk assessment scheme (PM15), the award criteria (PM16), participation in the public sector cloud federation (PM17). First, authorities would face one-off adjustment costs to carry out the sovereignty risk assessment to map sovereignty assurance leve ls to cloud and AI computing services used in the public sector. They would face recurrent costs for the ir periodic renewals and for revision of the audit reports (PM15). These are relatively modest and estimated in a range of EUR 25 to 99 m. Under this measure, c ontracting authorities could con sider using the sovereignty framework for their procurement decisions. See the box below for the assessment of the potential costs for public authorities related to porting and migrating cloud services. Under this option, since the measure is not mandatory, a smaller group of public authoriti es has been considered to use the sovereignty framework. The intervention could accelerate the porting of a limited subset of critical cloud applications to sovereign levels 3-4. Based on this, the anticipated porting is assumed to concern only between 1% and 6% of the relevant application ba se, resulting in discounted costs ranging from EUR 620 m to EUR 4 bn, over three years from 2030 . Minor costs are estimated for 107 This estimate represents a worst case scenario in which authorities would need to establish a dedi cated team from scratch, whereas in practice Member States may rely on existing resources under the Gigabit Infrastructure Act, including by designating a single informat ion point established under Regulation (EU) 2024/1309, with the relevant functions, procedures and mechanisms applying accordingly. 63 authorities voluntarily updating their procurement templates with the new procurement criteria (PM16). The platform for public sector cloud federation is expected to generate the costs ranging between EUR 170 to 260 m in discounted terms. Summing all these activities leads to total costs under this option to range between EUR 820 m and 4.4 bn . PO2-C foresees costs previously described but scaled upwards as well as new ones. For the former, elements include both the one - off and recurring costs for the sovereignty risk assessment scheme, reflecting the higher number of public authorities that would perform the m compared with PM15 . Under PM15, around 150 audited services are expected to be verified by 2036, while under the mandatory approach in PM21 this figure is projected to rise to 600 in the same period , which is broadly consistent with benchmarks such as FedRAMP. Also, in the case of PM15, given the voluntary nature of the scheme, only a limited number of Member States would perform the risk assessment and the consequent verification of audited services . Under this option , the mandatory nature of PM21 assumes that all MS would prepare the personnel and the infrastructure to run the scheme. Hence, the changes of PM15 and PM21 would need to be seen in combination: increase in the number of authorities adapting their processes to perform the sovereignty risk assessment and an increase in the number of audit reports to be verified. Therefore, under this option , the cost for authorities assumes that the policy intervention would accelerate the porting of the limited subset of critical applications across the full population of 6 400 public entities considered in scope. This would result in total discounted costs of around EUR 3 to 15 bn , over the same period. Under PM19, authorities would also face some costs to update their procurement templates with the new procurement criteria, alongside minor effort to draft an action plan or light touch strategic note outlining how they intend to use public procurement to increase the uptake of highly innovative cloud and AI computing services . PM20, which aims to boost open source in public administrations is expected to produce several costs for public authorities , i.e. related to (i) the creation and maintenance of the Open Source Programme Offices (OSPOs), (ii) setting up open source repositories and governance mechanisms defining contribution, review, and acceptance procedures, (iii) the continuous maintenance and set -up of additional repositories, (iv) the activities needed to release code as open source and (v) the comparative assessments of proprietary and open source solutions for their procurement procedures . While currently public authorities may not have this knowledge in-house, the initial comparative assessments and the set- up of the repositories may require certain investment in staff training and in the development of training evaluation capacity in the contracting authorities. However, these administrativ e costs are expected to be mitigated thanks to the deployment of the Open Source Programme Offices (OSPO). OSPOs, as part of their role in their technical, legal, procedural and strategic – related tasks, may provide contracting authorities with standardis ed evaluation frameworks, scoring methodologies or advisory support thereby sharing expertise costs across the public sector rather than requiring each authority to develop this capacity independently. Finally, in PM22 for the public sector cloud federation, national public authorities will have the same costs as described for PM17 above, as it builds on top of it . These measures would result in total costs for public authorities amounting to a range of EUR 4 to 18 bn for this option. Focus box #2: costs for authorities to port and migrate services This box makes the distinction in between: • Cloud porting, i.e. moving a service from one cloud provider to another cloud provider • Cloud migrating, i.e. moving a service from on-premises to cloud None of the proposed policy measures obliges public authorities to port an existing cloud service from one provider to another , or to migrate on -premises service to the cloud or to port. These decisions are made on a case-by-case basis by public authorities alone, considering the authority's 64 specific needs, existing systems, and procurement cycle. Examining costs is however relevant since the results of Member States' sovereignty risk assessments are expected to induce cloud porting decisions 108. As well, the expected increase in trust resulting from the existence of a sovereignty framework is expected to increase or anticipate cloud migration decisions. These costs are not immediate consequences of the intervention's entry into force, but rather p otential future expenses that may arise during the normal course of business. These costs are thus presented for illustrative purposes. Porting an existing workload from one cloud provider to another (cloud-to-sovereign cloud) Porting refers to moving an existing cloud -based service from one cloud provider to another, in this case to a sovereign cloud service. This concerns services that are already cloudified but may need to be moved/ported if sovereignty risk assessments conclude so. It is worth noting that this is something that anyway happens naturally as existing contracts come to an end and are re-tendered. To port an existing service, costs include a feasibility assessment, strategy and planning, target environment setup, migration, testing and validation, cutover, DNS switching, and recurrent activities linked to operating the service in the new environment, including performance optimisation and maintenance. These activities mainly involve personnel costs and parallel running costs. It is important to underline that the cost of porting is comparable when systems are ported from one cloud providers to another or to a sovereign cloud environment . In other words: the fact that the end cloud is sovereign does not per se affect the cost of porting. The porting of a single system To estimate the cost of porting an IT system, applications can be grouped into small, medium - sized and large, based on their size, complexity, business case and infrastructure needs. Annex 12 provides an in-depth analysis of the cost categories and their magnitudes, which can be grouped in the following categories: Application type Indicative effort Estimated cost Small application 50 days EUR 20 000 – 50 000 Medium-sized application 400 days EUR 200 000 Large application 1000 days EUR 500 000 Real-life use case 1: a porting of a high usage application to a sovereign PaaS One real-life example concerns the porting of an existing application from a cloud to a sovereign Platform-as-a-Service environment. • In the current situation, the service costs approximately EUR 2 m per year with a large commercial cloud provider. • The target scenario is porting the application to a sovereign PaaS environment. • The application is a monolithic Laravel application with a large -scale MySQL database and several large Elasticsearch clusters. • It does not process or store personal data, but it ha s a high usage profile, with sustained traffic and high-intensity connections. • Its criticality is mainly reputational, as an incident could have a high public impact, 108It must be noted that porting can also be triggered naturally as a consequence of regular procurement decisions after the exp iration of cloud service contracts. 65 although the service is not considered real -time critical from a business continuity perspective. The estimated transition effort is around 2 FTEs over six months, broken down as follows: Workstream Estimated cost Application adaptation, migration and validation 1 FTE Infrastructure provisioning, platform adaptation and automation 0.5 FTE Security and compliance alignment 0.5 FTE Total 2 FTEs over 6 months This example shows that the initial migration requires a structured investment to adapt the application, infrastructure and security posture to a sovereign environment. However, part of this effort can be reusable for future migrations, particularly infras tructure patterns, deployment practices and security baselines. The learning curve is therefore front -loaded, meaning that subsequent migrations of similar systems could benefit from the developed experience and skills . The actual effort may vary based on the application’s technological stack, its dependence on cloud-specific services and its overall architecture complexity. Real-life use case 2: transition of an application based on a high -volume database to a sovereign PaaS Another real-life example of a transition of an existing application to a sovereign Platform -as-a- Service environment: • The application, based on a few tenths of large scale microservices managing a very high - volume document database (1 .5 bn records), is hosted by a large commercial cloud provider and is migrated to a sovereign PaaS environment. • The application is monolithic with a large -scale relational database, WebLogic application server and proprietary monitoring tools. • It does not store or process personal data, just public documents, but it has a high usage profile, with more than 100 m visits and around 20 m documents consulted every year. • Its criticality is mainly reputational, as an incident could have high public visibility, although the service is not consi dered real -time critical from a business continuity perspective. • The chosen migration strategy was re -platforming, i.e. migrating the application and the database, and moving from proprietary solutions to open -source solutions (e.g. Apache Tomcat, Postgre SQL, Virtuoso) which entails refactoring code to eliminate dependencies to the deprecated technologies and to align it with the new technological choices, while maintaining the same performance. • The estimated transition effort is around 8 000 hours, or 4.5 FTEs over a year. What would sovereign cloud porting cost for a typical public authority? Extrapolating the individual costs of porting different types of applications to the full set of public authorities potentially affected by the policy measure s 15 and 21 would require considering several parameters. These include: • The outcome of the risk assessment with the sovereignty assurance level applicable to the concerned applications • The number and complexity of IT systems managed by each public authority 66 • The current level of cloudification of each authority • Whether the public authority’s data are already hosted in the EU under their existing cloud arrangement. On this basis, three illustrative cases are presented to show how costs can vary across different types of public authorities . These scenarios provide a benchmark for individual authorities, while the aggregated cost across public entities possibly in scope under PO2-B and PO2 -C is detailed under Annex 12. The estimates cover the additional a nticipated porting of a limited subset of critical applications to levels 3-4 where such porting could be directly accelerated by the intervention. Small public authority A small public authority , e.g. a mid-size municipality, manages 200 IT systems, with limited use of cloud services. Around 30% of the systems, i.e. 60, would need to be ported to a sovereign cloud environment. Most of these systems would be small applications (70%), e.g. standard administrative tools, with only limited num ber of medium (29%) or large platforms (1%). In this scenario, following the risk assessment outcomes, all IT systems (60) are subject to sovereignty requirements, as the authority never consider ed sovereignty criteria in previous tenders. Most applications (70%) fall under lower sovereignty assurance levels (level 1) while 20% need to be moved to sovereignty level 2 and 10% at least sovereignty level 3 . Based on this, the cost of porting for the authority is expected to reach around EUR 4.7-6.0 m over five years , corresponding to around EUR 1 m per year. Medium public authority A medium sized public authority, e.g. a national agency, manages around 800 IT systems, with a medium intensity cloud-user profile. Around 30% of its systems are cloudified, i.e. 240, and could be subject to higher sovereignty requirements, i.e. level 2 and above. Based on the outcome of the risk assessment , only 30% of these IT systems would require porting to a sovereign cloud environment, i.e. around 72 systems. Most of these systems are small (60%) or medium applications (37%), with a limited number of large and complex platforms (3%). On this basis, the cost of porting for this authority would reach around EUR 7.3-8.6 m over five years , or around EUR 1.6 m per year. Large public authority A large public authority , e.g. a large ministry , manages 1500 IT systems, with intensive use of cloud services, e.g. mission -critical platforms used by citizens, and a higher number of systems subject to sovereignty requirements. Compared to the medium case, it would manage a larger and more complex portfolio, including a larger share of medium (45%) and large (5%) applications. For this scenario, only critical systems falling under Level 2 and above are expected to require porting to a sovereign cloud environment as the authority may already be hosting most of its IT solutions with a cloud service falling under level 1 or on -premises. The cost of porting would reach around EUR 16.6-18.6 m over five years, i.e. around EUR 3.5 m per year. It is important to distinguish this cost of porting from the price of cloud services , which can be affected by a premium, something discussed under section 2.3.4. Migration of legacy applications to the cloud Most public sector use cases are not cloud -based today with 70% estimated to be on -premises. This can be further split, in between 30% that are on premises and could be migrated to the cloud, and a leftover of 40% of on-premises that are legacy applications being phased out (sometimes 67 long periods of time), or that are too small to deserve particular attention. To migrate services from on-premises infrastructure to the cloud , public authorities face adjustment costs associated mainly with staff time and migration activities. The effort to migrate a legacy-to-cloud application are harder to estimate than the ones for porting because the range of situations is much broader. Annex 12 details the m further, leading to an estimate 1.5x the effort compared to porting a service from cloud-to-cloud. These migration costs need to be put in perspective with the benefits of cloudification. Literature points to potential benefits such as lower infrastructure costs, greater scalability and flexibility, improved service quality, and access to more advanced security and analytical capabilities. Th ese potential benefits are discussed further in Section 6.1.5. Cost savings for national public authorities. PO1-A is expected to realise direct cost savings for authorities in terms of administrative burden reduction from harmonised EU guidelines that would limit divergent interpretation s of permitting requirements (PM3), leading to savings that would range between EUR 0.1 and 0.6 m, modelled as a 2 -day saving per new project adopting the guidelines. Under PO1-B, recurrent savings would stem from administrative simplification for DC buildout (PM4), combined with the central mechanism to identify fast -track areas (PM5), which would avoid duplication and back and forth interactions with economic operators, leading to total expected administrative cost savings under this option ranging between EUR 166 and 277 m. In PO1-C, savings would result from a centralised EU -level structure reducing national efforts (PM10). Consequently, total cost savings for 27 public authorities could be between 6 and 19 m, based on the variability in the actual effort saved by using a central EU -based database and avoiding repeated clarifications with operators on siting rules . Under PO2-A, cost savings are expected to arise from clearer information used in procurement processes. However, the scale of this effect appears to be very limited to be quantified. Under PO2-B, the sovereignty scheme and repository (PM15) would help streamline compliance verification by providing information in a single place. Participation in the public sector cloud and AI computing service federation (PM17) is expected to generate considerable resource savings through an optimised use of compute capacity. Finally, the use of standard award criteria (PM16) is also expected to save authorities time in procurement processes, leading to total expected savings ranging between EUR 8 and 17 bn. Under PO2-C, cost savings derive from standardisation and automation at scale. Mandating sovereignty risk assessments (PM21) are expected to create a more systematic and trustful manner to assess needs for cloud and AI computing services and reduce their time for procurement thanks to the comfort of having compliance with sovereignty requirements verified ex-ante. Today, there are in several Member States (ex: France, Italy, Finland) some schemes and methodologies used at national level for the overall security and resilience of c loud c omputing services. Whereas a voluntary approach may not lead to convergence between them, a compulsory system as proposed in this measure, combined with Commission’s support and oversight, will have more benefits in terms of synergies between Member States, and will also complement other measures proposed to consolidate efforts. Notably, p articipation in the public sector cloud and AI computing service federation alongside voluntary EU-level joint procurement (PM22) are expected to generate significant savings through an optimised use of compute capacity , a more cost -efficient procurement and improved economies of scale. Greater use of open source (PM20) is expected to reduce proprietary license expenditures, lowering licensing costs and total cost of ownership for IT systems clxvi. These measures could altogether lead to considerable cost savings for authorities ranging between EUR 21 and 61 bn over 10 years. A significant part of these savings come from the EU -level joint procurement that starts managing 2% of the total cloud and AI procurement 68 volume of national contracting authorities reaching 20% at the end of the 10 -year period and moving from 10% savings in first year to a range of 20 -40% at the end of the period as economies of scale increase. 6.1.3. Impact on the European Commission Administrative and adjustment costs. PO1-A is expected to generate one -off and recurrent administrative costs, regarding the development of guidelines (PM3), the establishment of the new Alliance Working Group (PM1) and DC forum (PM2), leading to modest additional costs with respect to the baseline of around EUR 0.5 m . PO1-B would entail one-off adjustment costs and recurrent ones for establishing and subsequently managing the coordination hub supporting Member States in identifying fast -track areas (PM5), as well as adjustment effort to monitor and coordinate the monitoring and reporting on computing capacity (PM7), leading to expected total discounted costs over 10-years of around EUR 1 m. PO1-C would generate the highest economic burden for the Commission , with adjustment costs linked to setting-up and operating the 7-year funding programme for R&D and innovation ecosystems (PM8) and for funding the deployment of strategic projects (PM9). Finally, the EU -level identification of fast -track areas (PM10) would entail one-off adjustment costs to set up the mechanism and procuring a supporting digital tool, along with recurrent costs to manage the mechanism to identify areas for fast -tracked DC deployment and biennial adjustment costs for outsourced studies and expert meetings, leading to total costs of EUR 17 and 19 m. PO2-A is expected to generate one-off adjustment costs for the Commission from drafting and consultation for the development of an EU-criteria and guidelines on the notion of sovereign cloud and AI computing services (PM12). The annual week-long conference on digital sovereignty (PM13) would also entail recurrent adjustment costs for preparation time and event budget. Finally, the increased standardisation efforts on interoperability (PM14) are expected to generate modest one-off adjustment costs for procuring ad hoc studies and setting up the coordination group, and recurrent costs for participating and supporting discussions. This would lead to total costs of around EUR 7 m. Under PO2-B, costs are expected to arise from establishing and managing the repository of sovereign services (PM15), setting up the public sector cloud federation platform (PM17), and develop the training programme (PM18). These measures are expected to amount to discounted total costs of approximately EUR 130 m. In PO2- C, costs for the mandatory sovereignty risk assessment (PM21) would mirror those listed under PO2-B and comprise the p rocedures for setting up the repository. EU -level procurement (PM22) would generate adjustment costs related to hosting and maintaining the platform , and recurrent ones for operating it for joint procurement . The development, set -up and administration of the adoption scheme for SMEs (PM23) is expected to generate the highest adjustment costs under this option. Finally, the online toolbox for service providers to easily identify software tools to help them in complementing their service offering (PM24) is expected to generate costs related to the development and management of the toolbox. The measures are altogether expected to generate costs for the Commission amounting to in- between EUR 470 and 760 m at present value over the next 10 years. 6.1.4. Impact on innovation and technological sovereignty PO1-A would not expand the supply chain or balance dependencies on non -EU providers. Innovation effects would also be limited. PO1-B would be very impactful in ter ms of technological sovereignty and innovation. The funding of strategic projects would allow national public authorities to steer the development of infrastructure to sectors relevant to sovereignty and to DCs that deploy novel technologies for resource e fficiency. PO1-C would have a higher innovation impact than PO1 -B. Funding the development and deployment of novel technologies 69 would give an edge to the European DC ecosystem. PO2-A would have moderate impact on technological sovereignty. Soft harmonisation measures like defining a sovereign cloud and AI computing services, guidelines, and establishing an annual conference on digital sovereignty would indeed create a common understanding of sovereignty but would have limited impact. The development of harmonised interoperability standards would enhance the uptake of sovereign technologies. PO2-B would have greater impact than PO2-A on technological sovereignty in the Union, as the voluntary sovereignty risk assessment would allow public authorities to procure cloud and AI comput ing services that comply with the sovereignty criteria. The federation would ensure that authorities benefit from de facto sovereign cloud and AI resources s hared by other public bodies and would enhance resilience by allowing access to capacity located in other Member States. The voluntary award criteria on R&D investment and supply chain reinforcement are expected to encourage the development of an EU locate d innovation ecosystem . PO2-C, which builds on PO2 -B, is expected to have the greatest impact in terms of innovation and technological sovereignty. The sovereignty risk assessments performed by the public and private sectors will improve the overall sovereignty level of the EU economy and will provide additional opportunities and incentives to procure from European providers that are more immune to risks linked notably to data access or throttling of service quality . This in turn will encourage investment to improve innovation and technological sovereignty in the EU. The establishment of a framework for joint procurement would allow public authorities to increase their autonomy and resilience while funding innovative solutions in Europe . The non-price award criteria would allow contracting authorities to procure cloud and AI computing services to favour investment in innovative cloud and AI computing services , while reducing critical dependencies . The open source principles would also play a role in the increase of the Union’s operational autonomy, particularly in the public sector . Finally, the toolbox for cloud and AI computing service would support European cloud and AI computing service providers in complementing their service offerings and increasing their market visibility, by addressing fragmentation and lack of discoverability in the cloud market . Therefore, the toolbox is expected to contribute to reducing dependency on a limited number of dominant solutions. 6.1.5. Wider economic effects Beyond the direct costs and benefits quantified above, the proposed measures may generate wider economic effects through two main channels: first, support the deployment of data centres, with a focus on strategic ones prioritising innovat ion and sustainability, and second, by increasing the adoption of sovereign cloud and AI computing services. These effects are difficult to quantify because they relate to resilience, autonomy, avoided disruption and long-term competitiveness. However, given their economic relevance, the main evidence collected is summarised here as part of the overall assessment. Compute Capacity. The overall macroeconomic impact of constructing new data centres is best analysed qualitatively. The evidence base remains fragmented in part because official statistics often fail to categorise data centres as a distinct sector, and in part because several studies rely on project-specific case studies , surveys or modelling that cannot be scaled to the whole European context without large multipliers . Existing literature suggests that the construction and deployment of new data centres have a positive impact on th e economy in the short to medium term. The development of new data centre projects generates demand for various goods and services, including construction, engineering, electrical equipment and professional services . These in turn can have ripple effect s on local economies through related supply -chains and induced household spending. However, the extent of t hese effects is heavily in fluenced by local procurement patterns, labour market conditions, and degree to which these expenditures are 70 retained domesticall y. Studies indicate that investing in additional data centre capacity can stimulate economic activity during the construction phase, but the magnitude of this effect depends on the specific context 109. Some have attempted to quantify the contribution of data centres to GDP or value added. For example, in the UK, it has been estimated that the data centre sector generates around GBP 4.7 bn in annual G ross Value Added. Similarly, a 2025 study by Copenhagen Economics estimates that in Portugal the data centre sector contributed EUR 311 m to GDP between 2022 and 2024, with potential cumulative contributions ranging from EUR 6.1 bn to EUR 26.2 bn between 2025 and 2030, depending on the investment scenario110. When looking at international trade, expanding EU DC capacity is also expected to affect the EU’s external trade balance by increasing imports of semiconductors and ICT components . Today, Europe has a structural import dependency on semiconductors and the most advanced AI chips used in DCs are designed and fabricated outside the EU, mainly in the US, Taiwan, South Korea and China clxvii. Each new GW of installed capacity requires several millions of components, representing between EUR 3 to 4 bn of ICT hardware expenditure per GWclxviii. Applying this ratio to the EU’s projected 2025-2030 buildout, total chip and server imports could reach EUR 47 to 83 bn over this period. This dependency i s expected to further catalyse foreign direct investment (FDI) and technology upgrades within the EU, with technology firms potentially contributing to the development of clusters around the growing DC sectorclxix. At EU level, in 2024, investors announced FDI projects worth around EUR 60 bnclxx. From a broader economic perspective, the development of additional compute capacity serves as an important enabler for cloud computing, AI and other data -intensive activities . The primary economic benefit is likely to arise from the downstream effects on productivity and innovation, rather than the construction and operation of the data centres themselves. This in turn can have a positive impact of the economy by supporting growth and regional digital development. According to the OECD, cloud services play a key role in the value chain for many digital technologies used by businesses and governments, a nd can enhance innovation and productivity, particularly for SMEs that would otherwise face high fixed costs in acquiring advanced ICT capacity clxxi. Scalable and secure compute and cloud -based services can empower enterprises and public authorities to access advanced technologies without having to build the infrastructure in -house, something which requires time, a particular skill set and large upfront investments. Better access to digital infrastructure can improve the conditions for technology diffusion and digitalisation across sectors, ultimately giving rise to data -driven business models, including AI-enabled services. In the EU context, this is consistent with the policy objective of ensuring that strategic data centre capacity supports public interest use cases, such as healthcare, public administration, research, security, critical infrastructure and AI -enabled public services. The ultimate benefit of fostering this deployment would reside not in the creation of more data centres, but in the availabilit y of strategically located and appropriately governed compute capacity for economically and socially important workloads . As noted above in Section 2.2.1, the availability of local data centre access can also have an impact on latency, reliability and cost conditions, which can encourage greater cloud adoption clxxii. Furthermore, local data centres can enable more advanced AI applications by reducing latency and improving internet traffic, while 109 See: The local economic impact of a proposed data centre campus in London and Virginia Joint Legislative Audit and Review Commission Report to the Governor and the General Assembly of Virginia on data centers 110 The study focuses on immediate impacts in terms of investments and jobs and secondary effects on businesses supp lying DCs. It does not account for broader spillover effects of DCs on innovation and productivity across sectors or broader economy -wide effects, such as potential impacts on price changes or shifts in consumer behaviour. Available here. The report of the European Data Centre Association projects the European colocation DC sector’s GDP contribution to increase from EUR 30 bn in 2023 to EUR 83.8 bn by 2030. Available here. See also: Does GDP growth minus AI capex equal zero? 71 insufficient domestic compute capacity can cre ate or deepen dependence on external providers . With respect to the impact of AI, recent literature highlights its potential to generate economic benefits, particularly through productivity gains, innovation, scientific discovery and new business models. However, the evidence is strongest for task-level productivity gains and more uncertain at enterprise, sector and macroeconomic level. Cloud and AI computing services. The second channel of wider effects relates to the increased adoption of sovereign cloud and AI computing services. Benefits include enhanced autonomy, improved resilience, reduced dependency, stronger legal and operational control, and better conditions for AI -enabled innovation. Even though several of these effects are hard to monetise, they are economically relevant as cloud and AI computing services increasingly support public administration, healthcare, research, education, justice and law enforcement , cybersecurity and industrial competitiveness. If public authorities depend heavily on a small number of external providers or non -EU jurisdictions, they may face legal, operational, geopolitical and continuity risks. Sovereign cloud and AI services can reduce these risks by providing more diverse supply options, clearer governance, and ensuring stronger alignment with EU and Member State requirements. A key benefit is therefore greater resilience and continuity of public services . Dependence on a limited number of cloud infrastructures can create systemic risks, as disruption in a major provider can affect many services at the same time. The October 2025 AWS outage, for example, disrupted businesses and digital services globally, highlighting this vulnerabilityclxxiii. The World Economic Forum estimated that the 2024 global CrowdStrike outage caused around USD 5 billion in losses , disrupted airlines, banks, healthcare providers, retail payment systems and ATMs worldwide , underlining these system-wide economic consequences clxxiv. These examples do not imply that sovereign providers are immune from disruption. Rather, they show the economic relevance of resilience, provider diversity, and reduced single -provider dependency. Indeed, s overeign cloud services strengthen operational control. Sovereignty does not only mean storing data in the EU. It also concerns who operates the service, who can access systems, which jurisdiction applies, and whether public authorities retain effective control over sensitive workloads. These are particularly relevant for strategic public sector use cases, such as hospitals, emergency services, tax systems, justice systems or critical infrastructure, where continuity and trust outweigh marginal cost optimisation. In addition, greater availability of credible EU alternatives may have competi tion and cost benefits. Moving part of its services to EU providers would give public administration the capacity to improve their negotiating power and contribute to decreasing this market concentration. Another relevant potential wider economic effect concerns the domestic value added through import substitution. A higher market share for EU providers would shift part of existing and future cloud and AI spending towards services produced within the Union. This would increase the share of wages, profits, reinvestment and tax revenues retained in the EU rather than accruing them abroad. This, in turn, could stimulate additional investment in cloud and AI infrastructure within the EU, enabling European provid ers to scale up their offerings and strengthen their competitiveness. An illustrative calculation shows the possible order of magnitude. Considering that the EU -27 public cloud revenues could reach around EUR 320 bn by 2030111, that the public sector represents around 14% of demand, and that level 3 and 4 sovereignty levels correspond to 10% of these needs (see description of policy measure 21 here above), this means a 111 Public Cloud - EU-27 | Statista Market Forecast 72 market of EUR 320 bn * 14% * 10% = EUR 4.48 bn only addressable by EU controlled providers by 2030112. On top of this, it is likely that the signalling effect of European providers being selected for highly sensitive applications will give them increased opportunities in the market , and it can therefore be expected that European providers would increase their market shares also for lower sovereignty levels. Similarly, in the private sector, as regards sensitive sectors subject to a new obligation to pay attention to sovereignty issues, it can be expected that a number of entities will consider giving new business to European entities , which will have less difficult y in demonstrating their sovereignty levels. Sovereign cloud and AI adoption may support productivity gains, although these are still uncertain. McKinsey estimates that Europe could unlock up to EUR 480 billion annually by 2 030 in a “European digital sovereignty” scenario, where AI adoption is high and European providers capture most of the value. In a high adoption but externally dependent scenario, the estimated impact is lower, at around EUR 375 billion . In lower-adoption scenarios, the estimated impact falls to around EUR 80 to 100 billionclxxv. Increased availability of sovereign cloud and AI services may also increase trust among public authorities and thereby support greater cloudification as a side effect of the intervent ion. While for public administrations , the costs of porting or migration are one -off, several benefits may accumulate over time. These include a reduced need to own and manage infrastructure, greater scalability, faster deployment of new functionalities, m ore flexible cost structures, improved service quality and easier access to advanced analytics and AI tools. Cloud migration is often part of a broader modernisation effort: once the project is completed, the public authority may be freed from managing som e underlying IT infrastructure and may be able to add new functionalities more easily. Some literature and case -study evidence point to total cost of ownership savings in the range of 20 –50% for cloudification projects , although these estimates remain highly context-specificclxxvi. At the same time, these benefits must be balanced against the potential price premium (mark-up) of sovereign services. Any additional costs linked to providing sovereign services - compliance costs linked to audits, EUCS certification costs, the use of EU-based infrastructure, higher labour costs for EU-based staff - would be passed on to customers through higher prices. 6.2. Social impact Employment. DCs are highly automated facilities, and the effect on employment is greater during their construction phase than their operational phases. As reported by stakeholders, construction is typically undertaken by large multi-national construction companies with participation of local teams for the initial phases and non -local specialised teams for fit-out phases. For a 100 MW site, around 1 500 – 2 000 construction employees would typically be on site per day. During the operational phase, approximately 6 -8 full time jobs are created for every 1 MW of capacity, with economies of scale appearing as DCs measure beyond 50 MW. Some interviewees also highlighted that they provide offices for some of their larger customers, converting DCs into co- working hubs. When it comes to providing cloud and AI computing services, the EU’s shortage in ICT skills can hamper the development of cloud and AI ecosystems, with a limited availability of experts creating a significant gap in an already limited specialist workforce. For AI, only a small proportion of specialists are actively involve d in the industry clxxvii, with many remaining in academia. This results in a low transferability of results to the market and , where transfer is 112 In lower market growth (250bn) and lower share by the public sector (10%), this would reach EUR 250 bn * 10% * 10% = EUR 2.5 bn by 2030. In higher market growth (390bn) and higher share by the public sector (16%), this would reach EUR 390 bn * 16% * 10% = EUR 6.24 bn by 2030. 73 successful, companies lack the means to scale up or retain talent. Beyond these direct impacts, cloud and AI computi ng services play an important role in the digitalisation of other sectors , which has a complex effect on employmentclxxviii. With respect to the contribution of technological sovereignty, 71% of citizens from the three biggest Member States believe that sovereignty can help create and protect local jobsclxxix. Citizens. With regards to DCs, there are documented instances of public resistance against the ir construction due to environmental concerns , e.g. energy consumption and water security and potential consequences on related pricesclxxx. However, citizens increasingly use digital services in their daily lives clxxxi, where cloud and AI computing services and their underlying infrastructure play a vital enabling role. AI, while nascent, is already pervasive clxxxii. Citizens stand to benefit from accelerated deployment of nearby compute capacity for low -latency applications like automated driving, decentralised energy grids or assisted surgeries or living. These growing social benefits should help increase the long -term public acc eptance of the facilities that power these technologies. Concerning sovereign cloud and AI computing services, a strong majority of citizens from the three biggest Member States support greater sovereignty even if this increases costs and argue that governments should lead the investment and development to achieve this objective. The support drops, however, should this result into a lower spending on public servicesclxxxiii. Some POs have particular social impacts. Under PO1-A, the public guidelines and the yearly forum with the involvement of local municipalities, would help increase community trust and engagement. Under PO1-B, the social acceptance of DCs is expected to be the greatest, as decisions on DC build-out give a greater role to local authorities and are thus taken closer to citizens. Acceptance can be expected to be particularly high when DCs demonstrably contribute to local communities, for example through waste heat reused in local energy systems . Social acceptance should also be a core attention point of the coordination hub wh ich would disseminate best practices on deployment. Conversely, PO1-C is expected to have a detrimental social impact as EU-level decision making on DC deployment is perceived as further away from the citizen. PM18, which belongs to PO2-B and is then picked up in PO2-C, would have direct social impacts since it focusses on the development of ICT skills where Europe is lagging, resulting in higher employability of citizens. For PO1-A/B/C, the possible effects on consumer electricity prices have not been considered as this would require too many unverifiable assumptions (see next section). 6.3. Environmental impact DCs in the EU currently are projected to consume around 99 TWh of electricity in 2025, equivalent to roughly 3 % of total EU power generation. Over the next decade, rising capacity will be the primary driver of increased electricity use, though its effect will differ depending on the pace of expansion and the success of energy-efficiency. Electricity consumption and its associated CO₂ emissions represent the dominant environmental impact of DCs and are therefore used as a key proxy for quantifying the environmental impact of additional data centre capacity . Beyond electricity consumption and associated CO₂ emissions, data centres generate environmental impacts across several additional dimensions. W ater consumption, embodied emissions in equipment and buildings, refrigerant leakage, and local environmental external ities are also relevant measures of environmental impact113. The European Climate Law (ECL) consistency check was performed by comparing the projected electricity use and associated CO 2e emissions under each policy scenario with the EU’s declining 113 These impacts could not be systematically quantified at EU level due to lack of harmonised data. Looking ahead and considering the share of the emissions generated for DC construction materials (concrete , steel as well as other materials as semiconductors), the life cycle carbon footprint approach should be another relevant method to measure the environmental impact of each DC project. 74 grid-emission trajectory toward a 55% GHG emissions reduction target by 2030 and climate - neutrality by 2050. The first subsection presents the quantification of environmental impact in terms of increased energy consumption and CO₂ emissions under the different policy options, with considerations on the interaction between data centre deployment and impacts on the electricity system. Implications of increased data centre capacity on water consumption are then discussed in section 6.3.2. 6.3.1. Impact on electricity use and CO₂ emissions Under the baseline scenario, total capacity is expected to expand to 46.3 GW114 in 2036 with an expected modest PUE improvement from 1.29 down to 1.23 115. Annual electricity use is expected to rise from 99 TWh in 2025 to around 314 TWh in 2036, i.e. an average increase of 11% per year. The cumulative electricity demand over 2025 –2036 would amount to 2 571 TWh. Assuming an evolution in the EU grid carbon intensity from 0.25 kg CO₂e/kWh today to 0.16 kg CO₂e/kWh in 2036clxxxiv, this would correspond to 50 Mt CO₂ e in 2036. The environmental impact of PO1- A/B/C is assessed against the increase in electricity demand (in TWh) and CO2 emissions resulting from additional DC deployment under the different scenarios116. Table 10. EU-27 data centre capacity in 2036: electricity and CO2 impacts vs baseline Scenario 2036 Capacity (GW) PUE 2036 Electricity Use 2036 (TWh) Cumulative 2025– 2036 (TWh) CO₂e /GW 2036 (Mt/GW) Cumulative CO₂e 2025–2036 (Mt) Baseline 46.3 1.23 314 2 571 1.18 495 PO1-A 52.2 1.18 339 2 701 1.13 518 PO1-B 65.9 1.12 408 3 028 1.09 576 PO1-C 58.7 1.05 340 2 737 1.01 525 In PO1-A, the guidelines would encourage early integration of resource-efficient features , the adoption of renewables and best practices in energy management, while the coordination forum would facilitate dialogue with energy providers. These measures are expected to improve the PUE of new DCs by around 4% by 2036 compared to the baseline , reaching 1.18. Total installed capacity would increase to 52.2 GW and electricity demand would reach 339 TWh in 2036, or about 8% higher than the baseline and cumulative consumption over 2025 -2036 would total 2 701 TWh, or 130 TWh m ore than the baseline. Increased expansion of capacity under this option would push up cumulative carbon emissions by 23 Mt with respect to the baseline. In PO1-B, owing to fast -track area identification, Member States would have a stronger hand at linking DC development to sustainable energy availability and avoiding environmentally sensitive sites. EU- level discussions with national authorities are also expected to favour a fast uptake across Member States of sustainability best practices in DC build-out. Altogether, this policy option is expected to deliver an improvement in PUE of 9% by 2036. In this scenario, DC capacity is expected to increase fastest, reaching 65.9 GW by 2036, while annual electricity use would reach 408 TWh by 2036, the highest among all scenarios. Cumulative 2025 –2036 demand would exceed 3 000 TWh, approximately 30% above the baseline. Even with continuous efficiency gains, the speed of expansion would push up total energy and resource requirements. Cumulative CO₂ emissions are expected to be 82 Mt higher than the baseline over the decade. However, average CO 2e emissions/GW decline 12% faster than in the baseline scenario due to the expected improvements in PUE. With PO1-C, EU R&D funding (PM8) is expected to support the development and 114 Data centre capacity includes private sector, i.e. colocation and hyperscalers, and public sector capacity. 115 For additional information concerning expected PUE changed under the different Policy Options, please see Annex 4, Section 2.3.5. 116 The baseline assumes that electrical grid limitations remain an issue in certain primary markets such as Ireland and the Netherlands. However, it considers that regulators and operators in several markets have begun investing in grid modernisation and demand management. 75 gradual uptake of sustainable innovations, especially after an initial phase of testing and demonstration. These may include AI-driven energy management, advanced cooling systems, solutions for waste heat reuse and renewable and storage integration. Strategic funding for deployment (PM9) would also be used to incentivise projects incorporating highly sustainable features, making eligibility conditional on sustainability criteria. These two measures focusing on targeted grants or technical support will be designed to stimulate the development, testing and market uptake of advanced s olutions with the objective of considerably reducing PUE and WUE levels over a 10 -year horizon. This type of intervention could help smaller colocation providers reduce PUE a s they would aim to facilitate upfront R&D investments, pilots and CAPEX into innovative technologies that small operators struggle to finance compared to hyperscalers clxxxv. EU-level identification of fast-track areas (PM10) would ensure that facilities are deployed where they are least environmentally damaging at continent level . Capacity under this option is expected to reach 5 8.7 GW by 2036, with the strongest efficiency gains: PUE falls to 1.05 ( –15% with respect to the baseline ). Despite 27% higher capacity than the baseline, total electricity use remains close to PO1-A at 340 TWh, so is the cumulative consumption over 2025 –2036. Due to cleaner electricity sourcing, stronger PUE reductions and general forecasted decarbonisation of the grid mix, average CO₂e emissions/GW are expected to decline 21% faster than in the baseline scenario117. Across all scenarios, electricity use at least triples between 2025 and 2036. However, with policy measures under PO1 -C, stronger efficiency standards and renewable integrati on are expected to contain DC power demand to around 13% of EU electricity generation. Finally, under PO2-B and PO2-C, the cross -border re -use of cloud and AI capacity among Member States through the federation would be inducive of environmental savings: a rough estimation points to 5% energy efficiency improvement for 10% increase in server utilisation rateclxxxvi. The resulting emissions would increase across all scenarios due to growing DC electricity demand. However, CO 2e emissions per GW of added capacity would decline much faster under PO1-C than under the baseline, owing to the stronger reduction in PUE and gradual adoption of sustainable energy integration measures. The baseline pathway is not compatible with long -term climate neutrality goals, as it leads to increased energy demand without integrating sustainability requirements. Policy intervention is essential to uphold consistency with the ECL and ensure that possible national DC acceleration policies do not result in a race -to-the-bottom in terms of sustainability and minimise environmental impacts and grid strainclxxxvii. As mentioned under section 2.2.2., grid capacity limitations are also real and increasing barriers for the development of data centre capacity . The International Energy Agency highlighted that waiting times for grid connection in key data centre hubs range from two to ten years due to capacity limits and congestion, thus s lowing down project development and diverting investment to regions with available grid capacity clxxxviii. In this context, it is important to note the positive contribution which DCs – if properly leveraged – can make to grid stability, notably by offering flexibility services 118. The co -location of energy generation on a DC site can help reduce grid stress and DC investments have the potential to also boost investments in grid infrastructure. 6.3.2. Impact on water consumption Data centres are also becoming a significa nt and rapidly growing source of water consumption, with implications for regional water security and climate resilience. Depending on the cooling 117 Carbon footprint is mostly driven by scope 2 energy consumption. To reduce climate impact, low-carbon energy use should be incentivised. 118 Notably, due to their storage capabilities, data centres present a unique opportunity to enhance power system flexibility. Se e for example: Data centres as a source of flexibility for power systems - ScienceDirect. 76 technology used, their cooling systems can require large volumes of freshwater, often millions of litres per day for hyperscale facilities, placing pressure on local supplies, especially in drought - prone or water -stressed areas. As demand for cloud services and AI model tra ining accelerates, water use is expected to rise unless mitigated through efficiency measures, site -specific resource planning, and low -water or water -free cooling technologies. Estimates suggest that data centres across the EU consumed around 76 bn litres of water in 2025. At global level, the International Energy Agency estimates that water consumption by data centres amounts to approximately 560 bn litres per year clxxxix, implying that the EU -27 accounts for around 14% of global data centre water consumption. When assessed against broader metrics related to water use, data centres represent a relatively small share of overall water pressure. Total freshwater abstraction in the EU has decreased by 19% between 2000 and 2022, corresponding to a compound annual gr owth rate of -0.8%, according to the European Environment Agency cxc. Extrapolating this rate to 2025 suggests that, out of an estimated 192,000 million m³ of freshwater abstracted annually in the EU - 27, data centres accounted for 0.04%, i.e. remaining well below the levels observed in international counterparts. As data centre capacity is expected to grow in the next years, overall water consumption by data centres is also foreseen to increase. However, this trend could be alleviated by an industry shift tow ards more sustainable and resource -efficient operations. The adoption of advanced cooling technologies and improved practices is expected to consistently reduce water intensity over time. A reduction in Water Usage Effectiveness (WUE) from current levels o f 1.8 to 0.6 litres per kWh over the next decade, in line with the Climate Neutral Data Centre Pact’s target of WUE levels below 0.4 litres per kWh by 2040, and ongoing efficiency improvements by hyperscalers, could substantially limit water demand. Under these assumptions, water consumption growth could be reduced by around 8 percentage points in CAGR, resulting in total water consumption that is approximately half of what would be observed in the absence of comparable efficiency oriented measures. Against the sector’s continued growth, measures that incentivise resource -efficient investments, technological improvements and a balanced distribution of new data centre capacity across Member States, with particular attention to water -stressed regions, a re key to reduce the environmental impact also in terms of water consumption. As noted above, overseeing the water use of data centres is crucial not only for environmental sustainability but also for social equity and economic stability . Given the local n ature of water systems, the increase in data centre capacity can impact water supply reliability and influence drought resilience in specific areas. The analysis highlights the need for governance mechanisms that ensure new infrastructure aligns with sustainable water management, transparent reporting, and equitable access to shared water resources. 6.3.3. Other key metrics concerning environmental footprint Research has shown that focusing uniquely on electricity, CO 2 and water usage overlooks key environmental impact categories linked to building new data centre capacity, in particular as grids are expected to become more sustainable in the future. Studies have highlighted the importance of embodied impacts, i.e. envi ronmental impacts associated with construction materials, mechanical and electrical equipment and IT hardware maintenance, which can be come a relevant portion of the overall data centre footprint over time cxci. A recent p eer-reviewed paper similarly highlights the need for comprehensive life cycle assessments of cloud infrastructure to measure environmental impact cxcii. Several equipment and IT hardware pieces needed in data centres, especially if in constant use, may need replacing upon reaching end -of-life. The proper collection and treatment of these waste electrical and electronic equipment (WEEE) from data centres is 77 necessary to protect human health and the environment, in particular as regards depollution and hazardous substances, as well as the recovery of materials from recycling119. Another environmental factor in DC development remains sustainable cooling. While powering the cooling is an integral part of overall energy consumption, using low global warming (GWP) potential refrigerants remains important. Refrigerants used in cooling systems can pose significant climate challenges due to leaks of high -global warming potential fluorinated gases (F-gases). The European Environment Agency outlines why fluorinated greenhouse gases are a key focus for mitigation and tracks EU actions in this area 120. Moreover, at EU level, the recast F-gas regulation combined with the ICT Taxonomy provide guidance on the types of sustainable refrigerants to be used for cooling EU DCs121. Lastly, environmental assessments and Scope-3 frameworkscxciii bring attention to other impactful areas, e.g. supply-chain emissions and waste from equipment and infrastructure (Scope 3), emphasising the need to consider other parameters beyond electricity usage for accurately monitoring the environmental footprint of data centres in the future. 7. HOW DO THE OPTIONS COMPARE? This chapter evaluates the policy options in terms of their effectiveness, efficiency, coherence, subsidiarity and proportionality. It brings together the results of the preceding impact analysis to examine how each option performs against these criteria a nd highlight their relative strengths and weaknesses. It then presents the results of the sensitivity analysis conducted, using best - and worst-case scenarios to derive confidence intervals for testing the robustness of the cost -benefit results under varyi ng assumptions. The final section then focu ses on the comparison of the options, presenting their overall performance across the different criteria. 7.1. Effectiveness The analysis of effectiveness examine s the extent to which the policy options under considera tion are expected to contribute to the achievement of the general and specific objectives of this initiative. As out lined in section 5.2., the first set of option s primarily addresses SO1 and SO2 , while the second set has been designed to better address SO3 and SO4. The table below illustrates the relationship between the policy objectives and the assessment criteria, which served as initial benchmarks for evaluating the potential effectiveness of the options. The assessment draws primarily on evidence gathered through literature review and desk research, complemented by interviews, the CATI survey, and validation workshops. While this sectio n presents the analysis mostly in qualitative terms, the same evidence base, including survey results, was integrated into a multi -criteria decision analysis (see Annex 4 , section 6) to evaluate the effectiveness of the proposed measures, alongside other assessment criteria. Table 11. Links between objectives and assessment criteria General objective Specific objectives Assessment criteria Ensure the functioning of the internal market SO1 – Increase computing capacity in the EU through innovative and sustainable • Expected increase in EU installed computing capacity (MW) • Expected improved PUE of new data centres 119 As announced in the Clean Industrial Deal (CID) Communication adopted 26.02.2025, the Commission i s preparing a review of the WEEE Directive as a pillar of the upcoming Circular Economy Act (CEA) proposal intended for later in 2026, in particular with a vi ew to improve areas identified in the Evaluation of the WEEE Directive published 02.07.2025, including WEEE collection, treatment of WEEE, and recovery of critical raw materials (CRMs) embedded in various WEEE. 120 See: EU progress under the hydrofluorocarbon phase out set out in the EU F-gas Regulation | Hydrofluorocarbon phase out in Europe | European Environment Agency (EEA) 121 See Regulation (EU) 2024/573: https://eur-lex.europa.eu/legal-content/EN/ALL/?uri=CELEX:32024R0573 78 General objective Specific objectives Assessment criteria for cloud and AI computing services and secure the conditions necessary for the competitiveness of the Union’s industry and the resilience of its public sector as users of such services technologies • Increase in the number of pilots launched and innovative technologies, e.g. immersion cooling for energy efficiency, adopted in new data centre projects. SO2 – Ensure attractive conditions for the deployment of sustainable and innovative computing capacity • Expected reduction in the time needed for data centre permitting and total administrative proceedings. • Expected reduction in underutilised land (share of identified viable sites used). • Share of new capacity deployed outside existing hubs/underserved areas. • Additional investment in data centre capacity driven by better investment conditions for data centre projects. SO3 – Decrease the overall reliance on non-European cloud and AI computing services • Expected increase in the market share of European cloud and AI computing service providers serving highly critical use cases • Expected reduction in dependency concentration on non - EU providers SO4 – Enhance the resilience of supply of cloud and AI computing services, in particular in the public sector • Expected increase in the number of public sector contracts supplied by providers meeting the sovereign services at level 2, 3 or 4 scored under level 2, level 3 or 4 • Expected increase in the (re-)use and sharing of open source solutions • Expected increase of federated resources across the public sector and use of the joint procurement of cloud and AI services Regarding SO1 (increase computing capacity in the EU through innovative and sustainable technologies), PO1-A would provide a limited effect. An expanded working group and structured forum are expected to reduce coordination and information frictions mainly linked to inconsistent permitting and zoning procedures across Member States . The guidelines focused on sustainability would be designed to translate “innovative and sustainable” technologies into best practices for data centres. These would aim to complement the existing reporting obligations under the EED with concrete instruments to improve compliance with sustainability requirements and allow an earlier integration of efficiency -related considerations in pr oject design. At the same time, being voluntary instruments based on ad hoc participation or adoption by businesses, these measures are expected to indirectly and slightly increase computing capacity in the EU and reduce PUE with respect to the status quo scenario. While the option is expected to improve the quality of new capacity, its concrete contribution to additional MW or innovative technologies for energy- efficiency is expected to be moderate. PO1-B is expected to be more effective at increasing EU- based computing capacity, with the strongest direct impact on additional data centre deployment . This is expected as the result of more favourable growth conditions, driven by simplification measures, faster permitting and potential public support by Member States. The national facilitator (PM4) and nationally defined strategies, including fast-track areas (PM5) are expected to reduce permitting timelines and time needed for data centres to connect to the g rid, while ensuring that projects also locate where grid capacity, land and water constraints make sustainable expansion of capacity technically feasible. This would foster lower PUE levels across the EU as access to the zones would also be linked to susta inability performance . Without this linkage, adv erse consequences linked to excess grid stress or carbon -intensive expansion would undermine SO1. The regular monitoring of compute capacity and national strategies would ensure that the intervention is effective in closing the demand -supply gap , without under or over supply ing capacity across the EU. PO1-C is expected to be less effective than PO1-B, due to the addition of 79 a decision step at EU -level over what is currently decided at nati onal or regional level . PM10 consolidates the 27 national permitting and fast-tracking systems for data centre deployment into a single EU -level decision framework. This centralisation is expected to create different types of inefficiencies for data centre deployment. The first one would be related to the number of projects that would be processed in parallel. While under PO1 -B access to fast -track areas can be authorised in parallel across MS, under PO1 -C projects must pass through a common EU -level decision layer, which is likely to limit the throughput of projects that can be supported. The lower effectiveness of this option was also strongly raised by stakeholders during workshops and interviews, where several operators and public authorities expressed their concerns that an EU - coordinated process would slow down procedures rather than accelerat e deployment. They specifically mentioned that top -level identification of fast -track areas for projects would be less able to reflect geographical and local specificities, e.g. related to grid cond itions or community impacts. While u nder PO1-B, the social acceptance of DCs is expected to be the greatest, as decisions on build -out would give a greater role to local authorities and are thus taken closer to citizens, EU-level decision making on DC depl oyment will likely be perceived as taken far away from citizens. This option is expected to be mostly effective in promoting sustainable technologies through EU R&D funding ( PM8) and EU deployment funding ( PM9). These measures are expected to improve technology readiness, e.g. in advanced cooling or energy management, while also de-risking first-of-a-kind projects of a strategic interest. Therefore, this option is expected to perform better than the other options and the baseline on long -term sustainable co mputing capacity, while below them in terms of short to medium-term delivery of additional data centres. All POs dealing with the dependence on cloud and AI computing services provided by non -EU providers (PO2-A, PO2-B and PO2-C) are expected to have an indirect impact on DC capacity in the EU, particularly PO2-C as one of the criteria to identify sovereign services across all levels includes the need for infrastructure to be located in the EU. Therefore, if the demand for sovereign services increases, the infrastructure in the EU will also have to increase. Looking at SO2 (ensure attractive conditions for the deployment of sustainable and innovative computing capacity), PO1-A would provide a relatively low -cost way to address the bottlenecks that affect DC build-out in the EU. However, it is expected to have a limited effect on addressing permitting delays, access to resources and capital for strategic projects. Under this scenario, attractive conditions for data centre deployment are built through structured dialogue and guidelines, which contribute to reduce uncertainty for businesses and investors during site selection and project design. The reduced transaction costs allow operat ors to face fewer project redesigns, while authorities also rely on shared benchmarks. This is expected to somehow reduce permitting timelines by a few weeks and lower regulatory risks but would not consistently change the economics of new data centre proj ects. Similarly, this option is expected to lead to improvements in established markets, without unlocking significant capacity deployment in other regions or alternative locations , other than through natural market dynamics . PO1-B shows a significant pote ntial to reduce bottlenecks for DC buildout, thus ensuring more attractive investment conditions. The introduction of fast -track areas would address inefficient procedures, uncertainty in approval processes and delays that operators cite as critical barriers . The systematic mapping of suitable sites and removal of zoning uncertainty are expected to make land investment-ready and reduce underut ilised yet suitable sites. In parallel, the creation of a project facilitator aims to accelerate administrative processes and is expected to decrease the time for 80 building a new DC facility by at least 6 months 122. This improved timeline reliability is tran slated as higher project Net Present Value and Internal Rates of Return (IRR) for investors , with an expected increase in private capital mobilisation . Under this option, projects’ IRR would rise by over 80 basis points with respect to the baseline, increa sing from 9.86% to 10.70%. This shift is expected to enhance investor appetite, as confirmed by interviews with investors, who highlighted that this shift in IRR can reposition assets within investor target bands, improving competitiveness against alternat ive infrastructure investments and affecting bankability 123. This is particularly relevant for mid -sized European data centres (typically 5 –25 MW), which are aligned with institutional investment ticket sizes but face tighter margins and higher relative development risk than hyperscaler projects. Where needed, n ational funding support (PM6) can help lower capital and operating costs, improving project bankability and investment decisions , especially for smaller providers, thus lowering their entry barriers in the market . Sweden has provided a useful example of how tax incentives could be poorly managed if not linked to specific energy objectives and subsequent evaluationcxciv. Monitoring deployment is also expected to increase policy credibility and transparent information for investors. By targeting the drivers of geogr aphic clustering (i.e. divergent frameworks, path dependency, uninternalized externalities) and lowering entry barriers in underutilised regions, this option is expected to unlock investment in secondary markets, e.g. Italy or Portugal, and in developing regions, e.g. Bulgaria124, leading to a rebalancing of capacity across the EU . PO1-C, although effective at addressing fragmentation and promoting harmonisation through EU-level coordination, is expected to be less effective in achieving relevant reductions in permitting duration and financing conditions of projects. On one hand, R&D funding and deployment funding would be a relevant political signal towards the development of sustainable digital infrastructure. EU-level coordination would also help minimise regulatory hurdles for cross -border investors . With respect to promoting a more geographically balanced distribution of capacity and increase land optimisation, EU-level decision making is , in principle, best placed to steer deployment towards an optimal territorial allocation of computing infrastructure. However, its effectiveness in reaching this objectiv e is contingent on local engagement, which may be harder to secure than under PO1-B. Industry consultations highlighted that the creation of additional governance layers could slow down decision -making processes, especially if still requiring national or l ocal review. Thus, this option is expected to be less effective than PO1-B in addressing barriers to deployment. For SO3 (decrease the overall reliance on non -European cloud and AI computing services ), PO2-A is expected to have limited effectiveness relative to the baseline . Harmonised criteria, guidelines and a dedicated conference, are expected to increase clarity and promote a more coherent understanding of the concept of sovereignty. This may reduce inform ation asymmetries and improve comparability of service offerings, especially in public procurement. However, these measures are unlikely, on their own, to shift demand away from non -European cloud and AI computing services. In the absence of clear and robu st assessment mechanisms to verify the 122 This has been confirmed through interviews with stakeholders and validated during a final workshop in the context of the supporting study. The impact has been assessed on the basis of an overall 18-month permitting period for data centre deployment. However, any reduction in this timeline, including for example through the introduction of as 12-month deadline would further increase Europe’s attractiveness as a location for data centre investment 123 Interviews with investors confirmed that data centre investments are evaluated across a wide risk -return spectrum, broadly consistent w ith market benchmarks positioning core infrastructure targeting around 7 -9% IRR and core -plus assets around 10 -13%. Expected returns depend strongly on asset maturity and risk profile: stabilised, fully built platforms with secured power and long -term contracts are treated as lower -risk assets, while development -stage projects face higher execution risk related to permitting, power availability, equipment procurement, and commercialisation. Equity investors typically target “single digit returns plus a risk premium,” with materially higher expectations for projects exposed to development, energy, or commercial risk. 124 During stakeholder interviews, and as mentioned above, Bulgaria was identified as lacking a clear classification of data centres in its permit ting system, creating long delays and deterring investment in the country. 81 harmonised criteria, sovereignty claims would remain self -declared and the notion of sovereignty risks remaining a marketing tool with little or no effect in trust building. Ensuring the effectiveness of the interoper ability provisions of the Data Act would contribute to creating opportunities for EU providers to build integrated offers. However, the Data Act’s effects remain to be seen, given its recent adoption . The main consequences of this option would reside in the gradual standardisation of the services, coupled with measures to promote interoperability, rather than a structural change in procurement or deployment choices, which would alter existing market dynamics. PO2-B is expected to b e moderately effective in meeting this objective. A voluntary sovereignty framework combined with voluntary award criteria that give weights to factors such as the resilience of the EU cloud supply chain are expected to strengthen trust in cloud and AI computing technologies, especially for the public sector . Through spillovers, parts of the private sector could also be impacted , notably in sectors where sovereignty considerations are strategically important. By enabling the federation of computing capacity, as opposed to procuring from external providers, the option would produce more concrete substitution effects than PO2 -A or the baseline . The option is expected to broaden the range of eligible procurement models for public authorities, e.g. in terms of tender design, vendor evaluation, without mandating a universal switch to sovereign solutions. The vendor -neutral cloud and AI computing services training programme is also expected to reduce the reliance on few, vendor -specific training and certification programmes. The overall effe ctiveness of the option in decreasing the reliance on non-European cloud and AI computing services would depend on authorities’ administrative capacity, procurement design and consequent market responsiveness. It could reduce some exposure to third country dependencies if contracting authorities choose services with stronger EU control features. This PO’s weakness lies in the voluntary nature of the proposed measures, which could result in uneven adoption across Member States. PO2-C is expected to be the most effective option in reducing the reliance on non -EU cloud and AI services . The combination of joint procurement mechanism, the mandatory sovereignty risk assessment and mandatory award criteria, along with the promotion of open source solutions is expected to have more substantial impact on market outcomes compared to other options and the baseline. Unlike softer or voluntary measures, this package embed s an approach to sovereignty into market access and purchasing decisions, going beyond mere clarification or incentives . First, the mandatory sovereignty risk assessment for procuring cloud and AI services plays a crucial role in embedding so vereignty and dependency-related considerations into procurement decisions. This measure ensures that contracting authorities procure services considering the sovereignty implications of decisions, leading to more informed choices. By bringing clarity with respect to the u se cases for which cloud and AI computing services shall be procured under specific sovereign levels, the approach contributes to reducing the reliance on non -EU cloud and AI services . In fact, levels 3 -4, which are estimated to cover 10% of the public sector’s needs, would need to be served by EU providers to address and ensure the protection of public order in the public sector. Most procurement cases would fall under intermediate levels of sovereignty, where non -EU providers can participate. However, EU providers are likely to face fewer difficulties in complying with the sovereignty requirements, giving them a competitive edge (the reasoning for these numbers is presented under the descriptions of policy measures PM15 and PM21 in section 5.2. 2, and the coverage of the necessary range of services by EU providers in section 2.3.1). Moreover, with a view to reducing critical dependencies, the non-price award criteria would allow public authorities to procure cloud and AI computing se rvices with a higher level of local added value. The overall monitoring framework managed by the Commission would support Member States in assessing the market presence of EU providers. By advancing an EU -coordinated procurement and support framework for s overeign services, the option is also expected to increase trust in cloud and AI computing 82 services and accelerate the cloudification of on -premises solutions of the most critical use cases, while creating market opportunities for sovereign European cloud providers. This approach is also expected to create broader spillover effects beyond the public sector. Notably, the mandatory nature of the sovereignty framework as well as the proposed extended risk assessment for essential entities of the private sector listed under Annex I NIS 2 to address sovereignty-related risks are expected to create a wider spillover effect compared to that of PO2 -B. The main challenge that could hinder the adoption of sovereign services in the private sector could be a “sovereignty- premium price” whose range remains subject to be established (see discussion un der section 2.3.4). However, several companies in critical sectors have already publicly manifested their interest in those solutions and are moving towards that direction125. This would be amplified through the SME support scheme fostering cloud and AI adoption among SMEs, and the creation of toolbox for the integration of EU providers solutions , which is expected to increase the visibility of EU sovereign services. Building on this, the joint procurement mechanism allows public sector organisations to pool their purchasing power, creating a larger and more stable market for inter alia EU providers. This mechanism is also expected to attract more investment, reduce costs and improve the overall competitiveness of EU providers, making them comparable alternatives to non -EU providers126. Moreover, t he promotion of open source solutions within public administrations would further reinforce this objective by improving fairness and transparency, reducing vendor lock-in, stimulating competition among providers, and opening the market to alternative solutions and to new entrants. This measure encourages innovation and local development, creating opportunities for European companies to thrive in the cloud and AI market , and contributing to the growth of the open source services sector in Europe . Overall, the measures included in policy option PO2 -C work together to reduce the reliance on non -EU cloud and AI services, promote European sovereignty, and foster a robust and competitive European cloud and AI ecosystem. By addressing the risks associated with dependency on non -EU providers with a granular, layered sovereignty framework and promoting the development of Eu ropean solutions, this option is expected to have a lasting impact on the market, creating a more sustainable and resilient foundation for the public sector's digital transformation. For SO4 (enhance the resilience of supply of cloud and AI computing serv ices, in particular in the public sector), PO2-A is expected to have a very limited effect due to the soft nature of the measures. While common criteria and guidance may improve awareness of relevant risks and encourage the use of more coherent definitions by public authorities, they would not materially increase switching capacity, supply redundancy or operational continuity in the event of disruption. The option thus addresses only part of the information problem but not the structural sources of fragility and trust . This would result in having a marginal effect on reducing exposure to service disruption, or non -EU dependencies, especially in the public sector. PO2-B is expected to be moderately effective in improving the resilience of supply of cloud and AI computing services. The federation would contribute to ensuring that specific use cases are served by services with increased EU control . Federation is especially relevant from a resilience perspective as it supports the diversification of de pendencies, and reduces the risks associated with reliance on a single external provider. T he training programme on vendor –agnostic technologies and voluntary award criteria are also expected to expand the market for resilient and locally managed cloud and AI computing services. Nonetheless, as mentioned above, the voluntary implementation of these measures could limit their consistent implementation across the EU. This would result in uneven 125 See for instance Airbus who recently announced their activities to migrate their critical workloads to a European cloud provider. 126 The outcome of the recent DIGIT tender for cloud services is testament to this. Commission advances cloud sovereignty through strategic procurement 83 resilience gains: authorities with higher procurement maturity would likely benefit more, while others may not implement the framework in a way that changes their risk exposure. PO2-C is expected to have the biggest effect on resilience. The establishment of an actionable and comprehensive sovereignty assessm ent framework provides national authorities with a more robust mechanism to procure and uptake cloud and AI computing services, protecting critical use cases where public order is at stake. The framework allows for the diversification of dependencies, and services from non -European providers would still be able to qualify for 90% of the public sector’s needs. The use of harmonised public procurement award criteria would also contribute to the public sector’s resilience for specific services since procured services would have a higher EU added value. Moreover, the joint procurement mechanism is expected to simplify the procurement of cloud and AI computing services and allow public authorities – especially the smaller ones – to achieve better commercial and c ontractual terms. Finally , the promotion of open source technologies would further strengthen resilience by reducing dependencies on proprietary systems. Altogether, these measures would directly reduce exposure to non -EU dependencies and single provider concentration risks, strengthening the resilience and autonomy of cloud and AI services, particularly in the public sector. With respect to the general objective of promoting competitiveness while strengthening strategic autonomy, the options differ in eff ectiveness and in the balance they strike between the two dimensions. In terms of promoting competitiveness, the first set of options differ s in the expected ability to accelerate data centre deployment and reduce investment barriers. PO1-A would have a limited but positive effect by improving coordination and sharing good practices, although its voluntary nature means that it may not significantly re duce permitting, infrastructure or investment bottlenecks. PO1-B would be the most effective option, as national -level legislative and financial measures could be tailored to local conditions, including designated areas, fast -track procedures, public support for projects and capacity monitoring. This would directly support faster deployment and investment certainty. PO1-C could also support competitiveness through EU - level funding and fast -tracking, but may be less responsive to local permitting, energy and land- use constraints. Strategic autonomy would be strengthened under all options to the extent that additional capacity is built in the EU, with the greatest practical effect expected under PO 1-B. PO2-A is expected to make a modest contribution to competi tiveness by reducing information frictions and clarifying some notions, but it is unlikely to improve the competitive position of EU - based providers or to alter the dependency structure of the market. Its contribution to strategic autonomy would therefore also be limited. In practice, it would preserve the status quo in market structure while improving transparency. As a result, it is unlikely to achieve the general objective. PO2-B is based on a more comprehensive set of measures that may impact competitiv eness and strategic autonomy . Its contribution to competitiveness would come from stronger demand for sovereignty-audited services, greater contestability through federation and interoperability, and reduced lock -in. Its contribution to strategic autonomy would come from lower dependency in sensitive use cases and a gradual expansion of EU -controlled capacity. However, the option may not be strong enough to overcome incumbent scale advantages, so both competitiveness and autonomy gains may remain incomplete. PO2-C is likely to deliver the strongest gains in strategic autonomy. It is the option most likely to expand the market position, scale and credibility of sovereignty-qualified providers, and therefore the most likely to change the structure of the market in favour of strategic autonomy. Over time, this could support competitiveness if stronger EU demand fosters scale, innovation capacity, local value creation, and broader ecosystems around interoperable and open solutions. In terms of achieving autonomy, this is the option which most effectively prevents unlawful access to European data through non -European laws that have an extraterritorial reach, but in a proportionate way. In fact, MS can decide which use cases should 84 fall under higher levels of sovereignty assurance, based on their considerations. To support the Single Mark et, the Commission would issue EU -level guidance for MS to conduct their risk sovereignty assessments. While not ensu ring a unique outcome, this would be a signal for authorities to converge towards a unique approach. Doing this would allow providers to operate more easily across the EU, thanks to common criteria and approaches to which services can be served under diffe rent sovereignty levels. Competitiveness is also preserved because the sovereignty framework is devised in a way to better align MS with the available offer from European operators thanks to the market monitoring reports provided by the Commission . These would allow Member States to integrate a market reality check in their risk assessments, avoiding situations such as tendering at Level 3 where competition is limited or no solution exist s. These market monitoring reports would also act as a powerful guidance for EU providers to prioritise the development of their offering, thus incentivising the emergence of a competitive European alternative. In terms of long run competitiveness, the use of clear sovereignty levels for different use cases based on a risk s overeignty assessment is also expected to reinforce trust and the uptake of cloud and AI technology across the EU economy and society127. The overall effectiveness assessment with respect to each specific objective is presented below using a symbolic scoring, using ranking indicators that go from “ o” no relevance to “ very effective”, with respect to the baseline. Table 12. Effectiveness of the Policy Options against the Specific Objectives SO1: Increased computing capacity through innovative and sustainable technologies SO2: Attractive conditions for the deployment of computing capacity SO3: Reduced reliance on non-EU providers SO4: Enhanced resilience of supply of cloud and AI computing services Policy option 1A + ++ o o Policy option 1B +++ +++ o o Policy option 1C ++ ++ o o Policy option 2A + o + + Policy option 2B + o ++ ++ Policy option 2C ++ o +++ +++ Legend: o no relevance; + limited effectiveness; ++ effective; +++ very effective 7.2. Efficiency The table below presents a qualitative summary of costs and benefits of the Policy Options borne by the main stakeholder groups analysed under section 6.1., i.e. data centre operators, cloud and AI service providers, essential entities of the private sector, public authorities and the European Commission, mostly calculated using the standard cost model and net present value framework 128. Given the uncertainty around the estimates, the results are presented using “+” and “ -”, which reflect indicative ranges rather than precise values . The objective is to present the likely direction and scale of each option compared to the baseline . Positive signs indicate benefits, while negative ones indicate costs, while the number reflects the order of magnitude of the quantified impact. The 127 This issue was recently illustrated by the postponement of Finland’s electoral management system cloudification, previously awarded to AWS, and France’s switch from US solutions to open source equivalents to serve public sector video conferencing needs are illustratio ns of this broad trend. 128 The table does not include the impact on SMEs, which is discussed only qualitatively in the previous section. Additional info rmation on quantified costs and benefits for SMEs under PM23 can be found in Annex 4 and are reported in the efficiency overview of the preferred package below. 85 table does not incorporate non-market social and environmental externalities. These effects are discussed in the respective sections 6.2, 6.3 and further below as a relevant part of this impact assessment. Table 13. Summary of costs and benefits of the policy options – indicative ranges based on central estimates of NPV for 2027-2036 and qualitative estimates, compared to the baseline Difference to the Baseline PO1-A PO1-B PO1-C PO2-A PO2-B PO2-C Data centre operators Benefits + +++ +++ N/A N/A N/A Costs − − − N/A N/A N/A Cloud & AI service providers Benefits N/A N/A N/A + ++ ++ Costs N/A N/A N/A − − −− Essential entities of the private sector Costs N/A N/A N/A N/A N/A −− Public authorities Benefits + ++ + N/A ++ ++++ Costs − −− − − −− −− European Commission Costs − − − − −− −− Wider economic effects + ++++ +++ + ++++ ++++ Total benefits + +++ +++ + +++ ++++ Total costs − −− −− − −− −− Net benefits − +++ +++ − +++ ++++ Legend: N/A not applicable; + small benefit <€100m; ++ moderate benefit €100m-5bn; +++ large benefit €5-20bn; ++++ very large benefit >€20bn; - small cost <€ 100m; -- moderate cost €100m-5bn; --- large cost €5-20bn; ---- very large cost >€20bn Overall, all the options except for PO-2A and PO1-A are expected to generate positive net benefits relative to the baseline. For these options the expected benefits outweigh the expected costs. PO2- C is expected to generate the highest net benefits among all options. Although it also entails higher quantified costs, these remain lower than the expected benefits. PO1-B, PO1-C and PO2-B also show strong efficiency, with large, expected benefits relative to the expected costs. 7.3. Coherence In terms of external coherence, the proposed POs are consistent with existing initiatives. They seek to close remaining gaps with respect to reaching the objectives. See annex 7 for details. PO1-A/B/C complement and leverage other initiatives: PO1-A expands the existing Alliance on Industrial Data, Edge and Cloud. PO1 -B/C builds on t he future Regulation on accelerating and streamlining environmental assessments , which will simplify and speed up environmental screenings and assessments. It allows for sectoral legislation to reference a toolbox with additional favourable provisions for strategic sectors or categories, which CADA will do for DC projects built in acceleration areas129. These additional DC-specific support measures are necessary to rapidly close the capacity gap and can only be delivered in a dedicated instrument. Similarly, PO1- B/C uses the rating scheme for DC sustainability under the EED to identify which DCs are sustainable and can benefit from acceleration measures. In the same vein, PO1-B/C complements 129 PO1B/C takes the creation of a single point of contact for environmental assessments for granted and complements it with a fa cilitator (PM4) who would accompany the DC operator in this and other administrative stages (environmental assessments but also oth er permitting requirements related to zoning, land allocation and building). 86 the Grids package by ensuring DC location considers grid availability, information is exchanged sufficiently in advance to feed into grid planning and hence ensure timely connection of DCs. Finally, none of the PO1 s will overlap with the Industrial Ac celerator Act which focusses on the industrial manufacturing sector to which DCs do not belong. PO2-B/C will complement the Public Procurement Directives 2014/23, 2014/24 and 2014/25 by ensuring that the public procurement of cloud and AI computing services is covered by a specific sectoral approach which caters for its specificities : For example, for reasons of strategic autonomy, it is of utmost importance to ensure that highly critical public sector use cases of cloud and AI computing services rely on services which are shielded from third -country data access and possible interference with service continuity (PO2-B/C). This is different from a blanket ‘Buy European’ approach, which may be considered as part of the ongoing re vision of the Public Procurement Directives. Due to today’s strong reliance on non -European CSPs, a blanket ‘Buy European’ approach would not be suitable for public procurement. Instead , for reasons of public order protection , PO2-B/C put forward ways of mitigating incrementally existing dependencies through award criteria rewarding, for example, the integration hard - or software from outside the countries of dependencies . On the side of contracting authorities, this approach implies that they will have to comply with the horizontal requirements laid down in the Public Procurement Directives as well as the lex specialis of CADA, especially under PO2 -C. In view of the ongo ing review of the Public Procurement Directives , the preparatory work on the impact assessment supporting the formulation of a Public Procurement Act includes a framework regulating the use of ‘EU preference’ provisions in sectorial legislations . The measures foreseen in the impact assessment supporting the Public Procurement Act would underpin the approach taken in CADA both in terms of tools (award criteria) and justification (demonstrable relation to public order and proportionate approach to risk mitigatio n). To prepare the grounds for a faster uptake of cloud services by the public sector, CADA will be accompanied by a Recommendation on a single EU - wide cloud and AI policy for public administrations and public procurement translating the Regulation’s approach to public procurement into ready-made tender specifications. While the Data Act opens the path to a possibl e reduction of dependencies on non -EU providers by enabling switching, it does not directly incentivise the development of more sovereign cloud and AI computing services, something that PO2-A/B/C will do with different intensities. These options indirectly build on the Data Act’s right to switch and multi-cloud, which all cloud service providers must enable and which all cloud users, including public administrations, can make use of, for example to switch to a sovereign service . In laying down and using a harmonized criteria for sovereign cloud and AI computing services, PO2-A/B/C build on an existing obligation of cloud service providers under the Data Act: To take technical, organisational and legal measures to prevent international and third -country governmental access and transfer of non -personal data held in the Union, outside of recognised international law enforcement cooperation, where this would conflict with Union or national law. The harmonized criteria for a sovereign service employed across PO2 -A, B and C goes further by also capturing immunity to third -country policies affecting service continuity . This initiative thus does not create a new compliance burden for providers but rather enables those providers wishing for their services to reach a sovereignty label to build on existing compliance work under the Data Act . The AI Act already sets requirements for AI systems and general-purpose AI models ensuring a high -level protection of safety, health and fundamental rights, thus harmonising rule s for the internal market. As detailed in annex 8, PO2-A/B/C and more generally CADA, focusses on cloud and AI computing services exclusively. The Commission proposal for the C ybersecurity Act 2 empowers the Commission to impose prohibitions and mitigation measures by means of adopting implementing acts (1) p rohibiting 87 specific types of NIS2 entities from using, installing or integrating ICT components from high-risk suppliers in key ICT assets; and (2) r equiring such entities to apply targeted ICT supply chain mitigation measures, including supplier transparency obligations, restrictions on transfers or remote processing from third countries, third -party-audited technical safeguards, limits on outsourcing or supp lier contracting, requirements for personnel vetting by national authorities, or diversification of supply. CADA relies on the CSA 2 for the exclusion of high -risk cloud and AI vendors from EU critical sectors. At the same time, CADA goes further than the CSA 2 and introduces a targeted approach to mitigating sovereignty risks specific to the provision and use of cloud and AI computing services. In defining what constitutes a sovereign service under PM11, PM15 and PM21, CADA leverages the future cybersecurity certification scheme for cloud services (EUCS), where the sovereignty levels under CADA require a gradual con formity against the EUCS assurance levels . There is no overlap between the requirements of the CADA sovereignty levels an d the applicable requirements and those assessed under the EUCS, which covers exclusively technical cybersecurity aspects. Figure 11. External coherence with most relevant ongoing legislative initiatives In terms of internal coherence, all POs are designed to be coherent with the objectives of the EU and address the identified problem drivers (see also section 5.2.3) . The measures under each PO are compatible with each other, see Annex 7. Sovereignty related measures respond to the needs of ensuring public order while the measures targeting critical dependencies focus on EU added value measures, notably in the context of innovation procurement. The promotion of open source solutions aims to build a foundation for auditable, open and interoperable services and products. The publicly auditable code provides a level of transparency and verifiability that is not possible in proprietary solutions, enabling authorities to independently assess security properties and verify the absence of undisclosed data flows or access mechanisms. Open source licensing removes the legal mechanisms that make vendor lock -in so difficult to escape in practice. The levera ge that proprietary vendors have for the maintenance of the software is diminished with open source, reducing therefore the dependencies. The collaborative and distributed development models of open source create a form of supply chain resilience that is d ifferent from the proprietary solutions: open source communities distribute the maintenance and burden across a wide base of contributors, none of which can unilaterally determine the future of the project. 88 7.4. Subsidiarity and proportionality As highlighted i n sections 3.2 and 3.3, there is a clear need for action at EU level to address the identified problems and their drivers. All policy options respect the subsidiarity principle. In PO1-A, the Commission uses its convening powers to enhance the existing col laborative framework between Member States to stimulate compute capacity and remove deployment barriers. PO1-B contains EU-level rules but is designed with subsidiarity at its core since it entails decisions and financial incentives enforced at national le vel. PO1-C entails the most centralised EU action, with decisions and financial intervention enforced at EU -level, at the expense of less subsidiarity. In PO2-A, the EU’s involvement is limited to be a mere convenor of national actors , hence highly respect ful of subsidiarity . PO2-B requires more EU -level intervention, following a traditional Single Market logic through an EU -defined and Member State enforced sovereignty risk assessment mechanism, third-party audits, voluntary award criteria used for procurement of cloud and AI computing services in the public sector, and the vendor-neutral cloud and AI training programme. PO2-C adds further EU -level intervention, but in domains where no Member State can act alone, in particular as regards joint procurement. Moreover, it leaves to national authorities the ability to determine the sovereignty risk assessment outcome, while only producing guidelines to support a uniform implementation across MS. All policy options are assessed to be proportionate, as EU -level action is limited to what is necessary to advance the EU’s capacity, capability and autonomy in cloud and AI computing . PO1-A represents the lowest level of intervention and is less effective , while PO1-B entails the necessary and most effect ive EU-level intervention to address bottlenecks in the deployment of DCs by requiring that Member States implement national procedures. PO1 -C is more ambitious and would entail additional administrative implications in terms of coordination with Member States. PO2-A introduces transparency measures that have limited prospects of changing current trends. It is proportionate to its ambition, as it imposes low compliance costs but its capacity to effectively achieve the intervention’s objectives is limited. PO2-B further improves market openness with additional compliance mechanisms that would increase impacts and the expected benefits but may not be sufficient due to their voluntary nature. PO2 -C is the most ambitious option as it proposes structural changes, through a tailored approach in existing public procurement practices and organise d joint efforts. It is the most proportionate option given the magnitude of the problem and the intervention’s goal to secure the necessary conditions for the Union’s competitiveness and strategic autonomy . It strikes a balance between the need for effective sovereignty and the need to minimi se unnecessary burdens. By establishing a granular framework with four levels of sovereignty, this option provides a nuanced and targeted approach to addressing the needs of both the public and private sectors. This tiered approach is justified, as it reflects the varying degrees of sensitivity and criticality of different use cases, and ensures that restrictions are proportionate to the ri sks involved. The addition of attestations of qualification to the Business Wallet of service providers and the establishment of a publicly available repository of qualified services facilitate transparency, reuse, and sharing among stakeholders. 7.5. Sensitivity analysis The analysis has been designed to account for uncertainty and the multidimensional nature of policy impacts. As further detailed in Annex 4, a scenario -based sensitivity analysis was carried out to understand how the output of the cost -benefit analysis (CBA) behaves in response to changes in its inputs and assumptions . It was conducted to verify the uncertainty range (confidence interval) of the values estimated in the CBA for the most impactful policy measures . Given the different design, target stakeholders, and the type of impacts generated, the variables under scrutiny are not uniform or comparable. Therefore, r ather than applying a full sensitivity 89 analysis, a bounded variation assessment was performed by introducing minimum and maximum variation to relevant parameters, thus creating worst and best case scenario for each measure130. 7.6. Comparison per criteria The following table synthesises the qualitative and quantitative analysis presented in Section 6, summarising the potential impacts of the policy options across economic, social and environmental dimensions. Table 14. Summary of economic, social and environmental impact of the Policy Options, relative to the baseline Criteria PO1-A PO1-B PO1-C PO2-A PO2-B PO2-C Economic impact + +++ ++ + ++ +++ Social impact + ++ - + ++ +++ Environmental impact + - ++ o + + Legend: o neutral impact; + minor positive; ++ positive; +++ significant positive; - minor negative; -- negative impact; --- significant negative, all with respect to the baseline With respect to their economic impact131, PO1-B and PO2-C are expected to deliver the strongest outcomes, mainly driven by long-term benefits due to accelerated infrastructure developmen t, joint procurement and cloud federation among Member States . PO1-A delivers only modest benefits, limited to administrative si mplification and minor efficiency. By issuing guidelines and reinforcing the current collaborative framework between data centre developers, cloud service providers, energy actors, public authorities and other relevant stakeholders, the option would reduce some uncertainty around data centre planning and deployment. Data centre operators and authorities would benefit from greater predictability in permitting and common engagement. However, because this option would not introduce binding legal changes, dedic ated support or formal deployment mechanisms, its impact on investment decisions would remain modest. In terms of innovation and technological sovereignty, this option could help create a more predictable environment for data centre development but would n ot change Europe’s ability to scale cloud computing capacity . Wider economic effects would also be positive but limited , considering the reduced friction, better information flows and improvements in investment conditions. PO1-B is expected to have a more significant economic impact, as it would generate the strongest infrastructure related economic benefits, driven by increased computing capacity. By promoting legislative and financial measures in the form of project facilitators for data centre deployment, areas for fast -track sustainable development, possible national funding mechanisms for priority projects and monitoring of capacity, this option would create stronger incentives for investment. Reducing delays linked to data centre deployment would consequently decrease their time to market and potentially further crowd in private investment. For data centre operators the main benefits would stem from more predictable permitting procedures, clearer administrative pathways and potentially lower risks . Increased attractiveness of the Union for investment decisions would also help address regional capacity gaps. For public authorities, this option would involve higher administrative responsibilities than PO1 -A, as they would need to designate these zones and contribute to setting up project facilitators . These costs are expected to be offset by broader economic benefits , including increased investment , job creation and local infrastructure development. This would also contribute to strengthen the infrastru cture based needed to develop cloud solutions, AI and support digitalisation in the public and private sector. Under this option 130 This reflects the structure of the standard cost model used for most of the policy measures, which relies on a limited number of inputs, thus limiting the interpretability of traditional one-at-a-time sensitivity testing. 131 The scoring of economic impacts reflects the estimated costs and benefits associated with each policy option, but also their broader effects on industry (including SMEs), public authorities, innovation and technological sovereignty, possible wider economic effects, trade, and the functioning of the internal market. 90 the Commission’s role would focus on monitoring capacity, supporting coordination across Member States and ensuring consistency with other EU -level objectives. PO1-C also produces gains through EU -level fast-tracking and funding, but these remain below PO1 -B due to smaller expected time savings and a more centralised implementation , which is expected to reduce its effectiveness. The evidence collected suggests that the expected economic benefits under this option would be weakened by implementation delays due to the additional coordination and governance arrangements. For operators this would reduce the value of EU -level deployment and support. For public authorities, the option could offer long -term benefits by creating a more coherent EU-level mechanism for data centre deployment . However, the need to coordinate at EU level is expected to create administrative complexity , as national authorities would still need to be involved in permitting, zoning , energy coordination, environmental assessments and local processes, including community engagement. The option could still have a relevant economic impact but the evidence collected sug gests that this would be slower to materialise and less effective in addressing deployment bottlenecks and national decision making procedures. PO2-A yields limited economic benefits by increasing transparency and visibility of sovereign cloud and AI computing services , with overall net costs aggregated across stakeholders . For cloud service providers, especially smaller European ones, this option could still reduce barriers to market entry and help users better understand available services. However, due to the non -binding nature of the measures, the impact on actual demand and procurement behaviour would be limited. Similarly, the impact on technological sovereignty would be positive but modest , contributing the overall positive but minor economic impact of this option. PO2-B is expected to improve economic outcomes by reducing cross -border compliance costs and increasing trust in sovereign services, generating net benefits. Providers would be able to leverage the voluntary frameworks to create reputational and market benefits . Wider economic benefits are expected and could include increased demand for sovereign services and overall stronger market competition. However, while recognising the positive economic impact of the option on different stakeholders, its effectiveness in achieving these results would ultimately depend on market uptake and public sector adoption. PO2-C builds on PO2 -B and is thus expected to deliver the largest eco nomic impact, despite higher costs . The sovereignty risk assessment is expected to enable a once -only audit process across MS with significant savings for providers , whereas the joint procurement and federation mechanism are expected to enable savings for authorities procuring cloud and AI computing services and exchanging their idle compute capacity. The impact of this option on innovation and technological sovereignty is expected to be substantial. By using public demand strategically, the public sector could support the development and scaling of sovereign cloud and AI computing services, while still leaving to non-European providers a relevant share of the market, based on MS needs and individual assessments. Wider economic effects would include increased competition, higher productivity through broader adoption of advanced cloud and AI computing services, greater resilience of digital supply chains and stronger opportunity for European SMEs. While dire ct economic impacts were more robustly quanti fiable, social impacts were not monetised due to the absence of data on willingness to pay or stated preferences. The impacts considered include differences in employment , skills development, and public acceptance of the different options . PO1-B in combina tion with PM8 and PM9 is expected to produce the best outcome among the first set of options, especially in terms of additional employment created and public acceptance of new data centre projects . The option empowers local authorities in siting decisions, thus fostering decision-making processes closer to citizens . Positive social impacts are also expected as this option focuses on shaping data centre development towards sustainable, innovative and strategic projects , e.g. facilities contributing to tangible community benefits such as waste heat reuse and overall dev elopment of local economies . Conversely, PO1-A delivers 91 limited engagement gains, while PO1 -C weakens perceived proximity to decision -making. For cloud and AI services, PO2 -B and PO2 -C address skills shortages and employability, supporting broader societal acceptance of technological sovereignty . Finally, environmental impacts were assessed in environmental terms but not monetised to ensure consistency across impact categories and avoid bias from uncertain valuation assumptions. In this context , PO1-C would achieve the strongest performance by combining efficiency -driven innovation, sustainable siting, and renewable integration, substantially reducing emissions intensity while limiting energy growth. By contrast, PO1-B’s capacity expansion outweighs efficiency gains, resulting in the highest absolute increases in electricity demand and CO₂ emissions. PO2 -B and PO2 -C provide modest environmental benefits through improved server utilisation and reduced duplication of infrastructure under the cloud federation. The multi -criteria analysis (MCDA) was used to complement the CBA by integrating survey- based evidence on the perceived effectiveness of the measures, as well as their expected environmental and social impacts. It provided an alternative analytical lens, particularly through its underlying components, i.e. stakeholder responses of the proposed measures. The aggregate results were interpreted with caution, as they reflect the original configuration of measures and options, which was partly superseded by subsequent refinements. Overall, the weighted aggregate scores across the different assessment dimensions confirm ed the consistency of the initial comparative assessment (see annex 4 section 6) . With respect to Problem 1 - limited and geographically concentrated availability of computing capacity in the EU - economic operators showed a preference for PO1-B over PO1 -C. Similarly, PO1-B scores higher for national public authorities, driven mainly by better cost outcomes and perceived social and environmental effects. With respect to Problem 2 - Dependence on cloud and AI computing services supplied by non - European providers – the results pointed to a clear preference for PO2-C because of its expected economic and social benefits, including potential effects on transparency and citizen trust . On the other hand, na tional public authorities appeared to favour PO2-B due to the voluntary nature of most of the measures. This should be nevertheless interpreted with caution as na tional authorities represented a limited share of survey responses, which may have affected the robustness of the aggregate scores. Table 18 compares the different POs against the criteria presented in Section 7, summarising the relative performance of each option against the baseline scenario in terms of effectiveness, efficiency, coherence, subsidiarity and proportionality. Table 15. Comparison of the options per criteria, relative to the baseline132 Criteria PO1-A PO1-B PO1-C PO2-A PO2-B PO2-C Effectiveness + +++ ++ + ++ +++ Efficiency − +++ +++ − +++ ++++ Coherence ++ +++ ++ ++ ++ +++ Subsidiarity and proportionality +++ +++ ++ +++ ++ +++ Legend: o no relevance; + more effective/efficient/coherent/proportionate than the baseline; +++ much more effective/efficient/coherent/proportionate than the baseline; - less effective/efficient/coherent/proportionate than the baseline; --- much less effective/efficient/coherent/proportionate than the baseline PO1-A’s soft measures contribute to making it a cost -effective and coherent option but limit its effectiveness, as it contributes to the specific and general objectives only to a limited extent with respect to the status quo. PO1-B’s administrative simplification and fast -track areas strengthen its 132 “+” (more effective/efficient/coherent/proportionate than the baseline) to “+++” (much more effective/efficient/coherent/prop ortionate than the baseline); from '-' (less effective/efficient/coherent/proportionate than the baseline) to '---' (much less effective/efficient/coherent/ proportionate than the baseline). 92 effectiveness by achieving the greatest expected increase in compute capacity and reduction of bottlenecks for DC deployment, while being proportionate to solve the issue and leaving implementation within Member States. PO1 -C’s EU -level measures improve effectiveness and efficiency, given the EU -level centralisation of efforts, but constrain subsidiarity through centralised enforcement. PO2 -A improves effectiveness in reaching the specific objectives but presents overall net costs and falls short of the challenge at hand . PO2 -B’s design balances coherence and efficiency, while achieving only moderate effectiveness given the magnitude of the problems to be addressed and the voluntary nature of its measures. By encouraging rather than mandating a gradual shift towards more sovereign solutions in the public sector, PO2 -B may accelerate some porting and migration costs for users and providers, although they are expected to remain relatively contained and market -driven. Finally, PO2-C generates strong synergies across all criteria, with the highest costs and savings over ten years, ref lecting high ambition a t the expense of increased operational complexity. It is likely to accelerate porting and transition costs more significantly, particularly for entities deciding to move workloads and applications to the highest levels of sovereignty assurance. While the option could increase operational complexity and short to medium-term costs, it would be more proportionate and coherent than other options as it matches the scale of the interventions to the nature of the challenge. Moreover, the exp ected upfront and operational costs should still be weighed against long-term and less easily quantifiable benefits, including reduced strategic dependencies, increased control over critical digital infrastructure, improved resilience and greater European technological sovereignty. 8. PREFERRED OPTION 8.1. Outcome of comparison of policy options Structuring the policy options into blocks addressing individual problems has allowed to evaluate the most effective, efficient, and proportionate measures from each block of options, while also analysing the package’s comprehensiveness in addressing both problems and their underlying drivers. This section brings together the evidence across criteria to assess the relative merits of the policy options in addressing the identified problems and objectives. For the first problem , PO1-B performs as the option that most effectively improves the limited availability of computing capacity in the EU relative to the baseline and alternative options . Administrative streamlining and fast -track permitting at national level , coupled with strategic funding and monitoring of capacity, appear as the most impactful options to tackle the bottlenecks for expanding such capacity in the EU . The option is expected to generate greater benefits than costs for both private sector and public sector stakeholders. Moreover, public acceptance of data centres is expected to be highest because local authorities would have a stronger role in decisions on where and how they are built. This means that decisions would be made closer to the people affected by them. By contrast, PO1-C is expected to reach a lower level of computing infrastructure deployment than PO1 -B, because PM10 adds a layer of decision -making at EU - level. Nevertheless, PO1 -C reaches the best environmental impact due to the expected positive contribution of EU-level funding (PM8 and PM9) to R&D and innovation in sustainable technologies. Given the importance of fostering deployment of data centres with a focus on sustainability and reducing environmental impacts, for the first problem, the analysis points towards a package centre d on PO1-B, supp lemented by PM8 and PM9 as a proportionate response. This combination is expected to offer a favourable balance between supporting deployment of capacity and better energy efficiency and environmental performance per unit of new capacity. With respect to the second problem, PO2-C emerges as the best performing option across the comparison criteria. Through clarity in the definition of sovereignty, which is also defined in a 93 proportionate manner, combined with complementary measures addressing procurement and open source, it will facilitate the uptake of solutions that meet desired sovereignty levels , and provide opportunities for European providers. It incorporates, in an incremental way, several elements of the other PO2 policy options. Additional individual PMs are expected to deliver only limited marginal gains: PM12 and PM13 are soft measures that the Commission could decide to undertake in the future should the need arise; PM14 lacks perspective on how effective the enforcement of the Data Act will be (see annex 4). On this basis, PO2 -C is retained as the preferred package addressing the second problem. As outlined above, the first set of options primarily addresses SO1 and SO2, while the second set is more directly aligned wit h SO3 and SO4. Given this differentiated contribution, a combined application of the best performing options among the two sets is expected to be the most effective approach to tackle the full range of problems and underlying drivers identified in the problem definition, which are heterogeneous in nature. Taken together, these options would also support the achievement of the general objective of ensuring the functioning of the internal market for cloud and AI computing services and secu ring the necessary conditions for the Union’s competitiveness and strategic autonomy , by providing a coherent response to the interconnected challenges identified. Therefore, with regards to effectiveness, the preferred package is expected to address the identified problem drivers in a comprehensive manner and, relative to the baseline, achieve a “very effective (“+++”) score against all Specific Objectives. SO1: Increased computing capacity SO2: Conditions for sustainable and innovative capacity SO3: Decreased reliance on non-EU providers SO4: Enhanced resilience of supply of cloud and AI computing services Policy option 1A + ++ n.r. n.r. Policy option 1B +++ +++ n.r. n.r. Policy option 1C ++ ++ n.r. n.r. Policy option 2A + n.r. + + Policy option 2B + n.r. ++ ++ Policy option 2C ++ n.r. +++ +++ Preferred Package +++ +++ +++ +++ The retained package is hence made of the following policy measures: PO1-B: • PM4 - National facilitator • PM5 - Fast-track areas • PM6 - National funding support • PM7 - Deployment targets • PM8 - EU R&D funding • PM9 - EU deployment funding for strategic projects PO2-C: • PM19 - Mandatory award criteria (which builds over PM16) • PM20 – Open Source use in the public sector • PM21 – Mandatory sovereign risk assessments for the use of cloud and AI computing services (which builds over PM11 and PM15) • PM22 – Joint EU-level procurement of cloud and AI (which builds over PM17) • PM23 – SME cloud and AI support scheme (which has synergies with PM18) • PM24 – Cloud and AI toolbox Overall, the analysis suggests that PO1-B and PO2 -C perform relatively strongly in terms of economic and social benefits , while PM8 and PM9 play an important role in supporting environmental sustainability . This highlights the importance of combining such options to balance growth, sovereignty, and climate objectives in a balanced manner. 94 This package combining PO1 -B, PM8 and PM9, is expected to generate positive efficiency effects, as the expected benefits in the short and medium term seem to outweigh the generated costs over the assessment period for different stakeholders . The main expected benefits under PO1-B arise from the measures that simplify procedures and reduce fragmentation across Member States. Similarly, under PO2 -C key benefits are expected for public authorities under the joint procurement scheme and the federation of capacity. These are altogether expected to reduc e administrative burdens, shorten timelines and improve legal certainty for private operators and public authorities. This combination of options also entails implementation and transition costs. There are mainly linked to adapting systems and procedures, familiarising stakeholders with the new requirements and ensuring compliance. Most of these costs are one -off or transitional in nature, while several of the expected benefits are recurring over time. This combination of options is expected to deliver a po sitive balance of costs and benefits, while achieving the objectives in a proportionate and cost effective manner. In terms of coherence, the package is consistent with the policies described under section 1.2. The analysis does not indicate significant overlaps, as the measures tackle the DC, cloud and AI markets from different perspectives. Instead, they address the objectives pursued, while securing the EU’s digital competitiveness and resilience. This package is also respectful of subsidiarity and proportionality principles. Whil e Member States in principle can enact at national level many of the measures, both problems addressed are characterised by common underlying drivers across the EU and would require a degree of coordination and harmonisation that cannot be ensured through national action only. EU-level intervention is therefore expected to offer clear added value , as the objectives of this initiative seem impossible to be achieved sufficiently by Membe r States alone . At the same time, the achievement of the expected impacts will be shaped by n ational implementation choices and contextual factors, underlining the key role of Member States in materialising the initiative. The MCDA was also used to examin e the options and measures from an additional perspective. While it assessed the options separately for each problem area, it provided a wat to consider their performance across effectiveness, environmental and social impact dimensions. This approach allowed us to capture additional social and environmental effects, for which robust monetary valuation such as willingness to pay or shadow price estimates, was not available. 8.2. Application of the “One In One Out” (OIOO) Approach The preferred policy package is expected to lead to both administrative cost savings and administrative costs for businesses and national public authorities. The details of how these administrative costs and savings have been quantified, including the underlying assumptions ca n be found in Annex 4, section 3. The table below summarizes the main administrative costs and savings, including details on the related activities, who is affected and their quantification. Table 16. Application of the OIOO approach - Businesses Preferred package Activities Economic operators affected Monetization (NPV 2027 – 2036) PO1-B PM5* One-off administrative costs of preparing the application file to access the fast-track areas Data centre operators EUR 0.8 – 2.8 m PO1-B PM6 One-off administrative costs of preparing the application to respond to the calls (est.12 applications every two years) EUR 0.2 – 1.3 m PO1-B PM7 Recurrent administrative costs of survey response time and eventual periodic verification of data on compute capacity EUR 0.2 – 0.6 m PM8 One-off administrative cost of preparing the Data centre EUR 0.7 – 1.6 m 95 Preferred package Activities Economic operators affected Monetization (NPV 2027 – 2036) application under calls for proposals (est. 20 applications every two years) operators PM9 One-off administrative cost of preparing the application under calls for proposals (est. 15 proposals every two years) Data centre operators EUR 0.4 – 1.2 m PO2-C PM19 Recurrent administrative costs of adapting the offers to the new criteria Cloud and AI service providers EUR 13.6 – 96.4 m PO2-C PM21 Recurrent administrative costs for new audits at assurance level 2 - 4 Private sector (independent auditors) EUR 4.4 – 4.4 m PO2-C PM21 Recurrent administrative costs for audit renewals at assurance level 2 - 4 Private sector (independent auditors) EUR 7 – 7 m PO2-C PM21 Recurrent administrative costs of intermediate audits at assurance level 2 - 4 Cloud and AI service providers EUR 53.9 – 134.8 m PO2-C PM21 Recurrent administrative burden for private sector entities under NIS 2 Annex 1 to address non - technical risks Private sector entities operating in sectors listed under Annex I of NIS2 EUR 480– 2 620 m PO2-C PM21 Recurrent administrative cost savings in intermediate audits from doing it once for all 27 MS Cloud and AI service providers EUR 404.3 – 2 021.4 m PO2-C PM23 One-off administrative cost of preparing the application under call for applications (est. 16,000 applications per year) SMEs EUR 27.7 – 83.4 m *PM4 and PM5 are expected to generate reduced administrative burdens and improved information through more consistent and pre dictable interactions with permitting bodies. However, these administrative savings have not been monetised due to the lack of robust data and their relative smaller scale compared to the economic benefits captured through the NPV approach. Table 17. Application of the OIOO approach - Public Administrations Preferred Package Activities Monetization (EUR, NPV 2027 – 2036) PO1-B PM4 Recurrent a dministrative burden reduction thanks to the project facilitator which would reduce parallel processing and back-and-forth interactions EUR 83.1 – 138.6 m PO1-B PM5 One-off administrative costs for drafting the strategies for national data centre deployment EUR 1.2 – 6.1 m PO1-B PM5 Recurrent administrative costs of mapping the fast -track areas and updating the strategies EUR 46.4 – 86.3 m PO1-B PM5 Recurrent administrative burden reduction thanks to the fast-track areas with additional reduction in parallel processing and reporting duties EUR 83.1 – 138.6 m PO2-C PM19 Recurrent administrative cost savings from using standard non -specific award criteria when drafting the specifications EUR 4.3 – 13.1 m PO2-C PM19 One-off administrative cost to update the procedures related to the public procurement of cloud and AI computing services and draft plans on highly critical use cases involving the purchase of sovereign services EUR 3.4 – 13.5 m PO2-C PM19 Recurrent administrative costs to update the plans and track their progress EUR 46.4 – 115.4 m PO2-C PM20 One-off administrative costs to adapt the procurement templates to promote open source EUR 6.9 – 13.9 m PO2-C PM20 Recurrent administrative costs to maintain the Open Source Programme Office each year EUR 60.5 – 211.7 m PO2-C PM21 Recurrent cost savings from using the sovereignty scheme in tenders Around EUR 2.5 m PO2-C PM21 Recurrent administrative costs from validation of the audited services and renewals EUR 0.3 – 0.8 m 96 9. HOW WILL ACTUAL IMPACTS BE MONITORED AND EVALUATED? The Commission (DG CONNECT) will be responsible for monitoring the implementation of the intervention on a regular basis, possibly with the support of other Commission services, EU agencies, external studies, Member State and market data. A set of possible indicators is provided in the following table, alongside preliminary questions for the evaluation of the intervention, which is expected five years after implementation. Annex 11 presents the detailed monitoring framework devised for this inter vention and how this will build upon existing schemes to avoid duplication and benefits from synergies. With respect to the expected targets of the intervention, the data provided in this assessment presents indicative ranges, which should be interpreted a s plausible trajectories. In line with the Better Regulation Toolbox, quantitative targets were based on the problem analysis, baseline scenario, available evidence from the assessment, including validation through interviews, and the expected scale of pol icy impact. They were defined to quantitatively measure the effectiveness of the intervention in the next years and paired with indicators for a systematic review. They included a clear timeframe, i.e. by 2030 or 2035, expectations based on the evidence ga thered and the availability of data collection systems to make this monitoring effective. Table 18. Summary of KPIs by Specific Objective Operational objectives and performance thresholds Possible indicators for monitoring/evaluation Main data sources and data collection methods Increase computing capacity deployed in the EU through innovative and sustainable technologies: By 2030, +200% EU computing capacity vs 2025 and ensuring that such capacity fully covers its needs by 2035 133; ≥25% of global share134; energy -efficient technologies in ≥80% of new facilities135. • Installed computing capacity (MW IT load) by MS • Aggregate general purpose and AI -optimised compute, shifting to a measurement by FLOPs as opposed to MW. • EU share of global installed computing capacity • Number of new EU -based DCs operational per year • Utilisation rate of EU computing capacity; measures on PUE, WUE, location -based emissions and related environmental impact of data centres • Deployment of innovative and energy -efficient technologies ( pilots launched and uptake of new solutions) • Share of re newable energy in data centres and waste-heat reuse • Total annual public and private investment in EU-based DCs • Share of new data centre capacity deployed outside existing hubs and in underserved regions Survey (and follow-up interviews) of data centre operators, national authorities and TSOs/DSOs Desk research EED reporting Interviews with experts, academia, think tanks and associations Industry dataset, e.g. Data Centre Map, EUDCA EEA emission data Ensure attractive conditions for the deployment of • Average permitting time for new data centre projects Surveys per (and follow- up interviews) across 133 Since the precise level of self -sufficiency is impossible to anticipate today, PM7 has been conceived to monitor the evolution of supply and demand of computing capacity across EU Member States. 134 This 25% target of EU-27 global share has been derived from the estimated increase in EU capacity expected under PO1 -B. Under the baseline scenario, the EU-27 share of global data centre capacity is projected to grow from 20% (2025) to 23% (2030), i.e. reaching around 28 GW in 2030. This is based on the Goldman Sachs forecast that total global data centre capacity will reach around 122 GW by 2030. The addi tional capacity expected to be enabled by the proposed measures could raise this EU share to aroun d 27% by 2030. To account for uncertainties, a more conservative threshold of 25% was set to capture the additional percentage points of global capacity. 135 The need to prioritise and have energy -efficient technologies in at least 80% of new installations, measured by PUE, WUE and other relevant indicators, is considered a necessary threshold to comply with EU goals of climate neutrality by 2050. 97 Operational objectives and performance thresholds Possible indicators for monitoring/evaluation Main data sources and data collection methods sustainable and innovative computing capacity: By 2030, overall permitting time should be <18 months136, +30% annual investment vs. 2025137, ≥20 MS with harmonised frameworks138. • Total administrative burden for operators • Share of projects delayed/cancelled due to regulatory or infrastructure barriers • No. of MS with simplified permitting frameworks • Cost competitiveness index (€ /MW build cost, €/MWh energy cost vs. US/Asia) national authorities and operators FDI statistics Eurostat Decrease the overall reliance on non -European cloud and AI computing services: By 2035, ≥ 30% market share of EU-homegrown cloud and AI computing service providers in the EU, i. e. at least doubling it against the baseline • Share of total EU cloud and AI computing services revenue captured by European service providers • Number of public sector authorities served by sovereign providers per MS • Share of installed EU DC capacity owned by European providers • Share of idle capacity shared among MS Survey (and follow-up interviews) of data centre operators and national authorities Desk research Market research Contribute to the protection of public order by enhancing the resilience of supply of cloud and AI computing services, in particular in the public sector: By 2035, 100% of highly critical use cases in the public sector operated using sovereign cloud and AI computing services139 • Number of cloud and AI services audited under level 2, 3 or 4 • Compliance rate by contra cting authorities (%) with the sovereignty scheme • Annual value of EU public procurement of sovereign cloud and AI computing services • SME share (%) in awarded public contracts • Number of public sector solutions released as open source in the repository, and their downloads by third parties Number of assessed and evaluated sovereign services in the repository Survey (and follow -up interviews) of DC operators and national authorities Desk research Market research TED data Table 19. Preliminary questions for the evaluation of the intervention Evaluation criterion Assessment objective and possible evaluation questions Effectiveness Goal: assess the extent to which the objectives of the initiative have been achieved and how benefits have accrued to different stakeholders. To what extent did the intervention increase EU installed computing capacity and create the conditions for easier data centre deployment? How did it foster the development and deployment of innovative and sustainable data centres and a better use of energy sources? To what extent did it increase clarity around the concept of sovereign cloud and AI computing services? How d id it improve the market share of European cloud and AI computing service operators? What is their market share for sovereign use cases? To what extent did it increase federated resources across the public sector and joint procurement for cloud and AI comp uting services? To what extent did it increase the use of open source solutions? Efficiency Goal: assess the extent to which the initiative has been cost -effective, analysing the relationship between expected and actual benefits and costs. Have benefits and cost savings been achieved at proportionate costs for different stakeholders? 136 This has been set to ensure that regulatory procedures for deploying data centres across the EU are reduced i n a consistent way. Under the baseline, average permitting duration was estimated to be of 32 months across the 12 Member States under scrutiny. Reducing t his timeline to 18 months is a realistic improvement, even if still above today’s best-performing countries. 137 Reducing administrative barriers has been shown in the literature, and confirmed through interviews, to greatly improve projec t bankability and attract additional investments. Hence, a 30% additional investment unlocked compared to the baseline scenario has been set as a reasonable success criterion. This should be measured against the additional capacity deployed. 138 The objective of seeing 20 Member States with harmonised frameworks stems from a willingness to improve visibility and simplify ma rket access to data centre investors and businesses, so that they can fully exploit the Single Market without additional administrative burdens. 139 Since the objective consists in enhancing the resilience of supply of cloud and AI computing services, in par ticular in the public sector, a long - term target of full compliance is expected as a measure of success. 98 Evaluation criterion Assessment objective and possible evaluation questions Relevance Goal: assess the extent to which the objectives of the initiative still reflect current and future needs. To what extent the initiative still addresses relevant needs? How is it still aligned with EU priorities? Coherence Goal: assess the initiative’s internal and external coherence, i.e. if the different elements of the intervention worked together to reach the set goal and if it worked well or overlapped with other initiatives, both at EU level and national level. To what exte nt is the initiative consistent with existing and future energy, digital, competition, environmental, security rules at EU level and national level? EU Added value Goal: assess the extent to which the initiative brought EU added value compared to what cou ld have been achieved by Member States alone. To what extend did EU -level action prevent fragmentation of DC rules? How did it improve cross - border service delivery and competitiveness of EU providers? 99 ANNEX 0 - ENDNOTES i The Draghi Report on competitiveness ii Draghi report iii Competitiveness Compass iv JOIN/2023/20 final v Mission letter to EVP Virkkunen vii The AI Continent Action Plan | Shaping Europe’s digital future viii Europe’s digital decade: 2030 targets | European Commission ix REPORT on European technological sovereignty and digital infrastructure | A10 -0107/2025 | European Parliament x Council Conclusions of 5 December 2025 xi Federal Cloud Computing Strategy, February 2011? xii See for example Amazon's Invasion of the CIA Is a Seismic Shift in Cloud Computing? xiii America’s AI Action Plan xiv Accelerating Federal Permitting of Data Center Infrastructure – The White House xv Promoting The Export of the American AI Technology Stack – The White House xvi China plans network to sell surplus computing power in crackdown on data centre glut | Reuters xvii UK Compute Roadmap - GOV.UK xviii UAE Dominates Global Data Centre Rankings as Region Becomes Digital Infrastructure Hotspot -MIT Sloan Management Review Middle East xix Decision - 2022/2481 - EN - EUR-Lex xx Directive - 2023/1791 - EN - EUR-Lex xxi Regulation – 20200/852 – EN – EUR-Lex xxii Regulation - 2019/424 - EN - EUR-Lex, which is currently under review. xxiii Digital Networks Act, information accessed from the 'Have Your Say' page xxiv Commission collects views in preparation of the European Grids Package - European Commission xxv Savings and investments union - Finance - European Commission xxvi Apply AI Strategy | Shaping Europe’s digital future xxvii Data Act xxviii Regulation - 2022/1925 - EN - EUR-Lex xxix Regulation - EU - 2024/1689 - EN - EUR-Lex xxx Cybersecurity Act (CSA) xxxi Regulation - 2022/2554 - EN - DORA - EUR-Lex xxxii Directive on Security of Network and Information Systems (NIS2) xxxiii Public Procurement Directive xxxiv Cloud Services Market to Exceed 68 Billion in 2010 | Security Magazine xxxv Gelvanovska-Garcia, Natalija; Mačiulė, Vaiva; Rossotto, Carlo Maria. 2024. Advancing Cloud and Data Infrastructure Markets: Strategic Directions for Low - and Middle -Income Countries. Sustainable Infrastructure Series. © World Bank. http://hdl.handle.net/10986/41587 License: CC BY 3.0 IGO. xxxvi 53% EU enterprises used paid cloud services in 2025 - News articles - Eurostat xxxvii European Cloud Providers’ Local Market Share Now Holds Steady at 15% | Synergy Research Group xxxviii European IT providers struggle to capitalise on continent-wide growth in cloud demand | Computer Weekly xxxixEuropean industrial technology roadmap for the next generation cloud -edge offerin g, May 2021. Available at: https://ec.europa.eu/newsroom/repository/document/2021- 18/European_CloudEdge_Technology_Investment_Roadmap_for_publication_pMdz85DSw6nqPppq8hE9S9RbB8_7 6223.pdf xl CIA Awards Secret Multibillion -Dollar Cloud Contract ; CIA awards multibillion C2E cloud contract to AWS, Microsoft, Google, Oracle, and IBM. xli What made AWS the leader in the cloud industry? xlii Training and Certification for AWS Partners | Digital and Classroom Training | AWS ; Top 10 AWS Consulting Partners; Azure Partners – Find an Azure Expert Partner | Microsoft Azure ; Microsoft partnerships drive innovation 100 and growth in Europe in times of uncertainty – Microsoft Pulse; Cloud Solution Provider program overview - Partner Center | Microsoft Learn; xliii Cloud computing - statistics on the use by enterprises - Statistics Explained - Eurostat xliv Netflix, Prime Video and Disney+ have 85% of Europe’s SVOD market - Mobile Europe xlv European IT providers struggle to capitalise on continent-wide growth in cloud demand | Computer Weekly xlvi Grassano, N., Hernandez Guevara, H., Tuebke, A., Amoroso, S., Dosso, M., Georgakaki, A. and Pasimeni, F., The 2020 EU Industrial R&D Investment Scoreboard, EUR 30519 EN, Publications Office of the European Union, Luxembourg, 2020, ISBN 978 - 92-76-27418-6, doi:10.2760/203793, JRC123317. Available here: SB2020_final_16Dec2020_online.pdf. xlvii The Future of Hyperscaler Capital Expenditures: A Deep Dive into AI and Cloud Computing – HyperFRAME Research xlviii See also Arnal, J. (2025). Towards Competitive Cloud Ecosystem s: Strategic Responses for Europe’s Digital Future, IE Center for the Governance of Change. Available here: CGC_Competitive_Cloud_Ecosystems_2025.pdf xlix Crémer, Jacques & B iglaiser, Gary & Mantovani, Andrea, 2024. "The Economics of the Cloud ," TSE Working Papers 24-1520, Toulouse School of Economics (TSE). lThe UK’s Competition and Markets Authority detail this situation in their July 2025 report li Market study into cloud services | ACM lii Gartner Says Worldwide Sovereign Cloud IaaS Spending Will Total $80 Billion in 2026 liii AI and Compute ; The cost of compute power: A $7 trillion race | McKinsey ; How Can We Meet AI’s Insatiable Demand for Compute Power? | Bain & Company ; AI to drive 165% increase in data center power demand by 2030 | Goldman Sachs; The 2025 AI Index Report | Stanford HAI liv Statista Technology Market Insights, 2025. Available here: Artificial Intelligence - EU-27 | Statista Market Forecast lv Data Centres | CBRE lvi Global Data Center Trends 2025 | CBRE lvii Big Tech's AI investments set to spike to $364 billion in 2025 as bubble fears ease ? lviii Technopolis Group et al. (2025), "Study: Cloud and AI". lix Technopolis Group et al. (2025), "Study: Cloud and AI". lx KPMG | The evolving data centre landscape lxi Data coming from the Cloud and AI Study. Additional data can be found here: Financing Infrastructure for a Competitive European AI - Groupe d'études géopolitiques lxii Technopolis Group et al. (2025), "Study: Cloud and AI". lxiii Savills | Costs on the rise lxiv Unlocking the European AI revolution | McKinsey lxv Data Centres | CBRE lxvi Data Centres | CBRE lxvii RTE | No new data centres for the capital for the foreseeable future lxviii HOW DATA CENTERS HAVE COME TO MATTER: Governing the Spatial and Environmental Footprint of the ‘Digital Gateway to Europe’ - Monstadt - 2025 - International Journal of Urban and Regi onal Research - Wiley Online Library lxix CREOS annual report 2021 lxx ServerMania | Cloud server prices lxxi Mistral AI warns of lack of data centres and training capacity in Europe | Euronews lxxii Public Cloud - EU-27 | Statista Market Forecast lxxiii Cloud is a Global Market - Apart from China | Synergy Research Group lxxiv European Cloud Providers’ Local Market Share Now Holds Steady at 15% | Synergy Research Group lxxv European Cloud Providers’ Local Market Share Now Holds Steady at 15% | Synergy Research Group lxxvi European Software and Cyber Dependencies lxxvii Competition in the provision of cloud computing services (EN) lxxviii Asterès | Technological dependence on American Software and Cloud services lxxix ChatGPT in the Public Sector - overhyped or overlooked? lxxx AI in Europe: A new opportunity for growth | McKinsey lxxxi Understanding cloud outages: Causes, consequences and mitigation strategies | HCLTech lxxxii What the EU Needs to do to Challenge Big Tech Cloud Dominance | TechPolicy.Press ; Amazon web services return to 'normal operations' after mass outage, tech giant says - BBC News. 101 lxxxiii Nicolas Guillou, French ICC judge sanctio ned by the US: 'You are effectively blacklisted by much of the world's banking system' lxxxiv Kyndryl announces agreement to purchase cloud-services provider Solvinity lxxxv Ibid lxxxvi Dutch parliament calls for end to dependence on US software companies | Reuters lxxxvii ECB Guide on outsourcing cloud lxxxviii Microsoft Can't Keep EU Data Safe From US Authorities lxxxix Section 3 - Capgemini. Cloud Sovereingy: the road ahead xc Page 43 to 47 - Baromètre de la cybersécurité des entreprises du CESIN, xci How Many Data Centers Are in the US? Latest Statistics and Trends - C&C Technology Group xcii Recent Trends in U.S. Services Trade: 2022 Annual Report xciii Global Infrastructure Regions & AZs xciv Discover more about regions and availability zones | OVHcloud Worldwide xcv OECD (2025), “Competition in the provision of cloud computing services”, OECD Roundtables on Competition Policy Papers, No. 323, OECD Publishing, Paris, https://doi.org/10.1787/595859c5-en, pp. 23-24. xcvi Oaktree-backed firm unveils $1.2 billion Amsterdam 'hyperscale' data centre project | Reuters xcvii https://www.mordorintelligence.com/industry-reports/europe-colocation-market-industry xcviii Data Centres | CBRE xcix Leitmotiv - Toward our Digital Future c Google raises 2025 capex estimate, again, to $91 -93bn - plans "significant increase" in data center spend for 2026 - DCD ci OVHcloud - Results cii Too late to act? Europe’s quest for cloud sovereignty | Clingendael ciii NGP Capital | The Cloud Evolution: From Hyperscaler Dominance to Modular Infrastructure civ See here: Announcing the Regional 2024 AWS Partners of the Year for Europe, Middle East, and Africa? cv See for instance AWS Distribution program or Microsoft’s partner program cvi The economics of the Cloud – Toulouse School of Economics – March 2024 cvii Partnerships Between Cloud Service Providers and AI Developers cviii Competition in the provision of cloud computing services (EN) ; Partnerships Between Cloud Service Providers and AI Developers. cix Cloud Computing & Web Hosting | OVHcloud Worldwide ; Cloud Computing & Web Hosting | OVHcloud Worldwide. cx Eindrapport In het kader van het quickscan -onderzoek naar technische, organisatorische en juridische gaps tussen Europese/Nederlandse cloudproviders en Amerikaanse hyperscalers voor het ministerie van Economische Zaken | Tweede Kamer der Staten-Generaal cxi Eindrapport In het kader van het quickscan -onderzoek naar technische, organisatorische en juridische gaps tussen Europese/Nederlandse cloudproviders en Amerikaanse hyperscalers voor het ministerie van Economische Zaken | Tweede Kamer der Staten-Generaal cxii European Cloud Providers: What Are the Options Today? - InfoQ cxiii Best Strategic Cloud Platform Services Reviews 2026 | Gartner Peer Insights cxiv CMS. (n.d.). Expert Guide on Real Estate Data Centre Consenting. CMS Law. cxv (2024). European data center overview 2024 cxvi European Real Estate Market Outlook 2026 cxvii The Real Estate Power Play Behind Europe’s Data Center Growth cxviii See McKinsey: Unlocking the European AI revolution | McKinsey ; IEA: Energy demand from AI – Energy and AI – Analysis - IEA; The Shift Project: Environmental-impacts-of-digital-technology-5-year-trends-and-5G- governance_March2021.pdf; Ember: Grids for data centres: ambitious grid planning can win Europe's AI race cxix IDC Report Reveals AI -Driven Growth in Datacenter Energy Consumption, Predicts Surge in Datacenter Facility Spending Amid Rising Electricity Costs. See also: CERRE_Report_DCs_FinalPDF.pdf pp 13-15. cxx For example in Dublin: Data Centres in Ireland, and in Amsterdam: Challenges in the Dutch Data Center Market. cxxi Grids for data centres: ambitious grid planning can win Europe's AI race ; Ember, 2025 ; Reuters, 2025 ; BCG, 2025; Power connection requests for Italy data centres rise to 42 GW at end -March | Reuters; See also: Single Market - Compendium of obstacles - 21 May 2025 cxxii Why Retrofit Could Dominate Data Centre Builds This Decade | Data Centre Magazine cxxiii Data centre developers explore linking up to UK gas pipelines 102 cxxiv Europe primed for data centre ABS financing as investment soars | News | About Us | Linklaters cxxv Why data center finance is diversifying cxxvi AI Drives Cloud Player Capex Amid Cautious Overall Spend cxxvii Knight Frank: Global Data Centres Report cxxviii China invests $6.1 billion in computing data center project, official says | Reuters cxxix North America Data Center Report Midyear 2025 cxxx Circular water solutions key to sustainable data centres | World Economic Forum ; Mytton, D. Data centre water consumption. npj Clean Water 4, 11 (2021). Data centre water consumption. cxxxi See for ex ample Revealed: Big tech’s new datacentres will take water from the world’s driest areas . Globally, however, total data centre water use is much smaller than tha t of other sectors. See: icef.go.jp/wp- content/themes/icef_new/pdf/roadmap/icef2025_roadmap.pdf. cxxxii See for example: ECIPE | The EU’s Trillion Dollar Gap in ICT and Cloud Computing Capacities: The Case for a New Approach to Cloud Policy cxxxiii Eurostack | Deploying the Eurostack: What’s needed now. cxxxiv Sovereign Cloud Technologies – EU-Lisa technology brief – June 2025 cxxxv Concession from the Department for digital transformation to the Polo Strategico Nazionale cxxxvi Germany launches government cloud – Press release cxxxvii CISPE’s Buying Cloud Services in the Public Sector provides a comprehensive overview of public procurement difficulties cxxxviii ECIPE, Occasional paper No. 04/2025: ’Boosting Efficiency and Quality in EU Public Services: The Need for a European Multi Cloud-First Strategy’: ECI_OccasionalPaper_04-2025_LY04.pdf cxxxix V-ICT-OR delivers innovative Flemish government services with Azure Container Apps | Microsoft Customer Stories cxl Digitale Abhängigkeit von Microsoft: Risiken und Auswirkungen auf die EU -Wirtschaft cxli "We're done" - major government organization slams Microsoft Teams as it drops Windows for good ; Danish government agency to ditch Microsoft software in push for digital independence ; Denmark’s Digital Declaration of Independence: A Growing European Revolt Against Big Tech Dependency. cxlii What is the Log4j vulnerability? cxliii “EDLER, J. "Technology sovereignty for the EU: Needs, concepts, pitfalls and ways forward". Available at European Commission cxliv AWS European Sovereign Cloud cxlv EU Sovereign Cloud | Oracle Europe cxlvi Capgemini and Orange are pleased to announce the launch of commercial ac tivities of Bleu, their future “cloud de confiance” platform - Newsroom Orange Group cxlvii Clarence | Le premier cloud souverain déconnecté en Europe cxlviii Sovereign AI | Oracle Europe cxlix The next chapter for UK sovereign AI | OpenAI cl See for example: Die souveräne Cloud für den öffentlichen Sektor - STACKIT or Sovereign Cloud for Tech Innovation | Scaleway. cli Sovereign Cloud in the EU: Providers, Challenges, and Opportunities clii Introducing the Overview of the AWS European Sovereign Cloud whitepaper | AWS Security Blog cliii 6G Infrastructures for Edge AI: An Analytical Perspective cliv When AI Takes Time to Think: Implications of Test-Time Compute clv This is a challenge already observed in the United States, where electricity prices have risen in regions with high data-centre concentration. It highlights the need for the EU to ensure a more balanced distribution of data -centre deployment across Member States, in order to prevent similar electricity price spikes in specific areas. Additional information av ailable here: How AI Data Centers Are Sending Your Power Bill Soaring ; $64 billion of data center projects have been blocked or delayed amid local opposition — Data Center Watch clvi Global Data Center Trends 2025? clvii Time to place our bets: Europe’s AI opportunity? clviii Europe Public Cloud Market Size & Outlook, 2023-2030. clix Artificial Intelligence Index Report 2025 clx Technopolis Group et al. (2025), "Study: Cloud and AI". clxi IEA (2025). Energy and AI, pp. 93-96. Available at: https://www.iea.org/reports/energy-and-ai clxii Technopolis Group et al. (2025), "Study: Cloud and AI". 103 clxiii European Commission clxiv ACTON, M., BOOTH, J. and PACI, D., 2025 Best Practice Guidelines for the EU Code of Conduct on Data Centre Energy Efficiency, Publications Office of the European Union, Luxembourg, 2025, https://data.europa.eu/doi/10.2760/9449356, JRC141521. clxv Technopolis Group et al. (2025), "Study: Cloud and AI". clxvi Blind, K. et al. (2021). T he impact of Open Source Software and Hardware on technological independence, competitiveness and innovation in the EU economy. European Commission. Available at: Study about the impact of open source software and hardware on technological independence, competitiveness and innovation in the EU economy clxvii See Special report 12/2025 - The EU’s strategy for microchips ; Competition in artificial intelligence infrastructure (EN) and Report_Emerging-Resilience-in-the-Semiconductor-Supply-Chain.pdf clxviii Technopolis Group et al. (2025), "Study: Cloud and AI". clxix As mentioned in the Copenhagen Economics Study (Available here), t he data centre sector can contribute to increasing FDI by fostering clusters along parts of the digital infrastructure value chain which can , in turn, attract other businesses , e.g. suppliers or technology firms benefitting from proximity to the facilities . Other factors contributing to the selection of data centre locations are also presente d here : 2025-Data-Center-Site-Selection- Dynamic-Brief.pdf clxx The EU attracted the most FDI projects among world’s regions according to figures from fDi Markets. Data centre investors announced several mega projects, i.e. with over $1bn in committed CapEx across Europe and FDI worth more than $69bn in 2024. Figures available here: fDi’s European Cities and Regions of the Future 2025 clxxi OECD (2025), “Competition in the provision of cloud computing services”, OECD Roundtables on Competition Policy Papers, No. 323, OECD Publishing, Paris, https://doi.org/10.1787/595859c5-en. clxxii British International Investment insight, How-does-access-to-a-local-data-centre-affect-business-productivity.pdf clxxiii AWS services recover after daylong outage hits major sites clxxiv WEF_Global_Cybersecurity_Outlook_2025.pdf and CrowdStrike outage: We finally know what caused it - and how much it cost | CNN Business clxxv Accelerating Europe’s AI adoption: The role of sovereign AI clxxvi Right Scaling for Right Pricing: A Case Study on Total Cost of Ownership Measurement for Cloud Migration | Springer Nature Link clxxvii Artificial intelligence: Europe needs to start dreaming again clxxviii See Digitalisation and Employment, International Labour Organization, 2022 clxxix Findings of an unpublished Research briefing by FGS Resea rch made available to the Commission in November 2025 (survey of 3,022 adults across 6 markets - UK, US, Japan, France, Germany, Italy – with a sub-set of questions specific to France, Germany and Italy only) indicates that (1) 71% of surveyed populations think that “Technological sovereignty helps create and protect local jobs ” as opposed to 22% who insisted that Technological sovereignty harms and threatens local jobs. clxxx See Infrastructure or Intrusion? Europe’s Conflicted Data Center Expansion clxxxi See Eurostat (2024, 2025), E-government activities of individuals via websites , Individuals - frequency of internet use and Meetings via the internet by size class of enterprise clxxxii OpenAI reports that Chatgpt search alone has 120 milion average monthly users in the EU. clxxxiii Ibid (1) on average, 65% of citizens in France, Germany and Italy insist that “ It is worth investing more to keep technologies like satellites, cloud services, and AI systems un der national control, even if that means costs are higher”, as opposed to the average of 28% thinking that “ It is more important to keep costs low, even if that means relying on foreign companies for things like satellites, cloud services, and AI systems ”. (2) On average, 54% of citizens think “ Governments should lead and invest heavily in technology development to secure sovereignty ”, whereas 36% that “The private sector should drive technology innovation with minimal government intervention ”. (3) But only 39% think “It is worth spending more on developing our own technologies, even if that means less funding for other areas like healthcar e”, while 55% argue that “ Public money should prioritise essential services like healthcare and education, even if that means relying on foreign technology”. clxxxiv This is in line with past expectations and figures. EEA’s indicator shows that the GHG intensity of power generation in the EU has been falling for decades and was about 40% lower in 2024 than ten years before. See h ere: Greenhouse gas emission intensity of electricity generation in Europe | Indicators | European Environment Agency (EEA) clxxxv The IEA 4E EDNA p olicy work underlines that reducing infrastructure use (PUE) can be achieved by smaller data centres through grants or technical support, separate from Minimum Energy Performance Standard s or 104 obligations which may be challenging to apply to smaller data centres. Available here: Policy development on energy efficiency of data centres draft final report v1.05 . Smaller operators typically la g behind hyperscalers as they lack the capital and human resource capacity to invest in efficiency innovations, leading to structurally higher PUEs, and often depending on available technologies. clxxxvi https://www.networkworld.com/article/972407/5-ways-to-boost-server-efficiency.html clxxxvii See also: Al, data, and computing: shaping infrastructures for a decarbonised world - The Shift Project IL clxxxviii IEA (2025) . Overcoming energy constraints is key to delivering on Europe's data centre goals . Available at: https://www.iea.org/commentaries/overcoming-energy-constraints-is-key-to-delivering-on-europe-s-data-centre-goals clxxxix IEA (2025). Energy and AI. Available at: https://www.iea.org/reports/energy-and-ai cxc European Environment A gency (2024). Water abstraction by economic sector in the 27 EU Member States, 2000 - 2022. Available at: https://www.eea.europa.eu/en/analysis/indicators/water-abstraction-by-source-and/water- abstraction-by-economic cxci Circular thinking for data centres - Arup cxcii Alissa H., Nick T., Raniwala A. et al., Using life cycle assessment to drive innovation for sustainable cool clouds , Nature, Vol. 641, 2025, pp. 331–338, available at: Using life cycle assessment to drive innovation for sustainable cool clouds | Nature cxciii Schneider Electric. (2023). Quantifying Data Center Scope 3 GHG Emissions to Prioritize Reduction Efforts— White Paper 99. https://www.se.com/ww/en/download/document/SPD_WP99_EN/ cxciv Swedish audit reports (2022). See: Central government initiatives to stimulate investments in data centres (RiR 2022:18) --- [Bilaga - Konsekvensbedömningsrapport, del 2 av 2.pdf] EN EN EUROPEAN COMMISSION Brussels, 3.6.2026 SWD(2026) 502 final PART 2/2 COMMISSION STAFF WORKING DOCUMENT IMPACT ASSESSMENT REPORT Accompanying the Proposal for a REGULATION OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL establishing a framework of measures for strengthening Europe's cloud and AI ecosystem (Cloud and AI Development Act) {COM(2026) 502 final} - {SEC(2026) 502 final} - {SWD(2026) 503 final} Contents 0. GLOSSARY ................................................................................................... V ANNEX 1: PROCEDURAL INFORMATION ...................................................... 7 1. LEAD DG, DECIDE PLANNING & CWP REFERENCES .......................... 7 2. ORGANISATION AND TIMING .................................................................. 7 3. CONSULTATION OF THE RSB ................................................................... 7 4. EVIDENCE, SOURCES AND QUALITY ................................................... 17 ANNEX 2: STAKEHOLDER CONSULTATION (SYNOPSIS REPORT) ........ 18 1. INTRODUCTION ......................................................................................... 18 2. OVERVIEW OF CONSULTATION ACTIVITIES ..................................... 18 2.1 Public Consultation on the Cloud and AI Development Act .............. 18 2.2 Study to support the impact assessment .............................................. 18 2.3 Overview of workshops, seminars and roundtables: ........................... 18 2.4 Awareness raising events in Member States and internatio nal outreach ............................................................................................................. 19 2.5 Bilateral meetings with industry, academic institutions, think tanks .. 19 3. PARTICIPANTS AND METHODOLOGY ................................................. 19 3.1 Participants .......................................................................................... 19 3.2 Methodology ........................................................................................ 20 4. ANALYSIS OF THE STAKEHOLDER CONSULTATION ...................... 20 4.1 EU businesses and public authorities’ dependency on non-EU cloud and AI providers ......................................................................................... 20 4.2 Bottlenecks to expand (sustainable) data centre capacity within the EU ............................................................................................................. 21 4.3 Barriers to public sector transformation and public procurement ....... 23 4.4 Lack of common concept and operational criteria for sovereign cloud and AI computing services .................................................................. 25 ANNEX 3: WHO IS AFFECTED AND HOW? ................................................... 27 1. PRACTICAL IMPLICATIONS OF THE INITIATIVE .............................. 27 2. SUMMARY OF COSTS AND BENEFITS ................................................. 30 3. RELEVANT SUSTAINABLE DEVELOPMENT GOALS ......................... 34 ANNEX 4: ANALYTICAL METHODS .............................................................. 36 1. METHODOLOGY ........................................................................................ 36 2. GENERAL ASSUMPTIONS FOR THE MODELLING OF THE POLICY MEASURES .................................................................................................. 37 2.1. Valuation framework and time horizon ............................................... 37 2.2. Unit cost parameters/ standard cost model .......................................... 37 2.3. Estimates related to data centres .......................................................... 39 2.4. Estimates related to Public Procurement ............................................. 52 2.5. Indirect benefits from cloud adoption ................................................. 56 3. IMPACTS OF POLICY MEASURES IN TERMS OF COSTS AND BENEFITS .................................................................................................... 57 3.1. PM1: Expanding the Alliance for Industrial Data, Edge and Cloud with a working group on data centres and extending membership to relevant players .................................................................................................. 57 3.2. PM2: Creating a forum for exchanges between relevant public and private stakeholders involved in the buildout of data centres ............. 59 3.3. PM3: Adopting guidelines on building sustainable data centres in the EU ........................................................................................................ 61 3.4. PM4: Project facilitators for the roll-out of data centres ..................... 64 3.5. PM5: Mechanism for Member States to identify areas to fast-track data centre deployment ............................................................................... 68 3.6. PM6: National funding support for data centres ................................. 72 3.7. PM7: Set deployment targets and monitor progress ............................ 74 3.8. PM8: EU Funding for R&D and innovatio n ecosystems for cloud and AI ......................................................................................................... 76 3.9. PM9: EU deployment funding for strategic projects ........................... 79 3.10. PM10: EU -level identification of areas for fast -track data centre deployment .......................................................................................... 80 3.11. PM11: Creating EU-level harmonized criteria for sovereign cloud and AI computing services ......................................................................... 84 3.12. PM12: Creating EU guidelines for sovereign Cloud AI computing services for public procurement .......................................................... 88 3.13. PM13: Annual conference on digital sovereignty ............................... 90 3.14. PM14: Interoperability flanking measures .......................................... 92 3.15. PM15: Voluntary sovereign risk assessments for the use of cloud and AI computing services in the public sector ......................................... 94 3.16. PM16: Non-mandatory specific award criteria for the procurement of cloud and AI computing services ...................................................... 101 3.17. PM17: Public Sector Cloud Federation ............................................. 103 3.18. PM18: Vendor-neutral EU cloud/AI skill certificates ....................... 106 3.19. PM19: Mandatory specific award criteria for the procurement of cloud and AI computing services ................................................................ 109 3.20. PM20: Boosting open source in public administrations ................... 111 3.21. PM21: Mandatory sovereign risk assessments for the use of cloud and AI computing services in the public sector ....................................... 116 3.22. PM22: EU-level Procurement of cloud and AI computing services . 125 3.23. PM23: Financial support for SMEs to adopt cloud and AI ............... 127 3.24. PM24: Tools to enrich EU cloud and AI computing services offering 129 4. STRENGTHS AND LIMITATIONS OF THE ANALYSIS ...................... 131 5. SENSITIVITY ANALYSIS ........................................................................ 132 6. MULTI-CRITERIA DECISION ANALYSIS ............................................ 138 6.1. Models used for the multi-criteria analysis ....................................... 138 6.2. Development and comparisons of policy options (MCDA) .............. 143 7. ENVIRONMENTAL IMPACT ANALYSIS ............................................. 155 7.1. Installed IT capacity .......................................................................... 156 7.2. Utilisation and efficiency assumptions .............................................. 156 7.3. Conversion to annual electricity demand .......................................... 156 7.4. Emissions calculations ....................................................................... 157 7.5. Limitations ......................................................................................... 157 8. SO3 – HOW REALISTIC IS IT TO SET AN OBJECTIVE FOR EU PROVIDERS TO REACH A MARKET SHARE OF 30% BY 2035? ...... 158 9. TYPES OF PROCEDURES, PERMITS AND DATA CENTRE DEPLOYMENT TIMELINES PER MEMBER STATE ............................ 160 ANNEX 5: COMPETITIVENESS CHECK ....................................................... 172 1. OVERVIEW OF IMPACTS ON COMPETITIVENESS ........................... 172 SYNTHETIC ASSESSMENT ............................................................................ 172 ANNEX 6: SME CHECK ................................................................................... 176 ANNEX 7: EXTERNAL COHERENCE WITH RELEVANT EU LEGISLATION AND POLICY INITIATIVES .................................................................... 182 ANNEX 8: KEY TECHNICAL CONCEPTS ..................................................... 196 ANNEX 9. BASELINE SCENARIO (POLICY OPTION 0) ............................. 199 1. Limited and geographically concentrated availability of computing capacity .............................................................................................. 199 2. Dependence on cloud and AI computing services supplied by non - European providers ............................................................................ 202 ANNEX 10. CADA INTERVENTION LOGIC ................................................. 207 ANNEX 11. OPERATIONAL MONITORING AND EVALUATION SYSTEM ..................................................................................................................... 208 1. Output monitoring: deliverables and direct effects ........................... 208 2. Outcome monitoring: mid-term change ............................................ 209 3. Impact monitoring: long-term structural effects ................................ 211 4. Evaluation arrangements and timing ................................................. 212 ANNEX 12. COSTS OF MIGRATING AND PORTING APPLICATIONS .... 214 12.1 Considerations about migrating and porting ..................................... 214 12.2 Cost modelling for public administrations to port services (cloud -to- sovereign cloud) ................................................................................ 218 12.3 Phases of a porting operation ............................................................ 220 12.4 Aspects considered for the analysis of costs ..................................... 224 12.5 Limitations of the analysis ................................................................. 235 ANNEX 13. COMPARATIVE ANALYSIS OF SELECTED CLOUD SERVICES ..................................................................................................................... 236 0. GLOSSARY Term or acronym Meaning or definition AI Artificial Intelligence AZ Availability Zone CEN European Committee for Standardization CENELEC European Committee for Electrotechnical Standardization CfE Call for Evidence Colocation data centre A data centre in which one or more customers install and manage their own network or networks, servers and storage equipment and service Colocation data centre operator An organisation who manages and leases/sells space, security, network access, power and cooling capacit y from a colocation data centre to one or more customers who install and manage their own network or networks, servers and storage equipment and services CSP Cloud service provider Data Centre (DC) A data centre (DC) is defined as a structure or a group of structures used to house, connect and operate computer systems/ servers and associated equipment for data storage, processing and/or distribution, as well as related activities. DSO Distribution System Operators operate and manage local and regional distribution networks, delivering electricity to end users from the transmission system, such as Data Centres up to a given size. See also TSO. EC European Commission Enterprise data centre operator Enterprise data centre operator is a physical or legal person who manages the entire enterprise data centre, including the building and the use of the information technology services delivered EED Energy Efficiency Directive ESO(s) European Standardisation Organisation(s) EU European Union Term or acronym Meaning or definition FLAPD Refers to the data centre markets located in Frankfurt, London, Amsterdam, Paris and Dublin. FTE Full Time Employee GDPR General Data Protection Regulation Hyperscaler Hyperscalers are very large cloud service providers. They are characterized by their ability to provide cloud computing at very large scale . Hyperscalers include Amazon (Amazon Web Services), Microsoft (Azure), and Google (Google Cloud Platform). IA Impact Assessment ICT Information and Communication Technology IPCEI Important Project of Common European Interest MS Member State(s) OSS Open-Source Software is software that is released under a license that allows users to view, modify, and distribute the source code. PC Public Consultation PUE Power Usage Effectiveness, or PUE, is a metric used to measure the energy efficiency of data centres. It is define d as the ratio of total facility energy to the energy used by IT equipment. A PUE of 1.2 implies that for each unit of energy spent in powering IT equipment, 0 .2 units are spent for non -IT equipment such as cooling. A lower PUE indicates better energy efficiency, as it means less energy is being used for non-IT purposes. Simpl Smart middleware platform for data spaces SME(s) Small- and Medium-sized Enterprise(s) TFEU Treaty on the Functioning of the European Union TS Technical Specification TSO Transmission System Operators , or TSOs, manage the high - voltage transmission networks that transport electricity over long distances, ensuring stability and reliability across regions. Above a given size, Data Centres connect to the grid directly through TSOs. See also DSO. 7 ANNEX 1: PROCEDURAL INFORMATION 1. LEAD DG, DECIDE PLANNING & CWP REFERENCES The lead DG is Directorate-General for Communications Networks, Content and Technology (DG CNECT), UNIT E2: Cloud and Software. The DECIDE reference number of this initiative is PLAN/2025/815. The Commission work programme for 2025 includes a legislative action for a cloud and AI Development Act, under the header “ 3.1 A new plan for Europe’s sustainable prosperity and competitiveness”. 2. ORGANISATION AND TIMING The impact assessment started in 2025, with the public consultation and call for evidence published on 9 April 20251. The impact assessment on a possible cloud and AI Development Act was coordinated by an Interservice Coordination Group (ISCG). The Commissions Services participating in the ISCG were: S ecretariat-General, Legal Service, DG Communications Networks, Content and Technology, DG for Internal Market, Industry, Entrepren eurship and SMEs, DG for Energy, DG for Trade, DG for Digital Services, DG for Environment, DG for Climate Action, and DG for Competition. The ISCG met on 24 July 2025 , on 12 September 2025 , 28 November 2025, and 25 January 2026. It was consulted throughout the different steps of the impact assessment process, notably on all stakeholder consultation materials and deliverable s from the external contractor and on the draft impact assessment before submission to the Regulatory Scrutiny Board (RSB). 3. CONSULTATION OF THE RSB This version was submitted to the RSB on 30 April 2026. The RSB issued a positive opinion with comments on 8 May 2026. The comments received from the Board have been addressed in the revised version of the impact assessment as detailed below. Table 1. Modifications of the impact assessment report in response to RSB comments Opinion of the RSB by point How comments have been addressed Sections in IA report/Annex (B) Key issues The report should sufficiently describe the policy measure establishing a set of non -price award criteria and the one encouraging the use, reuse, development and sharing of open- source assets by the public sector. PM16 and PM19 have been reformulated to support EU added value. The non-award criteria defined under these PMs should be of ancillary and non -decisive value in view of the overall tender and are to be included, voluntarily, by contracting authorities in the procurement of cloud and AI computing services that are not off the shelf, standardised or commercially available servi ces. These criteria will earn Main report sections 5.1.1 and 5.1.2 and Annex 4. 1 AI Continent – new cloud and AI development act. 8 Opinion of the RSB by point How comments have been addressed Sections in IA report/Annex additional points to tenderers. Furthermore, the criteria have been updated. Given that the costs and benefits entailed majorly administrative costs ( e.g. updates of templates) these values remain unchanged. The description of PM20 in section 5.1.2 has been updated to make more explicit what it is intended with ‘use, reuse, and share’ in this context, arguing on the motivation to follow such an approach. The internal coherence between the policy measures addressing sovereign cloud and AI services and those addressing critical dependencies and supporting the use of Open Source should be sufficiently explained and assessed. Under section 7.2. the coherence between sovereign cloud and AI services, critical dependencies and open source interplay with each other and are mutually reinforcing each other. Main report section 7.2 The costs related to migration and porting and the related uncertainties should be sufficiently reflected in the assessment of the total costs in the main report. A portion of t he costs of porting applications have been included as part of the cost – benefit analysis. The text argues that the central value of EUR 86.3 bn should be considered as a maximalist approach, where all out of the 30% of the cloudified s olutions requiring sovereign level 2, 3, and 4 of the 6 400 essential entities under NIS2 would be ported to a sovereign cloud service as of result of the intervention. A more plausible scenario has been considered, where all applications at level 4 (1% of the total applications) and half of the applications at level 3 (5% compared to the estimated 9%) will be ported over 3 years as a result of the intervention. Main report 6.1.2, 7.2 and Annex 12, section 12.4 (C) What to improve The policy measures aimed at reducing critical dependencies (PM16/PM19) should be better described, in particular why the criterion “outside of the country of dependencies” is used rather than “within the EU”, on the basis of which criteria the dependency threshold is set at 50%, how the non-price award criteria are to be used by public buyers, how they will be used and assessed. The report should also better discuss the representativeness of the assumptions in PM15 regarding what percentages of use cases would respectively require sovereignty levels 1, 2, 3 and 4. PM16 and PM19 have been reformulated to support EU added value. The non-award criteria defined under these PMs should be of ancillary and non -decisive value in view of the overall tender and are to be included, voluntarily, by contracting authorities in th e procurement of cloud and AI computing services that are not off the shelf, standardised or commercially available services. Under PM15, both in the main report and Annex 4, a clarifying sentence has been included to argue on the representativeness of th e assumptions. Main re port 5.1.1 and 5.1.2 and Annex 4. 9 Opinion of the RSB by point How comments have been addressed Sections in IA report/Annex Policy measure PM20 encourages the use of Open Source in the public sector and requires the contracting authorities to assess the equivalence/superiority of Open Source over proprietary solutions in the tendering procedure. PM22 encourages EU level joint public procurement. Building on the annex, the report should better analyse the impact of these measures on public authorities, including the need for specialised expertise and interplay with envisage d Open -Source Programme Offices, as well as how a uniform approach across the EU will be ensured. The impact of these measures on the companies offering the relevant IT services should also be discussed The description of PM20 in Annex 4 has been expanded. It is discussed that the initial administrative costs incurred due to the comparative assessment of solutions (proprietary vs. open source) in staff training would result in capability benefits in the long term. Furthermore, public authorities may rely on OSPOs as centres of excellence in open source, at technical, legal, procedural and strategic level , who can support public authorities with standardised evaluation frameworks and methodologies. Uniformity may be achieved by means of recommendations and experience sharing in the OSPO networks. The new text also includes how these new conditions would impact businesses, both providers of proprietary solutions and open source solutions, and the overall market. Annex 4, description of PM20; main report section 6.1.2 and 6.1.4 Regarding external coherence: as the policy measure PM11, defining the sovereignty levels and the associated requirements, includes criteria based on the European Cybersecurity Certification Scheme for Cloud Services (EUCS), which has not yet been adopted, the report should describe in more detail the interplay of the two initiatives as well as implementation uncertainties for EUCS PM11 includes the inter -relation between the sovereignty levels and EUCS as one of the criteria to fulfil. This footnote argues that a s part of the ‘One Europe, one market’ roadmap agreed by the Parliament, the Council and the Commission, the co -legislator have agreed to finalise negotiation for this initiative ed by Q4 2027. Adding one year for the measures to take effect, this implies an enter into force in early 2029. EUCS technical work is done and has been adopted by CEN -CENELEC Technical Specifications. The candidate scheme has therefore reached an advanced stage of development, which now needs to be transformed into an Implementing Act to be adopted under the Cybersecurity Act, a process much shorter than CADA’s interinstitutional negotiations. Main report 5.2.2 and Annex 4, as a footnote in PM11. In view of the impact on the total costs of the initiative, the costs related to migration and porting, described in box 2 and in the annex, should be reflected in a summary table of costs and benefits. The table and text in section 7.2 have been modified to reflect the costs of porting . Under 6.1.2 the estimated costs are detailed based on the explanations provided under Annex 12, section 12.4, which has also been updated. Main report 6.1.2, 7.2 and Annex 12 , section 12.4 10 Table 1. Modifications of the impact assessment report in response to RSB comments Opinion of the RSB by point How comments have been addressed Sections in IA report/Annex (B) Key issues (1) The key proposed policy measures are not sufficiently specified to allow for the assessment of those measures and whether they can address the identified problems of EU competitiveness and strategic autonomy. Their proportionality is not adequately demonstrated. In response to the Board’s comments regarding the measures designed to respond to Problem 2 and its corresponding drivers, the updated impact assessment proposes a more refined and proportionate approach to how sovereignty would be defined in CADA and how it would be practically implemente d by public administrations. PM11 now defines sovereignty along four levels (instead of one level, which required exemptions for particular cases), of which higher levels come with higher sovereignty demands. This allows for greater granularity in answering customers’ needs and reflects with more nuance the reality of available and future service offerings. The layered approach reinforces the proportionality of the measure. It aligns better with the available offer from European operators. It increases trus t and enables broader cloudification of on -premises solutions of the most critical use cases, while creating new market opportunities for sovereign European providers. PM11 now also includes a dedicated synthesis table providing a consolidated view of the gradually demanding sovereignty criteria. The assessment of conformity against the respective sovereignty levels is also more balanced and cost -effective for all parties involved, notably in terms of administrative burden on public authorities. As introduc ed by PM15, compliance against sovereignty level 1 would be based on self -assessments conducted by the service provider. Verifying compliance of service against sovereignty level 2-3-4 would be done through third party’s auditors and verified by national c ompetent authorities designated by Member States (a mechanism similar to that used in the Digital Services Act). We make it explicit that services from non - European providers can qualify for Level 1 and Level 2, but not for Level 3 and Level 4. The measure remains anchored in addressing the protection of public order in the public sector (SO4). But since the new Level 3 and Level 4 are reserved to EU providers (on sovereignty grounds), it nevertheless justifies that this measure also addresses the overall d ependence Main report: section 5.2.2. (and all subsequent analytical sections) 11 Opinion of the RSB by point How comments have been addressed Sections in IA report/Annex on non -European cloud and AI computing services (SO3). The sovereignty risk assessment newly introduced by PM15 allows Member States to identify which public sector use cases within require the use of which sovereignty level. This approach reinforces the subsidiarity dimension of the measure. It empowers Member Stats to integrate sovereignty criteria in their established practices and to better choose or change providers where the sovereignty risk assessment has determined so. It li mits transition costs, by allowing Member States to consider their own budgets so that the transition to sovereign solutions naturally follows their existing investment schedules. Finally, it avoids big one- off expenditures by public authorities and diffuses any risk of a supply crunch since the uptake of sovereign services will be more gradual. In this context, to ensure methodological clarity and appropriate degree of delineation between the different measures analysed, the previous PM19, part of PO2 -B, w hich consisted in sovereignty audits to be conducted in the public sector has been removed altogether as it was too close of the sovereignty risk assessments now conducted under PM15 and PM21. A new PM19, now part of PO2 -C, has been spun off from PM21 and consists in the award criteria made mandatory. (2) The analysis of effectiveness and efficiency does not adequately reflect all the costs (i.e. transition costs). The benefits appear to be over-estimated. The updated approach to sovereignty is reflected in the way costs and cost savings are calculated. Based on the feedback of the Board, the impact assessment now includes in the costs not only those corresponding to the establishment of t he measures, but also transition costs directly in the calculations, and not at a macro-economic level. In response to the Board’s targeted comments and based on new evidence, the impact assessment introduces an improved sensitivity analysis of the effecti ve price mark -up of sovereign solutions, as described in section 2.3.4. This results into a more robust range - based calculation of impacts across the applicable PMs detailed in Annex 4, section 3. We now also analyse the costs for a customer to port individual IT systems from one provider to Main report: section 2.3.4., 6.1.2., 6.1.5 Annexes: Annex 4, section 3. Annex 12 12 Opinion of the RSB by point How comments have been addressed Sections in IA report/Annex another. This is summarised in a new box under section 6.1.2 and detailed in the new Annex 12 provides which also covers the case of migration (cloudification) of legacy applications. It includes the migration/switching journey broken down into distinct phases and accounts for three gradual application sizes for which the corresponding costs are calculated. In response to the Board’s comments regarding the previous approach to quantification of benefits, section 6.1.5. now provides a more narrowly defined and qualitative analysis of macro-economic effects. The first part of the new qualitative analysis focuses on benefits for public administrations related to improved sovereignty stemming from the use of sovereign services, lesser dependency on 3 rd-country providers. The second part provides a qualitative analysis of the commercial spillover in terms of improved market opportunities for providers serving use cases associated with Level 3 and Level 4, related for example to improved visibility and perception in terms of service quality from the perspective of private buyers. (3) The analysis of coherence must be reinforced as there are apparent overlaps with existing and upcoming legislation. This comment is addressed under the more detailed point 4 of the What to improve section. (C) What to improve (1) Given the market situation and the stated specific objectives, the interplay betw een the criteria for authorising sovereign cloud services and existing legislation in third countries should be clarified and the resulting impacts analysed. The report must provide a robust estimate of the number of entities affected by mandatory requirements regarding sovereign solutions, as well as which sovereign cloud services EU service providers currently do not offer. The report should explain how “countries with dependencies” will be identified as well as how and by whom the criterion of equivalence/superiority will be established for the prioritisation of open source. Without these The updated PM11 provides under section 5.2.2. a granular description of the four levels of sovereignty, including a breakdown of the gradually demanding requirements. PM11 now also includes clarifications as to which types of providers could qualify for which sovereignty level, all in view of the increasing level of assurance provided between Levels 1 and 4 against the risks defined under Problem 2. New analysis provided under PM15 in Annex 3, section 3.15. connects the new stratified approach to sovereignty w ith current market realities with regard to providers in scope of CADA. The section details the number and type of providers who could reach the respective levels of sovereignty. We assess that 59 non-EU headquartered providers meet Level 1 requirements an d would be able to qualify to Level 1 or 2 should they decide so. 226 EU headquartered providers could qualify as Level 1 or 2 and would be able to qualify as Level 3 Main report: section 5.2.2. (and all subsequent analytical sections), section 6.1.2., section 2.3.2. Annexes: Annex 3, section 3.1.5., section 3.2.1. Annex 12, Annex 13 13 Opinion of the RSB by point How comments have been addressed Sections in IA report/Annex clarifications the impact and proportionality of the intervention in terms of costs, including transition costs, and benefits cannot be credibly assessed. should they decide so. Some of these providers are large companies with proven track reco rd already in serving governments. We also clarify that at this moment, few European providers can achieve Level 4 but more are expected to reach this level soon. When it comes to the requested strengthened analysis of the number of entities impacted by the obligations under PM21, section 6.1.2. includes real life evidence-based calculations of costs of porting applications between two cloud environments with a view for three distinct types of public authorities (small, medium, high) and the implied IT system complexity. Annex 3, section 3.21. On this basis, three illustrative cases are presented to show how costs can vary across different types of public authorities. These scenarios provide a benchmark for individual authorities, while the aggregated cost across all 6400 public en tities possibly in scope is presented under the new Annex 12. The new Annex 13 provides a comparative analysis between offerings of the three leading hyperscalers and three selected European providers. Complementing the previous description of the differen ce in terms of the number of offerings under PD1, section 2.3.2., the Annex provides a much more granular and nuanced assessment of this. A set of dedicated tables shows that the selected European providers already offer services broadly equivalent to thos e of AWS, Microsoft Azure, and Google Cloud Platform across the core infrastructure categories that are most widely used: compute, storage, network, and managed container orchestration. The comparison has been extended to office automation suites, one of the most widely adopted SaaS categories in the public sector, where credible European and open-source alternatives are also available. Where previous interviews have shown that most public administrations use an average of twenty services, instead of the wh ole range offered by hyperscalers, the Annex demonstrates that EU providers already offer the most used services and with a similar level of functionality. With respect to the identification of countries of dependence, PM16, under section 5.2.2 . now details the methodology to establish the 14 Opinion of the RSB by point How comments have been addressed Sections in IA report/Annex necessary degree of dependence as well as the necessary evidence collection and notification to Member States contracting authorities. Finally, regarding the approach to establishing equivalence or superiority of an open source solution to define its priority over a proprietary one, PM20, under section 5.2.2. now provides further operational details related to this assessment. (2) The analysis of benefits must be based on robust and verifiable assumptions and methodologies. Although the report acknowledges the arbitrary choice of certain assumptions and parameters used for assessing the impact of key measures under the preferred option, those (for example increased market shares, risk parameters allocation between the various options, mark -up percentage for sovereignty increased costs) app ear to drive the results of the analysis. In response to this comment, the modelling has been reviewed for all PMs where changes were implemented. Where appropriate, to ensure the most convincing analysis attainable, we have shifted from a quantitative to a qualitative assessment, including with respect to increased market share of European providers (as explained in response to the Key issue #2). The analysis of a price mark -up for sovereign solutions and the sensitivity analysis thereof has also been redo ne and is now based on newly available empirical evidence, as detailed in section 2.3.4. Main report: Section 2.3.4., 6.1.5. (3) The report must provide a more comprehensive analysis of technical, functional and operational consequences of key measures (i.e. PM 20, 21). As certain measures (in particular PM 21, embedding PM 11, 15 and 16) aim at building an EU sovereign cloud, the impacts of the limitations of supply from third countries must be assessed, including the time and costs estimated f or EU service - providers to offer equivalent substitutes. The report should assess the pass -through of these cost As part of the assessment of economic impact on industry, including SMEs and private sector essential entities, section 6.1.1. now includes a dedicated Focus box detailing in qualitative terms (with several illustrative pieces of quantitative evidence) the costs for service providers to develop sovereign services or raise the conformity level of existing services. This section should be read in c onjunction with the new Annex 13 providing a comparative analysis between offerings of the three leading hyperscalers and three selected European providers. Main report: section 6.1.1. Annexes: Annex 13 (4) The report should provide a detailed analysis of coherence, in particular of the authorisation scheme for cloud and AI computing services with the security risk assessment in the Cybersecurity Act and of public procurement measures with the upcoming revision of the public procurement rules. This should be accompanied by Section 7.3. now includes a detailed description of delineation and complementarity between CADA and the Cybersecurity Act 2 (CSA 2) on one hand and the upcoming Public Procurement Act on the other. With regard to the CSA 2, this section details the complementarity between the cybersecurity measures established by the Act and the sovereignty criteria put forward by CADA. The risk assessments intr oduced by the CSA 2 and the possible prohibitions and other mitigating Main report: Section 7.3 Annex 7 15 Opinion of the RSB by point How comments have been addressed Sections in IA report/Annex an analysis of the potential additional legal complexity and administrative burden. measure, including with respect to high -risk vendors, provides a cybersecurity baseline which CADA builds over by introducing a targeted approach to mitigating sovereignty risks specific to the provision and use of cloud and AI computing services. Similarly, the gradual sovereignty levels established by PM11, PM15, PM21 incorporate increasingly demanding compliance against the three assurance levels of the future European cybersecurity certification scheme (EUCS). The section also explains the absence of any overlap between the requirements of the CADA sovereignty levels and the applicable requirements and those assessed under the EUCS, which exclusively covers technical cybersecurity asp ects. Finally, PM21 details further how private sector essential entities listed under Annex I of NIS 2 will have to integrate into the cybersecurity risk assessment they already conduct, the assessment of the risks stemming from their use of cloud and AI computing services. Accordingly, section 6.1.1. clarifies the costs of such entities integrating sovereignty considerations in their existing risk assessment activities. With respect to applicable legal framework of the Public Procurement Directives, curre ntly under review, all measures of CADA related to public procurement are compatible with the rules in place and those anticipated to be proposed by the Commission under the new framework. Notably the measures related to restricted access to public procure ment under PM15 and PM21 incorporate the justifications necessary to comply with the requirements of the exemptions foreseen in the Government Procurement Agreement of the World Trade Organisation. Additionally, based on targeted consultation with DG GROW, the section now details the interplay between horizontal measures related to admissible means of incorporating “EU preference” requirements in public procurement which the Public Procurement Act should provide and the sector- specific approach leveraging a ward criteria under PM16 and PM19 of CADA. 16 Table 2. Modifications of the previous version of the impact assessment report in response to RSB first negative opinion Opinion of the RSB by point How comments have been addressed Sections in IA report/Annex (B) Key issues (1) The key proposed policy measures are not sufficiently specified to allow for the assessment of those measures and whether they can address the identified problems of EU competitiveness and strategic autonomy. Their proportionality is not adequately demonstrated. A clearer description of the market historical context and evolution has been added before introducing the problems of the intervention. Moreover, problem drivers 1 - 4 have been updated to better reflect relevant failures and the regulatory complexity at play. Main report: section 2.1, section 2.2 , section 2.3 (2) The aspects of EU strategic autonomy are insufficiently reflected in the report. The general objective , and the specific objectives 3 and 4 have been updated to include a clearer strategic autonomy dimension. Main report: section 4 (3) The proposed policy measures, including on EU ‘sovereign’ solutions, are not clearly defined and the causal links in the intervention logic are not sufficiently substantiated. The description of the policy measures has been improved both in section 5.2 and in annex 4 , notably PM11, PM15 and PM21 . The causal links have been included also in section 5.2. Furthermore, the table in section 5.2.3 has been updated to show clearer the link between the problem drivers, the problems, the policy options, policy measures and specific objectives. Finally, a new table has been added in section 5.2.4 to better demonstrate which aspects of each problem driver the proposed policy measure address. Main report: section 5.2 (notably 5.2.1, 5.2.2, 5.2.3 and 5.24) (4) The analysis of effectiveness and efficiency does not sufficiently reflect the adjustment costs, technical feasibility and unintended consequences linked to the proposed policy measures. Adjustment and administrative costs have been cross-checked and updated in the main report under section 6 and Annex 4. While quantitative estimates of all possible adjustment costs and unintended consequences were at times limited by data availa bility, the effectiveness and efficiency analysis have been revised and the discussion to address transition costs, technical feasibility and possible side effects of the proposed measures , expanded . This has been added under section 7.1 and 7.2. The sensitivity analysis in s ection 7.5 has also been updated to clearly present the uncertainties linked to the proposed policy measures. Main report: section 7.1, 7.2, 7.5 Annex 4 (C) What to improve 1) The report should better analyse the root causes of the insufficient cloud capacities in the EU and the declining market share of European services providers. Section 2.1 (Problem context) has been reformulated to include an analysis of the main drivers for the current situation of the declining market share of EU providers. Main report: Section 2.1, Section 2.2, Section 2.3 17 Opinion of the RSB by point How comments have been addressed Sections in IA report/Annex Based on an analysis of the main drivers of competitiveness, such as price, scope of services, innovation and quality, including cyber security, it s hould analyse potential market failures. It should also analyse potential regulatory failures based on available evidence of investment decisions. It should analyse more thoroughly the current practices and regulatory frameworks in Member States and how th ey impact the Internal Market. It should describe the risks of reliance on non -EU providers and the potential trade - offs with aspects of strategic autonomy. Problem drivers 1 -4 have been updated to showcase better the different failures, such as market and regulatory related ones . Problem driver 1 has been updated seeking to respond to the aspe cts related to the main drivers of competitiveness. Problem driver 2 has also been updated and reformulated to better substantiate the fragmentation of the different regulatory frameworks across MS . P roblem driver 3 has been updated to discuss the risks of reliance to non-EU providers, notably for the public sector. 2) The report should be clear whether – and if yes how - the objectives of this initi ative relate to the EU’s strategic autonomy. What level of autonomy is to be achieved and in which domains? The content of policy measures should be clearly defined, including the criteria for “sovereign solutions” and “EU - made”. The report should better justify how the target of market share of EU providers is set. The general objective as well as specific objectives 3 and 4 have been updated to include a clearer strategic autonomy dimension. The explanations of the main elements of the policy measures have been updated in section 5.2. Further explanations and details have been included in annex 4 under each PM11, PM15, PM16 and PM21 to clarify this. Section 6.1.5 has been updated to include a justification of how the increase of market share from 15% to 30% has been used and what has been the rationale for such an assumption. A new section has been included in Annex 4 (section 8.3) aiming to better explain the feasibility of the move towards a market share of 30% by EU providers per customer segment. Main report: Section 4, Section 5.2, section 6.14 Annex 4 section 7.2 , section 3 and section 8.3 3) The report should assess the potential impacts related to the criteria for “sovereign solutions”. It should analyse in sufficient detail the levels of sovereignty to be reached and be transparent about technical prerequisites needed. The report should assess all the adjustment costs and quantify them to the extent possible and be clear on who will bear these costs. The report should provide a more comprehensive analysis of unintended consequences, including on cyber security, in particular related to The report has been modified in section 5.2 and annex 4 , where a clearer definition of the sovereignty criteria is provided. Annex 4 and section 6.1 have been amended to clarify which adjustment cots have been considered for the sovereignty aspects. Additional explanations and justifications have been included to motivate the rationale of why certain adjustment costs have not been considered. The sovereignty criteria that have been discussed in the report will result in a unique level of sovereignty. However, the report h as been edited to include the notion of “sovereignty-readiness” in section 5.2 and Main report: section 5.2, section 6.1, section 2.2.3. Annex 4 section 3, description of PM11, PM15 and PM21 18 Opinion of the RSB by point How comments have been addressed Sections in IA report/Annex sovereignty and open -source requirements. annex 4, to clarify that not all cloud and AI computing service providers will start from the same situation and what this may entail. The unintended consequences of cybersecurity and open source have been described in PD3 , which has been adjusted accordingly. 4) The analysis of b enefits should be based on robust assumptions, in particular for PO2B and PO2C where stated benefits are very high. For example, all implications should be factored in the analysis, such as investments needed to maintain cyber security, and the scale needed to make them viable in economic terms. In terms of the environmental footprint, the report should explain the mechanisms leading small(er) EU cloud providers to significantly reduced Power Usage Effectiveness values and how European-funded R&D initiative s are expected to deliver superior results when compared to the efforts of global hyperscalers. For PO2-B and PO2-C in annex 4 a clarification has been added both under PM15 (applicable to PO2-B) and PM21 (applicable to PO2-C) on the costs that have been included, the ones that have been excluded and the rationale behind them. The report has also been updated to include additional considerations on the environmental impact of data centre capacity, wi th clearer explanations of how EU-funded R&D initiatives and other Policy Measures are expected to accelerate the adoption of energy - efficient technologies within data centres and thus leading to a long-term reduction in PUE levels, compared to the other o ptions and baseline. The timing dimension of this reduction was also further considered as programmes require time to develop and market new solutions that would optimise energy - efficiency. The report does not suggest that EU- funded R&D is expected to outp erform or deliver superior results when compared to hyperscaler-led investments in innovation . Rather, the discussion focuses on how public R&D support and related policy instruments could help facilitate the diffusion and adoption of current and new techn ologies across the wider data centre ecosystem, and in particular among non -hyperscale operators , which have been found to exhibit higher average PUE levels than hyperscale facilities. Main report: Section 6.3 Annex 4 5) The report should allow for verifiability of the economic modelling. It should quantify and monetise only benefits which can be clearly linked to the policy measures and whose quantification can be substantiated by evidence. Currently the benefit cost ratios presented in the report are not plausible. After revision of the analysis of costs and benefits, the sensitivity analysis should be reviewed in order to allow to assess uncertainty related to the most impactful variables behind the projections. The cost benefit analysis has been r evised. The benefits modelled in annex 4 include only those that can be quantified and monetised; however, as an additional exercise, the indirect benefits, not quantified, had already been included in the previous version of annex 4 under most policy measures. Most of the assumptions remain in line with what had been previously presented. These were validated in one-to-one interviews, CATI surveys and the final validation workshop of the study led by Technopolis. In the even t of uncertainty, assumptions were discussed in the final validation workshop. Except for a couple Main report: section 7.5 Annex 4 19 Opinion of the RSB by point How comments have been addressed Sections in IA report/Annex of them (authorisation effort and PUE) all other assumptions were confirmed by attendees. The explanations for the sensitivity analysis have been improved in section 7.5 6) The coherence, complementarity and potential synergies with other initiatives - such as the Cybersecurity Act, Data Act or the public procurement revision - should be analysed in more detail. Additional clarifications on external coherence with the Cybersecurity Act, the Data Act and the public procurement revision have been added to section 7.3, on top of the existing analysis in Annex 7. Section 7.3 of the main report 4. EVIDENCE, SOURCES AND QUALITY The impact assessment is based on several sources, including: 1. Stakeholder consultation activities (see Annex 2) 2. External support study carried out by an independent consultant (Technopolis Consulting Group Belgium coordinator - SPECIFIC CONTRACT No 4500075392 implementing framework contract No FW-00141707 CNECT/2022/OP/0036 - Framework Contract for the provision of Studies and related services on digital policy issues Study: cloud and AI – STUDY 2024-046) 20 ANNEX 2: STAKEHOLDER CONSULTATION (SYNOPSIS REPORT) 1. INTRODUCTION This annex provides a summary of the consultation activities undertaken to gather evidence and ensure that the public interest is well reflected in the design of potential policy measures for cloud and AI computing services development within the EU. It pr esents the range of stakeholders consulted, describes the main consultation activities and provides an analysis of their views and the main issues they raised. The objective of the consultation activities was to collect the views and experience of stakehol ders on the key problems and associated drivers related to cloud and AI infrastructures in Europe, including current and future capacity needs, sustainability, investment conditions, and the availability of secure EU -based providers and services. In additi on, it aimed to gather information and their opinions on the definition of relevant policy objectives linked to those problem areas and the identification, definition and screening of policy measures that could eventually be incorporated into policy options for this impact assessment as well as gather information and opinions on their likely impacts. 2. OVERVIEW OF CONSULTATION ACTIVITIES 2.1 Public Consultation on the Cloud and AI Development Act The Public Consultation (‘PC’) consisted of an online questionnair e available in English, French and German; and a Call for Evidence (CfE) for stakeholders to submit detailed position papers outlining their views and recommendations on the objectives and proposed actions envisaged by the cloud and AI Development Act, whi le also giving direct evidence to inform the design of policy options. The questionnaire and the Call for Evidence ran from 9 April 2025 to 3 July 2025. In addition to the OPC, the following consultation activities were conducted: • Targeted Workshops with relevant stakeholders; • Ad-hoc contributions and targeted consultations with Member States, small -and- medium sized enterprises (SMEs) and other relevant stakeholders; • Targeted consultations with industry representatives and public authorities through surveys and workshops as part of a study commission by the Commission to support the impact assessment. 2.2 Study to support the impact assessment The Commission contracted a study to a consortium led by Technopolis Group to provide empirical evidence on the currently available computing capacity across Europe and to assess present and projected future cloud computing needs within the EU. The study addresses knowledge gaps in cloud computing development and provides policy recommendations to support the Impact Assess ment. The study incorporates multiple stakeholder engagement activities, including targeted interviews (over 60) , surveys (with over 250 replies) and workshops (over 100 participants). The results of those activities are also included in this annex. 2.3 Overview of workshops, seminars and roundtables: • Workshop with 70 industry actors on industry needs for cloud computing capacity for AI demand (4 October 2024, Brussels, Belgium); • Seminar with industry, academia and public authorities on the economic dynamics of the AI stack (4 April 2025, online); • Workshop with industry on the rationale and policy options that underpin the Act (14 May 2025, Berlin, Germany); 21 • Workshop with the Information Technology Industry Council (15 May 2025, Brussels, Belgium); • Roundtable on investment in cloud compute with financial investors (20 May 2025 Brussels, Belgium); • Presentation on future EU cloud and AI policy with industry (3 June 2025, Bilbao, Spain); • Workshop on the preliminary findings of the accompanying study of the cloud and AI Development Act (6 June 2025, Brussels, Belgium); • Roundtable on policy measures to facilitate data centre integration to the EU grid (18 June 2025, Brussels, Belgium); • Roundtable with European Cloud Service Providers’ CEOs on develo ping sovereign cloud offerings in the EU (23 June 2025, Brussels, Belgium); • Workshop during the 6th General Assembly and Alliance Forum of the European Alliance for Industrial Data, Edge and Cloud (8 July 2025, Brussels, Belgium). • Roundtable with American Chamber of Commerce ( 22 October 2025, Brussels, Belgium); • Workshop on the final findings of the accompanying study of the cloud and AI Development Act (12 November 2025, Brussels, Belgium); 2.4 Awareness raising events in Member States and international outreach The Commission conducted stakeholder activities across several Member States, participating in bilateral meetings with a diverse range of stakeholders in Poland, Germany, the Netherlands and Spain to discuss the problem drivers and core elements of the proposed legislation. The Commission also maintained dialogue with Member States’ relevant authorities through the European Alliance for Industrial Data, Edge and Cloud (‘Cloud Alliance’) a nd bilateral meetings in Brussels. Furthermore, the Commission engaged in bilateral discussions with third countries, including Japan, Switzerland and the United Kingdom, to present and discuss the considered policy options while gathering insight on best practices. 2.5 Bilateral meetings with industry, academic institutions, think tanks The Commission conducted over 100 bilateral meetings with a diverse array of stakeholders, including industry representatives, academic institutions, think tanks and civil soci ety organisations to gather feedback on the design of policy options for the cloud and AI Development Act. These meetings facilitated an open dialogue with both European and international partners regarding their perspectives, concerns, and recommendations across the different policy pillars of the cloud and AI Development Act. 3. PARTICIPANTS AND METHODOLOGY 3.1 Participants A total of 436 responses to the PC were received: 243 for the consultation survey and 193 for the Call for Evidence. The largest share came from EU citizens, accounting for 33% of all responses. This was followed by companies (28%) and associations and trade unions (18%). Additional contributions came from academic and research institutions (9%), civil society and consumer organisations (7%), and public authorities (4%). Only 2% of all respondents were non-EU citizens. In terms of geographical origin, 90% of respondents (393) were based within the E U. The remaining 10% (43 responses) came from non-EU countries, including the US (25 responses), United Kingdom (10), Switzerland (2). The Member States with the highest participation rate 22 were Spain (78 responses; 18%), Germany (57; 13%), and both France and Belgium (56; 10% each). No responses were received from Bulgaria, Croatia, Latvia, or Malta. The 243 respondents to the questionnaire comprised 66 companies and private businesses (27%) including 17 SMEs, 96 EU citizens (39%), and 13 public authorities (0.4%). Out of the 66 companies and private businesses, 57% were AI developers or deployers, 5 6% were cloud/edge/AI users, 48% were cloud/edge/telecommunications providers, 45% were data centre operators, and 7% were financial institutions.2 3.2 Methodology The responses to the OPC were subjected to quantitative and qualitative analys es. In the quantitative analysis, the respondents were ordered into the main categories considered relevant for the analysis. The answers were mapped and analysed to identify patterns as regards “who thinks what?”. When considering the views of respondents on questions where they were asked to rank on a scale of 1 to 5 (1 = not very important, 5 = very important), only responses ranked 4 or 5 were considered when determining respondents’ positions on each issue. The qualitative analysis of open responses and position papers was carried out in two stages. In a first step, the content of the submissions was synthesised to capture the main experiences and feedback of respondents. In a second step, these summaries were clustered according to the type of issue raised, so that contributions addressing comparable concerns were considered together irrespective of their specific wording. This approach allowed for a structured overview of the main perspectives of the respondents. 4. ANALYSIS OF THE STAKEHOLDER CONSULTATION The respondent input gathered through the OPC highlighted four core policy challenges, which directly informed the structure of potential policy options under consideration for the cloud and AI Development Act. The main challenges and problems identified through the OPC are: 1. The strategic dependency of EU businesses and public authorities on non-EU providers of AI and cloud services, raising questions about sovereignty, resilience, and competitiveness; 2. Structural and regulatory bottlenecks hindering the e xpansion of data centre capacity across the EU, particularly in the face of growing AI-related demand; 3. Barriers to the digital transformation of the public sector, including limited capacity, fragmented compliance, and complex procurement procedures; and 4. The absence of a common EU -level definition and operational criteria for 'sovereign' cloud and AI computing services , leading to legal uncertainty and inconsistent implementation across Member States. 4.1 EU businesses and public authorities’ dependency on non -EU cloud and AI providers The hyperscalers are recogni sed for their ability to deliver comprehensive, ready -to-use business services that European providers have yet to match. For example, in terms of AI computing services, out of the respondents that prov ided an answer in the questionnaire, 48% indicated that only hyperscalers could offer those services and only 3% said that European providers were capable of offering those services. Despite this reliance, respondents emphasized the critical need for trust ed EU -based cloud service providers, particularly for 2 The sum of the percentages is higher than 100 as one company may be involved in more than one sector. 23 processing sensitive data. When selecting cloud service providers, users prioritise cybersecurity (97%), data location (87%), connectivity (81%), and innovation (81%) as their primary criteria. Among re spondents who provided an answer, when selecting a cloud provider, 82% were concerned that provider was headquartered in a third country that poses specific cybersecurity threats to the EU. In addition, 58% were concerned about vendor lock-in and 42% considered as a challenge the limited access to computational capacity in the EU. Finally, 89% considered that the location of the data was one of the main factors impacting their choice of Cloud/Edge/AI provider. In the CfE, public authorities showed widespread concern about Europe’s dependency on non- EU cloud and AI providers; however, there was some divergence on the solutions. Some authorities described the situation as a “market failure” due to the lack of viable European alternatives in key service areas and called for supplier diversification. Other public authorities advocated risk-based approaches to avoid protectionist outcomes. Some EU citizens questioned the structural reliance on private actors and proprietary systems while advocating for an EU- first approach and arguing that transformation cannot succeed while relying on foreign vendors whose strategic incentives may not align with public interest objectives. 4.1.1 Policy measures In the CfE, respondents were generally in favour of simplifying per mitting requirements and one-stop-shop to facilitate the deployment of data centres in the EU (see Section 4.2.1 below). European companies and business associations expressed strong interest in setting up sovereignty requirements and introducing “Buy EU” criteria in public tenders, whereas their global counterparts cautioned against digital protectionism and argued digital trust could be achieved without exclusion based on geographical origin (see Section 4.4.1). 4.2 Bottlenecks to expand (sustainable) data centre capacity within the EU Data centre operators (‘operators’) demonstrated strong investment intentions in AI infrastructure, with 80% of them planning to expand capacity within the EU. Among operators, 77% replied future infrastructure would be dedicate d to general purpose computation, 70% indicated it would be used for AI model inference, 60% on AI model training, and 33% on edge AI. Despite this enthusiasm, operators face substantial barriers that may hamper their expansion plans. Complex and lengthy permitting procedures emerged as the primary challenge ( 87%), followed closely by limited access to energy resources ( 83%). The prevalence and severity of these obstacles is illustrated by the fact that 57% of operators need on average between 3 and 5 years for the data centre to be operational, and 13% of them need between 5 and 7 years. The presence of those bottlenecks is supported by the responses to the CfE where connection to the electrical grid was also identified as a key bottleneck by several resp ondents. One business association indicated it could take up to 7 or 8 years for transmission access and two operators mentioned grid connection could take up to a decade. In addition, one business association considered those problems were exacerbated by growing local opposition to the construction of data centres, a phenomenon often termed “not in my backyard”. The factors considered by operators regarding building new data centres or expanding existing infrastructures are energy availability (91%), as well as long approval times (83%), permitting 24 procedures (82%) and the complexity of the regulatory framework (75%).3 Those factors reflect the importance given by operators to grid connections and the entire permitting process. Access to finance also appears to be a common hurdle with 50% of operators and 53% of Cloud/Telco/edge providers considering high interest rates as a limitation when expending their capacity in the EU. 4 In addition, several SMEs expressed mounting concerns over high operational costs when it comes to infrastructure expansion in the EU. In the CfE, public authorities agreed on the need for increased data centre capacity while stressing different strategic priorities. I ndustry associations identified fragmented permitting regimes across Europe, limited energy access, and regional disparities as persistent constraints on capacity scaling. It is important to note that in the CfE, some EU citizens challenged the expansion narrative entirely, criticizing the approach for the ignoring social and environmental costs of AI and advocating for binding limits on resource consumption rather than efficien cy improvements alone. 4.1.2 Policy measures Overall, across all respondent groups, 45% considered that having a one -stop-shop service to deal with permits at different administrative levels should be a priority action at EU level to boost the availability of su fficient and adequate cloud capacity for AI workloads; and 46% considered it essential to reduce the amount of time needed to obtain the necessary permits and environmental authorisations. Finally, 55% were in favour of creating expedited approval mechanisms and clear conditions for critical or strategic projects. Table 2. EU policy measures on simplification of infrastructure permitting procedures Policy Measure Companies (SMEs) Data Centre operators Public Authorities EU Citizens Business associations/ trade unions CSOs5 One stop shop service for managing permits 59% (41%) 83% 46% 43% 56% 15% Reduce time to obtain permits and environmental authorisations 71% (53%) 93% 23% 38% 60% 21% Expedited approval mechanisms for critical/strategic projects 79% (71%) 97% 54% 49% 57% 27% In the CfE, several industry associations and companies recommended the creation of EU-level zoning guidelines, one-stop-shop permitting hubs, and fast -track authorisation for sustainable projects. This was echoed by investment respondents who stressed that streamlining permitting procedures would significantly enhance the sector's attractiveness for capital allocation. In terms of sustainability, 69% of respondents supported funding for R&D of energy-efficient technologies. This was echoed in the CfE by a Member State’s government which suggested R&D&I for data centre technologies enhancing sustainability , as well as several business 3 The respondents who did not provide an answer to that question were not included to calculate the percentage of respondents. 4 The respondents who did not provide an answer to that question were not included to calculate the percentage of respondents. 5 The category Civil Society Organisations (CSOs) include NGOs, consumer organizations, environmental organizations, and academic/research institutions. 25 associations and companies. In addition, 62% were in favour of tax incentives for using sustainable technologies. In terms of EU actions that should be prioritised to boost the availability of sufficient and adequate cloud capacity for AI workloads, 72% supported the creation of clear environmental compliance requirement et EU level, and 66% were in favour of unified guidelines at EU level for energy efficiency for computing infrastructure. Table 3. EU policy measures to address sustainability aspects of data centres Policy measure Companies6 DC operators Public authorities EU citizens Business associations / trade unions CSOs7 Clear environmental compliance requirements 64% 73% 46% 86% 60% 70% Addressing energy availability 73% 80% 54% 77% 50% 61% Addressing land availability 47% 47% 23% 65% 47% 52% Funding for research and development of energy-efficient technologies 61% 57% 54% 83% 60% 58% Tax incentives for using sustainable technologies 70% 73% 54% 67% 60% 39% In the CfE, multiple business associations and companies suggested the introduction of targeted tax incentives to build sustainable and energy efficient cloud infrastructure. Some considered this would be more useful than duplicating the current environmental regulations. On e company suggested to create tax incentives for data centre operators that implement sustainable technologies, including waste heat reuse or immersion cooling. In addition, one business association was in favour of public-private partnerships to build sustainable, innovative cloud infrastructure. Some public authorities recommended strategic infrastructure funding to be tied to interoperability and climate goals. Overall, this shows a strong support by different respondent groups to address existing bottlenecks in the deployment of data centres and to ensure those are sustainable and energy efficient. 4.3 Barriers to public sector transformation and public procurement Cloud adoption in the public sector is already widespread with 85% of respondents (i.e. public authorities) storing data in cloud environments. This data often includes sensitive information (46%), commercially sensitive material (38%), or content related to public security and health (23%). The sensitive nature of this data creates heightened concerns about exposure to third - country authorities and the cybersecurity risks associated with cloud service providers headquartered in certain jurisdictions. Such a problem is not theoretical as 69% of public authorities acknowledged that their procured providers were subject to non -EU jurisdictions including laws with extraterritorial effect. In addition, 77% of public authorities cited security risks as one of the primary obstacles preventing broader public sector cloud adoption, alongside regulatory barriers, including 6 In each policy measure, companies include data centre operators, cloud/edge/telecommunications providers, cloud/edge/AI users, AI developers and AI deployers, and financial institutions. 7 The category Civil Society Organisations (CSOs) include NGOs, consumer organizations, environmental organizations, and academic/research institutions. 26 procurement requirements (68%), and insufficient technical capacity to assess and procure appropriate cloud services ( 62%). In addition, 62% of public authorities mentioned fear of vendor lock as a challenge in the adoption of cloud. These concerns are echoed by EU citizens since 76% considered public services in the EU should not be allowed to store citizen data with non -EU cloud providers, only 9% considered it depended on the type of service or data. In the CfE, regional and local authorities identified administrative barriers such as fragmented national audits, inconsistent certifica tion requirements, and burdensome permitting processes as core obstacles. Overall, multiple respondents emphasized that underlying market structure issues such as vendor lock-in and limited portability represent real barriers. 4.1.3 Policy measures To address these barriers, public authorities advocated for coordinated EU -level action, with 84% supporting the establishment of cybersecurity guidelines, 77% supporting the adoption of standards, open specifications, and mechanisms to ensure interoperability. Finally , 77% advocated for a mechanism to allow federation of cloud services across public administration within and across Member States. In terms of policy actions to address the current problems faced by public administrations regarding procurement, 85% of public authorities support the creation of guidelines with standard criteria to procure cloud services an d 69% support guidelines with standard award criteria. Regarding cloud and AI computing services more generally, 61% would support the creation of a marketplace for cloud and AI computing services. In addition , overall, 74% of respondents support an open s ource software ecosystem. The majority of public authorities, academic institutions and EU citizens would favour an obligation to release the code developed with public money onto open-source repositories (61%), as well as a common open-source licensing schema across the EU (64%). Table 4. EU policy measures to support procurement of cloud and AI computing services Policy Measure Companies8 Public Authorities EU Citizens Business associations / trade unions CSOs9 Guidelines with standard criteria to procure cloud services 50% 85% 61% 20% 55% Standardised tender vocabulary and requirements 38% 54% 36% 20% 30% Guidelines with standard award criteria 32% 69% 26% 17% 39% Criterion for solutions with added value and innovation 27% 23% 30% 33% 18% Improvement of skills and capabilities 32% 69% 41% 40% 21% Marketplace of cloud and AI computing services 26% 62% 31% 20% 27% Supporting an open source software ecosystem 62% 31% 92% 73% 60% 8 In each policy measure, companies include data centre operators, cloud/edge/telecommunications providers, cloud/edge/AI users, AI developers and AI deployers, and financial institutions. 9 The category Civil Society Organisations (CSOs) include NGOs, consumer organizations, environmental organizations, and academic/research institutions. 27 In the CfE, some national and local governments as well as several public authorities emphasized empowering public buyers through model clauses and guidance to help public administrations to procure cloud services. However, some warned against mandatory obligations that could conflict with EU procurement principles or overly limit their flexibility. Some companies framed public procurement as a critical but underused leverage point, though they diverged sharply on solutions. European companies argued that current frameworks fail to empower buyers to choose sovereign, sustainable, or interoperable solutions, calling for uptake targets for trusted EU cloud services and criteria based on sovereignty and environmental performance. Some argued for a diversificat ion of cloud supply, including strengthening EU-based alternatives and governance but without restricting the use of non-EU providers. In contrast, global providers support the EU's ambitions to bolster innovation and security but warn against overly restrictive sovereignty rules that could hinder competitiveness and limit access to cutting -edge technologies if they exclude providers based on corporate origin. Sovereignty requirement for critical use cases must be carefully defined to avoid fragmentation. They advocate for a pragmatic and targeted approach to defining ‘sovereignty’ to avoid unintended consequences such as straining the EU's cloud ecosystem or fragmenting the Single Market. To strengthen resilience and avoid vendor lock -in, several companies and business organisations recommend that public authorities adopt multi -cloud strategies for non -critical use cases. In general, all respondent groups, especially public authorities and both EU and non -EU companies, showed strong support for o pen source to foster sovereignty, interoperability and competition. 4.4 Lack of common concept and operational criteria for sovereign cloud and AI computing services In the CfE, respondents consistently identified the absence of a common EU definition and certification framework for sovereign cloud and AI computing services as a fundamental barrier to building trust, driving adoption, and enabling cross -border scalability. The lack of harmonized cybersecurity standards particularly limits providers’ ability to scale services across Member States, creating fragmentation that undermines the Single Market potential. This regulatory gap has intensified demands for trusted EU -based cloud providers capable of delivering sensitive data services with robust guarantees of legal and operational sovereignty, interoperability, and protection from extraterritorial interference. These concerns align with public sentiment, as EU citizens expressed significant wariness about foreign control of public data where 85% reported low to very low trust in providers based outside of the EU, and 76% considered public services in the EU should not be allowed to store citizen data with non -EU cloud providers. In the CfE, there was near-universal agreement that the term ‘digital sovereignty’ lacks a clear and actionable definition, particularly in the context of cloud and AI computing services. Public authorities acknowledged that the concept of ‘sovereign cloud’ remains ill -defined, creating uncertainty across the policy landsc ape. Several EU citizens emphasized that sovereignty should ensure services critical to public continuity cannot be disrupted unilaterally by non-EU actors. 4.1.4 Policy measures Among public authorities, 77% would support a criterion to ensure sovereignty, auto nomy, resilience and availability. In the CfE, public authorities specifically called for a clear, uniform 28 definition of cloud sovereignty that encompasses data ownership, exclusive EU jurisdiction, and comprehensive contractual safeguards. Many advocated for deploying EU -level secure cloud offerings comparable to existing frameworks like SecNumCloud or EUCS High+. Some respondents repeatedly emphasized the urgency of finalising the EUCS certification scheme and integrating it into procurement frameworks, w hile leveraging public procurement rules to reinforce sovereignty requirements and mitigate national security risks. Several public authorities proposed extending NIS2 scope to include suppliers serving essential public services. Some public authorities a nd national governments advocated for functional, risk -based approach to sovereignty as full technological autonomy for all cases is not realistic. Sovereignty should be anchored in clear operational criteria focused on retaining control over data and operations, switching providers, and avoiding undue foreign legal influence rather than mandating EU-only solutions. Regulatory bodies emphasized that sovereignty must not become a pretext for fragmentation, instead advocating for open architectures, multi-cloud approach, and guaranteed access to key inputs for challenger firms. Among industry associations, there was a split between those calling for functional definitions based on EU legal jurisdiction and vendor independence through federated European solutions, and those warning that overly restrictive criteria could impede cross-border services and harm innovation. Several European companies pushed for enforceable criteria involving EU ownership, legal immunity from third -country laws, and operational aut onomy, with some proposing sovereignty frameworks differentiated by use case criticality. In contrast, non -EU providers urged against rigid definitions, recommending non -discriminatory and risk -based criteria grounded in technical safeguards rather than ownership or nationality. Table 5. Level of support for EU policy measures to protect against unlawful access to sensitive data by third-country legislation with extraterritorial reach and risk associated with supply chain dependenci es Policy Measure Companies10 Public Authorities EU Citizens Business associations / trade unions CSOs11 Criterion ensuring sovereignty, autonomy, resilience and availability 45% 77% 63% 23% 52% Criteria to narrowly identify highly critical use cases for public procurement 30% 62% 48% 20% 52% Pursue international cooperation with third countries that address such risks 45% 69% 40% 70% 27% Criteria to differentiate between third countries depending on whether they pose specific threats to the Union 29% 54% 44% 27% 24% 10 In each policy measure, companies include data centre operators, cloud/edge/telecommunications providers, cloud/edge/AI users, AI developers and AI deployers, and financial institutions. 11 The category Civil Society Organisations (CSOs) include NGOs, consumer organizations, environmental organizations, and academic/research institutions. 29 ANNEX 3: WHO IS AFFECTED AND HOW? 1. PRACTICAL IMPLICATIONS OF THE INITIATIVE This initiative aims at providing a framework to ensure the functioning of the internal market for cloud and AI computing services in the Union and secure the necessary conditions for the Union’s competitiveness and strategic autonomy. The preferred policy option s and measures are expected to increase computing capacity deployed in the EU through innovative and sustainable technologies, ensure attractive conditions for the deployment of such computing capacity, decrease the overall reliance on non-European cloud and AI computing services and contribute to the protection of public order by enhancing resilience of supply of cloud and AI computing services in particular for the public sector. The key stakeholder groups concerned include data centre operators, cloud and AI computing service providers, private sector entities operating in sectors listed under Annex I of NIS2, national and local public authorities, and the European Commission. However, all businesses that rely on digital services across a wide range of sectors, as well as citizens will also be indirectly impacted, albeit in varying degrees. The following table presents an overview of the main impacts and stakeholders affected for the preferred options. Table 6. Main impacts and stakeholders affected Affected stakeholder Main impacts Costs Benefits (Direct and indirect) Businesses Data centre operators ⎯ Direct compliance costs: ⎯ Administrative costs (e.g. preparing applications and ensuring compliance with funding rules; paperwork for fast track permitting) ⎯ Adjustment costs (e.g. adjustments to meet funding eligibility criteria and access the areas) ⎯ Improved predictability of regulatory direction (e.g. coordination efficiencies and reduced information asymmetries) ⎯ Reduced fragmentation of national approaches and administrative simplification, e.g. fewer bilateral interactions, clearer requirements, and coordinated processing ⎯ Reduced permitting delays (e.g., faster time to market and higher NPV, labour time saved) ⎯ Direct financial support for innovation and deployment ⎯ Energy savings ⎯ Possibility for improved access to investment opportunities (CAPEX de-risking) ⎯ Easier cross-border operations 30 Affected stakeholder Main impacts Costs Benefits (Direct and indirect) Cloud and AI computing service Providers ⎯ Direct compliance costs: ⎯ Administrative costs (e.g. providing information for repository; participation to audits; preparation of applications for funding scheme) ⎯ Adjustment costs (e.g. alignment with sovereignty criteria; participation to public procurement procedures; eventual alignment with standards) ⎯ Improved predictability of regulatory direction (e.g. coordination efficiencies and reduced information asymmetries) ⎯ Reduced fragmentation of national approaches ⎯ Reputational gains from alignment with EU standards ⎯ Easier cross-border operations ⎯ Faster procurement ⎯ Direct financial support for innovation ⎯ Improved access to investment opportunities ⎯ Reduced marketing costs ⎯ Increased revenues ⎯ Easier uptake of innovative solutions for cloud and AI computing services ⎯ Productivity gain and business modernisation ⎯ Improved business continuity Private sector entities operating in sectors listed under Annex I of NIS2 − Direct compliance costs: ⎯ Administrative costs (i.e. expanded cybersecurity risk assessment to address non- technical risks) Public authorities National and local public authorities ⎯ Direct compliance costs: ⎯ Administrative costs (e.g. data collection of fast-track areas; sovereignty risk assessments; drafting of national strategies; updates of procedures/ templates related to public procurement; reporting activities to maintain the open source programme office and on the implementation of national strategies) ⎯ Adjustment costs (e.g. redesign of permitting processes and reprioritising planning resources for fast- track areas; alignment of national measures with EU- level rules; integrating risk assessment outcomes within procurement; transition costs linked to new cloud and AI computing services providers; participation in the public sector cloud federation; alignment of procurement criteria; set up and management of the infrastructure for the open- source repository) ⎯ Enhanced dialogue with industry ⎯ Better monitoring of sector developments ⎯ Alleviated constraints and delays resulting in reduced pressure from industry over bottlenecks ⎯ Reduced time dedicated to individual data centre projects ⎯ Saved effort from common mechanism and sharing of idle capacity ⎯ Faster and more reliable procurement processes ⎯ Reduced screening efforts and efforts needed to verify eligibility ⎯ Streamlined verification of compliance ⎯ More sovereign cloud and AI computing services ⎯ Reduction of proprietary license expenditures and lower licensing costs ⎯ Reduced duplication of work and efforts ⎯ Reduction of total cost of ownership for IT systems ⎯ Shorter procurement time for innovative solutions; reduced time needed to find providers 31 Affected stakeholder Main impacts Costs Benefits (Direct and indirect) European Commission ⎯ Administrative costs (e.g. design and monitor EU-level funding instruments; setting up and overseeing the repository of audited sovereign services; financial and coordination support) ⎯ Adjustment costs (e.g., setting targets; monitoring progress; new supervisory capacity to enforce EU-level targets; design of training programme; setting up the certification framework; developing and deploying the federation platform; setting up the voucher scheme for SMEs; setting up the cloud and AI toolbox) ⎯ Enforcement costs (e.g. running EU-level infrastructure, defining targets and ensuring compliance) ⎯ Harmonisation of practices and approaches across the EU ⎯ Increased ability to steer the market towards EU priorities and accelerated innovation ⎯ Reduced duplication of efforts at national level ⎯ Faster and more reliable procurement processes; ⎯ Reduced screening efforts and efforts needed to verify eligibility; ⎯ Streamlined verification of compliance; ⎯ Reduction of proprietary license expenditures and lower licensing costs; ⎯ Reduced duplication of work and efforts; ⎯ Reduction of total cost of ownership for IT systems; ⎯ Shorter procurement time for innovative solutions; reduced time needed to find providers Consumers and citizens Consumers and citizens ⎯ Potential budgetary trade-offs from public funding ⎯ Possible cost pass-through from compliance obligations to end users ⎯ Higher prices12 ⎯ Improved transparency and stakeholder engagement ⎯ Faster and more sustainable roll- out of digital infrastructure ⎯ Improved digital service quality and lower costs ⎯ Improved transparency on security properties ⎯ Enhanced protection of fundamental rights, especially privacy and data protection ⎯ Enhanced transparency and trust ⎯ Higher employability ⎯ Greater trust in public digital services 12 Concerning data centre expansion, potential increased costs via grid tariffs are an important element. ACER’s 2024 Electricity Infrastructure Monitoring Report shows that future grid costs are highly sensitive to rising electricity consumption and increased grid-investment expenses, with a 10% increase in either factor possibly resulting in a 1 to 4.5 EUR/MWh rise in grid costs by 2050. As data centres are among the fastest-growing and electricity-intensive sectors, they influence both drivers of higher grid costs with consequent possible increases in electricity prices. The Finnish National Roadmap for Data Centres similarly highlights that the sector’s expansion could st rain the power grid and contribute to higher electricity prices unless data centre development and grid planning are coordinated proactively. See also: Overcoming energy constraints is key to delivering on Europe's data centre goals – Analysis - IEA; ACER Monitoring Report on cross -zonal electricity trade and congestion management in the EU (2025) and National Roadmap for Data Centres : Rapporteur's Report. Moreover, in regions where water resources are limited, inefficiently managed industrial demand c an exacerbate competition with households, increase the likelihood of water restrictions, and call for expensive network upgrades – costs that may ultimately affect consumer water bills depending on the tariff structure and regulatory cost distribution. Thus, proactive governance of data centre water usage is also key to protect citizens’ access to water and prevent unintended increases in residential water costs. 32 Affected stakeholder Main impacts Costs Benefits (Direct and indirect) ⎯ Continuity and resilience of critical services, like health, defence, and finance This initiative is expected to generate costs for data centre operators and cloud and AI computing service providers, but also significant savings and direct economic benefits. While administrative and adjustment costs arise from, inter alia, participation in funding programmes and fast-track permitting procedures, or from the audit procedures and risk assessments, these are offset by the efficiencies and benefits that emerge from administrative simplification, reduced fragmentation of national approaches , and greater incentives for investments, improving the attractiveness of the Single Market. National public aut horities are expected to incur administrative and adjustment costs for assessing applications for support measures and permitting, planning resources for fast -track areas, monitoring compliance, and participating in the cloud federation. However, these costs are balanced by significant savings resulting from reduced inefficiencies and duplications caused by the lack of harmonisation. National public authorities will also directly benefit from open source solutions as well as indirectly from additional cloud and AI capacity at lower costs. Ultimately, this initiative aims to support the digital transformation and resilience of public authorities. Moreover, while some Member States might need a reinforcement of capabilities, the EU would bear the cost of oversight, with the aim to create efficiency gains in the cooperation across Member States. The administrative and adjustment costs borne by the European Commission, related to the implementation of the measures and their supervision are expected to be outweighed by significant long-term benefits. Society at large is expected to benefit from the wider availability of digital services, underpinned by robust digital infrastructures. As the same time, the deployment of sustainable infrastructures will accelerate the green transition, ensuring that digitalisation goes hand in hand with environmental responsibility. The assessment of the impacts draws on multiple data sources, including the targeted stakeholder consultation (interviews and s urveys), the public consultation, and desk research in the context of the impact assessment support study. To the extent possible, the impacts are quantified based on available assessments or modelling by Technopolis et al. (2025)13. Where dedicated modelling was not possible due to the lack of tools or data, a qualitative assessment was performed, based on existing studies and input from stakeholders. Annex 4 provides further details on the methodological approach, detailed tables and estimates. 2. SUMMARY OF COSTS AND BENEFITS 13 Technopolis et al. (2025), “Study: Cloud and AI” I. Overview of Expected Benefits (total for all provisions) – Preferred Option Description Indicative range (NPV 10-years) Comments Direct benefits Economic benefits from administrative simplification and fast-track areas for providers (PM4, PM5) EUR 8 – 27 bn These are the large, expected benefits accruing to data centre operators which are foreseen to benefit from reduced times to build new facilities. It has been calculated as the net present value of discounted economic benefits over 10 years. The economic benefits that are expected from these measures extend beyond the measurable impact (see below on indirect benefits). 33 14 Harvard economist Jason Furman reported in September 2025 that investment in information processing equipment & software was 4% of GDP in the US in 2024, but it was responsible for 92% of GDP growth in the first half 2025; US GDP excluding these categories grew at a 0.1% annual rate in the first half of 2025. More information available here: Without data centers, GDP growth was 0.1% in the first half of 2025, Harvard economist says | Fortune. Cost savings from administrative simplification and fast -track areas for public authorities (PM4, PM5) EUR 166 – 277 m These include administrative cost savings accruing to public administrations as they reduce parallel processing of projects and back-and-forth interactions with operators. Cost savings from the increased use of open source in public administrations (PM20) EUR 2 – 12 bn By reusing and adapting existing software rather than commissioning bespoke solutions, administrations can reduce duplication of effort and lower the total cost of ownership of ICT projects. Costs savings for authorities from using standard non-specific award criteria when drafting tender specifications (PM19) EUR 4 – 13 m Cost savings for public authorities stem from use of standard criteria when procuring cloud and AI computing services that can be reused across all public tenders. Costs savings for authorities from using audited services in tenders (PM21) ⁓ EUR 2.5 m Cost savings for public authorities stem from the use of the repository of sovereign cloud and AI computing services and audit reports, which are expected to save administrations time in their verification of the documentation for the evaluation of the offers. Cost savings for cloud and AI service providers from being able to use sovereignty audits across all MS, i.e. once and for all (PM21) EUR 2 – 5 bn These direct savings for providers stem from their ability to get the audited in one Member State and participate in procurement of services for critical use cases across all EU27. Cost savings from cloud federation and joint procurement for public administrations (PM22) EUR 19 – 49 bn Recurrent savings stem from the cloud federation, i.e. from reducing idle capacity, getting cheaper computing resources and reducing the coordination effort for sharing computing capacity. The participation in the joint procurement framework and the aggregation of demand in common EU-level procurement processes is also expected to significantly reduce the required FTEs for procuring cloud and AI computing services and service prices from higher scale and purchase power. Direct cost savings in AI -based transformation project design for SMEs (PM23) EUR 160 – 500 m The targeted scheme to provide financial support to SMEs for adopting cloud and AI computing services foresees a yearly budget of EUR 40 050 000 over the 10 -year period, mostly dedicated to supporting the design and planning phase of cloud and AI -based transformation projects for SMEs. The grants are fixed amounts that SMEs can spend in consultancy services to design digital transformation projects based on cloud and AI technologies. Indirect benefits Indirect benefits coming from data centre deployment targets This was assessed qualitatively or based on existing literature. Decrease of the capacity gap and contribution to the overall GDP and workforce driven by the data centre sector and related fields. For operators, clearer EU -wide targets and consistent monitoring could help reduce investment uncertainty, reducing effort in oversupplied or poorly sited locations. Nationa l authorities would also benefit from improved infrastructure foresight, with better planning for grid reinforcements and targeting of support schemes. Indirect benefits from additional data centre capacity on GDP growth and employment levels This was addressed under Section 6.1.5 and 6.2. Economists have attributed the growth in GDP growth from investment in data centres and information processing technology14. In additional to these gains, there are likely to be indirect benefits for society at large, e.g. in terms of improved digital infrastructure, skills development and increased attractiveness of the EU for complementary industries. These spillover effects, while possibly significant, are not directly quantified due to the lack of reliable data. 34 (1) Estimates are gross values relative to the baseline for the preferred option as a whole (i.e. the impact of individual actions/obligations of the preferred option are aggregated together); (2) In the comments column the key stakeholder group as main recipient of the benefit is presented;(3) Spillover effects and broader social benefits of enhanced digital infrastructure for citizens and consumers were hard to quantify given their lon g-term and diffuse nature and were thus assessed only qualitatively. II. Overview of expected costs, indicative ranges as discounted NPV over 10 years – Preferred option Citizens/Consumers Businesses (including SMEs) Administrations (national public and European Commission) One-off Recurrent One-off Recurrent One-off Recurrent Legislative and financial intervention enforced nationally: Administrative simplification and fast-track areas for the roll-out of data centres; support measures and deployment targets also based on national data centre strategies (PO1-B) Direct adjustment costs EUR 6 – 26 m EUR 28 – 43 m EUR 2 – 14 m Direct administrative costs EUR 1 – 4 m EUR 0.2 – 0.6 m EUR 1 – 6 m EUR 46 – 86 m Direct enforcement costs EUR 30 – 89 m EU R&D funding and deployment funding for strategic projects (PM8, PM9) Direct adjustment costs EUR 1 – 2 m EUR 0.6 – 1.2 m Direct administrative costs EUR 1 – 3 m Indirect benefits coming from funding for R&D and strategic projects This was assessed qualitatively or based on existing literature. It is important to underline that the expansion of data centre capacity entails considerable environmental impacts, including increased energy consumption, water use, land uptake and associated carbon emissions. These impacts may generate new social and environmental costs, with possible consequences for overall welfare, local ecosystem and community acceptance. For these reasons , measures that promote sustainable solutions are fundamental to ensure that new facilities are designed and operated with sustainability principles at their heart. This fundamental to maximise net social benefits and safeguard the public good over the long term. Indirect benefits from the increased use of open sourc e solutions in public administrations This was assessed qualitatively or based on existing literature. When public administrations increase their procurement and use of open source software, they create additional demand for open and interoperable solutions across the wider economy. Indirect benefits from the sovereignty risk assessment scheme This was assessed qualitatively or based on existing literature. The sovereignty assessment framework provides national authorities with a more robust mechanism to procure and uptake cloud and AI computing services, protecting critical use cases where public order is at stake. It allows for the diversification of dependencies, and services from non -European providers would still be able to qualify for 90% of the public sector’s needs. At the same time, it contributes to reducing exposure to non -EU dependencies and single provider concentration risks, strengthening the resilience and autonomy of cloud and AI services. Indirect benefits from joint EU - level procurement This was assessed qualitatively or based on existing literature. The increase in public procurement of cloud and AI sales volume that is addressable by European providers may help increase their scale and competitiveness and their share in the European an d global cloud and AI markets. 35 II. Overview of expected costs, indicative ranges as discounted NPV over 10 years – Preferred option Citizens/Consumers Businesses (including SMEs) Administrations (national public and European Commission) One-off Recurrent One-off Recurrent One-off Recurrent EU-coordinated procurement and support framework for sovereign cloud and AI computing services: OSS use in the public sector; mandatory use of audited cloud and AI computing services in highly critical public sector use cases and award criteria; private entities cybersecurity risk-assessment integration to consider risks from using non audited providers; national strategy definition and monitoring; joint EU- level procurement; public sector cloud federation; SME support scheme; Cloud and AI toolbox (PO2-C) Direct adjustment costs EUR 173 m – 352 m EUR 140 m – 420 m (*) EUR 1.3 – 2.7 bn Direct administrative costs EUR 27 m – 83 m EUR 560 m – 2.9 bn EUR 10 m – 27 m EUR 142 m – 293 m Direct enforcement costs Direct regulatory fees and charges ⁓ EUR 3 m ⁓ EUR 3.4 m (*) The mandatory use of sovereign cloud and AI computing services would trigger an acceleration of porting of some applications to sovereign cloud services of assurance levels 2 to 4, requiring an anticipation of expenses of EUR 3 to 15 bn, as reported in section 12.4 of Annex 4 . Since they represent planned expenditure that would be incurred in the future as part of the regular cloud contract renewal cycles and independent of the preferred option , they have been scoped outside of the summary cost table so as not to conflate structural renewal costs with the incremental financial impact of the measure itself. (1) Estimates (gross values) to be provided with respect to the baseline; (2) costs are provided for each identifiable action/obligation of the preferred option otherwise for all retained options when no preferred option is specified; (3) If relevant and available, information on costs is presented according to the standard typology of costs (adjustment costs, administrative costs, regulatory charges, enforcement costs, indirect costs;); (4) although relevant environmental and social costs have been considered in this assessment, they were not quantified here due to the lack of sufficient and reliable data. III. Application of the ‘one in, one out’ approach – Preferred option One-off (annualised total net present value over the relevant period) Recurrent (annualised total net present value over the relevant period) Total Businesses New administrative burdens (INs) (EUR 30 m – 90 m) (EUR 559 m – 2.8 bn) (EUR 589 m – 2.8 bn) Removed administrative burdens (OUTs) EUR 404.3 – 2 bn EUR 404.3 – 2 bn 36 III. Application of the ‘one in, one out’ approach – Preferred option One-off (annualised total net present value over the relevant period) Recurrent (annualised total net present value over the relevant period) Total Net administrative burdens* (EUR 30 m – 90 m) (EUR 154.7 m – 0.8 bn) (EUR 184.7 m – 809 m Adjustment costs** (EUR 179 m – 378 m) National public administrations New administrative burdens (INs) (EUR 12 m – 34 m) (EUR 154 m – 414 m) (EUR 166m – 448 m) Removed administrative burdens (OUTs) EUR 90 m – 154 m EUR 90 m – 154 m Net administrative burdens* (EUR 12 m – 34 m) EUR 64 –2-60 m EUR 68 m – 194m Adjustment costs** EUR 209 m –507 m EUR 1 bn – 3 bn Total administrative burdens*** EUR 42 m – 124 m EUR 218.7 m – EUR 860 m EUR 252.7 m –1.00 bn (*) Net administrative burdens = INs – OUTs; (**) Adjustment costs falling under the scope of the OIOO approach are the same as reported in Table 2 above. (***) Total administrative burdens = Net administrative burdens for businesses + net administrative burdens for public administrations 3. RELEVANT SUSTAINABLE DEVELOPMENT GOALS IV. Overview of relevant Sustainable Development Goals – Preferred Option Relevant SDG Expected progress towards the Goal Comments e.g. SDG no. 4 – quality education Increase in training opportunities for enhancing digital skills, contributing to quality education and lifelong learning. e.g. SDG no. 7 - affordable and clean energy, 12 - responsible consumption and production, 13 - climate Increased energy efficiency of data centres will save energy and CO₂e emissions per GW of additional capacity added with respect to the baseline over the next 10 years, contributing positively to SDG no. 7 (affordable and clean energy) and SDG no. 13 (climate action) including through the promotion of renewable energy sources to power data centres. Greener data centres would contribute to reduce their carbon footprint and support the clean energy transition. Promotion of energy -efficient hardware and optimisation of cooling systems, also thanks to the use of AI-integrated solutions, is also expected to reduce waste and resource consumption. The proposal embeds the concept of “sustainable -by- design” data centres, including high environmental and energy -efficiency obligations, e.g., through alignment with the upcoming Union scheme for rating the sustainability of data centres. Affordable energy for all must be sustained through the renewal and upgrade of the energy grids (which falls outside of the scope of the current initiative), but which is a relev ant prerequisite to move closer to this SDG target. 37 IV. Overview of relevant Sustainable Development Goals – Preferred Option Relevant SDG Expected progress towards the Goal Comments SDG no. 8 – Decent work and economic growth Expected increase in employment in relation to data centre rollout and GDP growth. Expected increase of SMEs and startups ’ use of cloud to support inclusive economic growth. SDG no. 9 – Industry, innovation and infrastructure Increase in the number of data centres and next generation infrastructure to meet the needs of business and citizens in the EU, strengthen innovation and build resilient digital infrastructure. Cloud computing and AI also enable digital transformation acro ss industries, boosting productivity and new services. The initiative aims to increase the EU’s share in the global cloud market from 15% to 30%. 38 ANNEX 4: ANALYTICAL METHODS 1. METHODOLOGY This impact analysis has followed a stepwise approach. First, a modelling analysis of each proposed policy measure has been carried out, using a structured set of parameters, assumptions and data inputs15. The data included has been gathered from the following sources: • Eurostat, notably for the labour costs. • The supporting study “Study: cloud and AI” led by Technopolis Group16, including over 60 targeted interviews, surveys with over 250 replies and two workshops with over 100 participants each. • Tenders Europe Daily (TED), for the calculation of the procurement contract values by public administrations in the field of cloud and AI computing services. • Desk research, with sources cited in the corresponding measures. • Best practices documented in the industry or similar approaches followed in other world regions or in EU countries. Section 2 of this Annex explains the general assumptions used for the modelling of the different policy measures. These assumptions apply across several policy measures and are therefore reused throughout the analysis. Section 3 includes a detailed explanation of the modelling approach for each policy measure. For each measure, the analysis covers: • The scope of the policy measure and how it would be implemented in practice. • The different types of costs, including the one -off and recurrent administrative and adjustment costs per stakeholder • The assumptions, values and sources used to estimate these costs. • The expected cost savings and benefits, including the assumptions and the reasoning behind them. • Where relevant, indirect savings, that cannot be fully mon etised, but that nevertheless play an important role for assessing the overall effect of the policy measure. A sensitivity analysis was carried out to identify the parameters with the greatest variability and the strongest potential impact on the cost-benefit results. This analysis helps understand the robustness of results under the different assumptions. A final summary table presents the overall results for each policy measures, under three scenarios (central -min-max), as well as costs and benefits for the key stakeholder groups impacted. The modelling has resulted in a cost -benefit analysis for each policy measure, which was aggregated and presented in sections 6 and 7 of the core text of the impact assessment and in the Annex 3. In most cases, the analysis followed the Standard Cost model, whereas in some instances the NPV or other quantification approaches have been used to estimate expected benefits. 15 This consisted of a cost-benefit model built around defined assumptions and evidence sources, not on a macroeconomic model. 16 Technopolis et al. (2025). “Study: Cloud and AI” 39 Section 4 discusses the strengths and limitations of the approach and of the data used for the analysis. To investigate the robustness and stability of the results, a min-max sensitivity analysis was performed (See section 5 of this Annex for more details and assumptions checked in interviews and CATI surveys). Section 6 presents the multi-criteria decision analysis (MCDA), which was carried out using three different models, to further assess the strengths and weaknesses of each option. Wider economic impacts, indirect effects or non-market social and environmental externalities can be material but are excluded from the monetisation within the Cost -Benefit Analysis due to limitations in available data and the lack of robust methodologies for monetising these effects. Section 7 of this Annex includes the assumptions behind the environmental impact analysis performed, while section 8 includes additional literature used to discuss the wider economic effects associated with the policy options. Section 9 shows the analysis performed by Technopolis Group as p art of the study “Study: cloud and AI” on the different procedures, permits and data centre deployment timelines across several Member States, aiming to demonstrate the fragmented approach currently existing in the EU. 2. GENERAL ASSUMPTIONS FOR THE MODELLING OF THE POLICY MEASURES 2.1. Valuation framework and time horizon Price base. All figures are expressed in real 2025 euros; no general price inflation is applied. All unit costs are expressed in real 2025 euros and are based on Eurostat hourly labour cost. In 2024, the EU-27 average hourly labour cost for the whole economy was EUR 33.5; services averaged EUR 33.3; information and communication at EUR 46.3; and the mainly non-business economy (excl. public administration) averaged EUR 34.2. These figures are taken from Eurostat’s latest annual release and Statistics Explained pages17. Discounting. Present values are computed at a 3% real discount rate. The discounting base date is the beginning of 2027; cash-flow timing follows an end-of-year convention. The cumulation period is 2027-2036 inclusive. The discount factor for a flow in year t is: DF𝑡 = 1 (1 + 0.03)𝑡−2027 Horizon. Impacts are accumulated over 2027–2036 inclusive (10 years). 2.2. Unit cost parameters/ standard cost model Working day length. 8 hours/day. Working days in the year. 220 working days/year Day-rate proxies (EU averages with sector uplifts): Eurostat’s EU-27 hourly labour cost converted to day-rates: 17 EU hourly labour costs ranged from €11 to €55 in 2024 - News articles - Eurostat 40 Table 7. Labour costs and rates used ( Source: Eurostat and Statistics Explained Hourly labour costs page (Table for breakdown by activity) Baseline aggregate Hourly labour cost (2024, EU-27) Day-rate (8h) Services EUR 33.3 / h EUR 266.40 / day Mainly non-business (excl. public admin) EUR 34.2 / h EUR 273.60 / day Information and communication EUR 46.3/h EUR 370.40 / day Eurostat’s 2024 reports, for the EU -27, an average hourly labour cost in Information and communication (NACE J) at EUR 46.3/hour18. This level reflects the high ICT skill mix and sits above the overall services economy. Anchoring directly to NACE J provides a relevant comparator for data-intensive activities. To capture systematic differences in skill composition and overhead, modest multipliers are applied to the J baseline, justified by reports on ICT labour market tightness and hard -to-fill vacancies 19. Each uplift is a modelling parameter, justified by EU evidence on sector pay premia and administrative overheads: • Cloud service providers (CSPs): ICT activities (NACE J62 – Computer programming, consultancy, and related activities; J63 – Information service activities ) carry higher earnings and labour costs than services overall due to specialist roles ( software engineers, site reliability engineers, cybersecurity). Eurostat SES shows ICT employees are concentrated in higher -skill/tertiary categories; Eurostat reports tight markets for ICT specialists and persistent hard-to-fill vacancies, supporting a positive premium vs. average services. A 30% uplift is set on this baseline, which yields to EUR 481.52/day (46.3×8×1.3) • AI computing service providers: AI computing service providers offer computing infrastructure for the running (inference) of AI systems . Due to the complexity and novelty of running these clusters of AI GPUs, more specialised roles are needed compared to those running cloud infrastructures. Data show employees in these groups cluster in the highest wage deciles within ICT and Eurostat reports structural labour shortages in ICT that are particularly acute for advanced digital skill s. This systematic premium reflects both scarcity of talent and high value -add of AI services compared with broader ICT20. A 45% uplift is set on the baseline, which yields to EUR 537.08/day (46.3×8×1.45) • Data centre operators: DC operations mix technical operators, electricians, facility engineers and IT technicians. The mix is more operations -heavy and less developer - heavy than CSP software teams, so the premium over services is lower than for CSPs but still positive relative to the broad aggregate due to 24/7 operations and specialised compliance (e.g., uptime, safety). A 8% uplift positions DC operations below CSPs but above average ICT services, consistent with observed role mixes in NACE J63.11. This +8% leads to EUR 400.03/day (46.3×8×1.08). • National public authorities: Eurostat does not publish NACE O separately in this dataset, but reports EUR 34.2/h for the “non-business economy excl. O” aggregate, with 18 [lc_lci_lev] Labour cost levels by NACE Rev. 2 activity 19 ICT specialists in employment - Statistics Explained - Eurostat 20 AI Jobs Barometer | PwC 41 a figure for the mainly non -business economy (excl. public administra tion) as EUR 34.2/h. We apply a small +5% uplift to proxy: (i) policy/project staff engaged in inter - institutional coordination (above average non -business roles), and (ii) inclusion of specialist grades not perfectly captured by the “excl. public administration” aggregate. This remains conservative relative to some MS where public-sector employer costs are higher than the EU average. This +5% on non -business (excl. public admin) leads to EUR 287.28/day (34.2×8×1.05). • European Commission: Coordination at EU level entails multilingual drafting, legal vetting, translation, dissemination, and inter -DG and MS engagement. Relative to Member-State averages for non-business activities, Commission project teams typically face higher overhead (procurement, quality assurance, inter-service consultation). The +15% factor is a policy-evaluation convention to reflect those overheads while staying close to EU-wide non-business costs. Using the baselines and multipliers above +15% on non-business (excl. public admin) leads to EUR 314.64/day (34.2×8×1.15). • Private sector essential entities operating in sectors listed in Annex I of NIS2: Annex I NIS2 lists the following sectors as highly critical sectors: Banking and Financial market infrastructures (NACE Rev2 - K), Health (NACE Rev2 - Q), Drinking Water and Waste water (NACE Rev2 - E). Energy (NACE Rev2 - D), Transport (NACE Rev2 – H), Digital infrastructure and ICT Service Management (NACE REv2 - J), Public Administration and defence (NACE Rev2 – O) and Space (NACE Rev2 – C). The values that Eurostat yields for this query for 2024, the most current data is 46.8 €/hour21 Using the baselines and multipliers above • CSPs: 46.3 EUR /h×8×1.30 = EUR 481.52 / day. • Data-centre operators: 46.3 EUR /h×8×1.08 = EUR 400.03 / day. • AI service providers: 46.3 EUR /h×8×1.45 = EUR 537.08 / day • National authorities: 34.2 EUR /h×8×1.05 = EUR 287.28 / day. • European Commission: 34.2 EUR /h×8×1.15 = EUR 314.64 / day. External contractor rates: are set at 50% over external AI developer, EUR 537.08/day x 1.5= EUR 805,62/day. Travel. EUR 700 per in-person trip per participant (transport and incidentals for one day and one night). Webinars. 2 hours per participant, converted to 0.25 day for labour costing. In-person meeting/event time. Each in-person engagement entails 2.5 participant -days (1.0 meeting days + 1.5-day for preparation and follow-up). 2.3. Estimates related to data centres 2.3.1 Data centre supply growth There is no single, EU-wide dataset produced by regulators or energy system planning exercises that consistently locates historical data centre capacity at site level in terms of commissioned 21 Query used available at https://ec.europa.eu/eurostat/databrowser/view/lc_lci_lev__custom_20086615/default/table 42 IT load. The estimation of new data centres deployed under the different policy options builds on the scenarios of data centre growth (measured in MW) identified in Technopolis et al. (2025), “Study: Cloud and AI”. The analysis relied primarily on the Data Centre Map dataset, which is built entirely on historical data centre sites that have already been developed and commissioned, i.e. the 2025 dataset reflects the cumulative outcome of past capacity development rather than a forward-looking projection. The dataset includes the year of launch of the sites for only around one -third of the recorded sites, with uneven coverage across countries and operators. As a result, it was impossible to construct a consistent historical baseline of commissioned capacity across the EU without strong assumption or a systematic bias. Nevertheless, to present forward -looking projections based on past 22 and future trends, the study estimated possible forecasts for data centre capacity across the EU27 based on the characteristics of three strategic scenarios (low growth, central growth and high growth). These projections illustrate the potential evolution of installed capacity over the next decade, reflecting variations in natural resources, demand drivers, policy intervention, technological innovation, and market responsiveness. Table 8. Overview of low growth, central and high growth scenarios (Source: Technopolis et al. (2025)) Scenario CAGR (2025-2036) Key assumptions and trends Low growth 9% • Across 2025–2036, EMEA data centre capacity grows at an average ~9% CAGR, below the ~13.8% historic pace seen in 2018–2024. Growth remains concentrated in primary markets e.g. Germany, France, Ireland, and the Netherland while many secondary and emerging markets struggle to secure large, anchor-tenant investments or hyperscale commitments. The build-out is most intense in 2025 –2030 (approximately 14% CAGR), driven by committed pipelines, cloud region rollouts, and AI-ready retrofits. From 2030–2036, momentum slows to roughly 4.2% CAGR as power, permitting, and capital discipline increasingly constrain new capacity additions. • Power availability is the binding constraint, with insufficient electrical capacity to support large -scale AI compute in countries such as Netherlands, Ireland, Germany with limited investment in grid modernisation, increasingly observed between 2030-36. These constraints limit the development of new high-density sites and delay infrastructure upgrades. • In the absence of major policy shifts, a fragmented regulatory landscape persists across Europe. Disjointed national strategies, coupled with tightened environmental restrictions on energy usage and prolonged permitting processes, create significant barriers to new data centre development. These 22 To contextualise historical growth dynamics we performed desk research and looked at past industry -level analyses, which document that the FLAP -D markets experienced a 17% CAGR in MW supply between 2018 and 2023, while secondary European markets saw a 23% CAGR in the same period. Other industry market reports tracked data centre power capacity and trajectories, showing an increase from 9 GW in the early 2020s to above 11 GW in 2024. These trends confirm the growth dynamics of the European market id entified in the study, but they often differ substantially in geographic scope (e.g. considering the EMEA or UK market). No existing study combines the uses a methodology in a comparable manner to that of our study, making any comparisons misleading. See: Roland Berger and spotlight-eu-data-centre---november-2022-.pdf; spotlight-eu-data-centre---may-2024---final.pdf 43 Scenario CAGR (2025-2036) Key assumptions and trends hurdles constrain growth, keeping capacity expansion below historically observed levels. Central growth (used as baseline) 12% • Capacity growth aligns with the CATI survey average (~13% CAGR) and broader industry momentum through 2025–2030, then eases over 2030–2036. Expansion remains concentrated in FLAP -D hubs, with steady investment in secondary markets (Nordics, Spain, Italy) and slower uptake in developing markets (around 6.49% CAGR). In the baseline, aggregate growth is ~17.7 % over 2025 –2030 (consistent with the survey’s ~ 13% CAGR lens) as committed pipelines, AI-readiness upgrades, and new cloud regions come through. From 2031–2036, growth moderates to ~7.1%, reflecting tighter site selection driven by power and land availability, longer permitting lead times, and higher financing costs. • Electrical grid limitations remain an issue in certain primary markets such as Ireland and the Netherlands. However, regulators and operators in several markets have begun investing in grid modernisation and demand management. • Policy evolution remains gradual and inconsistent, creating a fragmented regulatory landscape across Europe. Efforts to modernise infrastructure and streamline permitting are underway, but progress is uneven, ofte n slowed by regulatory complexity and localised decision -making. Governments aim to balance digital infrastructure expansion with environmental priorities by introducing power efficiency targets, and sustainability requirements. High growth 15% • The growth rate accelerates to 15% from 2025 -2036 with front loaded 21.7% CAGR in 2025-2030 before moderating to 10.4% from 2030 -36. This is improving on the baseline scenario by following the trajectory of advanced, leading - edge markets such as Northern Virgi nia in the US, where data centre capacity grew at a 25% CAGR between 2014 and 2021, with capacity doubling from 2018 to 2021 23. This scenario sees aggressive geographic expansion beyond primary and secondary markets, with new regional hubs emerging in Sout hern Europe, the Baltics, and Central & Eastern Europe. Growth in developing regions significantly exceeds historical trends with a CAGR of 13% and outpaces current market projections. • Major public and private investment in grid modernisation leads to substantial increases in available electrical capacity, effectively removing power availability as a constraint on data centre expansion. This enables large scale AI deployments, including high density GPU workloads to 23 NVTC (2022). The impact of data centres on the state and local economics of Virginia 2022. Available at: https://www.spotsylvania.va.us/DocumentCenter/View/29411/2022-Virginia-Data-Center-Report--32022? 44 proceed rapidly not only in primary markets but in secondary and developing markets. • Proactive, coordinated policy action is witnessed across Europe. National and EU-level governments prioritise digital infrastructure development, implementing supportive strategies such as AI innovation hubs, tax incentives, and expedited permitting proces ses. Environmental goals are addressed in parallel, but through mechanisms that encourage rather than restrict growth, such as mandates for renewable energy procurement and circular economy initiatives. As of 2025, all three scenarios converge at an estimated 12 .4 GW of installed data centre capacity. This uniform starting point persists into 2026, with all paths reaching 15.1 GW, based on relatively firm visibility of near -term buildout plans and permitted sites. However, the trajectories begin to di verge thereafter as each scenario follows the key assumptions outlined above from 2027 onwards. This projection broadly aligns with the literature, even though some sources present slightly less ambitious estimates, such as a forecasted capacity of 13.1 GW by 202724. By 2030, under the central scenario, capacity reaches 28 GW. In the high growth scenario, driven by heightened demand and accelerated infrastructure deployment, capacity increases more sharply to 3 3 GW. Meanwhile, the low growth scenario sees m ore modest expansion, with capacity reaching just 24 GW by the end of the decade. The CAGR from 2025-36 for the low growth scenario is 9%, for the central growth scenario is 12% and for the fast growth scenario is 15%. Extending the forecast horizon to 2036 introduces a higher degree of uncertainty, largely due to evolving market dynamics, potential technological breakthroughs, and a lack of visibility into planned or in -progress developments beyond the 2026 –2030 window. That said, the divergence between the scenarios becomes more pronounced. In the low growth scenario, installed capacity reaches 31 GW, while the central trajectory leads to 42 GW. The high growth scenario sees capacity expand dramatically to over 60 GW, representing a 55% incre ase over the central forecast, as shown in the Figure below. 24 Savills (2024). European data centre power capacit y projected to rise to approximately 13,100 MW by 2027. Available at: https://www.savills.co.uk/insight-and-opinion/savills-news/362723-0/european-data-centre-power-capacity-projected-to-rise- to-approximately-13-100-mw-by-2027 45 Figure 1. Data centre capacity across the EU27 in GW from 2025-36 across three growth scenarios Source: Technopolis et al. (2025) by means of a CATI survey (n=100 companies, 280 Data Centres), DataCentreMap These findings complement existing literature, which forecasts a rapid growth in European data centre capacities in the coming years driven by the breakthrough of AI 25. While a diversification of data centre markets is similarly expected, the literature places more emphasis on constraints affecting the growth of emerging markets, including limited power grid capacity and less developed economic or business ecosystems 26.Technologies typically follow an S - curve growth rate and so is the expectation about data centre growth, implying that at some point in the future, the CAGR will start declining. The study has modelled a partial inflection of growth rates after 2030 but finds that other inflexion points are not e xpected in the time horizon contemplated here. To estimate near -term growth, the Data Centre Map dataset was leveraged, since it includes site-level information of facilities "Under Construction" and "Planned." All data centres identified as "Under Construction" were assumed to be operational by 2026, reflecting standard build timelines and aligning with industry expectations. Facilities classified as "Planned" were incorporated into our longer -term forecasts, with their capacity distributed evenly across t he 2026–2030 period. Information from government sources, company announcements, and market reports has been consulted to cross-check against these estimates. These sites were then assigned to NUTS-1 regions through geospatial mapping and manual checks where coordinates are missing. Projections beyond 2027 are also adjusted for regional and market maturity categories (primary, secondary, developing) across the three scenarios. To assess the realism of projected capacity, a natural resource constraint at the NUTS 1 level was incorporated. This was based on the national electricity generation capacity from 2020 – 2024 available from the European Commission’s Europe and Industry dataset and downscaled to the NUTS 1 level. This data was used to project grid capaci ty to 2036, applying historical 25 JLL (2024). EMEA Data Centre Report Q4 2024. Available at: https://www.jll.com/en-uk/insights/emea-data-centre-report. McKinsey analysis estimating global demand for data centre capacity to grow by a compound average growth rate of 19% in the pessimistic scenario and 27% in the more optimis tic one, with efficiency improvements, flexible workload management and supportive regulation. Available at: : https://www.mckinsey.com/industries/technology-media-and- telecommunications/our-insights/ai-power-expanding-data-center-capacity-to-meet-growing-demand 26 ICIS. Data centres: Hungry for power. Available at: https://www.icis.com/explore/resources/data-centres-hungry-for-power 46 CAGR trends. A validation threshold was then introduced to ensure that forecasted data centre capacity does not exceed a set share of regional power generation. This percentage was 20% for the central scenario, to reflect a situation where data centres become a relevant electricity user in line with emerging patterns in highly digitised regions; a more conservative 10% for the low scenario to reflect tighter grid constraints; while no constraints were considered for the high scenario under the assumption that major public and private investment in grid modernisation would enable substantial increases in available electrical capacity. 2.3.1.1 Scale, timing and distribution of new capacity This section provides additional information on the scale, timing, geographic distribution and functional orientation (AI-readiness) of new data centre capacity within the EU -27 under the central growth (baseline) scenario. Scale: the split between hyperscalers and colocation facilities is illustrated here below. AI-readiness: based on the results of the CATI survey, the study estimated that in 2025 approximately 12% of total EU -27 data centre capacity is AI -ready, defined as infrastructure capable of supporting high -density AI workloads (e.g. GPU-accelerated compute, advanced cooling, and power delivery). Survey responses indicate that hyperscale operators report a substantially higher share of AI-ready capacity than colocation providers, a finding that mirrors the scale of hyperscaler investment in advanced GPU architectures. Building on this baseline, three forward -looking scenarios for AI -ready capacity as a share of total data centre infrastructure were developed. o Slow growth scenario: By 2036, approximately 35% of total data centre capacity is AI-ready, corresponding to an average growth rate of ~32% over the ten -year period. o Baseline growth scenario: By 2036, approximately 64% of data centre infrastructure is AI-ready. o Fast growth scenario: By 2036, approximately 85% of data centre infrastructure is AI-ready, directly aligned with the upper -bound expectations reported by CATI survey participants These results were also validated through the several interviews with relevant stakeholders and two workshops organized in the context of the study. In practice, i n relation to computing capacity, the market and technical reality does not lend itself to a distinction between different types of supply with the exception of the training of large AI models. As discussed in Annex 8, the training o f AI models requires large, concentrated amounts of computing power. For training, low latency is not as important as for the later stages in an AI model’s lifecycle. This sets AI training facilities somehow apart. To a lesser extent, large facilities dedicated to a single client (typically hyperscalers) do not need to be in proximity to an economic centre, to the difference of colocation data centres which tend to be located next to their clients, so closer to economically active areas. The policy intervention is mostly agnostic on these considerations as the most pressing needs of data centres do not differ significantly based on their end use. One of its objectives is to create the right conditions for a faster build-out of data centres and is agnostic to their ultimate use, allowing the market Type 2025 2026 2027 2028 2029 2030 2031 2032 2033 2034 2035 2036 Colocation / CSP / telco (primary markets) 4210 5120 6068 7090 8238 9523 10577 11490 12317 13055 13703 14369 Colocation / CSP / telco (secondary markets) 2401 2921 3462 4045 4699 5433 6033 6555 7026 7447 7817 8197 Colocation / CSP / telco (developing markets) 793 965 1143 1336 1552 1794 1993 2165 2321 2460 2582 2707 Hyperscaler 5036 6125 7258 8481 9854 11391 12651 13744 14734 15615 16391 17187 12440 15131 17932 20953 24343 28141 31254 33954 36398 38577 40492 42460 47 to find the right balance. That is why the capacity gap presented in Annex 9 (baseline scenario) looks at total data centre capacity and does not differentiate data centre according to their use (in the colocation c ontext, the data centre operators would not even know for which downstream purpose their clients use of the server rooms offered by the colocation provider). 2.3.1 Data centre demand growth The estimation of data centre demand builds on three scenarios (measured in MW) identified in Technopolis et al. (2025), “Study: Cloud and AI” . The analysis presents corresponding projections for data centre demand across the EU27 region based off the characteristics of three strategic scenarios (low growth, central, and high growth). These projections illustrate the potential evolution of enterprise demand over the next decade. Table 9. Overview of low growth, baseline and high growth scenarios for data centre demand Scenario CAGR (2025-2036) Key assumptions and trends Low growth 10% • Enterprise IT budgets grow conservatively, constrained by macroeconomic headwinds, regulatory uncertainty, and cautious capital deployment across the EU27. • IT spending as a share of enterprise turnover holds steady at around 3.1%, reflecting a cautious approach to digital transformation. Within this, spending on data centre grows more slowly than in previous years, with a CAGR of approximately 8%, a notable deceleration from the 14% observed between 2021 and 2025. • Workload growth remains relatively modest, with most enterprises focusing on efficiency gains rather than significant expansion of compute -intensive workloads. AI adoption progresses slowly, resulting in only incremental increases in processing and storage demand. • Digital policy has limited influence on demand in this scenario. Private enterprises see limited incentives or pressures to scale AI or data -driven services. The lack of cohesive policy momentum results in a focus on maintaining existing infrastructure rather than investing in new capacity to support advanced workloads. Central growth (baseline) 13% • Enterprise IT budgets across the EU27 continue to expand at a steady and predictable pace, reflecting a stable macroeconomic environment and a me asured approach to digital transformation. • IT spending as a share of enterprise turnover increases gradually, reaching 3.7% by 2032. From 2032 onwards, this ratio stabilises, indicating a maturing digital spend profile with spend only increasing to 3.8% by 2036. Within this broader trend, investment in data centre infrastructure grows in line with the historical CAGR of 14% through to 2030, reflecting sustained demand for compute and storage infrastructure. This growth supports both the retrofitting of legacy environments and the deployment of new, AI-capable facilities, particularly in markets where cloud adoption and enterprise workloads continue to scale. From 2032 onwards, the growth rate of data centre spending decelerates, but 48 Scenario CAGR (2025-2036) Key assumptions and trends outlays continue to increase, sustained by lifecycle refreshes, AI-capable retrofits, compliance and resilience upgrades, and steady colocation demand • Workloads evolve steadily, with increased deployment of AI, machine learning, and data -driven services contributing to higher computational requirements. • Digital policies boost private sector demand. As governments roll out e -government services, data -sharing initiatives, and sector -specific AI guidelines, private enterprises respond by adopting initiatives which steadily drive increases in compute and storage requirements. High growth 17% • In the fast growth scenario, enterprise IT budgets across the EU27 rise sharply as digital infrastructure becomes a central pillar of business strategy. This acceleration is driven by the widespread deployment of AI, real -time analytics, edge computing, and data -intensive applications. Organisations across all sectors and geographies invest aggressively in next-generation infrastructure, resulting in unprecedented demand for data centre capacity. • IT spending as a share of enterprise turnover increases to 4.1% by 2033 . After reaching this threshold, the share stabilises through 2036, with digital operations have become deeply embedded in business models. Within this expanded IT budget, the sh are allocated specifically to data centre systems grows substantially reaching 23% of total IT spending by 2035, underpinned by a CAGR of approximately 11% through to 2036. This growth supports large-scale, AI-optimised infrastructure rollouts across both traditional hubs and new emerging markets. • Workload growth is exponential, driven by generative AI, large language model training, real -time analytics, and autonomous operations with enterprises requiring significantly more computational power. • Proactive and coordinated digital policies act as a powerful enabler of private sector demand. Large -scale public investments in AI, national cloud services, and public sector digital transformation signal long -term commitment to digital growth, de -risking private se ctor investment. Enterprises accelerate their own AI deployment, edge computing, and data management strategies to align with evolving regulatory frameworks, increased data flows, and market expectations. As of 2025, all three scenarios converge at an estimated 15.3 GW of installed data centre demand. However, the trajectories begin to diverge thereafter. By 2030, under the baseline scenario, demand reaches 37 GW. In the fast growth scenario, driven by incr eased spending, enterprise demand increases only slightly more sharply to nearly 40 GW. Meanwhile, the slow growth scenario sees more modest demand, reaching just 31 GW by the end of the decade. The 49 CAGR from 2025-36 for the low growth scenario is 10%, for the baseline scenario is 13% and for the high growth scenario is 17%. Extending the demand forecast horizon to 2036 introduces greater uncertainty, reflecting the unpredictable nature of long-term market drivers, potential shifts in enterprise digital strategy, and the impact of emerging technologies such as generative AI and edge computing. The divergence between the scenarios becomes much more pronounced. In the low growth scenario, demand reaches 43 GW, while the baseline trajectory leads to 62 GW. The fast growth scenario sees capacity expand dramatically to over 83 GW, representing a 43% increase over the central forecast and a 93% increase over our slow growth forecast. Figure 2. Data centre demand across the EU27 in GW from 2025-36 across three growth scenarios Source: Technopolis et al. (2025) by means of DataCentreMap, STL analysis The literature aligns most closely with the status quo scenario, estimating European data centre demand at around 35 GW by 2030. In terms of growth, the study’s findings are supported by global projections in the literature, which forecast a compound annua l growth rate of 19% to 22% between 2023 and 2030. AI is also consistently identified as a key driver of this demand, with some sources expecting global data centre capacity to triple as a result . Based on these projections, a supply-demand gap is expected to emerge by 2030 under all three scenarios. In the low growth scenario, the shortfall reaches approximately 7 GW, reflecting modest demand outpacing limited infrastructure expansion. Under the central trajectory (baseline), the gap widens to around 9 GW, as steady demand growth outstrips the pace of new capacity being built. In the high growth scenario, the mismatch becomes even more pronounced, with demand exceeding supply by over 13 GW, driven by accelerated adoption of AI workloads and large-scale digital infrastructure investment. By 2036 the gap becomes even more pronounced across all three of the scenarios. In the low growth scenario, the shortfall reaches approximately 12 GW, in the baseline reaches 19 GW and in the high growth it reaches 23 GW. In the high growth scenario, the gap, though still large at 23 GW, is only slightly higher than in the baseline. This is due to the assumption that rapid increases in demand are matched, at least in part, by accelerated capacity deployment enabled by more favourable investment conditions, improved regulatory agility, and large -scale public -private initiatives. However, even under this high -investment environment, the pace at which demand scales, particularly 50 for AI and high -performance compute, still exceed s the ability of the market to deliver sufficient, AI-ready capacity. Figure 3. Gap between data centre supply and demand in GW in 2036 Source: Technopolis et al. (2025) by means of CATI survey (n=100 companies, 280 Data Centres) 2.3.2 Data centres benefitting from each Policy Option The analysis of policy options uses the baseline and high growth results as anchor points to estimate the impact of different policy options, with intermediate values interpolated to reflect varying scenarios and intervention intensities. Growth trajectories under the different policy options are thus modelled according to three alternative compound annual growth rate (CAGR) trends, i.e. 15%, 14% and 13%, which reflect possible deviations from the central forecast expansion path (12%). To translate capacity expansion (MW) into the number of new data centres, the following assumptions are made: • The average data centre capacity has been derived from past deployment trends • A forward-looking adjustment is applied, assuming an annual increase of 1% in average data centre size, to capture the tendency toward larger facilities over time • For each year between 2026 and 2036, the additional MW capacity projected under the different policy growth scenarios is calculated • The number of new data centres is then obtained by dividing the incremental annual capacity (MW) by the estimated average data centre capacity for that year. • It is then assumed that only a percentage of new data centres each year will benefit from the policy intervention. This approach ensures that the model accounts not only for aggregate capacity growth, but also for the evolution in average facility size, which affects how many new sites are required to deliver the expected expansion. The tables below present the estimated number of new data centres (DC) benefitting under each policy option (PO1-A, PO1-B, PO1-C). These figures are derived by multiplying the projected number of new DCs coming online each year by the assumed percentage that would qualify for, or take advantage of, the measures under each option. The modelling distinguishes, wherever relevant, between the private market (colocation and hyperscalers) and the public sector. Enterprise data centres are not considered in the analysis. 51 To assess the impact of each option on data centre investment, the outcomes under each policy scenario have been compared t o the baseline scenario, in which no new policy is introduced. Since the objective of each policy option is to alter investment conditions and increase data centre deployment, each scenario has been defined to reflect this potential induced build -out. To reflect uncertainty in the voluntary uptake of the mechanism, the analysis varies the share of new projects benefitting from the different policy options between 30% (low), 50% (central, reported below ) and 70% (high). This range captures realistic differe nces in data centre facilities adoption dynamics, without assuming either full uptake or very limited benefit from each option. Table 10. Capacity growth and new data centres under the baseline, considering no intervention (Source: Technopolis et al. (2025)) 2025 2026 2027 2028 2029 2030 2031 2032 2033 2034 2035 2036 CAGR Capacity growth (MW) 12440 15131 17932 20953 24343 28141 31254 33954 36398 38577 40492 42460 12% Avg. capacity of one DC (MW) 13 13.1 13.3 13.4 13.5 13.7 13.8 13.9 14.1 14.2 14.4 14.5 1% No. of new DC built 205 211 226 251 278 226 194 174 153 133 136 Table 11. Capacity growth and new data centres benefitting from PO1 -A (Source: Technopolis et al. (2025)) 2025 2026 2027 2028 2029 2030 2031 2032 2033 2034 2035 2036 CAGR Capacity growth (MW) 12440 15131 18189 21573 25409 29754 33518 36893 39965 42722 45168 47712 13% Average capacity of one DC (MW) 13.0 13.1 13.3 13.4 13.5 13.7 13.8 13.9 14.1 14.2 14.4 14.5 1% No. of new DC built 205 231 253 284 318 273 242 218 194 170 175 % of DC benefitting from the option 0% 0% 5% 10% 15% 20% 25% 30% 35% 40% 45% 50% No. DC benefitting from the option 0 12 25 43 64 68 73 76 78 77 88 Table 12. Capacity growth and new data centres benefitting from PO1 -B (Source: Technopolis et al. (2025)) 2025 2026 2027 2028 2029 2030 2031 2032 2033 2034 2035 2036 CAGR Capacity growth (MW) 12440 15131 18705 22839 27632 33186 38440 43409 48003 52189 55974 59991 15% Average capacity of one DC (MW) 13.0 13.1 13.3 13.4 13.5 13.7 13.8 13.9 14.1 14.2 14.4 14.5 1% No. of new DC built 205 269 309 354 407 381 357 326 294 264 277 % of DC benefitting from the option 0% 0% 5% 10% 15% 20% 25% 30% 35% 40% 45% 50% No. DC benefitting from the option 0 13 31 53 81 95 107 114 118 119 138 Table 13. Capacity growth and new data centres benefitting from PO1 -C (Source: Technopolis et al. (2025)) 2025 2026 2027 2028 2029 2030 2031 2032 2033 2034 2035 2036 CAGR Capacity growth (MW) 12440 15131 18447 22202 26505 31435 35912 40041 43827 47249 50315 53538 14% Average capacity of one DC (MW) 13.0 13.1 13.3 13.4 13.5 13.7 13.8 13.9 14.1 14.2 14.4 14.5 1% 52 2025 2026 2027 2028 2029 2030 2031 2032 2033 2034 2035 2036 CAGR No. of new DC built 205 250 280 318 361 324 296 269 241 214 222 % of DC benefitting from the option 0% 0% 5% 10% 15% 20% 25% 30% 35% 40% 45% 50% No. DC benefitting from the option 0 13 28 48 72 81 89 94 96 96 111 2.3.3 Impact modelling In order to evaluate the impact of each policy option (PO1 -A, PO1-B, PO1-C), a Discounted Cash Flow (DCF) model has been carried out, for a single data centre, starting at 13 MW capacity in 2025, based on the estimations calculated by Technopolis et al. (2025). A dual approach has been used, including a company -level DCF (calculating the Weighted Average Cost of Capital (WACC) through a build -up methodology) and an external benchmarking at the MS-level (using WACC averages found in the literature for each MS 27), to ensure that the DCF analysis is both methodologically rigo rous and relevant for policymakers. Firstly, a company level DCF has been carried out, extracting companies investing and operating data centres from Data Centre Map 28. The following data has been extracted from companies when publicly available: WACC (if available), Cost of equity, Cost of debt, D/E ratio and beta. For private companies i.e., companies whose financial data are not publicly available, the Build-up model has been used to estimate the WACC factors. The same analysis has been performed at the MS level, using WACC averages found in the literature. The following parameters have been gathered up or estimated for a 13 MW data centre: CAPEX, OPEX (using the energy consumption as a proxy), total revenues (fixing the expected EBITDA margin and power provisioning charged to customers has been kept in an average 165 €/kW/month29 30) and corporate tax rate31. Energy price volatility and country-specific dynamics have been partly reflected in the model’s calibration. Electricity prices used to calculate operational expenses for data centres in the discounted cash flow model have been based on non-household prices from Eurostat data and adjusted to reflect the two sourcing models identified in the CATI survey, i.e. grid supply and power purchase agreements (PPA), using a 40/60 mix. This includes declining prices driven by increasing renewable penetration, stable P PA prices for new contracts and stable network charges and non-recoverable taxes and levies. Volatility has been captured through these time- varying trajectories. The DCF for a 13 MW project has been then performed as a European average and for each country under study, with the following assumptions: • IT CAPEX is disbursed in two phases of 7 and 6MW capacity. • Ramp up period: the capacity utilisation is adjusted in the first 3 years of the operations: 3 years (50% year 1, 75% year 2, 100%-year 3+). 27https://www.berec.europa.eu/system/files/2024- 07/BoR%20(24)%20102%20BEREC_WACC%20parameters%20Report_2024_1.pdf.pdf 28 https://www.datacentermap.com/ 29 https://www.cbre.com/insights/reports/global-data-center-trends-2025 30 https://www.cbre.com/insights/books/european-real-estate-market-outlook-2025/data-centres 31 https://taxsummaries.pwc.com/quick-charts/corporate-income-tax-cit-rates 53 • Depreciation of the construction is 15 years distributed equally while IT CAPEX presents different depreciation periods. Maintenance CAPEX has been calculated as a 3% of the total construction CAPEX yearly. • The DCF has been presented for the first 10 years of proje ct, using the Gordon Growth model to calculate the Terminal value (an average 2% perpetual growth rate has been considered for all countries). As mentioned above, the WACC used has been taken from the BEREC report that uses the methodology defined by the E uropean Commission Notice of 2019 for consistent WACC calculations across EU national regulatory authorities and supports regulatory pricing decisions in the electronic communications infrastructure sector including data centres32. The numbers obtained under the previous section have been used in the DCF model to estimate net benefits for data centre operators. The next present value of an average 13 MW project was calculated under the baseline scenario and under each option, varying key elements such as permitting timelines and PUE levels. The NPV difference between each policy option and the baseline was then multiplied by the number of facilities expected to benefit under each option, as derived from the possible capacity paths. It is important to underline that the 13 MW representative data centre corresponds to the average installed capacity of data centre facilities identified in the underlying database used to construct the EU baseline. It thus reflects the observed mean of capacity distribution cross hyperscale and colocation facilities. This size is not held constant over time. As above, the average facility size is projected to increase based on observed historical trends, thus capturing the shift towards larger, capital -intensive and possibly also AI -capable facilities. It is also relevant to note that announcements of new dat a centres with 200 MW+ capacity are often planned and built as campus or cluster of multiple facilities implemented as smaller units, e.g. of 10 to 20 MW, that altogether compose the larger capacity, rather than a single installation. The heterogeneity in data centre s, e.g. hyperscale facilities versus colocation operators, has been incorporated into operating and financial parameters used to derive costs. Such differences were captured through PUE assumptions and utilisation rates, with hy perscalers operating at higher utilisation and lower PUEs than colocation centres on average. These parameters had a direct impact on electricity consumption and thus operating costs used in the Discounted Cash flow model. Similarly, as mentioned above, the WACC was calculated considering different business realities to reflect the different costs of capital. While any averaging compresses the dispersion, this simplification was needed in our analysis to estimate aggregate costs and benefits based on observed market dynamics and structures. 2.3.4 Energy efficiency Starting with an average Power Usage Effectiveness, PUE, of 1. 29 each policy option is expected to achieve different levels of improvement over time as shown in the figure below, with PO1-C achieving the largest impact because of the contribution of public funding to R&D and innovation in sustainable technologies. Colocation PUE was calculated using information from Data Center Map (coming out an average of 1.39) whereas hyperscaler PUE was calculated using the latest reported hyperscaler figures (coming out at an average of 1.13). The result PUE of 1.29 for 2025 is the capacity - 32 BEREC. (2025). BEREC report on WACC parameter calculations according to the European Commission’s WACC Notice of 6th November 2019 (WACC parameters Report 2025). Body of European Regulators for Electronic Communications. https://www.berec.europa.eu/en/all-documents/berec/reports/berec-report-on-wacc-parameter-calculations-according-to-the- european-commissions-wacc-notice-of-6th-november-2019-wacc-parameters-report-2025 54 weighted average of PUE levels identified for colocation and hyperscale facilities in the EU. This approach was used to capture the differences in efficiency across businesses of different sizes. Moreover, it has been validated with the industry during interviews and workshops, for which it was also subject to refinements and further changes as some stakeholders provided additional data on their PUE levels and market presence. PUE improvements across the policy options are expected based on different mechanisms and time horizons. Under PO1 -A, such improvements are mainly driven by the diffusion of best practices produced by the guidelines and as part of the established forum for exchanges. These are assumed to generate positive spillovers on the use of increasingly energy -efficient technologies beyond the baseline, where individual companies (usually the largest ones) have most of the incentives to invest in such technologies, without necessarily sharing the outcome of their investment. Under PO1 -B, PUE reductions are driven by the stronger incentives for data centres to increase energy -efficiency due to the sustainability requirements linked to accessing the fast -track areas. These conditions are expected to increase inc entives for operators to adopt higher -efficiency and sustainable solutions relatively early, as this could become a prerequisite for benefitting from accelerated permitting. Under PO1-C, in addition, data centre operators would benefit from targeted R&D programmes to optimise energy efficiency and, in some cases, deployment funds for particularly sustainable technologies and strategic uses. Since these programmes require time to develop, test and de-risk new solutions, especially for smaller operators , the most substantial PUE improvements are expected to materialise in the later years of the period. Quantitatively, this is reflected in a somewhat flatter PUE reduction in the early years and a comparatively steeper profile towards 2032–2035, when a larger share of new capacity can incorporate the mature, higher-efficiency designs. Figure 4. Assumptions in terms of PUE improvement across the different policy options for colocation providers and public sector 2025-35 (Source: Technopolis et al. (2025)) 2.4. Estimates related to Public Procurement 2.4.1 Number of public authorities procuring cloud and AI computing services With regards to the number of public authorities that procure cloud and AI computing services and could participate at the EU-level procurement process, the assumption made is that there is one public authority in each NUTS1 and NUTS2 areas, and in most of the NUTS3 areas 33, 33 NUTS1, NUTS2 and NUTS3 areas in Europe are close to 1,500 (https://ec.europa.eu/eurostat/web/nuts). An adjustment has been made to slightly reduce the number of NUTS3 areas with a public authority procuring cloud and AI computing services in the bigger member states where the administrative distribution at that level is more granular. 55 resulting in a figure of 1 206 public authorities in Europe. This figure has been confirmed when filtering the number of unique buyers of cloud and AI computing services in the procurement notices registered in the years from 2021 to 2024 at the TED portal 34 (the filtering has been done applying a search of “cloud” and “AI” strings over the TED notices with Common Procurement Vocabulary ( CPV) 72 and 48 ). Not all public authorities launch procurement processes every year; in 2024, for instance, there were just 463 Public Administrations (PA) opening cloud and AI computing service tenders. 2.4.2 Public procurement contracts of cloud and AI computing services The following table shows the contract award notices in EU27 by public administrations, as extracted from TED using the TED API35. For the ICT award notices, ‘contract award notices’36 with CPV code 72 and 48 have been considered, whereas for cloud and AI, combinations of the keywords “Cloud” or “AI” have been used as a subset of the previous. 2024 is taken as the baseline for the calculations. Then, the count of each of the results have been extracted, whereas for the share, the percentage has been calculated. Table 14. Count of Public procurement award notices in TED for 2024. ( Source: Technopolis et al. (2025), elaborated from TED data) Count of Award Notices 2024 Cloud & AI awards 1 043 ICT awards 33 299 Share of Cloud & AI in ICT awards 3.13% Total awards 30 7249 Share of Cloud & AI in total awards 0.34% For the calculation of the CAGR the period spanning from 2021 – 2024 is considered. 2020 has been disregarded due to the COVID-19 pandemic effects. The values resulting from a query from TED are shown next: Table 15. Evolution of public procurement award notices 2021 – 2024. (Source: Technopolis et al. (2025), elaborated from TED data) Count of Award Notices 2021 2022 2023 2024 Avg 2021-2024 Cloud & AI Awards 815 915 1,017 1 043 948 ICT Awards 29 235 31 566 34 673 33 299 32 193 Total Awards 272 004 292 162 316 899 307 249 297 079 Share Cloud & AI vs Total 0.30% 0.31% 0.32% 0.34% 0.32% The data above r esults in a CAGR for the period 2021 – 2024 of 8.6%. Conservatively, it is assumed that the CAGR between now and 2030 will grow at the current pace whereas it will grow half as fast afterwards. Table 16. CAGR for public procurement award notices for ICT and cloud and AI. (Source: European Commission based on data provided by Technopolis et al. (2025)) 2021-24 2025-30 2031-36 34 TED is the official source for public procurement in the EU. However, it is to be noted that a percentage of the data sets do not present complete information, with some fields missing. 35 https://docs.ted.europa.eu/api/latest/index.html 36 TED also stores the contact notices which include closed procedures with no awardees. This number is however rather small and could fall under the margin of error. 56 CAGR Cloud & AI Awards 8.6% 8.6% 4.3% CAGR ICT awards 4.4% 4.4% 2.2% CAGR Total awards 4.1% 4.1% 2.1% With regards to the highly critical use cases, the assumption is that 10% of all contract award notices represent these narrowly scoped use cases37. Applying this to 2024 figures, the number of procurement procedures of cloud and AI computing services in that year is 52. The CAGR for this specific case is considered to be the same as for other types of use cases. The data provided in TED is not disaggregated enough to provide information on the criticality of the use cases and in some cases, the sectors ar e not present, making very difficult a further extrapolation. The above assumptions yield the following projections: Table 17. Projected number of cloud & AI awards (Source: European Commission based on data provided by Technopolis et al. (2025)) Projections Cloud & AI Awards Cloud & AI awards Highly critical services 2025 1 132 113 2026 1 229 123 2027 1 335 133 2028 1 449 145 2029 1 573 157 2030 1 708 171 2031 1 781 178 2032 1 858 186 2033 1 937 194 2034 2 020 202 2035 2 107 211 2036 2 197 220 An important differentiation along the document shall be the delineation between procurement tenders and bids. A tender is the procedure that a contracting authority launches while a bid is an offer that a cloud and AI computing service provider shall submit in response to the call for tender. The assumption is that as an average there are 3.5 bids for each tender launched and awarded. Where audit is voluntary, the assumption is that 30% of the tenders will require providers to offer an audited service, unlike when audit is mandatory, where this requirement is 100%. The projections resulting from these assumptions are depicted next: Table 18. Projections for the number of bids of cloud and AI computing services that need to be audited (Source: European Commission based on data provided by Technopolis et al. (2025)) 37 Member States have reported in various settings that 10% of their services fall under the category of highly critical services. 57 Projections Cloud & AI bids for highly critical services (HCS) audit mechanism mandatory Cloud & AI bids for HCS audit mechanism voluntary 2025 396 119 2026 430 129 2027 467 140 2028 507 152 2029 551 165 2030 598 179 2031 623 187 2032 650 195 2033 678 203 2034 707 212 2035 737 221 2036 769 231 2.4.3 Public procurement contract values of cloud and AI computing services The baseline data taken into consideration for the contract values of cloud and AI computing services procured has been extracted from the TED database using the TED API38. To calculate the ICT contract values, the sum of the contract values of the Contract Award notices under CPV72. For cloud and AI contract values, the keywords “cloud” or “AI” have been used to discriminate. Table 19. Public procurement contract values 2021 – 2024. (Source: Technopolis et al. (2025)) elaborated from TED data) Value of Award notices (bn EUR) 2021 2022 2023 2024 Avg 21-24 CAGR 21-24 Cloud & AI value of award notices 2.8 5.1 12.5 9.2 7.4 48% ICT Value of award notices 77.1 98.7 113.9 124.9 103.6 17% Total Value of award notices 1 031.5 1 041.1 1 195.0 1 356.1 1 155.9 10% Share of Cloud & AI in ICT awards 3.66% 5.14% 10.99% 7.38% 7.14% 26% Share of Cloud & AI in total awards 0.27% 0.49% 1.05% 0.68% 0.64% 35% 2.4.4 Estimated number of distinct cloud and AI computing service providers in the EU There is no common registry of cloud and AI computing service providers. Furthermore, the provision of said services is not categorized under NACE J. Under these constraints and in order to understand the current number of providers in the EU, it has been performed a desk search of Cloud Service Providers along with crossing data from various associations, market reports, TED and other documents. While this approach is limited, it has managed to capture the most relevant CSPs in the EU, both EU headquartered and non-EU. The results of this manual search yields in the following: 38 https://docs.ted.europa.eu/api/latest/index.html 58 Table 20. Number of cloud and AI computing service providers. (Source: Technopolis et al. (2025)) Cloud and AI computing service providers Number Total 410 EU-based 350 non-EU based 60 2.4.5 Audited Sovereign cloud and AI computing service providers To calculate the number of audited sovereign cloud and AI computing service providers, the number of services listed on the FedRAMP marketplace with Impact level moderate and high39 has been taken as baseline for the assumptions . FedRAMP is a programme that has been running since 2012 and , as of October 2025, there are currently 533 services at impact level moderate and high with the status “FedRAMP authorised” or “FedRAMP in process” or “FedRAMP ready”. The baseline situation is that in the first year, 30 cloud and AI computing service providers shall get audited, reaching up to 600 in 5 years. To reach to this number, this would imply a CAGR of 82%. The assumptions for the number of positive audits granted the first year are in line with how many authorisations FedRAMP authorised its first year of the programme, namely 2013 (10), and cross-referenced with SecNumCloud values40. 2.5. Indirect benefits from cloud adoption Most of the policy measures contribute to the development of European data centre infrastructure and cloud computing capacity, a richer European cloud and AI computing service offering and a more dynamic technological and industrial ecosystem, contributing to a higher adoption of clo ud. This will improve the efficiency in software and IT projects, increasing productivity of IT staff, ensuring the continuity of business processes (less downtime) and facilitating migration processes. This impacts not only the efficiency of the IT staff but also the flexibility and capability of the European private and public sector to adapt in an agile way to evolving market needs and conditions, and to the dynamic technology landscape, increasing its competitiveness. This could have been measured in te rms of effort saved in IT tasks (FTEs) , but it would have been difficult to allocate the specific contribution of each specific measure, adding potential risk of double counting their effect. The policy measures related to federation and joint procurement are making the biggest contributions, while most of the others will have a more limited impact. Cloud computing services generally offer a significant number of benefits, among them also the drive or productivity. The OECD reports strong productivity effects through cloud software investment, especially for low productivity firms, suggesting that such companies derive greater productivity benefits from this investment when fixed costs are lower and scaling -up opportunities are higher. It is implied that clo ud adoption has the potential to support the 39 https://marketplace.fedramp.gov/products 40 Source: https://cyber.gouv.fr/sites/default/files/document/catalogue-produits-services-qualifies-agrees-certifies-anssi_0.pdf . The list of services qualified are listed in Chapter 5.1. This table shows 9 individual cloud service providers qualified but 16 cloud services with the following breakdown: 2 services in 2023, 2 services in 2024 and 12 in 2025. 59 productivity catch up of latecomer firms, while low cloud adoption could still hamper broader productivity gains41. 3. IMPACTS OF POLICY MEASURES IN TERMS OF COSTS AND BENEFITS The assumptions presented below and used for the estimation of the impacts of policy measures on key stakeholders draw on recognised literature sources and observable practices in the industry and the public sector. To test their robustness, the supporting study led by Technopolis conducted a series of one-to-one interviews with a diverse set of relevant stakeholders. These assumptions were further scrutinised in the study’s final validation workshop, which led to an adjustment of some parameters. 3.1. PM1: Expanding the Alliance for Industri al Data, Edge and Cloud with a working group on data centres and extending membership to relevant players Under this measure, the European Commission would set up an additional Working Group (WG) under the Alliance for Industrial Data, Edge and Cloud to include data centre operators. This would facilitate the exchange of best practices on the deployment of data centres with the objective to foster EU -located capacity, while collectively addressing the obstacles that hold back data centre investment and expansion in the EU. Impact on data centre deployment acceleration . This new working group may improve deployment speed for the participating alliance members. The reduction in data centre deployment time will likely be very slow due to the limited reach of the initiative, the time required to produce and disseminate results, and the lack of structural effects. Adjustment costs for data centre operators. Participation in the new working group is voluntary at entry but implies expectations of active attendance and contribution once membership is granted. This is expected to generate adjustment costs for stakeholders willing to participate . Under the Better Regulation Toolbox, these can be consid ered consultation- related burdens, although voluntary . Thus, the recurring source of adjustment costs for data centre operators arises from their involvement in the newly established Working Group , who would face additional costs for travel and participati on in this new structure. This is based on 2.5 days of effort per participant for each in -person meeting (i.e. 1 day of attendance and 1.5 days of preparation), assuming two General Assemblies (in-person meetings) per year . In addition, participation in 10 webinars annually has been costed at 0.5 days of effort (or 4 hours) per participant per webinar, including both attendance and preparatory work . Please see the formula below. These are estimated at approximately EUR 5,400 per operator each year, made up of EUR 2 000 for in person engagement, EUR 2 000 for webinar participation and EUR 1 400 for travel expenses (estimated at EUR 700 per trip per participant). The Working Group is expected to involve 30 new delegates: therefore, the total recurrent adjustment cost stems from multiplying this total per participant by 30 and discounting it at present value. Recurrent adjustment cost per participant,year = (Days per in-person meeting × No. of in-person meetings × labour cost) + (Travel cost × No. of in-person meetings) + (Days per webinar × No. of webinars × Labour costs) 41 OECD Compendium of Productivity Indicators 2025 60 Additional effort has been considered for around 40% of the Working Group members, who would be active in producing documents, i.e. roadmaps or reports, each year, estimated at around 20 days of additional work per year, for a total of EUR 96 008 each year. This estimate reflects the contribution of the chairing team and rapporteurs, elected from within the WG, who are responsible for supporting and implementing the group’s daily activities. Although not mandatory, these recurrent activities would be undertaken in the operators’ best interest to gain information and reduce uncertainty in project development. For this, the formula is: Document production 40% subgroup/year = (40% × Total No. of participants) × (Effort of active engagement × labour cost) Total recurrent adjustment costs for data centre operators under PM1 are thus estimated at EUR 2.2 m (NPV, 10-years). Cost savings for data centre operators. The cost savings for data centre operators are explained as indirect impacts as the reach of this measure is by design not enough to justify a monetisation. No new costs or cost savings have been considered for national public authorities, as they would not participate in this new Working Group and are already participating in the General Assembly (as members of the Member State Cloud Cooperation Group), to which this new working group would report. Administrative costs for the European Commission. The establishment and onboarding of the new Working Group entails one-off administrative costs for the Commission. The related costs are estimated considering the time taken to onboard the new delegates in the Working Group during the first year, considering 20 days or 0.09 FTE-year in 2027. This would be facilitated by the existence of an existing working group of cloud and edge providers 42. Recurrent costs would reflect the additional administrative costs linked to the coordination of the new Alliance WG, i.e. preparing the work programme, meeting planning, agenda -setting, inviting stakeholders, circulating minutes, drafting reports, managing documents, dealing with day -to- day queries, running webinars and preparing them , for which 40 days per ye ar have been considered. These would include the additional meetings per year, preparation and reporting towards the Alliance Members. Total administrative costs have been calculated as the one -off administrative costs in year 1 plus the discounted value o f the recurrent annual administrative costs over 10 years. Total administrative costs = one-off administrative costs + recurrent administrative costs = (ΔT × labour cost)year 1 +∑ (𝛥𝑇 × 𝑙𝑎𝑏𝑜𝑢𝑟 𝑐𝑜𝑠𝑡)𝑦𝑒𝑎𝑟 𝑡 (1+0.03)𝑡−1 10 𝑡=2 Total (one-off and recurrent) administrative costs for the Commission under PM1 are thus estimated at EUR 0.1 m (NPV, 10-years). Indirect impact: The WG will help to foster EU-located capacity, providing advice, guidelines and recommendations to remove or reduce the obstacles that hold back data centre investment and expansion in the EU. This contribution will help the European Commission and national public authorities (NPAs) to orient their policies and data centre operators to fine tune their deployment plans. However, it is also possible that larger companies will be willing to invest 42 Assumptions behind these numbers have been validated with EC staff currently working on the Alliance for Industrial Data, Edge and Cloud. 61 more time and resources into the participation compared to SMEs, and that the measure will be more costly in relative terms for SMEs – despite this is hard to quantify. Sensitivity analysis: No sensitivity analysis has been conducted on this policy measure as the amounts at stake are too small. Results: For PM1 , the estimated costs for the implementation of this measure across all stakeholders are EUR 2 339 297. These costs reflect the recurrent administrative costs borne by the additional Commission staff for the ongoing coordination, meeting and time to manage the working group activities (EUR 130 696). On top of these, a small one-off administrative cost (EUR 7 661) is foreseen for initial setup tasks. The measure also includes the adjustment costs expected to be incurred by data centre operators and CSPs from participating in the WG. Table 21. Expanding the Alliance for Industrial Data, Edge and Cloud with a workgroup on data centres and extending membership to relevant players (PM1) Cost types Data centre operators (€) Public authorities (€) European Commission (€) Total Value (central, €) Total Value (min, €) Total Value (max, €) one-off administrative - - 7 661 7 661 7 661 7 661 recurrent administrative - - 130 696 130 696 130 696 130 696 one-off adjustment - - - - - - recurrent adjustment 2 200 940 - - 2 200 940 2 200 940 2 200 940 one-off regulatory fees - - - - - - recurrent regulatory fees - - - - - - one-off enforcement. - - - - - - recurrent enforcement - - - - - - Total costs 2 200 940 - 138 357 2 339 297 2 339 297 2 339 297 Total benefits - - - - - Net impact 2 200 940 - 138 357 2 339 297 2 339 297 2 339 297 3.2. PM2: Creating a forum for exchanges between relevant public and private stakeholders involved in the buildout of data centres Under this measure, the Commission would establish a dedicated forum to facilitate structured exchanges between the key public and private stakeholders involved in the deployment of data centres, with the objective of accelerating the deployment of innovative and sust ainable capacity in the EU. These fora would provide a structured platform for dialogue and coordination, enabling shareholders to share knowledge, identify challenges and coordinate approaches across the different stages of data centre planning, construction and operations. The forum would bring together all relevant actors, including transmission system operators (TSOs), connectivity providers, data centre operators, equipment manufacturers, and local and regional authorities. The purpose of the forum would be to support the uptake of advanced and sustainable technologies that can increase capacity while reducing the environmental footprint of data centres and to identify and address the obstacles currently hindering investment and expansion. These exchang es would also allow to include discussions on the needed communication regarding the trade-offs, benefits and potential mitigation strategies for public contestation of data centres. By fostering early and continuous exchanges, the forum would enable stakeholders to align on technical requirements, investment priorities, and regulatory expectations. Impact on data centre deployment acceleration. This forum is expected to contribute to creating a more predictable and investment -friendly environment for data centre deployment, supporting the EU’s objectives of technological leadership, strategic autonomy, and sustainable 62 digital infrastructure growth. This is expected to increase efficiencies in the deployment of a number of new data centres, especially of those operators participating in the forum. This would be the consequence of increased exchanges of best practices, and reduced interactions between economic operators and authorities. Adjustment costs for data centre operators. Recurrent participation in newly established fora is classified as a recurrent adjustment cost for organisations choos ing to participate on an ongoing basis and are expected to contribute actively once involved, i.e. in terms of resource commitments associated with meetings, preparation and coordination. Assuming two in-person events per year and five online webinars per year , the participation requirement amounts to approximately 7.5 staff -days per participant per year , plus travel costs per in -person trip . Participation is expected from 30 data centre operators and 10 CSPs active in the deployment of data centres, reflecting the forum’s focus on data -centre deployment issues. The cost for other private sector stakeholders is not factored. Total adjustment costs for data centre operators under PM2 are thus estimated at EUR 1.5 m (NPV, 10-years) Cost savings for data centre operators. The cost savings for data centre operators are described as indirect costs as the magnitude and reach of the measure is by design not big enough for these costs to be monetised. Adjustment costs for national public authorities. Recurrent adjustment costs for public authorities are primarily linked to their participation in the exchanges. For simplicity, it is assumed that 27 national authorities take part each year, although in practice representation may also be delegated to local authorities, depending on their involvement in dat a centre deployment. These costs cover attendance and preparation for two in-person meetings annually, as well as participation in a programme of five webinars per year for each authority. Total recurrent adjustment costs for national public authorities u nder PM2 are thus estimated at EUR 0.8 m (NPV, 10-years). Recurrent savings for national public authorities. The cost savings for public authorities are described as indirect costs as the magnitude and reach of the measure is by design not big enough for these costs to be monetised. Administrative costs for the European Commission. The Commission would incur one -off administrative costs to organise the ex changes, covering tasks such as defining the rules of procedure, issuing invitations and setting up the platforms for interaction. These start-up costs are estimated at approximately 40 staff days (equivalent to 0.2 FTE) for the first year of operation. Re current costs would arise from the supervisory and organisational role of the Commission in managing the forum. This is estimated at 40 staff days annually (0.2 FTE) for coordination and oversight, including the time dedicated to organising and participating in two in person events and five webinars per year. Furthermore, the cost of hosting one in -person event per year at the Commission’s premises is estimated at EUR 5 000. Total administrative costs (one-off and recurrent) for the Commission under PM2 are thus estimated at EUR 0.2 m (NPV, 10-years) Indirect impact: For data centre operators c ost savings under this measure would stem from coordination efficiencies due to these discussions focused on data centre development across the EU. The forum is expected to reduce duplicated outreach and bilateral exchanges with key 63 stakeholders, such as permitting authorities, TSOs and local administrations when building new data centres. Recurrent cost savings for national public authorities are expected from the centralisation of exchanges through the forum, which reduces repeated bilateral interactions with providers. Sensitivity analysis : As above, no sensitivity analysis has been conducted on this policy measure as the amounts at stake are too small. Results: For PM2, the estimated net costs for the implementation of this measure are EUR 2 603 530. These stem mostly from recurrent adjustment costs (EUR 2 372 210) stemming from the participation in the forum by the national public authorities and the economic operators. A one-off administrative cost (EUR 15 322) is foreseen for initial setup tasks borne by the Commission. Recurrent administrative costs of 215 998 are foreseen in relation to coordination for the management of the forum discussions. No direct savings are expected. Table 22. Creating a forum for exchanges between relevant public and private stakeholders involved in the buildout of data centres (PM2) Cost types Data centre operators (€) Public authorities (€) European Commission (€) Total Value (central, €) Total Value (min, €) Total Value (max, €) one-off administrative - - 15 322 15 322 15 322 15 322 recurrent administrative - - 215 998 215 998 215 998 215 998 one-off adjustment - - - - - - recurrent adjustment 1 553 531 818 679 - 2 372 210 2 372 210 2 372 210 one-off regulatory fees - - - - - - recurrent regulatory fees - - - - - - one-off enforcement. - - - - - - recurrent enforcement - - - - - - Total costs 1 553 531 818 679 231 320 2 603 530 2 603 530 2 603 530 Total benefits - - - - - - Net impact 1 553 531 818 679 231 320 2 603 530 2 603 530 2 603 530 3.3. PM3: Adopting guidelines on building sustainable data centres in the EU Under this measure, the Commission would develop non -binding EU guidelines for the sustainable planning, design and operation /deployment of data centres , which complement existing initiatives, e.g. DG ENER’s grid package, the EED, and the simplification of environmental permitting . The guidelines would prioritise voluntary coordination over top - down prescription. Their purpose is to addres s practical bottlenecks encountered by market participants and national public authorities, notably in terms of permitting, grid access, and financing, while promoting the uptake of innovative and resource-efficient technologies. They would also include recommendations on identifying suitable areas for data centre deployment. The guidelines would be co-created with Member States, relevant regulators, local authorities, TSOs/DSOs, data centre operators and CSPs. Drafting would also draw on the forum established under PM2, public consultations, and periodic review to reflect technological progress and implementation feedback. The text would be adaptable to national or regional contexts, allowing authorities to reference it if consistent and helpful with respec t to domestic frameworks. Governance cadence. Initial issuance of the guidelines in 2027, followed by triennial reviews (2030, 2033, 2036) to reflect technological progress and implementation feedback. 64 Impact on data centre deployment acceleration. The baseline capacity growth presents a 12% CAGR in data centre capacity ( 2025-2036). Under this option, it is assumed that the capacity growth rate (CAGR) increases slightly to 13% (see section 2.3.1 of this Annex). The guidelines are expected to reduce design, assessment and administrative tasks and applying best practices in datacentre rollout and operation. The scope of this measure covers data centre operators and CSPs active in the building of data centres in the EU. I mpacts scale with the share of organisations adopting the guidelines and the share of new projects applying them (see section 2.3.3). Since the use of the guidelines is voluntary, it is assumed that the share of new projects applying the guidelines increases from 0% in 2027 to 50% by 2036, to consider the differing views received during the consultations of Technopolis et al. (2025) about the usefulness and rate of uptake of the guidelines. Adjustment costs for data centre operators. The impact of the guidelines on businesses is modelled as adjustment costs using the Standard Cost Model (SCM), which accounts for the time and resources needed to understand and apply the guidelines. In year 1, each participating operator incurs one-off adjustment costs for consultation and discussions of the guidelines with authorities. Participation in the initial consultation process is estimated for 30 data centre operators and 10 CSPs43, considering around 27.5 staff days per operator per year (equivalent to 0.125 FTE or around 2 -3 full working days per month , spread across the year )44. The continued involvement in the revisions/updates of the guidelines is estimated at an additional 20 days every three years, but only for the 30 data centre operators and 10 CSPs originally engaged in the drafting. These days of effort per operator for participating in the discussion of the guidelines every three years and until 2036 would entail adjustme nt costs of EUR 1.58 m in total (NPV), assuming 30 data centre operators and 10 CSPs. For operators adopting the guidelines, 20 days per operator are considered for checking/adjusting planned solutions for the roll-out of data centres or of existing processes. It is assumed, backed by the results of the Final Workshop of the study carried out by Technopolis et al. (2025), that 50% of the approximately 400 CSPs and data centre operators active in building data centres in the EU would adopt the guidelines an d adjust their processes. Consequently, adjustment costs are estimated to amount to around EUR 29 317 per operator. Total adjustment costs (one-off and recurrent) for data centre operators under PM3 are thus estimated at EUR 7.4 m (NPV, 10-years) Administrative cost savings for data centre operators. The benefits generated by voluntary guidelines, e.g. fewer mistakes, reduced rework, faster processes and improved coordination, are classified as administrative burden reductions. The impact of the guidelines is modelled by assuming shorter administrative timelines using a SCM approach. The guidelines are expected to reduce the incidence of mistakes during the pre -operation phase of building a new data centre. This is modelled as a central 10 -days saving (min 5 days; max 15 days), with an increasing number of data centres benefitting from this measure (subject to sensitivity analysis). The time saving benefit of the voluntary guidelines is calculated as the time saved per facility that adopts the guidelines (ΔT) multiplied by the relevant labour cost, the total number of new facilities, and the estimated adoption rate. This follows the SCM formula: 43 The number of operators engaging with the drafting of the guidelines represents the average number of operators ty pically engaging in such processes, i.e. not the total number of operators in the EU. 44 Although this consultation is voluntary and not a legal obligation, operators are likely to engage due to their interest in influencing a framework that directly affects their operations 65 Total savings = ΔT × labour cost × s × No. new facilities Total administrative cost savings for data centre operators under PM3 are thus estimated at EUR 2.1 m (NPV, 10-years) Adjustment costs for n ational public authorities . For public authorities that participate in drafting the guidelines, adjustment costs would be related to their participation in the drafting of the guidelines and their internal adoption, in terms of familiarisation and optional adaptation of local checklists and templates, estimated at 30.5 days per year (0.14 FTE) or around 2-3 days per month of full -time work per national authority spread across the year of adoption. If one representative from each Member State woul d participate, this would translate into approximately EUR 236 575 in year 1. Thereafter, adaptation of the new templates/tools together with the participation of authorities in the review of the guidelines every three years are expected to require 20 staff days (0.1 FTE). This would entail recurrent adjustment costs of EUR 155,131 each update cycle, assuming all Member States would adopt the guidelines. Total recurrent adjustment costs for national public authorities under PM3 are thus estimated at EUR 0.6 m (NPV, 10-years) Administrative cost savings for n ational public authorities . Harmonised EU guidelines are expected to limit the need for national authorities to interpret divergent compliance questions during permitting. Authorities are expected to realise administrative burden reduction once the guidelines are applied, including reduced errors, faster processing with fewer clarifications, and improved coordination with operators . These time and resource savings are counted as administrative cost saving s in the impact assessment and are quantified using Standard Cost Model principles. From 2027 onwards, clearer information requirements are assumed to generate lasting process efficiencies, reducing administrative efforts per project and lowering disputes with data centre operators, as well as the need for repeated iterations with applicants. Given that operators are expected to save 10 days per project, a proportional reduction of approximately 20% on the authority side is applied, resulting in an estimate d saving of 2 days (min 1 day; max 3 days) per project (ΔT). This reflects reduced requests for clarification, fewer iterative corrections and smoother coordination thanks to the guidelines . The savings would largely depend on the voluntary adoption of the guidelines by the new data centre projects, allowing authorities to save time in terms of decreased interactions with them. Benefits are estimated considering they would accrue to around 50% of national public authorities (central estimate) in the EU dealing with data centre projects. Cost savingsPA = ΔT × labour cost × s × 𝑁𝑜.𝑛𝑒𝑤 𝑓𝑎𝑐𝑖𝑙𝑖𝑡𝑖𝑒𝑠 𝑀𝑆 × No of MS Total administrative cost savings for national public authorities under PM3 are thus estimated at EUR 0.3 m (NPV, 10-years) Adjustment costs for the European Commission. The Commission would be in charge of developing the guidelines, requiring one -off adjustment costs covering the drafting, consultation, translation and dissemination. These tasks are estimated to require around 110 staff days during the first year (0.5 FTE). Thereafter, periodic improvements and review s, comprising an update every three years, would require about 55 staff days (0.25 FTE) for each update cycle. Total adjustment costs = one-off adjustment costs + recurrent adjustment costs = (ΔT × labour cost)year 1 + (ΔT × labour cost)year update 66 Total adjustment costs for the European Commission under PM3 are thus estimated at EUR 0.1 m (NPV, 10-years) Indirect impact: The guidelines are supposed to support cross -fertilisation of best practices, especially for those operators with operations across EU27 borders, and by doing that they should work towards the improvement of the investment climate for green and sustainable technologies for data centres rollout. Sensitivity analysis: The key parameters tested for sensitivity include (1) the adoption rate of the guidelines in terms of the number of projects concerned, (2) time saved per project for operators and authorities. For such purposes min-max were created for these parameters. The number of projects benefitting from the guidelines ranges from 30% in the low scenario to 70% in the high scenario, with a central estimate of 50%. A low case combines a conserva tive adoption rate and limited time savings, while a high case combines a high adoption rate with higher efficiency gains. Results: The table below presents the aggregated costs for all stakeholders for the implementation of this measure. Total implementation costs are estimated between EUR 4 948 939 to EUR 15 841 158, while total cost savings range from EUR 1 298 171 to EUR 4 191 108, with a central value of EUR 2 383 022. The measure is therefore costly in all cases. The min and max scenarios are largel y driven by the adjustment costs required and consequent cost savings expected. Table 23. Creating guidelines on building sustainable data centres in the EU (PM3) Cost types Data centre operators Public authorities European Commission Total Value (central, €) Total Value (min, €) Total Value (max, €) one-off administrative - - - - - - recurrent administrative - - - - - - one-off adjustment 2 080 146 - 40 907 2 121 053 1 305 468 4 159 557 recurrent adjustment 5 363 245 612 097 51 523 6 026 866 3 653 471 11 681 301 one-off regulatory fees - - - - - - recurrent regulatory fees - - - - - - one-off enforcement. - - - - - - recurrent enforcement - - - - - - Total costs 7 443 391 612 097 92 431 8 147 919 4 948 939 15 841 158 Total benefits (2 103 643) (279 379) - (2 383 022) (1 298 171) (4 191 108) Net impact 5 339 748 332 718 92 431 5 768 775 3 650 768 11 650 050 3.4. PM4: Project facilitators for the roll-out of data centres Under this measure, Member States would simplify the administrative efforts required to roll out data centres , by designating a project facilitator acting as a central coordinator for the permitting process at national level, where this does not already exist. Member States would be free of designating the facilitator as per their own structures, e.g. a service within their central administration or within an agency. The project facilitator would be responsible for accompanying the applicants in securing all relevant authorisations (including environmental assessments, construction permits and/or grid connection permits) and coordinating with other national agencies/administrative entities (e.g. possible future single points of contact for environmental assessments) involved in the permitting process on one side, and with the data centres on the other. It would also provide support to the data centre operators in assessing whether projects qualify to be recognised as strategic, thereby enabling them to benefit from access to funding, helping data centres demonstrating readiness when it comes to grid 67 connection, and dedicated administrative support. For environmental authorisations, the project facilitator would interact directly with the designated authorities or through the national single point of contact (SPOC), ensuring that there is efficient coordination. Evidence from Technopolis et al. (2025) covering 12 Member shows that overall permitting timelines, i.e. including zoning & land allocation, building permit, utilities & grid connection, environmental permit/s currently range 32 months on average (see section 98 of this Annex for a more detailed overview). Impact on data centre deployment acceleration. The baseline capacity growth presents a 12% CAGR in data centre capacity ( 2025-2036). Under this option, it is assumed that the capacity growth rate increases to 15%. This uplift reflects the assumption that shorter, more predictable permitting procedures reduce barriers to investment, accelerate time to market, and improve certainty for operators, thereby stimulating additional capacity deployment. The scope of this measure covers data centre operators and CSPs active in new data centre builds in the EU (see section 2.3 of this annex for further details). It is assumed that 50% of the new builds will be adopting this measure, in a staged adoption going from 0% in 2027 until 50% in 2036. This is a conservative assumption used for modelling purposes only, with the caveat that the detailed assumptions of number of new builds forecasted per country per year is not considered, and not knowing how many countries will adopt this measure. Costs for data centre operators. Data centre operators will engage with the facilitator to submit necessary documents, attend joint meetings and receive guidance on the permitting processes. From the operator’s perspective this should replace the numerous, fragmented integrations with individual authorities that currently occur, resulting in limited additional costs. Although operators may incur some initial costs to familiarise themselves with the facilitator's procedures, these are likely to be outweighed by benefits in terms of fewer repeated submissions and shorter procedures (see below) . As the measure is expected to simplify the process without increasing the overall time spent on permitting, no separate administrative cost is considered for data centre operators. Direct economic benefits for data centre operators. The most relevant benefits of this measure arise from the direct economic benefits of earlier cash-flow realisation for one project linked to shorter permitting times achieved through the accompanying effects of the facilitator, i.e. the reduction in administrative processing time and the resulting acceleration of the overall development timeline for new data centre projects45. These benefits represent a subset of all the potential improvements generated by the measure, but they are the ones that can be robustly monetised. To capture them, the analysis applies a project-level Net Present Value (NPV) approach (discounted cash flow) that compares the baseline permitting duration with the accelerated scenario and measures the economic value of bringing construction and commercial operations forward, discounted at the project WACC (6%). Earlier time-to-market gains from faster permitting are reflected directly in the DCF through a shorter period before revenues are realised and thus earlier start of cash flows, while reduced operating costs from improved energy efficiency (declining PUE , basel ine scenario ) are included as part of the OPEX assumptions over the life of the project. Risk -related efficiency gains, e.g. better certainty on 45 Although all parameters (PUE, utilisation rate, revenues and costs) are held constant between the baseline and this policy scenario, the discounted cash-flow model is inherently non -linear in time. Therefore, shortening the permitting phase brings forward the entire operating cash-flow profile, reducing discounting on the most value-relevant early-operation cash flows. 68 siting, permitting and investment conditions, are considered indirect benefits rather than appearing directly in the model46. The simplified process through the use of a project facilitator is estimated, based on interviews with stakeholders and validated during the final validation workshop, to shorten the average permitting duration for a new data centre facility by 6 months, from an average baseline of 32 months to around 26 months duration from the development phase to operations. The NPV gain associated with this reduction in permitting timelines is not driven only by timing effects. The project’s cash -flow model incorporates several operational and financial parameters that together increase the economic value of accelerated deployment, resulting in a higher NPV than would be obtained through time-shifting alone. Consequently, the NPV increase from EUR 58 million to EUR 65 million reflects the combined impact of accelerated commissioning and improved operational performance, which contribute to the economic benefit of permitting simplification. Direct economic benefit = ΔNPV = 𝑁𝑃𝑉𝑃𝑀4 − 𝑁𝑃𝑉𝑏𝑎𝑠𝑒𝑙𝑖𝑛𝑒 Where each NPV is computed over a 1 0-year horizon and includes all cash flows: CAPEX outflows during construction, OPEX, Revenues. The analysis has been carried out in nominal terms, with both costs and revenues indexed over time and discounted using a nominal WACC. NPV baseline (EUR m) 58.32 Economic benefits per project (EUR m) Timeline reduction of 6 months NPV after PM implementation (EUR m) 64.74 6.42 11% Beyond the quantified impact, the measure is also expected to generate additional direct benefits such as improved information for operators and authorities, reduced administrative friction, and greater market efficiency through more consistent and predictable interactions with permitting bodies. These impacts can be considered administrative cost savings, improved information and better market efficiency, under the Better Regulation. They are not monetised because of their smaller scale compared to the efficiency gains captured throu gh the NPV differences. Total direct economic benefits for data centre operators under PM4 are thus estimated at EUR 4.6 bn (NPV, 10-years) Adjustment and enforcement costs for national public authorities. National authorities are expected to face one-off adjustment costs to comply with this measure and establish the project facilitator. These costs arise to design and implement streamlined permitting procedures, designate and staff a task force and align responsibilities across relevant authorities . For modelling, a one-off cost of around EUR 0.4 million per Member State has been assumed to capture the effort to (i) set up the project facilitator , i.e. defining the mandate, governance, allocation of responsibilities and decisions (1 FTE), (ii) staff new people, i.e. initial team preparation and training (2 FTEs), (iii) design streamlined procedures and guidelines (1 FTE) and (iv) coordinate effectively among different authorities, i.e. meet with relev ant ministries, agencies, authorities and other bodies, as well as secretariat support (2 FTEs). This cost corresponds to a total effort of 6 FTEs to enable the measure’s organisational design, workflow streamlining, initial staffing and coordination with other authorities. To reflect differences in territorial complexity and the number of administrative regions involved, this amount has been 46 The same applies to other measures using this modelling approach, i.e. PM5 and PM10. 69 uplifted with a mark-up for each NUTS administrative tier (NUTS 1/2/3) , i.e. + EUR 0.052m per NUTS-1 region, + EUR 0.01m per NUTS-2 region, + EUR 0.005 m per NUTS-3 region47. The measure would also entail recurrent enforcement costs for national authorities, reflecting the operations of the project facilitator and task force once established. These include staff time for coordinating with competent authorities, handling applications, maintaining harmonised workflows and acting as a central interface for data centre projects. These costs are mainly staff-time-based, assuming 4 FTEs/year. The total EU-wide costs are obtained by multiplying Member State–level savings by the total number of Member States. Total costs (one-off adjustment and recurrent enforcement) for national public authorities under PM4 are thus estimated at EUR 78.9 m (NPV, 10-years). It is important to underline that this estimate represents a worst case scenario in which authorities would need to establish a dedicated team from scratch, whereas in practice Member States may rely on existing resources under the Gigabit Infrastructure Act, including by designating a single information point established under Regulation (EU) 2024/1309, with the relevant functions, procedures and mechanisms applying accordingly. Administrative cost savings for national public authorities. Recurrent savings for national public authorities should stem from administrative simplifications given the assumed reduction of parallel processing and fewer back -and-forth interactions between authorities and with economic operators. In the baseline, permit applications are processed through multiple parallel channels, with each authority devoting s taff time to separate contacts, repeated information requests and uncoordinated reviews. Under the new set-up, a dedicated facilitator team would coordinate input, standardise documentation and organise joint meetings. As a result, and based on the interviews conducted, the total number of staff days required per project across all authorities is assumed to decrease , even though some of this effort is reallocated. The figures used consider that average processing of permitting procedures currently requires around 80 staff days (or 20 weeks) per project by each authority. Under the measure, process redesign and single-window coordination could reduce this by approximately 20 staff days per new data centre project (15-25 for sensitivity). Cost savingsPA = ΔT × labour cost × s × No. new projects × No. of MS Total administrative cost savings for national public authorities under PM4 are thus estimated at EUR 110.8 m (NPV, 10-years) Indirect impact: This measure is also expected to produce wider economic benefits and non- monetary benefits, such as reduced investment uncertainty, more predictable project planning, lower likelihood of disputes or appeals, enhanced coordination across authorities, and a more attractive investment environment for large -scale digital infrastructure. While these indirect effects are not quantified, they reinforce the overall positive impact of the measure and help explain the broader efficiency gains supported by the quantified analysis. Sensitivity analysis: Four key parameters are subject to sensitivity checks because of the complexity of this policy measure and the number of assumptions implied most affecting the balance of costs and benefits. The parameters subject to sensitivity are: (i) the time saved in 47 NUTS counts proxy multi-tier coordination and interface complexity (more NUTS-levels/regions implies small regions. The EU currently lists 92 (NUTS -1), 244 (NUTS -2), 1,165 (NUTS -3) regions, underscoring the heterogeneity across Member States. 70 permitting processes (ΔT) as this determines the scale of the economic benefits for operators through time-to-market acceleration (varied between 4 and 8 months) , (ii) the number of data centre projects that would benefit by 2036, (ii i) the implementation costs for authorities and (iv) time savings for permitting by public administrations. These dimensions form the low and high scenarios to test potential outcomes of this measure. Results: The aggregated costs and benefits for all sta keholders over the time horizon are summarised in the table below. While operators do not incur additional direct and experience substantial economic benefits from time-to-market acceleration, national public authorities face one-off adjustment and recurrent enforcement costs, with administrative cost savings from simplification. Even though authorities’ cost savings slightly outweigh their costs in all scenarios, the large economic benefits accruing to operators dominate the overall balance. The differences between scenarios are mainly driven by changes in the magnitude of the NPV gains linked to the expected reduction in permitting timelines. Table 24. Administrative simplification for the roll-out of data centres (PM4) Cost types Data centre operators (€) Public authorities (€) European Commission (€) Total Value (central, €) Total Value (min, €) Total Value (max, €) one-off administrative - - - - - - recurrent administrative - - - - - one-off adjustment 20 668 601 - 20 668 601 19 011 860 22 325 342 recurrent adjustment - - - - - - one-off regulatory fees - - - - - - recurrent regulatory fees - - - - - - one-off enforcement. - - - - - - recurrent enforcement - 58 225 227 - 58 225 227 29 112 613 87 337 840 Total costs - 78 893 828 - 78 893 828 48 124 473 109 663 182 Total benefits (4 585 666 446) (110 843 709) - (4 696 510 155) (1 908 005 277) (8 742 605 033) Net impact (4 585 666 446) (31 949 881) - (4 617 616 327) (1 859 880 804) (8 632 941 851) 3.5. PM5: Mechanism for Member States to identify areas to fast -track data centre deployment Under this measure, on the basis of a national data centre strategy/plan, Member States would need to identify areas to fast -track data centre deployment based on shared EU -level criteria (e.g. on connectivity, energy, water), allowing for the pre -selection of strategic sites where permitting procedures will be streamlined. Fast-tracking measures would apply to projects that have a significant social interest. This would be su pported by EU level support through a coordination hub, which will provide guidance, model templates and best practice s. The toolbox established in the new Regulation on speeding -up environmental assessments would be leveraged for the designated areas, to allow them to benefit from the additional favourable provisions in environmental assessments (overriding public interest, tacit approval, and dispute settlement). Within fast -track areas, maximum timelines for data centre permitting beyond environmental impact assessment should be of 18 months from the date on which a complete application is acknowledged as duly submitted to the point at which construction activities for the new facility begin. This implies that Member States would be required to adopt procedural measures for accelerated data centre deployment. Impact on d ata centre deployment acceleration. As above, i t is assumed that the data centre growth rate under this option increases to 15%. This uplift reflects the expectation that faster and more predictable processes with lower entry barriers, reduce time -to-market and improve 71 investor certainty, thereby stimulating additional deployment compared to the baseline. A geographic expansion beyond primary and secondary markets is supposed to emerge under this measure, with new regional hubs emerging in Southern Europe, the Baltics, and Central & Eastern Europe. The measure would primarily affect data centre operators, who account for most projects, and cloud service providers (CSPs) that construct and operate their own facilities (around 40% of projects). See Section 2.3.3 for further details. It is assumed that the share of new projects benefitting from this measure increases from 5% in 2027 to 50% by 2036. Administrative and adjustment costs for data centre operators. If operators choose to build in these areas to benefit from accelerated permitting, they must comply with the technical, environmental and procedural conditions attached to the areas. This gives rise both to administrative costs (i.e. information obligations needed to demonstrate compliance) as well as to adjustment costs (i.e. changes in project design or planning). Even if they are voluntary costs as operators opt into the scheme, they are considered direct compliance costs once participation is decided. Administrative costs arise from the additional effort required to access the area, i.e. preparing a specific application file, familiarising themselves with criteria and national implementing guidance, including connectivity, energy and water benchmarks, c ompleting standardised templates/checklists and submitting evidence of compliance with area conditions. These costs are assessed following the Standard Cost Model, focusing on the time required for operators to complete these tasks to access fast-track areas. This is estimated as an effort of 20 staff days or 4 weeks (sensitivity range 25-15) per application. This is multiplied by the share of the data centre operators applying for the areas across the EU, since such costs are only incurred by operators that apply to use fast -track areas. This is assumed to be 50% of the companies identified as building data centres in the EU. One-off administrative costs year t = ΔT × labour cost × No. of applications Operators are also expected to face one -off adjustment costs if their project design/planning shall be adapted to meet the area requirements, e.g., to comply with environmental conditions applicable within the area. For simplicity, adapting workflows/operations to comply with area- specific require ments and accelerated permitting timelines has been estimated to cost each operator additional 40 staff days (30-60 days) to modify the project48. After this initial set-up, recurring costs per project to demonstrate area eligibility are expected not to be incremental with respect to the baseline and are thus not represented. One-off adjustment costst = ΔT × labour cost × s × No. new facilities Total costs (one-off adjustment and one-off administrative) for data centre operators under PM5 are thus estimated at EUR 13.8 m (NPV, 10-years) Direct economic benefits for data centre operators . This measure aims to provide additional benefits by reducing uncertainty over where investments should be directed. By creating a mechanism for Member States to identify fast -track areas, operators avoid wasted effort on non-viable sites. These changes are expected to red uce the number of iterations required and shorten internal and external time commitments. Once initiated, each new deployment in a designated area requires fewer efforts as eligibility is predefined and baseline data on connectivity, grid, water, land use are available. The areas are also assumed to shorten the 48 CAPEX investments are not considered as part of the adjustment costs as only projects that already comply, or are willing to comply, with the EED and other relevant requirements under the baseline scenario would be eligible to apply for the fast - track areas. As a result, no additional CAPEX beyo nd what is already required under existing legislation is expected to arise specifically from participation in the areas. 72 average development cycle for a new data centre facility by an additional 8 months (sensitivity 6-10), thus leading to a total duration from end of procurement to operation of 18 months, assuming the full effect of the above measure (PM4) is also factored in. The improvement in timeline coming from the implementation of the areas identified for simplification fast-track deployment, has been estimated in 8 months average, due to: • Coordinated spatial mapping, identifying brownfield sites, industrial areas near power infrastructure, and locations with minimal environmental sensitivity (2 months savings). • Area-level Environmental Impact Assessment (EIA) completed in advance for entire areas (1 month carried out in parallel to the zoning). • Standardized building codes, infrastructure requirements, and technical specifications (3 months average for building permit). • Dedicated infrastructure areas, i.e., pre -planned electrical capacity (12 months for grid connection). As above, to capture these direct economic benefits, the analysis applies a NPV approach to compare the baseline permitting duration with t he accelerated scenario and measure the economic value of bringing construction and commercial operations forward, discounted at the project WACC. The NPV gain is also associated with the reduction in PUE foreseen under this measure, as only the most susta inable data centres would be able to benefit from the fast - tracking. In fact, expected i mprovements in energy efficiency , modelled as a declining PUE, also contribute to reducing operating costs over time. The NPV increase from EUR 58 million to EUR 74 million reflects the combined impact of accelerated commissioning and improved operational performance, which contribute to the economic benefit of permitting simplification. The business benefit is measured as th e difference in net present value (NPV) between an accelerated-permitting scenario and a baseline scenario, discounted at project WACC (6%): Direct economic benefit t = (ΔNPV = 𝑁𝑃𝑉𝑃𝑀5 − 𝑁𝑃𝑉𝑏𝑎𝑠𝑒𝑙𝑖𝑛𝑒)× s × No. new facilities Where each NPV is computed over a 1 0-year horizon and includes all cash flows: CAPEX outflows during construction, OPEX, Revenues. The analysis has been carried out in nominal terms, with both costs and revenues indexed over time and discounted using a nominal WACC. NPV baseline (EUR m) 58.32 Economic benefit per project (EUR m) timeline reduction of 8 months NPV after PM implementation (EUR m) 74.89 16.58 28% As mentioned above under PM4, a small share of this economic benefit (around 1%) is expected to direct administrative cost savings , i.e. avoided work by staff and consultants ( around 1.5 FTE-years) that would otherwise be needed for document preparation, follow -ups with authorities, and procedural back-and-forth foreseen before building a new data centre project. Under this policy option, the project’s internal rate of return would consequ ently increase by over 80 basis points with respect to the baseline. Taken together, PM4 and PM5 would increase the project’s IRR from 9. 86% to 10.70%, i.e. an economically meaningful shift which is expected to improve investor appetite. Interviews with in vestors confirmed that data centre investments are evaluated across a wide risk -return spectrum, broadly consistent with market benchmarks positioning core infrastructure targeting around 7 -9% IRR and core -plus assets around 10-13%. Expected returns depend strongly on asset maturity and risk profile: stabilised, fully built platforms with secured power and long -term contracts are treated as lower -risk assets, while development-stage projects face higher execution risk related to permitting, power availability, equipment procurement, and commercialisation. Equity investors typically target 73 “single digit returns plus a risk premium,” with materially higher expectations for projects exposed to development, energy, or commercial risk. Together, these perspective s illustrate why moving a project from 9.9% to 10.7% IRR can reposition assets within investor target bands, improving competitiveness versus alternative infrastructure investments and affecting bankability. This is particularly relevant for mid-sized European data centres (typically 5 –25 MW), which are aligned with institutional investment ticket sizes but face tighter margins and higher relative development risk than hyperscaler projects. Total direct economic benefits for data centre operators under PM5 are thus estimated at EUR 11.8 bn (NPV, 10-years) Adjustment and administrative costs for national public authorities . Member States are required to draft strategies for national data centre deployment, where these do not already exist and, as part of these, designate suitable areas for fast-track data centre permitting. This activity is expected to generate mandatory one-off administrative costs for public authorities. Since at least 7 MS already have a national data centre strategy or an analogous document ready or in the making (see footnote 206), 20 Member States are expected to incur additional administrative costs to draft new strategies . These have been estimated as 3 FTEs (1-5 for sensitivity) per Member State. Moreover, each Member State would need to reprioritise resources to set up processes and align national practices with these new rules. This has been estimated as a one-off adjustment cost equivalent to 6 FTEs (4-8 for sensitivity) per Member State. Member States are also expected to face ongoing administrative costs to update the strategies and the list of suitable fast-track areas for data centre deployment, estimated respectively as 3 FTEs every 5 years and 4 FTEs every year. Total one-off adjustment, one-off administrative and recurrent administrative costs for national public authorities under PM5 are thus estimated at EUR 79.9 m (NPV, 10-years). Administrative cost savings for national public authorities. Recurrent savings for national public authorities should also stem from administrative simplifications given the assumed reduction back and forth interactions between authorities and with economic operators, thanks to the clearer requirements from the areas. As above, given that permitting requires around 80 staff days per project by each authority, process redesign and clearer requirements are expected to reduce this to 20 staff days per new data centre project. The analysis thus foresees that the project facilitator and the fast-track approach might reduce overall administrative staff days per project compared with the baseline. Administrative cost savingsPA = ΔT × labour cost × s × No. new projects × No. of MS Total administrative costs savings for national public authorities under PM5 are thus estimated at EUR 110.8 m (NPV, 10-years). Adjustment costs for the European Commission. The Commission would face one -off adjustment costs to set up the coordination hub. This has been estim ated at 3 FTE during the first year. Moreover, recurrent annual adjustment costs are also estimated for the operation of the coordination hub that supports Member States in identifying and designing fast-track areas. This is estimated at 3 staff days per m onth each year (0.11 FTE/year) covering Commission staff time. 74 Total one-off and recurrent adjustment costs for the European Commission under PM5 are thus estimated at EUR 0.4 m (NPV, 10-years) Indirect savings: Similarly to the measure on administrative simplification, this measure has the potential to realise a broad range of indirect positive impacts on the investments climate, better compliance and transparency of operators during the permitting process, as well as an overall improvement of the decision making process. Sensitivity analysis: Sensitivity analysis focuses on the potential effectiveness of the measure and the ensuring associated regulatory costs, with parameters modelled to consider a changing level of effort to comply with the data centres areas requirements, both in terms of administrative and adjustment costs, as well as to understand how time savings influencing NPV calculations and adoption rates impact potential direct economic benefits. With respect to benefits, the reduction in months saved is varied between 6 and 10 (cent ral 8 months saving) as well as the share of facilities using the areas by 2036, i.e. considering between 30% and 70% (with a central scenario of 50%). Concerning the costs, the additional time considered for administrative and adjustment costs is also varied to reflect the uncertainty about the intensity of the new procedures. The low scenario (min) combines conservative assumptions on effectiveness (6 months saved, 30% uptake by 2036) with higher costs, while the high scenario (max) does the opposite. Sen sitivities were also considered for national public authorities, to reflect the uncertainty related to the complexity of setting up the strategies and administering the new processes, considering respectively minimum 1 and 4 and maximum 5 and 8 FTEs. Results: The aggregated costs and benefits for all stakeholders over the time horizon are summarised in the table below . Operators incur limited administrative and adjustment costs, while they benefit from substantial NPV gains through shorter time s to market and reduced uncertainty, and public authorities face moderate administrative costs. The scenarios are largely driven by the NPV calculation which is affected by the number of months and PUE savings that are expected to stem from this new process. This would be expected for simplification measures, whereby the benefits associated with earlier commissioning and reduced delays are economically significant while the costs are limited to a small number of administrative and compliance activities. As participatio n to use the areas is voluntary, no major regulatory burdens are imposed. Table 25. Establishing mechanism for Member States to identify areas to fast-track data centre deployment (PM5) Cost types Data centre operators (€) Public authorities (€) European Commissi on (€) Total Value (central, €) Total Value (min, €) Total Value (max, €) one-off administrative 1 476 159 3 681 647 - 5 157 806 2 057 555 8 903 876 recurrent administrative - 66 321 846 - 66 321 846 46 367 793 86 275 900 one-off adjustment 12 364 761 9 940 446 245 443 22 550 649 12 436 549 39 465 368 recurrent adjustment - - 117 627 117 627 117 627 117 627 one-off regulatory fees - - - - - - recurrent regulatory fees - - - - - - one-off enforcement. - - - - - - recurrent enforcement - - - - - - Total costs 13 840 920 79 943 939 363 070 94 147 928 60 979 524 134 762 770 Total benefits (11 844 675 172) (110 843 709) - (11 955 518 881) (6 219 100 693) (19 009 669 476) Net impact (11 830 834 252) (30 899 770) 363 070 (11 861 370 953) (6 158 121 169) (18 874 906 705) 75 3.6. PM6: National funding support for data centres The introduction of public support measures that target clearly defined market failures in line with applicable State aid rules , to support data centre deployment would generate cost and benefits mainly for operators and national authorities. Under this measure, Member States may grant public support to particularly sustainable and strategic data centres deployed within pre- identified areas (see PM5), according to commonly defined criteria. Impact on data centre deployment acceleration. The baseline capacity growth presents a 12% CAGR in data centre capacity (202 5-2036). Under this option, it is assumed that the capacity growth rate increases to 15%. This uplift reflects the assumption that support measures - together with the other PM described above implemented as part of this option – would reduce barriers to investment, accelerate time to market, and improve certainty for operators, thereby stimulating additional capacity deployment. The scope of this measure covers data centre operators and CSPs active in new data centre builds in the EU, while impacts scale with the share of new projects receiving funding. Please see Section 2.3.3 for further details. Administrative costs for Data Centre Operators . For operators, the one-off administrative costs of participating in such public support measures are modest. Preparing applications, providing supporting documentation and fulfilling reporting obligations are estimated at 0.2 FTE, or 45 days, during the first year . These are estimated as the staff time spent on the application and, where required, verification processes multiplied by the relevant labour costs. One-off administrative costs year t = ΔT × labour cost × No. of applications Operators may face incremental costs to meet eligibility requirement s. For example, the inclusion of battery storage, waste -heat reuse, or other technologies to improve grid stability and sustainability could raise investment costs. However, these would depend on the nature of the support measure and thus cannot be reasonably quantified. Total one-off administrative costs for data centre operators under PM6 are thus estimated at EUR 0.7 m (NPV, 10-years). Benefits for data centre operators. Operators would benefit from direct financial support, for example through tax advantages or incentives , which is expected to reduce their capital expenditure and accelerate or make possible the implementation of data centre projects. These subsidy amounts would represent direct benefits for operators and corresponding costs for public authorities . Nevertheless, given the voluntary nature of the funding scheme (as the Member State must first decide that it wants to implement such a scheme) they have not been quantified as fiscal transfers. Adjustment costs for national public authorities. For national authorities, in addition to the overall fiscal transfer costs, the set -up and management of the scheme generates new adjustment costs. These are quantified based on the expected effort required by each Member State, assuming that for the design and legal establishment of the scheme during the first year, 4 FTEs (3-5 for sensitivity ranges) are required and entail one-off adjustment costs. These costs are scaled by the number of Member States expected to operate the scheme under low, central and high uptake scenarios (25%, 50% and 75% of MS). Thereafter, processing, evaluation of applications, and monitoring is estimated at 3 FTEs (2-4 for sensitivity ranges) every two years as recurrent adjustment costs for the duration of the grant (assumed to be of 7-years). Total adjustment costs = (one-off adjustment costs + recurrent adjustment costs) × s × MS = [(ΔT × labour cost) year 1 + (ΔT × labour cost) year 1,3,5,7] × s × MS 76 Total one-off and recurrent adjustment costs for national public authorities under PM6 are thus estimated at EUR 10.1 m (NPV, 10-years) Cost savings for national public authorities. Administrative savings may be realised where harmonised EU criteria and te mplates reduce duplication of effort, e.g. estimated at around 1 FTE annually compared with purely national schemes. However, they are deemed negligeable and are not included in the calculations. Costs for the European Commission. At EU level, modest administrative costs would arise for the oversight and monitoring of Member State schemes. These costs are not accounted for in the calculations. Indirect benefits: Subsidies for particularly sustainable and strategic data centres may generate public sector benefits through higher tax revenues with positive spillover effects on the advancement of digital objectives. Tax reductions for data centres can also indirectly generate benefits, e.g. in terms of increased capital inflows and improved digital capacity that supports broader economic competitiveness . Such measures would need to be carefully designed to account for their opportunity costs and ensure that the expected benefits justify the reduced fiscal intake. The support measures should also aim to foster energy-efficient, environmentally responsible data centre facilities, contributing to improve digital resilience and service quality for citizens and businesses. These elements have not been quantified in this section. Sensitivity analysis: Sensitivity analysis was considered for the total administrative costs for the number of public authorities administering the scheme and the effort required to set -it up and manage it in terms of FTEs. Results: The table below presents the aggregated costs for all stakeholders for the implementation of this measure. Total costs are estimated at EUR 10. 8 m. The minimum and maximum ranges are driven by variations in the number of MS wishing to operate the scheme by and the magnitude of staff days involved. Fiscal transfers have no net effect when aggregated across stakeholders, i.e. financial benefits for operators are mirrored by equivalent fiscal costs for public authorities. Indirect oppor tunity costs for operators participating in the scheme are also illustrated in the table below and vary based on the uncertainty with respect to the number of applications and days dedicated to proposal/application preparation. Table 26. National funding support measures for data centres (PM6) Cost types Data centre operators (€) Public authorities (€) European Commission (€) Total Value (central, €) Total Value (min, €) Total Value (max, €) one-off administrative 654 225 - - 654 225 169 614 1 332 680 recurrent administrative - - - - - - one-off adjustment - 3 313 482 - 3 313 482 1 242 556 6 212 779 recurrent adjustment - 6 830 638 - 6 830 638 2 276 879 13 661 275 one-off regulatory fees - - - - - - recurrent regulatory fees - - - - - - one-off enforcement. - - - - - - recurrent enforcement - - - - - - Total costs 645 225 10 144 120 - 10 798 344 3 689 049 21 206 734 Total benefits - - - - - - Net impact 645 225 10 144 120 - 10 798 344 3 689 049 21 206 734 77 3.7. PM7: Set deployment targets and monitor progress The measure sets EU -level deployment targets for data centre capacity (e.g., MW IT load) which should be regularly adjusted in light of a monitoring of the compute -capacity gap identified for the EU. Such monitoring would be carried by the Commission and verified by relevant national authorities. The measure does not create mandatory obligations for private operators. The main costs would fall on the Commission, which would be responsible for developing the methodology and compiling the initial dataset. In so far as possible, the methodology would build on existing publicly available data and the data collected as part of the energy efficiency monitoring of the Energy Efficiency directive, and operators are expected to incur limited costs associated with providing supplementary information, while national authorities would face small recurrent costs to verify and validate the data submitted. Impact on data centre deployment acceleration. As above, under this option, it is assumed that the capacity growth rate increases to 15%. Administrative c osts for Data Centre Operators . Operators are expected to face minor recurrent administrative costs to provide supplementary information need for the dataset. These tasks involve supplying data that they already hold for operational or reporting purposes, notably covering capacity in MW or FLOP 49, which would keep the burden at a minimum . These costs have been modelled as staff time spent participating in surveys and possibly validating data quality. This is expected to require approximately 1 day per year (0.5-1.5 for sensitivity ranges). Annual updates are assumed to entail the same cost. Total recurrent administrative costs (voluntary)= (ΔT × labour cost × No. of operators) Total administrative costs for data centre operators under PM 7 are thus estimated at EUR 0.4 m (NPV, 10-years). Costs for national public authorities. National authorities would incur limited recurrent enforcement costs. Their main effort would entail performing periodic checks to verify that the compiled data is complete and reflects national conditions. In this context, the monitoring effort should take into consideration the implementation of national data centre strategies and track progress against their objectives so that any relevant results are also shared with the Commission. This effort is expected to require approximately 15 staff days per year (10-20 for sensitivity ranges), resulting in small and predictable administrative burden. Total recurrent enforcement costs = ΔT × labour cost × No. of MS Total enforcement costs for national public authorities under PM7 are thus estimated at EUR 0.9 m (NPV, 10-years). Costs for the European Commission. The Commission would be responsible for carrying the study and publishing the results at EU level. This would result in one -off adjustment costs to set up the process and guidance effort, estimated at 1.5 FTEs (1-2 for sensitivity ranges) in year 1, including the procurement of a study to survey capacity periodically over 10-years, with an estimated budget of EUR 800 000 . Recurring enforcement costs for monitoring and coordinating with Member States’ have then been estimated for at 25 days per year or 0.1 FTEs. 49 Floating point Operations Per Second (FLOPS) is a standard measure of the performance of a computer, indicating how many calculations on numbers with decimal points it can perform in one second. 78 Total one-off adjustment and recurrent enforcement costs for the European Commission under PM7 are thus estimated at EUR 1.0 m (NPV, 10-years). Indirect impacts. The measure generates relevant indirect benefits. For operators, clearer EU- wide targets are expected to reduce investment uncertainty and effort in oversupplied locations. It is expected to create better conditions for operators to understand regional demand and supply gaps and get access to EU-wide benchmarking on capacity utilisation and build-out. In addition, one harmonised EU reporting would reduce duplication of data reporting at national level. National authorities would benefit from improved infrastructure foresight and visibility of national data centre capacity , with better planning for grid reinforcements and targeting of support schemes. The Commission would ultimately also benefit through reduced duplication of studies, easier cross -DG coordination, and enhanced credibility when engaging with international partners. It would benefit from a cross -border, EU -wide analysis of capacity availability and needs to improve evidence-based policy intervention. Wider economic benefits include improved sector planning, enhanced competitiveness and potentially better environmental outcomes. Sensitivity analysis: Sensitivity analysis has been performed to u nderstand the possible direction of costs, i.e. FTE resources needed by operators, authorities and the Commission to participate in this monitoring exercise. Min and max scenarios vary the central assumptions presented above by approximately ±33%, resultin g in conservative, central and optimistic estimates of total costs. Results: For this measure, total estimated costs for the implementation are modest at EUR 2 266 361. These costs reflect the recurrent adjustment and recurrent administrative costs mainly borne by the Commission staff and national authorities for monitoring activities. Table 27. Set deployment targets and monitor progress (PM7) Cost types Data centre operators (€) Public authorities (€) European Commission (€) Total Value (central, €) Total Value (min, €) Total Value (max, €) one-off administrative - - - - - - recurrent administrative 392 445 - - 392 445 196 222 588 667 one-off adjustment - - 899 421 899 421 858 513 940 328 recurrent adjustment - - - - - - one-off regulatory fees - - - - - - recurrent regulatory fees - - - - - - one-off enforcement. - - - - - - recurrent enforcement - 902 108 72 388 974 496 659 316 1 289 676 Total costs 392 445 902 108 971 809 2 266 361 1 714 051 2 818 671 Total benefits - - - - - - Net impact 392 445 902 108 971 809 2 266 361 1 714 051 2 818 671 3.8. PM8: EU Funding for R&D and innovation ecosystems for cloud and AI Under this measure, the Commission would identify key R&D funding challenges for the development of energy and resource efficient and secure data centre technologies, including advanced cooling, renewable energy and storage integration and AI -based optimisation tools. Funding schemes would be used accordingly to develop R&D and innovation ecosystems focused on cloud and AI data centres and innovative software enabling cloud and AI computing services across the European cloud-to-edge continuum. The measure would aim to de-risk and accelerate the uptake of advan ced, sustainable and secure technologies, with a focus on data centre technologies to improve the replicability and scalability of innovative solutions across 79 Member States , especially for smaller providers . The measure assumes that successors to today’s Horizon Europe exists in the next multiannual financial framework and is provided for modelling purposes only, with no pre-emption of future budgetary decisions. The time horizon considered is seven years, with Work Programmes designed every two years. The scope covers activities at technology readiness levels four to eight, ranging from laboratory -scale research through piloting and demonstration, and includes sustainable cooling and energy solutions, reuse of waste heat and AI-enabled operations. Impact on data centre deployment acceleration. The baseline capacity growth presents a 12% CAGR in data centre capacity (2025-2036). Under this option, it is assumed that the capacity growth rate increases to 13%. The scope of this measure covers CSPs and operato rs active in new data centre builds in the EU, while impacts scale with the share of new projects receiving funding. See Section 2.3 for further det ails. It is assumed that the share of new projects benefitting from PO1 -C increases from 10% in 2026 to 50% by 2036 (see also sensitivity section). Administrative costs for data centre operators. Shall they wish to apply for this type of funding businesses would face administrative one -off costs include proposal preparation and consortium coordination. These costs (e.g. for p reparing applications, providing supporting documentation and fulfilling reporting obligations) have been estimated at 0.2 FTEs, or 45 days during the first year for consortium building and design of governance structures . It has been assumed that 20 proposals would be prepared every 2 years. These are estimated as the staff time spent on the application multiplied by the relevant labour costs. One- off administrative costs year t = ΔT × labour cost × No. of applications/proposals Total one-off administrative costs for data centre operators under PM8 are thus estimated at EUR 1.1 m (NPV, 10-years). Operators may also face incremental costs to meet eligibility requirements. Benefits for Data Centre Operators . Operators would benefit from direct financial support, which is expected to reduce their return on investments for cloud and AI projects. These subsidy amounts are considered benefits for operators and corresponding costs for the Commission for transparency, but they do not contribute to the direct impact assessment as they constitute fiscal transfers. Savings are calculated as the amount of reimbursable financing provided to the eligible final recipients. Currently, Horizon Europe Research and Innovation Action (RIA) applies a 100% funding rate while the Digital Europe Programme funding rate is 50% for simple action grants and 75% for the SME Support Actions. Adjustment costs for the European Commission. The Commission bears responsibility for the management of calls, development of templates and reporting tools, and the evaluati on and synthesis of projects. The main cost would be one -off programme design and administration, i.e. work programme preparation, call management, evaluation, grant management preparation, monitoring and results dissemination. This has been estimated as 3 FTEs during the first year of the programme and recurring every two years for Work Programme design. Recurrent costs then arise in relation to managing the funding scheme and have been estimated as 1 FTEs. The assumed portfolio consists of one call every two years funding approximately 10 projects. Total adjustment costs = (one-off adjustment costs + recurrent adjustment costs) = [(ΔT × labour cost) year 1,3,5 + (ΔT × labour cost) year 2,4,6,7] 80 Total adjustment costs for the European Commission under PM8 are thus estimated at EUR 1.1 m (NPV, 10-years). There could be an impact for those MS that decide to contribute to the funding programme with national funds in line with applicable State aid rules. As this would depend on the size of this contribution, it has not been modelled under this policy measure. Indirect savings: the main indirect impact, which is hard to quantify, is the value generated in terms of making current product and services more efficient and competitive and of generating new products and services. The EC estimated that every Euro invested in Horizon Europe generates 11 EUR in economic value (GDP gains by 2045), i.e. “For every euro of costs to EU society, the programme is expected to generate up to six euros in benef its for EU citizens by 2045. In terms of economic growth, every euro of EU contribution is estimated to generate up to €11 in GDP gains by 2045, according to an evaluation of the Commission released today..." (April 2025)50. The impact of Horizon Europe is directly reflected in the success of funding various research and innovation projects, in January 2025 for example, more than 15,000 projects in fields such as electric vehicles, new antibiotics, and accessible AI technologies benefitted from the programm e51. A last element has also made Horizon Europe particularly beneficial to European innovation and research savings, with lump sum grants being estimated to reduce beneficiaries’ administrative costs from 14% up to 30% over projects’ lifetime52 with the e limination of financial reporting requirements being of paramount importance in stimulating industry participation of SMEs and newcomers. Sensitivity analysis: Sensitivity analysis was considered for the total costs for the Commission in administering the scheme, i.e. the effort required to set-it up and manage it in terms of FTEs, also to consider the uncertainty related to the overall magnitude of the scheme. Results: The table below presents the aggregated costs for all stakeholders for the implementation of this measure. Total adjustment costs for the European Commission are estimated at EUR 1.09 m. The minimum and maximum ranges are driven by variations in the effort levels required to operate the scheme by and the magnitude of staff days involved. Fiscal transfers have no net effect when aggregated across stakeholders , i.e. financial benefits for operators are mirrored by equivalent fiscal costs for the Commission. Administrative costs for operators participating in the scheme are also illustrated in the table below and vary based on the uncertainty with respect to the number of applications and days dedicated to the preparation of the proposal/application. Table 28. EU Funding for R&D and innovation ecosystems for cloud and AI (PM8) Cost types Data centre operators (€) Public authorities (€) European Commission (€) Total Value (central, €) Total Value (min, €) Total Value (max, €) one-off administrative 1 090 375 - - 1 090 375 678 455 1 599 216 recurrent administrative - - - - - - one-off adjustment - - 694 870 694 870 463 247 926 493 recurrent adjustment - - 440 093 440 093 293 395 586 790 one-off regulatory fees - - - - - - recurrent regulatory fees - - - - - - one-off enforcement. - - - - - - 50 See: IP_25_1115_EN.pdf 51 ibid. 52 ibid. 81 recurrent enforcement - - - - - - Total costs 1 090 375 - 1 134 963 2 225 337 1 435 097 3 112 500 Total benefits - - - - - - Net impact 1 090 375 - 1 134 963 2 225 337 1 435 097 3 112 500 3.9. PM9: EU deployment funding for strategic projects Under this policy measure, without prejudice to the outcome of the negotiations on the next MFF proposal, the Commission would provide financial incentives specifically for data centre projects of European strategic interest and importance according to EU-level eligibility criteria. The measure assumes is provided for modelling purposes only, with no pre -emption of future budgetary decisions. Under this policy option, the EU would act as a market -enabler through financial incentives that de -risk infrastructure investment. By absorbing early capital expenditures (CAPEX) risk in data centre deployment, these investments would incentivise private investments where private return of investment is uncertain. This measure is designed to accelerate the roll -out of secure, sustainable, and cross -border digital services across the Union, while reinforcing European strategic autonomy. Impact on data centre deployment acceleration. The baseline capacity growth presents a 11% CAGR in data centre capacity (202 5-2036). Under this option, it is assumed that the capacity growth rate increases to 14% over the same period. This uplift reflects the assumption tha t public funding lowers barriers to investment, reduces financing costs for enterprises and accelerates the timing of large-scale deployment projects. Over time, CSPs and operators build more facilities than in the baseline and benefit from public support on a rising share of those builds. The scope of this measure covers CSPs and operators active in new data centre builds in the EU, while impacts scale with the share of new projects receiving funding. Administrative costs for Data Centre Operators. Even though participating in the funding scheme would be voluntary, it would create administrative costs through financing obligations and administrative compliance requirements. This would include proposal preparation and consortium coordination. Operators would need to prepare proposals and adapt processes to meet eligibility requirements. These would translate into one-off administrative costs incurred every two years in line with the funding cycle. It has been assumed that operators would prepare around 15 proposals per cycle, each requiring staff days (approximately 45 days) of work on average53. The average size of consortia has been considered of 2-4 partners per project. One-off administrative costs year t = ΔT × labour cost × No. of applications/proposals Total administrative costs for data centre operators under PM9 are thus estimated at EUR 0. 8 m (NPV, 10-years). Operators may also face incremental costs to meet eligibility requirements. Benefits for Data Centre Operators. As described above, operators would benefit from direct financial support, which is expected to reduce their return on investments for data centre projects. These subsidy amounts are acknowledged as direct benefits for operators and corresponding costs for the Commission, but they do not contribute to the direct impact assessment as they constitute fiscal transfers. 53 In this report, based on a survey, it was estimated that lump sum proposals required 50 days effort from ideation to submission in H2020 (https://ec.europa.eu/info/funding-tenders/opportunities/docs/2021-2027/horizon/other/comm/ls-assessment-report- 2024_en.pdf). 82 Adjustment costs for the European Commission. The Commission bears responsibility for the management of calls, development of templates and re porting tools, and the evaluation of projects. The main adjustment cost would be one -off programme design and administration, i.e. work programme preparation, call management, evaluation, grant management preparation, monitoring and results dissemination. Aligned with the estimations above, this has been estimated as 3 FTEs during the first year of the programme and recurring every two years for Work Programme design. Recurrent costs then arise in relation to managing the funding scheme and have been estimated as 1 FTEs. The assumed portfolio consists of one call every two years funding approximately 5 projects. Total adjustment costs = (one-off adjustment costs + recurrent adjustment costs) = [(ΔT × labour cost) year 1,3,5 + (ΔT × labour cost) year 2,4,6,7] Total adjustment costs for the European Commission under PM9 are thus estimated at EUR 1.1 m (NPV, 10-years). There could be an impact for those MS that decide to contribute to the funding programme with national funds in line with applicable State aid rules. As this would depend on the size of this contribution, it has not been modelled under this policy measure. Indirect savings: the main indirect impact stems from the value generated in terms of making current product and services more competitive and from generating new products and services. Sensitivity analysis: Sensitivity analysis was considered for the total administrative costs for the Commission in administering the scheme, i.e. the effort required to set-it up and manage it in terms of FTEs, also to consider the uncertainty related to the overall magnitude of the scheme. Results: The table below presents the aggregated costs for all stakeholders for the implementation of this measure. Total adjustment costs for the European Commission are estimated at EUR 1.1 m. The minimum and maximum ranges are driven by variations in the effort levels required to operate the scheme by and the magnitude of staff days involved. Fiscal transfers have no net effect when aggregated across stakeholders, i.e. financial benefits for operators are mirrored by equivalent fiscal costs for the Commission. Administrative costs (EUR 0.79 m) for operators participating in the scheme are also illustrated in the table below and vary based on the uncertainty with respect to the number of applications and days dedicated to proposal/application preparation. Table 29. EU deployment funding for strategic projects (PM9) Cost types Data centre operators (€) Public authorities (€) European Commission (€) Total Value (central, €) Total Value (min, €) Total Value (max, €) one-off administrative 792 583 - - 792 583 446 840 1 235 249 recurrent administrative - - - - - - one-off adjustment - - 694 870 694 870 463 247 926 493 recurrent adjustment - - 440 093 440 093 293 395 586 790 one-off regulatory fees - - - - - - recurrent regulatory fees - - - - - - one-off enforcement. - - - - - - recurrent enforcement - - - - - - Total costs 792 583 - 1 134 963 1 927 546 1 203 482 2 748 533 Total benefits - - - - - - 83 Net impact 792 583 - 1 134 963 1 927 546 1 203 482 2 748 533 3.10. PM10: EU-level identification of areas for fast-track data centre deployment Under this measure, the Commission would directly designate areas to fast-track permitting for data centre deployment based on EU-level criteria (e.g. on connectivity, energy, water) and in consultation with Member States experts, allowing for the pre-selection of strategic sites where permitting procedures will be streamlined. Consultation with a newly created EU Data Centre Acceleration Board consisting of Member State experts would be required for the identification and greenlighting of such areas. Permit granting for data centre projects would follow EU-wide rules and require approval from the Board. For these areas, Member States would be required to enact a set of acceleration measures prescribed at EU level. Impact on Datace ntre data centre deployment acceleration. Under this option, it is assumed that the capacity growth rate increases to 1 4%. This uplift reflects the expectation that faster and more predictable processes with lower entry barriers, reduce time -to-market and improve investor certainty, thereby stimulating additional deployment compared to the baseline trend. It is assumed that the share of new projects benefitting from this policy measure increases from 5% in 2027 to 50% by 2036. Administrative and adjustment costs for data centre operators. As above, if operators choose to build in these areas to benefit from accelerated permitting, they must comply with the attached conditions, which give rise to both administrative and adjustment costs. Costs are assessed following the Standard Cost Model, focusing on the information obligations and activities required for operators to access fast-track areas. Reading EU-level guidance, adapting internal procedures and staff would entail one -off costs fo r each operator. To access areas, operators must familiarise themselves with EU-level criteria. As above, this is estimated as an effort of additional 20 days (sensitivity range 25-15) per operator, which is multiplied by the share of the operators applying for the areas across the EU. This is assumed to be 50% (central value; 30%-70% for sensitivity) of the companies identified as building data centres in the EU. One-off adjustment costs year t = ΔT × labour cost × No. of applications Operators are also expected to face one -off adjustment costs i n adapting workflows and templates to comply with area-specific requirements and accelerated permitting timelines. Adapting workflows/operations to comply with requirements has been estimated to cost each operator additional 40 staff days (30-60 days) to modify the project. This would be multiplied by a share of the projects benefitting from the areas across the EU (50% by 2036 as the central scenario; 30%-70% for sensitivity). As outlined above, CAPEX investments are not considered as part of the adjustment costs as only projects that already comply, or are willing to comply, with the EED and other relevant requirements under the baseline scenario would be eligible to apply for the fast-track areas. As a result, no additional CAPEX beyond what is already required under existing legislation is expected to arise specifically from participation in the areas. One-off adjustment costs = ΔT × labour cost × s × No. new facilities After this initial set-up, recurring costs per project to demonstrate eligibility are expected not to be incremental with respect to the baseline and are thus not represented. Total costs for data centre operators under PM10 are thus estimated at EUR 11.9 m (NPV, 10- years). 84 Direct economic benefits for data centre operators. This measure aims to provide additional benefits by reducing uncertainty over where investments can be facilitated, similarly to PM5 but at Eur opean scale. With fast -track areas, operators should be able to avoid much of the wasted effort on non-viable sites. These changes are expected to reduce the number of iterations required and shorten internal and external time commitments. These savings are modelled using NPV, reflecting a time saving from end -procurement to deployment of 3 months in total (2-4 months for sensitivity ranges). This is assumed because, while this measure is wider than the measure on the fast-track zoning at MS level, the feedback received during consultations with industry highlighted that a top -level identification would be less effective as it would not be able to account in the same way, of geographical and local specificities. As above, to capture these direct economic be nefits, the analysis applies a NPV approach to compare the baseline with the accelerated scenario and measure the economic value of bringing construction and commercial operations forward, discounted at the project WACC. The strong NPV gain is also very sensitive to the strong reduction in PUE foreseen under this measure, as data centres would also be able to benefit from dedicated R&D to optimised energy efficiency and increase their sustainability. E xpected improvements in energy efficiency, modelled as a declining PUE, greatly contribute to reducing operating costs over time. The NPV increase from EUR 58 million to EUR 7 2 million reflects the combined impact of accelerated commissioning and improved operational and energy performance, which contribute to the economic benefit of permitting simplification. The business benefit is measured as the difference in net present val ue (NPV) between an accelerated -permitting scenario and a baseline scenario, discounted at project WACC (6%): Economic benefit t = (ΔNPV = 𝑁𝑃𝑉𝑃𝑀10 − 𝑁𝑃𝑉𝑏𝑎𝑠𝑒𝑙𝑖𝑛𝑒)× s × No. new facilities Where each NPV is computed over a 10 -year horizon and i ncludes all cash flows: CAPEX outflows during construction, OPEX, Revenues. The analysis has been carried out in nominal terms, with both costs and revenues indexed over time and discounted using a nominal WACC. NPV baseline (EUR m) 58.32 Cost savings per project (EUR m) Timeline reduction of 3 months NPV after PM implementation (EUR m) 72.08 13.76 24% Total direct economic benefits for data centre operators under PM10 are thus estimated at EUR 8.1 bn (NPV, 10-years). Adjustment and administrative costs for national public authorities. It is assumed that each Member State would need to set up processes and align national practices with these new rules to provide data to the Commission. This has been estimated as a one -off adjustment cost equivalent to 6 FTEs (4-8 for sensitivity) per M ember State as they would need to get familiarised with and onboard the new platform and adopt templates to provide data to the relevant EU entity in charge of identifying suitable areas to fast-track data centre deployment. In addition to this, MS would face one-off administrative costs associated to having to appoint delegates to the management board of the EU Data Centre Acceleration Board. Once the mechanism is operational, authorities would incur recurrent administrative administrative costs to map and upload data on suitable deployment areas onto the EU platform. For this, 3 FTE annually has been assumed. Recurrent adjustment costs are also expected from national authorities’ online participation in the EU Data Centre Acceleration Board . For this, 85 participation is estimated at 3 FTE each year per Member State, covering several meetings annually and additional related work. Total costs for national public authorities under PM10 are thus estimated at EUR 87.3 m (NPV, 10-years). Administrative c ost savings for national public authorities. By using a central EU -based database, Member States avoid repeated ad hoc clarifications with operators on deployment and siting rules for new data centres , thus reducing information obligations and simplifying tasks. On average, savings are estimated at one-third of time saved in terms of staff days, i.e. estimated as 1 FTE (0.5-2.0 for sensitivit y ranges) each year , reducing authorities’ net administrative burden. Savings for authorities would also results from a centralised EU-level structure that reduces duplication in national-level coordination meetings. Total administrative cost savings for national public authorities under PM10 are thus estimated at EUR 12.9 m (NPV, 10-years). Administrative and adjustment costs for the European Commission. The Commission would face one-off adjustment costs to set up the mechanism and the data centre acceler ation board. This has been estimated at 8 FTE during the first year, plus costs for the procurement and development of the supporting digital tool (EUR 2.0 m). Recurrent annual administrative costs are also estimated for the operation of the Board and to map and update the list of suitable fast- track areas for data centre deployment, also estimated at 6 FTEs per year. Adjustment costs in terms of maintenance of the tool (EUR 0.8 m) and a budget for procuring periodic external studies and/or expert meetings (EUR 2 m) are also considered to take place every two years on average. Total costs for the European Commission under PM10 are thus estimated at EUR 16.1 m (NPV, 10-years). Sensitivity analysis: The parameters are very sensitive to the number of benefitting operators and the assumed time reductions. As above, sensitivity analysis focuses on the potential effectiveness of the measure and the associated regulatory costs, with parameters modelled to consider a changing level of effort to comply with the areas requirements, both in terms of administrative and adjustment costs, as well as to understand how time savings influencing NPV calculations and adoption rates impact economic benefits. The reduction in months saved varies between 2 and 4 (central 3 months saving) as well as the share of facilities using the areas by 2036, i.e. considering between 30% and 70% (with a central scenario of 50%). Concerning the costs, the additional time considered for administrative and adjustment costs is also varied to reflect the uncertainty about the intensity of the new procedures. The low scenario combines conservative assumptions on effectiveness (4 months saved, 30% uptake by 2036) with higher costs, while the high scenario does the opposite. Sensitivities were also considered for national public authorities, to reflect the uncertainty related the annual effort for participating in the new processes. This has been varied considering between 15 days (high - effort) and 5 days (low-effort) per year and expected administrative cost savings generated by the mechanism, ranging from 0.5 to 1.5 FTEs saved per year at EU level under the low and high scenarios. The measure is highly sensitive to assumptions on PUE improvements, which significantly influence overall OPEX. In the absence of PUE reductions beyond the baseline scenario, the NPV would fall to EUR 59.82 million, i.e. only around 3% of projected cost savings. This highlights the critical role of PM8 and PM9 in driving more sustainable and energy-efficient data-centre operations. 86 Results: The total costs and benefits for all stakeholders are summarised in the table below. Total costs are estimated between EUR 105.5 m and EUR 131.1 m, including administrative and adjustment costs for establishing and maintaining the EU-level mechanism. Total savings are substantial, ranging from EUR 4. 8 bn to EUR 12.2 bn, reflecting the expected efficiency gains from faster permitting, coordinated siting, and reduced duplication across Member States. The high-low scenarios are largely driven by the NPV calculation which is affected by the number of months which is perceived to be saved in this process. Table 30. EU-level identification of areas for fast-track data centre deployment (PM10) Cost types Data centre operators (€) Public authorities (€) European Commission (€) Total Value (central, €) Total Value (min, €) Total Value (max, €) one-off administrative 1 476 159 - - 1 476 159 830 339 2 767 798 recurrent administrative - 38 698 697 3 822 094 42 520 790 42 520 790 42 520 790 one-off adjustment 10 375 852 9 940 446 2 596 263 22 912 560 13 728 731 37 475 850 recurrent adjustment - 38 698 697 9 682 334 48 381 031 48 381 031 48 381 031 one-off regulatory fees - - - - - - recurrent regulatory fees - - - - - - one-off enforcement. - - - - - - recurrent enforcement - - - - - - Total costs 11 852 011 87 337 840 16 100 690 115 290 541 105 460 892 131 145 470 Total benefits (8 082 059 633) (12 899 566) - (8 094 959 199) (4 769 247 820) (12 245 115 194) Net impact (8 070 207 622) 74 438 274 16 100 690 (7 979 668 658) (4 663 786 928) (12 113 969 724) 3.11. PM11: Creating EU-level harmonized criteria for sovereign cloud and AI computing services Policy Measure 11 (PM11) establishes a harmonised Union-level framework for ‘sovereign’ cloud and AI computing services. AI systems are not concerned by the measure, as they are already subject to the AI Act. Acknowledging that different use cases require varying degrees of ‘sovereignty’, the framework provides for four levels of sovereignty assurance. To be considered ‘sovereign level 1’, a service must meet the following cumulative criteria: (i) the service provider must be established in the Union (meaning the EEA); and (ii) the service must be fully operated from computing infrastructure, personnel and assets located in the Union; and (iii) customer data, including metadata and telemetry data, is in the EU unless the customer explicitly requires otherwise; and (iv) the service provider demonstrates that it complies with state -of-the-art cybersecurity standards; and (v) if technical and operational support is outsourced to third -party providers outside of the Union, necessary measure are put in place to en sure that would not compromise the provider’s operational autonomy; and (vi) there is full transparencey around the use of subcontractors, for which the cloud service provider assesses that they meet Union legal obligations; and (vii) where the cloud service provider is subject to the control of a third country or a third country entity, it must be able to prove that the laws and government practices in that country do not require the provider to tell that country's authorities about software vulnerabilities before those vulnerabilities have been publicly discovered These requirements would allow service providers with a parent company headquartered outside of the Union to be considered as ‘sovereign level 1’. 87 To be considered ‘sovereign level 2’, a service must meet the following cumulative criteria: (i) the service provider and subcontractors must be established in the Union; and (ii) the service must be fully operated from computing infrastructure, personnel and assets located in the Union; and (iii) provide available personnel complying with additional personnel screening and Union citizenship requirements, if the customer determines that i mposing these additional requirements is necessary; and (iv) the service provider must be controlled by a legal entity in the Union. Alternatively, if the service is controlled by a third-country legal entity, it must demonstrate that it has in place the necess ary technical, legal and organisational measures necessary to prevent third -country governmental access and transfer of data stored in the Union, to prevent or refuse any request from a third -country government, ensure that the control of the third -country or third-country entity is not exercised in a manner that restricts the provider’s ability to deliver the service, and to prevent the service disruption and/or degradation of the service by a third - country government54; and (v) the data generated by using the audited service shall not be re-used for the training or fine-tuning of an AI system operated by an entity outside the EEA and in any case are not transferred outside the Union; and (vi) the customer data, including metadata and telemetry data, remain in the U nion unless the customer explicitly requests otherwise; and (vii) the service must demonstrate a high level of cybersecurity by being certified at least at level ‘ substantial’ under the European Cybersecurity Certification Scheme for Cloud Services (EUCS) 55; and (viii) the service provider must demonstrate a high degree of control over the software components that underpins the service. This notably implies that there exists a list of identified dependencies related to the provision of the service, and where the software components are provided by a third-country entity, the relevant code of the security relevant components of the service stack can be audited , and there exists a migration plan in the event a vendor fails or a third -country imposes restrictions; and (ix) if subcontractors are from a third country or a third country entity, appropriate measures in place to demonstrate the absence of control; and (x) operational and technical support, including outsourcing, are initiated and performed exclusively within the Union; and (xi) where the cloud service provider is subject to the control of a third country or a third country entity, it must be able to prove that the laws and government practices in that country do not require the provider to tell that country's authorities abo ut software vulnerabilities before those vulnerabilities have been publicly discovered 54 In the absence of a harmonised framework, non-EU service providers attempting to prevent third -country governmental access and transfer of data stored in the Union and to prevent or refuse any request from a third-country government are using a diverse technical, legal and organisational measures. This include technical architecture with segregated physical infrastructure, ensuring that the encryption keys are not accessible to the provider or are held exclusively by the customer , adding specific clauses in their EU employees’ contract that forbid them from taking instructions from outside of the EU, setting up independent boards to review extra-territorial data access requests, etc. 55 As part of the ‘ One Europe, one market’ roadmap agreed by the Parliament, the Council and the Commission, the co - legislator have agreed to finalise negotiation for this initiative ed by Q4 2027. Adding one year for the measures to take effect, this implies CADA entering into force in early 2029. EUCS technical work is finalized and has been adopted by CEN - CENELEC Technical Specifications. The candidate scheme has therefor e reached an advanced stage of development, which now needs to be transformed into an Implementing Act adopted under the Cybersecurity Act, a process much shorter than CADA’s interinstitutional negotiations. 88 These requirements would allow service providers controlled by a third -country or third- country entity to be considered as ‘sovereign level 2’, but on the basis of some organisational efforts. Service providers owned and controlled by a legal entity in the Union would face less difficulties in complying with these criteria. To be considered ‘sovereign level 3’, a service must meet the following cumulative criteria: (i) the service provider subcontractors must be established in the Union; and (ii) the service must be fully operated from computing infrastructure and assets located in the Union; and (iii) members of the board, executive team and personnel operating the service are Union nationals, located in the Union, and are security cleared where appropriate; and (iv) the service provider must be owned and controlled by a Union legal entity and the subcontractors are not subject to the control of a third country or a third-country entity. A cloud computing service subject to the control of a third country or a legal entity established in a third -country can still be a udited against the audit criteria where the third country has implemented specific safeguards that ensure that there is no risk of unauthorised access to Union data or possible disruption of service quality or continuity; and (v) the data generated by using the audited service shall not be re-used for the training or fine-tuning of an AI system operated by an entity outside the Union and in any case are not transferred outside of the Union, and (vi) the customer data, including metadata and telemetry data, remain i n the Union unless the customer explicitly requests otherwise; and (vii) the service must demonstrate a high level of cybersecurity by being certified at least at level ‘substantial’ under the European Cybersecurity Certification Scheme for Cloud Services (EUCS); and (viii) the service provider must demonstrate a high degree of control over the software components that underpin the service (software stack). This notably implies that there exists a list of identified dependencies related to the provision of the service, and where the software components are provided by a third -country entity, the relevant code of the security relevant components of the service stack can be audited, and there exists a migration plan in the event a vendor fails or a third - country imposes restrictions; and (ix) operational and technical support, including outsourcing, are initiated and performed exclusively within the Union and by Union citizens, and by third parties that are not subject to the control of a third country or third country entity; and (x) where the cloud service provider is subject to the control of a third country or a third country entity, it must be able to prove that the laws and government practices in that country do not require the provider to tell that country's authorities abo ut software vulnerabilities before those vulnerabilities have been publicly discovered These requirements would not allow service providers whose parent company is headquartered outside of the Union to be considered as ‘sovereign level 3’. To be considered ‘sovereign level 4’, a service must meet the following cumulative criteria: (i) the service provider and subcontractors must be established in the Union; and (ii) the service must be fully operated from computing infrastructure and assets located in the Union; and 89 (iii) members of the board, executive team and personnel operating the service are Union nationals, located in the Union, and are security cleared where appropriate; and (iv) the service provider must be owned and controlled by a Union legal entity and the subcontractors involved in the provision of the service are located in the Union and owned and controlled by a Union legal entity; and (v) the data generated by using the audited service shall not be re-used for the training or fine-tuning of an AI system operated by a third-country legal entity and in any case are not transferred outside of the Union; and (vi) the cusomter data, including metadata and telemtry data, remain exclusively in the Union; and (vii) the service must demonstrate a high level of cybersecurity by being certified at least at level ‘ high’ under the European Cybersecurity Certification Scheme for Cloud Services (EUCS); and (viii) the service provider must demo nstrate effective control over the software components that underpin the service (software stack) by demonstrating that a third country or a third country entity does not have excessive control over the software and the software lifecycle. This notably implies that the relevant code of the service stack can be audited and that the effective control of the code exists by a Union legal entity; and (ix) operational and technical support, including outsourcing, are initiated and performed exclusively within the Union and by Union citizens, and by third parties that are not subject to the control of a third country or third country entity; and (x) where the cloud service provider is subject to the control of a third country or a third country entity, it must be able to prove that the laws and government practices in that country do not require the provider to tell that country's authorities about software vulnerabilities before those vulnerabilities have been publicly discovered. These requirements would not allow providers headquartered outside of the Union to be considered as ‘sovereign level 4’. Sovereignty is not only cybersecurity . The criteria above deal solely with sovereignty. Cybersecurity and sovereignty are closely related and are complementary. However, they do not focus on the same aspects nor pursue identical objectives. In this respect, s overeignty goes beyond the technical protection of services . It primarily addresses who exercises control over the data, and under which legal framework this control is exercised. A cloud service can be technically very secure and still be exposed to non-technical risks stemming from the exposure to third country legislation, because it is subject to foreign laws, or because key operations and decision -making are locat ed outside of the EU. In such cases, the residual risk stems from legal obligations rather than from technical vulnerabilities. Hence, non-technical risks related to the potential access of third-country authorities to the data cannot be fully addressed t hrough technology or cybersecurity alone. Both need to be understood and looked at as complementary measures, not mutually exclusive and partially overlapping. Technical cybersecurity and non -technical risks address different threat vectors. Properly designed security architectures, such as customer -controlled encryption, strict role segregation or data access minimisation can technically constrain the practical ability of a third- country authority to access the data, regardless of the provider’s jurisdicti on. In this sense, a technical cybersecurity implementation can serve as a meaningful mitigation strategy of a non- technical risk. 90 Measures that significantly improve sovereignty (e.g. increasing strategic autonomy and resilience, decreasing dependence) may have a limited incremental effect on classical cybersecurity, while they are still justified for regulatory and trust -building reasons. Conversely, some cybersecurity measures such as stronger encryption mechanisms can be implemented without drastic changes to who controls the infrastructure and data or which legal construct governs access, thus resulting in marginal improvements of sovereignty and operational autonomy. Even when a service is exceptionally well protected from a cybersecurity standpoint, a legally binding request from third country authorities may still compel the provider to grant access to the data, which constitutes a residual risk if robust internal processes are not in place. This risk exists independently of the techni cal robustness of the service and the service provider and stems from the provider’s legal obligations rather than from technical vulnerabilities. For this reason, the way a service provider constructs its whole architecture becomes crucial and typically follows a “cannot comply” paradigm. Under this approach, compliance with external access requests in rendered technically, operationally or legally impossible (see the OVH case in Canada 56). This is achieved through well -defined governance and control mecha nisms, including strict internal processes governing how employees handle access requests, clear delineated roles and responsibilities regarding data access, as well as more organisational measures such as segregation of duties or control over the cryptogr aphic keys (e.g. ensuring that the encryption keys are not accessible to the provider or are held exclusively by the customer). Although these architectures involve additional upfront and operational costs , the majority in personnel , they demonstrably incr ease assurance and trust for customers, as they reduce the scope for a compelled access to data through the provider and strengthen compliance with sovereignty requirements. Organizations already have clear roles and responsibilities and segregation of dut ies defined as part of their policies and procedures addressing technical requirements and hence are not considered in the calculations. Only the additional costs such as the definition of the policies and procedures to protect from the requests of third c ountry legislations with extraterritorial reach and the modification of controls are to be considered in the adjustment costs. Sovereign architectures incorporating measures to address non -technical risks often require separate environments for jurisdiction, stricter network segmentation and redundant infrastructure, thereby increasing the design, integration and maintenance effort compared to a ‘single’ cloud deployment, and introducing new misconfiguration risks. Complying with non - technical requirements on top of cybersecurity obligations adds significant legal and administrative efforts as providers must demonstrate extensive evidence of compliance and rely on specialised expertise to do so. One-off adjustment costs for the EC. In the case of the EC the costs for the definition of the harmonized criteria are not to be accounted for as the definition is set in the Act. However, one off adjustment costs to update the definition are accounted for with 0.5 FTE in 2032. One-off adjustment costs for national public authorities . In the case of National Public Authorities, one-off adjustment costs relate to the adaptation of the ir procurement templates based on the harmonized criteria provided by the act. As in the case of the Commission, effort has been estimated for both the initial changes and for the ones needed to be done after the 56 https://www.heise.de/en/news/Canadian-Court-OVHcloud-from-France-must-hand-over-user-data-11092029.html 91 revision of the harmonized criteria. In the f irst case, 3 days have been estimated whereas 1.5 days have been considered for the second activity. These values are per Public Administration publishing public procurement of cloud and AI computing services and deciding to voluntarily use the harmonized criteria for sovereignty. Therefore, the formula for the total one -off adjustment costs must be computed as: One-off adjustment costs (National Public Authorities) = time needed to adapt the procurement templates * labour costs * number of procuring authorities using the criteria Recurrent savings for national public authorities could result from having a clear harmonized criteria for sovereignty. These are considered negligeable. One-off adjustment costs in cloud and AI computing service providers. The effort to adhere and align with the criteria for sovereignty only applies when the se are linked to an official document specifying the request to comply with the criteria for sovereign services for a specific procedure. Negligeable administrative costs for cloud and AI operators is assumed since voluntary in nature. This has been contrasted with stakeholders as part of the study led by Technopolis group. Recurrent savings in cloud and AI computing service providers. No recurrent savings are assumed. Indirect savings: The availability of harmonized criteria would create some certainty on what is considered sovereign, avoiding different interpretations. Through this measure, organisations able to adjust their processes to adhere to the criteria will increase trust from cloud consumers and potentially resulting in larger market revenues for EU providers due to market credibility. Sensitivity analysis: The data presented above is sensitive notably to the number of procuring authorities under consideration. This has been set between a minimum of 50% and a maximum of 100%. The average value is set to 75% of public authorities. Another important aspect is the estimation of the percentage of procurement procedures that will voluntarily request the alignment with the harmonized criteria for sovereignty. Results for all stakeholders aggregated and for the years covered by this measure are summarised in the table below. The results point towards low total costs for National Public Authorities and negligeable co sts for cloud and AI computing service provider s. The total estimated costs for the implementation of this measure are EUR 336 077 over the entire period. These costs entirely stem from one -off adjustment costs. The main driver in the min and max values is the number of countries that adopt the EU-level definition for their procurements. Table 31. Creating an EU-level harmonized criteria for sovereign cloud and AI computing services (PM11) Cost types Cloud & AI providers (€) Public authorities (€) European Commission (€) Total Value (central, €) Total Value (min, €) Total Value (max, €) one-off administrative - - - - - - recurrent administrative - - - - - - one-off adjustment - 336 077 - 336 077 224 051 448 289 recurrent adjustment - - - - - - one-off regulatory fees - - - - - - recurrent regulatory fees - - - - - - one-off enforcement. - - - - - - recurrent enforcement - - - - - - 92 Total costs - 336 077 - 336 077 224 051 448 289 Total benefits - - - - - - Net impact - 336 077 - 336 077 224 051 448 289 3.12. PM12: Creating EU guidelines for sovereign Cloud AI computing services for public procurement The assumptions detailed for PM11 remain valid for PM12, with the following additions : Whereas PM11 only considers the criteria of what constitutes a sovereign cloud and AI computing service, PM12 adds detailed guidelines developed by the Commission over PM11’s criteria to ensure that service providers interpret the m in a similar manner. Wh ile the Commission is the sole responsible for the drafting of the guidelines, these would be consulted with representatives of national public authorities and service providers. One-off adjustment costs for the European Commission stems from the developme nt and adoption of the EU guidelines for sovereign cloud and AI computing services. Guidelines entail detailed explanations and interpretations and therefore the effort estimated to draft and adopt them is 2 FTEs over 1 year. One-off adjustment costs for national public authorities include the following items: firstly the participation of Member States’ authorities in the discussions to draft the guidelines in collaboration with the European Commission and the cloud and AI computing service providers and secondly, the adaptation and updates of the bid templates as well as the institutionalisation of certain elements so that the guidelines can be applied uniformly across the public sector. The participation in the discussions for the guidelines has been estimated to 27.5 days per public authority considering one participant per MS, while for the adaptation of the templates the estimation is 3 days per public authority applying the guidelines, assuming that 904, the majority of pub lic administrations of the procuring authorities adopt them. A sensitivity is introduced as a minimum of 3 days and a maximum of 10 days. One-off adjustment costs (NPA) = labour costs * ((effort in discussions * number of authorities involved in the discussion) + (effort to adapt the guidelines * number of authorities adopting the guidelines) Recurrent savings in national public authorities may stem from a voluntary but systematic application of the adapted templates in the different procurement procedures. The clarity of the criteria could result in a lower number of disputes between procuring public authorities and cloud and AI computing service providers. However, interviews with Public Administrations do not point to savings as a result of guidelines alo ne. As part of the sensitivity a min of zero and a max of 5 days per procured tender is arbitrarily set. Recurrent savings for reusing the harmonized criteria (national public authorities) = estimated effort saved per tender * labour cost * number of yearly public tenders integrating the guidelines One-off adjustment costs for cloud and AI computing service providers. Under this PM, cloud and AI computing service providers will participate in the discussions for the guidelines and the effort estimated for this activity is 20 staff days for 30 cloud and AI computing service providers. The second type of one -off administrative costs is related to the alignment to the sovereignty guidelines. This requires checking the undertakings’ internal organisational and legal 93 procedures. This effort has been estimated in 20 days , and it would apply to all economic operators. Recurrent adjustments costs in cloud and AI computing service providers. Under this measure no adjustments costs for companies to comply with the requirements and modify organisational or legal procedures, set by the guidelines. Recurrent savings in cloud and AI computing services providers result from the systematic application and reuse of the documentation that needs to be handed in for each procurement procedure. cloud and AI computing service providers will be able to re-use a set of documents throughout procurements since these will be aligned with the guidelines. These savings are estimated at 1 day per tender and 10 tenders a year. Recurrent savings (cloud and AI computing service providers) = effort saved per bid * labour costs * number of yearly bids per provider * number of cloud and AI computing service providers aligned to guidelines Indirect savings: Through this measure, organi sations able to adequate their processes to adhere to the harmonized criteria for sovereign services will increase trust from cloud consumers and potentially resulting in larger market revenues for EU providers due to market credibility. Sensitivity analysis: The items used for the sensitivity analysis are 1) the percentage of public administrations using the harmonized criteria for sovereign services in their procurement activities, ranging from 50% to 100%; 2) the number of public administrations procuring cloud services; 3) time needed by public administrations to adopt the procedures as well as to evaluate the bids; 4) the number of cloud and AI computing service providers that can participate in procurement processes, ranging from 244 (min) to 350 (central and max). Results for all stakeholders aggregated and for the years covered by this measure are summarised in the table below. The average scenario is slightly above cost neutral. While the min scenario measure points towards benefits not fully offsetting costs the max scenario points towards net benefits. The main source of difference between the min and max is caused in the cost savings category and how many national public authorities integrate the guidelines to their tenders and cloud and AI computing service providers adopt the guidelines. Table 32. Creating EU guidelines for sovereign cloud and AI computing services for public procurement (PM12) Cost types Cloud & AI providers (€) Public authorities (€) European Commission (€) Total Value (central, €) Total Value (min, €) Total Value (max, €) one-off administrative - - - - - - recurrent administrative - - - - - - one-off adjustment 2 975 585 1 252 254 168 538 4 396 376 2 562 268 7 021 802 recurrent adjustment - - - - - - one-off regulatory fees - - - - - - recurrent regulatory fees - - - - - - one-off enforcement. - - - - - - recurrent enforcement - - - - - - Total costs 2 975 585 1 252 254 168 538 4 396 376 2 562 268 7 021 802 Total benefits (6 693 922) (5 693 922) (1 897 974) (16 358 845) Net impact (2 718 336) 1 252 254 168 538 (1 297 545) 664 294 (9 337 043) 94 3.13. PM13: Annual conference on digital sovereignty This policy measure aims at creating awareness and foster discussions on digital sovereignty, sharing latest developments, best practices and solutions among different stakeholders such as policymakers, cloud and AI computing service providers, researchers, or financial institutions. It answers the call made by several cloud and AI computing service providers to gain visibility through political exposure. The event will be organised on a yearly basis and is expected to last for a week in a venue outside of the European Commission. The target number of attendees is 300 people from the private sector, 3 representatives from each member state national public administration and 100 representatives from the EUIBAs, whose costs are for modelling purposes assigned to those of the Commission. Recurrent adjustment costs for the European Commission, which result from the organisation and attendance to the conference. EUR 35 000 per day, are estimated for subcontracting costs covering organisation, logistics and operational activities. This includes venue rental, communication with panellists, registration and admission process, badges and catering. For the organisation, it is estimated that 50 staff days will be needed every year by the Commission to oversee the activities carried out by the subcontractor. It is assumed that 5 officials from the Commission will attend all 5 days and require additional 2.5 days for the preparation of their participation in panels, keynotes or discussions. Travel costs are also considered. Recurrent adjustment costs for national public authorities . 3 representatives per Member State will attend and participate with an estimated effort of five days attending the event and 0.5 to 2.5 days for the preparation of their par ticipation in panels, workshops or discussions. Travel costs of EUR 700 per participant are considered. Recurrent adjustment costs (NPA) = MS 57 * Number of participants (PA) * (labour cost * (number of days attending the conference + number of days preparing the workshop) + travel costs per participant) Recurrent savings in National Public Authorities. Public authorities will potentially achieve savings staff from a reduction in the effort on bilateral exchanges with other stakeholders. However, given the limited scale of this effect this has not been monetised. Recurrent adjustment costs for cloud and AI computing service providers (and other stakeholders). An effort between 5.5 and 7.5 days for the participation and preparation of the event are considered for each of the 300 participants from private sector companies and other stakeholders. Additionally, travel costs are included. Recurrent adjustment costs (CASP) = Number of cloud and AI computing service providers participating * ((number of days for the preparation and attendance * labour cost) + travel costs) Recurrent savings in cloud and AI computing service providers (and other stakeholders). Event participants may save staff days from a reduction in the effort on bilateral exchanges . Given the limited scale of this effect this has not been monetised. Indirect savings: 57 MS unless stated otherwise is MS = 27 95 • For cloud and AI computing service providers, faster and better understanding of the technologies and techniques to be secured and sovereign, hence delivering services into the market that are perceived as more trustworthy and more up to date in terms of the use of for instance dep endency analysis tooling, ultimately leading to an increase in market sales. • For national public administrations: a clearer perception of what are the main risks associated with the use of non -sovereign solutions, potentially reducing research on attack and threat vectors, and ultimately resulting in an improved business continuity of the digital services offered. Sensitivity analysis: The impact of this policy measure depends on the number of events and participants, but a sensitivity analysis is not relevant given the size of the impact. Results for all stakeholders aggregated and for the years covered by this measure are summarised in the table below. Low costs are assumed for all stakeholders modelled. Savings are negligeable and hence not monetised. Table 33. Annual conference on digital sovereignty (PM13) Cost types Cloud & AI providers (€) Public authorities (€) European Commission (€) Total Value (central, €) Total Value (min, €) Total Value (max, €) one-off administrative - - - - - - recurrent administrative - 1 972 376 - 1 972 376 1 972 376 1 972 376 one-off adjustment - - - - - - recurrent adjustment 12 099 496 - 4 594 816 16 694 311 16 694 311 16 694 311 one-off regulatory fees - - - - - - recurrent regulatory fees - - - - - - one-off enforcement. - - - - - - recurrent enforcement - - - - - - Total costs 12 099 496 1 972 376 4 594 816 18 666 687 18 666 687 18 666 687 Total benefits - - - - - - Net impact 12 099 496 1 972 376 4 594 816 18 666 687 18 666 687 18 666 687 3.14. PM14: Interoperability flanking measures Under this policy measure , the goal is to prioritise the support and development of new harmonised standards under the Data Act in order to cover existing gaps and foster interoperability among cloud services. This policy measures therefore focuses on three aspects. Firstly, a contract for supporting the Commission in continue analysing the gaps in standardisation, notably in PaaS and SaaS and creating awareness of this lack of harmonised standards. Secondly, on the creation and monitoring of coordination groups steered by the Commission with MS and industrial players for potential recommendations on the prioritisation of standard development. Thirdly, on the development of standards by European Standardisation Organisations (ESO). The conservative approach is that two standards will be developed and adopted yearly. The application of the standards is out of the scope of the current policy measure. One-off adjustment costs for the European Commission are related to the budget reserved for the contract on carrying out the studies (EUR 200 000) as well as for drafting the specifications (0.25 FTE). It also includes an external study on portability of AI models, valued at EUR 200000. 96 One-off adjustment costs = external study + (effort for drafting the specifications * labour costs) + study on portability of AI models One-off administrative costs for the European Commission stem from the setting up of the coordination group, which would hold participants coming from the industry and MS , estimated in 2 FTEs. One-off administrative costs = effort to set up the coordination group * labour costs Recurrent administrative costs for the European Commission include, firstly, the administrative support for the coordination of standards, both in the coordination group and in the ESOs estimated in 2 FTEs. Secondly, it includes the administration of a support action (2% of administrative overheads), funded under an R&D programme, fostering the participation of European stakeholders in ESOs and standardization activities. The budget estima ted for this action is EUR 6 million, within a funding period of 6 years. Recurrent administrative costs = labour costs * (effort estimated to monitor the coordination group + effort to monitor the coordination with standardization organizations + effort for the programme administrations) One-off administrative costs for national public authorities are the result from MS selecting the members that would participate in the coordination group set up. This is estimated in 0.1 FTE. One-off administrative costs (NPAs) = MS * effort to identify members * labour costs Recurrent administrative costs in national public authorities stem from the participation in both the coordination groups and standardisation organisations (0.25 FTE for each activity) on a yearly basis. Since ESOs offer the possibility to participate online in the meetings this has been the option considered, and travel costs neglected. Recurrent administrative costs (NPAs) = MS * (effort to participate in ESOs + effort to participate in coordination groups) * labour costs One-off adjustment costs for cloud and AI computing service providers are also related to the setting up of the coordination group, estimated in 0.1 FTE. One-off administrative (CASP) = number of participants * (effort to set up the coordination group * labour cost). Recurrent administrative costs for cloud and AI computing service providers are related to the participation of the providers both in the coordination groups and ESOs estimated respectively in 0.25 FTE and 1 FTE respectively. Whereas the meetings for the coordination groups are to be more opportunistic, the meetings on ESOs occur on a regular basis58. Recurrent administrative costs (CASP) = number of participants * ((effort to participate in the coordination groups + effort to participate in the ESOs) * labour cost) Recurrent administrative costs for European Sta ndardisation organisations occur by supporting the creation, development and publication of standards, as well as by the 58 Depending on the ESO the meetings of the Joint Technical Committees or Technical Committees are scheduled on a monthly basis. 97 coordination with the European Commission and the key stakeholders such as the rapporteurs. This effort is estimated in 1 FTE. This stakeholder category is not accounted for the in the CBA. Indirect savings: For cloud and AI computing service providers, having clear interoperability standards facilitates EU players the entry into established markets, lowers transaction and integration costs and simplifies the management of a multi -cloud / multi -vendor ecosystem. Finally, it also provides enhanced trust, credibility, transparency and auditability. Sensitivity analysis: For this policy measure no sensitivity analysis has been considered, given that only the development of standards is considered while the enforcement and compliance by cloud and AI computing service providers are out of scope. Results for all stakeholders aggregated and for the years covered by this measure are summarised in the table below. Low costs are assumed for all stakeholders modelled. Savings are negligeable and hence not monetised. Sensitivity analysis does not apply. Table 34. Measures to effective interoperability of cloud and AI computing services (PM14) Cost types Cloud & AI providers (€) Public authorities (€) SDOs (€) European Commission (€) Total Value (central, €) Total Value (min, €) Total Value (max, €) one-off administrative 11 205 170 644 - 168 538 350 387 350 387 350 387 recurrent administrative 2 134 177 10 917 230 1 437 660 1 546 004 16 035 070 16 035 070 16 035 070 one-off adjustment - - - 368 538 368 538 368 538 368 538 recurrent adjustment - - - - - - - one-off regulatory fees - - - - - - - recurrent regulatory fees - - - - - - - one-off enforcement. - - - - - - - recurrent enforcement - - - - - - - Total costs 2 145 381 11 087 874 1 437 660 2 083 079 16 753 994 16 753 994 16 753 994 Total benefits - - - - - - - Net impact 2 145 381 11 087 874 1 437 660 2 083 079 16 753 994 16 753 994 16 753 994 3.15. PM15: Voluntary sovereign risk assessments for the use of cloud and AI computing services in the public sector Policy Measure 15 (PM15) would recommend Member States to carry at least one sovereignty risk assessment and repeat it at least every four years or more frequently if deemed necessary. The purpose of the sovereignty risk assessment is to identify which public sector use cases within a Member State require the use of which sovereignty level as described under PM11. The sovereignty risk assessment would assess, inter alia, the risks induced by the access to such data by a third -country authority or third -country legal entity; or the risk of possible service disruption due to dependence on a single or limited number of third -country services providers. On the basis of dedicated discussions conducted with 3 different public authorities representing about 200 NIS 2 Annex 1 contracting authorities operating at regional, national and European level (out of an estimate of 6 400 NIS2 entities across the EU),, this assessment assumes that the matching of sovereignty levels to public sector demand follows the following pattern: 70% of use cases would require a sovereignty level 1; 20% for level 2; 9% for level 3; and 1% for level 4. Even though the sch eme is novel and does not correspond to existing frameworks, this assessment fits with broad orders of magnitude that can be inferred from 98 existing analyses conducted in several Member States that have introduced risk assessments for their public sector clouds, such as France, Poland59 or Italy60. Critical use cases, defined as the use cases whose disruption would affect operational autonomy or public order, correspond to use cases covered by level 2, 3 and 4. The risk assessment would have to consider th e reality of the supply market to avoid unrealistic outcomes, such as mandating the use of services that don’t exist (yet) in the market. To facilitate appropriate and coherent sovereignty risk assessments, the European Commission would develop guidelines for Member States to conduct such assessments and provide a sample risk assessment methodology (note that these guidelines concern the conduct of risk assessments and differ from PM12, which consist in explaining the different levels of sovereignty). For Member States to have up -to-date information about the market conditions of cloud and AI sovereign solutions, the Commission would also produce market monitoring reports that will point Member States to possible gaps in the coverage of some services. The Member State would be recommended to reflect the outcome of the risk assessment in applicable public tenders. While PM11 only puts forward the definition of sovereignty levels, PM15 goes further by putting forward a framework through which the respective levels of sovereignty can be assessed. Cloud service providers shall submit the relevant evidence that demonstrate that they comply with the sovereignty assurance criteria to the designated competent authority . For assurance level 1, the service provider will submit the competent authority the ir self-assessment report for the service. Cloud computing service providers qualifying as SMEs will not be required to undergo the validation by the national competent authority. Verifying the compliance of the service against sovereignty level 2 -3-4 would be done through third party’s auditors . In this case, the service provider will submit the audit report and the ‘positive’ audit op inion to the competent authority of the country of establishment who shall verify them, along with the submitted evidence, without undue delay. The result of this activity is an acceptance or rejection of the audit report and opinion. If a cloud service provider wants to participate in p ublic procurement procedures across the Union, the validating Member State shall notify the other Member States for a review of 60 days. During the period of review there is a recourse possibility for the Member States. If no reasoned objection has been submitted in the framed period the validation of the audit report and audit opinion shall be considered accepted by all Member States and t he service recognized across the Union. If continued objections are raised, the Commission shall adopt a binding opinion. The competent authorities should register the decision in a Union repository, maintained by the Commission.The repository of sovereign cloud and AI computing services will be a public list of audited sovereign cloud and AI computing services that verifiably comply with the sovereignty requirements. The benefits are for providers and users alike: providers will enhance their visibility and users their market research. 59 See Cloud in Government Services 60 See Strategia Cloud Italia 99 To cater for market evolutions, the sovereignty criteria of all levels and evaluation evidence proposed, but not limited to, would be modifiable by comitology. This evaluation evidence would help third party auditors in their assessment of the service and ensure full harmonisation in the way different auditors conduct their assessment and for Member States to ensure that the procedures have been followed. The assessment would be peridoically renewable following the same evaluation methodology. Policy measure 15 then implies that the Commission sets up and maintains a repository of the services audited against level 2-3-4. Finally, policy measure 15 implies the actual transfer cost for public authorities to change from a non-sovereign service to a sovereign service (cloud porting). This measure is primarily designed to contribute to the protection of public order by enhancing the resilience in the public sector, which is SO4. Nevertheless, European providers would face less costs and efforts to meet sovereignty conditions. When it comes to meeting the criteria to demonstrate sovereignty level 1 and 2, EU providers can more readily substantiate that they are not affected by third -country policies affecting data access or limiting service continuity. As well, level 3 and level 4 sovereignty can only be served by service providers owned and controlled by EU entities. This implies that PM15 will also contribute to decreasing the overall reliance on non-European cloud and AI computing services, which is SO3. One-off adjustment costs for the European Commission Setting up and maintaining the repository of sovereign cloud and AI computing services. These costs include the drafting of the tender specifications for an external provider to build, develop and maintain the repository plus additional time for the evaluation and the definition of their governance procedures. This has been estimated to 120 s taff days. The repository will be developed by an external contractor with a contract value of EUR 500 000. One-off adjustment costs (EC) = time to draft tender specifications for the repository * labour costs + external contract to develop the repository Guidelines for MS to perform the sovereignty risk assessments. In order to support Member States in the implementation of their sovereignty risk assessments, the Commission will publish guidelines. These guidelines would include the process to carry out t he risk assessment, the criteria that would allow them to identify the scope, for instance by means of use cases and / or applications, the data classification process, where the market surveillance or information on sovereign services can be found. The es timated effort for the development and publication of these guidelines is 2 FTEs over 1 year. Recurrent adjustment costs for the European Commission Maintenance of the repository for audited services. Another important activity is related to the maintenance of the repository of audited services and related activities, including: • Yearly hosting costs of the repository, estimated to be of EUR 200 000. The repository will be deployed on a sovereign cloud at the Commissions’ premisses and telemetry and FinOps procedures will be put in place to control expenses. 100 • Yearly maintenance of the repository, performed by an external contractor, includes the upgrades of the software libraries amidst identified vulnerabilities, correction of errors and bugs and additional features. The estimated effort assumed for this is 2 staff days on a weekly basis. • Oversight of the repository, including the follow -up of the contractors’ activities, estimated in 2 staff days per month. Recurrent adjustment costs (EC) = costs of the yearly hosting + external contract for the yearly maintenance of the repository + (number of days for the oversight of the repository * labour costs) One-off adjustment costs for public authorities. Conduct the risk assessments. National public authorities and regional or federal authorities in the case of decentralized Member States shall perform at one sovereignty risk assessment, with the aim of mapping sovereignty assurance levels to cloud and AI computing services used in the public sector, taking into consideration aspects such as sensitivity and criticality of the data processed, the risks associated to the potential unlawful access to data by third country legislation, potential disruption of the services, and the existence of computing services audited under that sovereignty level, among others. The estimated number of authorities is 267, considering the NUTS-0 and NUTS -1 distribution. Given that it is a voluntary measure, it is considered that the uptake will be only by in 25% of the authorities, that is, 67. The output of this risk assessment will be a classification of applications or use cases categories mapped to the minimum sovereignty assurance level permitted for the procur ement of cloud and AI services serving those cases. The estimated effort for this sovereignty risk assessment is of 10 FTEs. This is a new activity for which there is yet few expertise in the Member States. It is considered that in the initial iteration, Member States will need to understand well the sectors, applications and type of data, among other aspects, that will drive their risk analysis to decide one sovereignty assurance level or another. It is expected that initially this will be an activity enc ompassing various ministries and agencies and therefore an intensive collaboration is expected. The guidelines from the Commission, however, should alleviate this effort. The risk assessments will start in 2029, once EUCS and the sovereignty framework is in place. Designation of the competent authority, which has an estimated of 0.2 FTE per MS, which will be responsible to verify the audit reports received from the providers that had their services audited at sovereign level 2 at least. Cloud-to-sovereign-cloud migration costs for the public sector. Detailed information is provided in Annex 12 on the methodology and calculation of the costs for the migration and porting of cloud applications to sovereign cloud services. Due to the voluntary nature of the measure and given that transition to a sovereignty service is recommended and not mandatory, only 25% of the cloudified and the cloudifiable IT systems would be ported or migrated to a sovereign solution. Both the migration of applications from legacy-to-sovereign cloud or from cloud-to-sovereign cloud will be performed in a linear distributed manner in a time frame spanning 5 years, starting in 2029, once there is a set of services audited as sovereign. 101 The average cost of porting a single application to a new cloud varies from EUR 30 000 and EUR 600 000 depending on the size of the application , and not much on the type of cloud at origin or destination, as they are mainly based on human effort (400 to 8000 hours of work). See Annex 12 for a explanation of these figures. These costs have not been quantified in the cost -benefit analysis, although they are described in detail, and illustrated with the real use cases in Section 6.1.2 of the main text. Recurrent administrative costs for national public authorities Sovereignty risk assessment. This risk assessment shall be renewed every 4 years. The effort estimated for this reassessment of the sovereignty risks is estimated to be 5 FTEs, a lower effort than implementing the risk assessmen t from scratch, given that the activity is already ramped up and the Member States would already have a good understanding of their situation. 67 authorities will carry out these assessments and therefore will have to renew them. Revision of the audit reports by the competent authorities, per service audited at sovereign level 2 at least, estimated at 5 days per service. After verifying the audit report, opinion and evidence and consulting with the other competent authorities, the evaluating competent autho rity will adopt a decision that would allow a service provider to participate in public procurement activities. Recurrent savings in National Public Authorities Running applications on the cloud. Operating applications on the cloud, if performed well, with a continuous FinOps verifying that services are not overprovisioned can lead to significant savings. Literature sources estimate that the total cost of ownership (TCO) savings can amount to 20-50% in the case of legacy-to-cloud migrations61. No savings are here accounted for in the operation of applications migrated from cloud -to-sovereign cloud, as the applications would have already been benefitting from the total cost of ownership savings. See Annex 12 for a further qualitative discussion on savings. Simpler public procurement. Savings in this respect stem from the simplification of voluntarily using procuring audited services, which are part of the repository of sovereign cloud and AI computing services. This shall allow public administrations to save time in the verification of the documentation for the evaluation of the offer. This will result in 2 staff days per bid, and assuming that there are 3.5 potential contractors presenting bids in each tender procedure. Recurrent savings = Average number of yearly service bids requiring sovereignty assurance level 2 – 4 * staff costs savings per bid Sovereign services. The savings from using sovereign services cannot be quantified due to the intangible nature of sovereignty and resilience. Costs for service providers to develop sovereign services Assessing the cost and benefits for providers to provide sovereign services is a complex task that involves many parameters and differs greatly from provider to provider. As well, in the absence of an established market for sovereign services, data sources are rather anchored in providers’ business plans, not in ex post analysis of established businesses. Such data is 61 Chatzithanasis & Michalakelis (2018) estimates 24% to 50% The Benefits of Cloud Computing:. Ali Khajeh-Hosseini, David Greenwood, Ian Sommerville 102 confidential to companies, and the below considerations are based on targeted discussions with stakeholders that requested to remain anonymous. A first consideration is that th e consulted companies unanimously indicated that, in developing the business plan for these new services, they count on new large critical use cases that are today not in the cloud; in other words, they see sovereign services to generate a new source of income, but not to substitute existing. Cost wise, new costs notably include the amortisation of all one -off adjustment costs such as the additional cost induced by using EU-located infrastructure, the additional compliance costs induced by the audits, the additional costs of being certified under EUCS; and proper recurrent costs such as the higher salaries of employing EU workforce. As an illustration, speaking under the condition of anonymity for business secrecy reasons, one of the largest EU service providers of sovereign services speaks of an overall investment of EUR 1.5 bn , including hardware, for a broad range of IaaS and PaaS services (for an unspecified computing capacity). Conversely, another EU service provider with an established range of non -sovereign services speaks of an overall investment in the range of EUR 20 -40 m to adjust existing hardware and software to the stricter norms that a sovereign service entails, with plans to invest progressively should the market develops. The benefits for service providers to develop sovereign services are covered under section 6.1.5. Benefit wise, cloudifying legacy on -premises services means new revenues. As to the move from traditional cloud to sovereign cloud, today’s few available sovereign services come with a mark-up which is still too uncertain to draw conclusions (see discussion under Problem Driver 4 in 2.3.4) . To this additional income, consulted EU service providers see also sovereign services as niche market where they have a demonstrable added value that could spill over to other market segments. The consulted companies unanimously indicated that it is too early to confirm whether, over the span of the next ten years, the i ncremental cost and benefits would reach the same balance (i.e. margins) as with equivalent non-sovereign services, which is today commonly assumed to be around 30%62; to cater for this uncertainty, this assessment assumes that stakeholders’ margins vary from 25% to 35%. One-off adjustment costs for cloud and AI computing service providers Ultimately, the decision of a provider to audit one or more services is their own business decision. However, in order to have a sense of magnitude of how many providers could decide to do so, extensive desk research conducted as part of the preparatory study (Technopolis et al., 2025) identified that services from 59 non -EU headquartered cloud service providers likely meet Level 1 requirements and would be able to qualify to Level 2 should they decide so. 226 EU headquartered providers could qualify their services as Level 2 and would be able to qualify their services as Level 3/4 should they decide so. If only large companies are considered and SMEs are excluded, the figure goes down to 59 EU headquartered large companies. The assumptions are as follows: 1 50 services will be audited from 2029 until 2034, with the assumption of 30 audits the first year, and an annual growth of 38%. This builds over the number of services currently qualified in comparable national qualification and certification schemes63, and the FedRAMP mechanism. As of September 2025. the FedRAMP repository contains 530 authorised services under level moderate and high. 62 Amazon Web Services profits squeezed as AI arms race drives spending surge – GeekWire 63 For this impact assessment ES, IT, and FR have been considered as baseline as their data is public. 103 Services may be audited under different levels, provided that the criteria mentioned above (see PM11) are met. For the purpose of this impact assessment, it is estimated that the proportion of audited services in the different assurance levels will be mirroring t he needs of the public authorities (see below). This would then make that out of the estimated 150 audited cloud services: • 70% of the services will be Sovereignty Assurance Level 1, making 105 services • 20% of the services will be Sovereignty Assurance Level 2, resulting 30 services • 9% of the services will be Sovereignty Assurance Level 3, amounting to 13 services • 1% of the services will be Sovereignty Assurance Level 4, resulting in 2 service. The effort needed to get audited under sovereignty assurance level 2 -4 is estimated to be 15 FTEs. This includes the definition and implementation of the necessary legal, organisational and technical measures to reach sovereignty assurance level 2 – 4 and the auditing procedure carried by the third party auditor. This effort was validated in the Final Validation workshop held as part of the study led by Technopolis. One-off adjustment cost of new audits = (effort to get sovereignty assurance level 2 – 4 audited * labour costs) * number of audited services assurance level 2 – 4 One-off regulatory fee for cloud and AI computing service providers New audits, assumed to be EUR 20 000, for the estimated number of audited services at sovereignty assurance level 2– 4. One off regulatory fee for new audits (CSAP) = regulatory fee * number of audited services assurance level 2 – 4 Recurrent regulatory fee for cloud and AI computing service provider Renewal of audits, assumed to be EUR 14 000. Recurrent regulatory fee for new audits (CSAP) = regulatory fee * number of audited services assurance level 2 – 4 Recurrent administrative costs for cloud and AI computing service providers Audits: These compliance costs stem from the audits to maintain the audit certificate, where the goal is to verify that the conditions under which it was first obtained remain valid (effort estimated as 3 FTE/year per service). Compared to the effort needed to achieve it initially, the effort dedicated to the intermediate audits has been assumed to be lower than obtaining it initially, in spite of the annual reporting obligations set out above. Recurrent administrative compliance cost of renewal of audits = (time to be audited * labour costs) * number of audited services Recurrent savings for cloud and AI computing service providers. Audits. A crucial matter in the analysis of the recurrent savings for cloud and AI computing service providers is the single market effect. Providers will be able to be audited in one MS and operate in all EU27 at once. Additionally, the analysis considers that in the business -as-usual scenario one cloud service provider would seek to obtain the a udit in 5 MS in average. Given the costs of compliance, a cloud and AI computing service provider would carefully prioritize in which MS(s) it would seek to obtain the audit, usually taking into consideration aspects such as the market share or other commercial opportunities. With this policy measure, a single audit 104 provided by a MS will enable a provider to present offers including the audited service to public tenders in all 27 MS. Saving costs audits valid throughout the EU = Number of MS where the cloud and AI computing service providers would get certified in the absence of an EU approach * cost to get audited * number of audited services Public procurement. Another relevant saving stems from the fact of not having to collect and resubmit all the evidence necessary to demonstrate that the criteria are fulfilled for each bid, given that the audited services are listed in the repository and accessible for the contracting authority. The assumption is that undertakings will save 5 staff days / year per service and bid. The number of yearly bids amounts to 50 a year. Business costs saved: = Businesses time saved per evidence submission in a tender procedure * number of submitted bids Recurrent administrative costs for the private sector (Auditors) Third party audits. In this PM, as mentioned above, the target number of cloud and AI computing services that will be in possession of the positive audit report is estimated to reach 150 by 203264, whereas 30 of these will be audited sovereign level 2 -4 during the first year. The assumed CAGR is 38%. The assumption under this policy measures follows a linear progressive uptake of the certification scheme. The estimated average effort for auditing a service under Sovereignty assurance level 2 -4 is 110 days / audit. The same effort is considered for the renewal process.. Indirect savings: Through this measure, cloud and AI computing services able to comply with the sovereignty audit scheme will increase trust from public administrations, and notably for the most critical cases. This will result in more trustworthy, credible and very specialized as well as very advanced offers responding to challenges such as resilience and autonomy. Sensitivity analysis: The most affected parameters for this Policy Measure are as follows: 1) number of FTEs required to get audited and to maintain the audit (min and max value are 10 and 20 respectively ). For the maintenance of the audit this varies between 2 and 5; 2 ) the number of MS that designate the competent authorities to carry out the sovereignty risk assessments. This varies from 5 MS (min) to 27 (MS), with 16 being the central value : 3) in terms of savings, the common audit process will allow to save audit ef forts in some of the markets where the provider operates, considered to be a minimum of 3 MS and a maximum of 10, with a central value of 5. Results for all stakeholders aggregated and for the years covered by this measure are summarised in the table belo w. For all scenarios including the average, min and max the benefits outweigh costs. What causes the range between the min and the mix is dependent on the number of Member States which take up the scheme. Table 35. Voluntary sovereign risk assessment for the use of cloud and AI computing services in the public sector (PM15) Cost types Cloud & AI providers (€) Public authorities (€) European Commission (€) Total Value (central, €) Total Value (min, €) Total Value (max, €) 64 Assumption taken considering the current valid authorised cloud services in FedRAMP moderate and high, which amounts to 531 as of 26 September 2025. 105 one-off administrative - - - - - - recurrent administrative 25 161 510 17 314 082 42 475 592 25 383 464 2 763 406 090 one-off adjustment 51 370 998 39 378 999 693 692 91 443 689 59 940 678 247 443 239 recurrent adjustment - - 2 117 274 2 117 274 2 117 274 44 128 193 one-off regulatory fees 773 977 - - 773 977 773 977 773 977 recurrent regulatory fees 1 047 966 - - 1 047 966 1 047 966 1 047 966 one-off enforcement. - - - - - - recurrent enforcement - - - - - - Total costs 78 354 450 56 693 081 2 810 965 137 858 497 89 263 359 232 817 048 Total benefits (451 348 550) (3 280 022) - (454 628 572) (172 234 292) (566 620 181) Net impact (372 994 099) 53 413 060 2 810 965 (316 770 075) (82 970 933) (333 803 133) This policy measure would trigger an acceleration of porting of some applications to sovereign cloud services of assurance levels 2 to 4, requiring an anticipation of expenses of EUR 620 m to 4 bn. These costs are estimated and reported under section 12.4 of Annex 4. Since they represent planned expenditure that would be incurred in the future as part of the regular cloud contract renewal cycles and independent of the present policy measure, they have been scoped outside of the summary cost table so as not to conflate structural renewal costs with the incremental financial impact of the measure itself. The benefits accruing from the risk reduction, notably an increased autonomy and strengthened operational resilience through the adoption of sovereign cloud and AI computing solutions are intangible and cannot be expressed in quantitative terms . While thes e benefits cannot be quantified, they are acknowledged as a significant consideration underpinning the policy rationale. 3.16. PM16: Non-mandatory specific award criteria for the procurement of cloud and AI computing services This policy measure defines non-mandatory award criteria for the procurement of cloud and AI computing services, rewarding their specific characteristics in terms of EU added value. With a view to enabling an enhanced EU value added of public procurement , this measure establishes a set of voluntary non-price award criteria to be included, voluntarily, by contracting authorities in the procurement of cloud and AI computing services. These criteria will earn additional points to tenderers that demonstrate: (i) Their contribution to reinforcing the digital technology supply chain in the Union, including the use of software or hardware designed or manufactured in the Union (ii) Integrated Union technologies, including the uptake of research and development results stemming from EU-funded research and development programs; (iii) That the innovation required to deliver the service being procured is conducted in the Union or in a third country that contributes to the development of a European cloud and AI ecosystem; (iv) That the service is delivered, to the greatest extent feasible with regard to market availability or technical requirements, through critical [computing, storage and networking] hardware components designed in the Union or manufactured in the Union, or both, or, where this is not feasible, through hardware components from a 106 country or countries that contribute to strengthening security of supply and developing a European cloud and AI ecosystem; Next, the baseline data used for this policy measure is detailed. Number of public tenders for cloud and AI computing services. The data is taken from the TED portal65 where all public tenders open by MSs are recorded. The list of tenders is filtered by the CPV related to IT services, software and computing, i.e. CPV codes under the families of 72000000, 30000000, and 48000000, and by keywords “cloud” and “AI”, which re sults in 1.043 tenders for 2024. This is expected to grow until 2030 using the same CAGR as the one observed for these tenders in the period 2021-24 (8.6%). From 2031 until the end of the period, the CAGR is reduced to half (4.3%) as a result of the improv ement in cloud and AI adoption. It is assumed that one fourth of the tenders use the voluntary criteria. The assumption is that all national public authorities participate in this measure even if not mandatory and each of them receives 3 to 4 offers for each public tender they organise. Cloud and AI computing service providers that participate in public procurement every year. An estimate of 350 providers is used in the calculation. The estimate is based on a combination of TED and desk research. One-off administrative costs in national public authorities . Administrations that choose to adhere to these criteria will need to adapt their procurement templates by integrating the specific award criteria, with a low effort of up to 10 staff days for each public a uthority. This is translated into the corresponding cost by multiplying by the average salary and the number of public authorities introducing the specific award criteria. It is assumed that 25% of the authorities decide to use the award criteria in their tenders and hence make the corresponding changes. One-off administrative costs (NPA) = number of national public authorities introducing the non-price award criteria (labour cost * effort to adapt templates) Recurrent savings in national public authorities. Public authorities will use the standard award criteria and guidelines instead of drafting those separately. This represents a saving and is estimated at an assumption of 1.5 days per public tender. Recurrent savings (NPA) = number of tenders (labour cost * effort saved) One-off adjustment costs for cloud and AI computing service provider s. Providers who choose to participate in procurement processes including the specific award criteria need to align with the public procurement procedures for cloud and AI computing services. This includes adopting and aligning their processes and improving them to meet these criteria, with an estimated one-off effort of up to 20 staff days. Recurrent administrative costs for cloud and AI computing service providers, are the costs needed to adequate the offers, assumed to be 2 staff days per bid. These days were validated during the interviews as part of the supporting study. They assume only administrative work for companies who would be eligible. The cost is calculated multiplying this effort by the 65 EU-Tenders search APIs: https://docs.ted.europa.eu/api/latest/search.html 107 number of bids presented in a year and the average salary of the cloud and AI computing service providers. Recurrent administrative cost = number of bids presented * effort / bid * labour costs Recurrent savings for cloud and AI computing service providers. Revenue gains are possible, especially for providers who can differentiate due to the award criteria. These are however not modelled. Indirect savings: There are notable indirect benefits for cloud and AI computing service providers that are able to compl y with the different non -specific award criteria. For instance, additional revenue gains, increase in reputation and the possibility to enlarge the scope of their solutions which in turn may lead to an increase of sales. Sensitivity analysis: The impact o f this policy measure is sensitive to the number of public authorities procuring cloud and AI computing services, the number of tenders and offers per year and the number of cloud and AI computing service providers and the costs to adapt the offers. Results for all stakeholders aggregated and for the years covered by this measure are summarised in the table below. Total costs are estimated between EUR 6.0 million and EUR 31.5 million, consisting mainly of recurrent administrative costs related to coordination, reporting, and compliance activities, alongside smaller one -off administrative and adjustment costs. Total cost savings are limited, ranging from EUR 1.1 million to EUR 3.3 million. Costs outweigh benefits across the average, min and max set of parameters. The difference in the min and max is mainly caused by the number of CSP and AI providers participating in public procurement every year across EU. Table 36. Non-mandatory specific award criteria for cloud and AI computing service procurement (PM16) Cost types Cloud & AI providers (€) Public authorities (€) European Commissio n (€) Total Value (central, €) Total Value (min, €) Total Value (max, €) one-off administrative - 1 731 580 - 1 731 580 865 790 2 597 370 recurrent administrative 13 486 479 - - 13 486 479 3 371 620 23 601 338 one-off adjustment 3 560 007 - - 3 560 007 1 780 004 5 340 011 recurrent adjustment - - - - - - one-off regulatory fees - - - - - - recurrent regulatory fees - - - - - - one-off enforcement. - - - - - - recurrent enforcement - - - - - - Total costs 17 046 486 1 731 580 - 18 778 066 6 017 413 31 538 719 Total benefits - (1 630 135) - (1 630 135) (1 086 757) (3 260 270) Net impact 17 046 486 101 445 - 17 147 931 4 930 657 28 278 449 3.17. PM17: Public Sector Cloud Federation PM17 establishes a European public sector cloud federation for voluntary participation European and national public authorities at all levels to allow them to share their own existing data centre, cloud and AI computing services. This policy measure requires the establishment of the technical back end that operates the necessary brokering services. 108 Cloud Capacity in the Public Sector. The public sector in Europe is running a data centre capacity of 1.5 GW 66 in 2025 and shows an annual increase of 8.9% due to the growing adoption of PaaS and SaaS services67, that might be impacted in the first years with this policy measure. As the measure is voluntary, it is assumed that only a part (two thirds) of the public authorities will join the federation, reducing the capacity available in the federation to 1 GW. Assuming a power usage effectiveness (PUE) of 1.29, a consumption of 500 W per server and 32 virtual machines (VMs) per server, the 1 GW of datacentre capacity could deliver around 50 million mid-sized VMs of 4 vCPU and 16 GB. Number of VMs = ((1 000 000 000 W/ PUE) / 500 W per server) x 32 VMs per server Market price of a VM is set at 0.23 EUR per hour based on a baseline configuration of 4 vCPUs (processors) and 16 GB (memory) 68. Considering the high margins in commercial cloud services, beyond 60%, and a cost -based chargeback among participants to the federation, a conservative assumption of a 30% price advantage of the cloud federation services with respect to commercial cloud services is made, setting the cloud federation’s VM price at 0.16 EUR per hour. This assumption was confirmed in the Final Validation workshop held as part of the study carried out by Technopolis et al. (2025)). Over time, VM configurations will evolve to higher performance and higher share of AI processing units (GPUs, TPUs, etc). Prices are considered to remain relatively constant as these more sophisticated configurations will get commoditized over time. A target utilization of 60% is assumed for the cloud capacity based on own infrastructure. This is based on a report from Berkeley Lab on data centre energy usage69, considering an evolution of public sector data centres from current low occupation in traditional compute (below 20%), towards higher occupation levels as the load of AI inferencing and AI modelling grows (datacentres with this kind of loads present an average of 40% and 80% time operational, respectively). A middle point (60%) is set as the target. Applying a conservative approach only 25% of the idle capacity, 10% of the total capacity, is considered to be shared with other members of the cloud federation. On the other hand, cloud capacity extensions in each MS are assumed to be reduced by 10% by using idle capacity from other federation members. With regards to the number of public authorities that own and run a datacentre infrastructure and could be members of the public sector cloud federation, in the absence of a precise number, 66 Based on calculations by Technopolis et al. (2025). The study estimates a total computing capacity consumed by the public sector in EU27 in 2025 of 2.9 GW. The CATI surveys shows that 51% of this computing capacity (1.5 GW) is served by datacentre infrastructure own by the public administrations. This is the capacity that is shared in the cloud federation. 67 Source: Technopolis et al. (2025) 68 Example taken from a basic AWS EC2 product using AWS configuration tool: https://calculator.aws/#/createCalculator/ec2- enhancement. Par ameters used: <Tenancy:Dedicated Instances>, <Region:Frankfurt>, <Operating system:Linux>, <vCPUs:4>, <Memory:16 GiB>, <Network Performance:Up to 12500 Megabit>. Price calculated at 12th Sep 2025 for <Instance name:m6i.xlarge>: 0,253 USD/hour (0,227 EUR/h at the average exchange rate for 2025 by Sept 2025: 0,8986 EUR/USD) 69 Shehabi, A., Smith, S.J., Hubbard, A., Newkirk, A., Lei, N., Siddik, M.A.B., Holecek, B., Koomey, J., Masanet, E., Sartor, D. 2024. 2024 United States Data Center Energy Usage Report. Lawrence Berkeley National Laboratory, Berkeley, California. LBNL-2001637. https://escholarship.org/uc/item/32d6m0d1 109 the assumption made is that there is one in each NUTS1 and NUTS2 area70, resulting in a figure of 300 public authorities in Europe. One-off adjustment costs for the European Commission. This policy measure entails one-off adjustment costs to establish the public sector cloud federation platform. These costs include 4 persons half time in 2027 (2 FTE) from the EC to run the procurement process for the federation platform (define requirements and prepare the call, assess and award the contract), that will be tasked to a subcontractor for an estimated cost of EUR 20 000 000. This includes the technical aspects of the platform, as well as the development of the service level agreements and of the technical common specifications. One-off adjustment costs = external contract to develop the platform + (effort to run the procurement process * labour costs) Recurrent administrative costs for the European Commission. On a yearly basis, the operation of the federation platform requires 6 FTEs. Recurrent adjustment costs for the European Commission relate to hosting of the platform in a cloud, estimated at 1 million EUR per year, and operating, maintaining and evolving the federation platform, with an effort of 60 contractor FTEs per year, including the integration of APIs and connectors to aggregate the NPA cloud resources to this platform. Recurrent adjustment costs = hosting of the platform + maintenance of the platform One-off and recurrent adjustment costs for National Public Administrations. Member States dedicate an effort of 55 staff days (0.25 FTEs) in 2027 to participate in the setup of the public sector cloud federation. On a recurrent basis during the first years, up to 2031, each NPA will have to apply efforts to connect national infrastructures and ensure interoperability to join the federation (2 FTEs), to onboard cloud resources and services on the federation platform (30 staff days) and to update and delete them later on (20 and 50 staff days respectively), making a total yearly effort of 2.45 FTEs. Recurrent savings for National Public Administrations . With the measure and thanks to the federation platform, NPAs will save 0.5 FTEs in the coordination with other Member States for the sharing of cloud capacity. In addition, the sharing of 10% of the idle VM capacity on a pay -per-use mode (with capacity assumed to be consumed during 10% of the time) will represent a charge back of around EUR 690 million EUR inz the first year (2027). Savings = VM capacity x %shared x price/hour x number of hours The acquisition of 10% of the cloud capacity demand from the cloud federation will derive in around EUR 296 million EUR savings in 2027, due to the 30% price difference between federation and commercial cloud services. 70 NUTS1 and NUTS2 areas in Europe are close to 340 (https://ec.europa.eu/eurostat/web/nuts). An adjustment has been made to slightly reduce the number of NUTS2 areas with a public authority owning and running datacentre infrastructure in the bigger markets where the administrative distribution at that level is more granular. 110 Savings = VM capacity x %extension avoided x price difference x usage These savings grow over the years with the expected increase in cloud capacity demand (8.9% annually). Indirect savings: Through this measure, the public sector achieves additional data centre efficiency and improves the return on investment from their infrastructure and assets in cloud and AI. The increase in resource utilization achieved by pooling resources reduces the investment risk and may stimulate the increase in their investment in data centre, cloud and AI capacity. Sensitivity analysis: The values to be challenged in this policy measure include the capacity shared by each MS with the federation ranging from 5% to 15% which impacts the savings in terms of idle capacity reduction. Results for all stakeholders aggregated and for the years covered by this measure are summarised in the table below. The main difference stem from the percentage of idle resources shared and particularly by the Member States participating in the federation. Table 37. Public Sector Cloud Federation (PM17) Cost types Cloud & AI providers (€) Public authorities (€) European Commission (€) Total Value (central, €) Total Value (min, €) Total Value (max, €) one-off administrative - - - - - - recurrent administrative - - 4 312 980 4 312 980 4 312 980 4 312 980 one-off adjustment - 4 613 563 19 540 197 24 153 761 23 231 048 25 076 473 recurrent adjustment - 213 669 483 99 241 949 312 911 432 269 386 167 356 436 698 one-off regulatory fees - - - - - - recurrent regulatory fees - - - - - - one-off enforcement. - - - - - - recurrent enforcement - - - - - - Total costs - 218 283 046 123 095 126 341 378 173 296 930 195 385 826 151 Total benefits - (12 533 772 955) - (12 533 722 955) (8 175 327 110) (16 892 218 800) Net impact - (12 315 489 908) 123 095 126 (12 192 394 782) (7 878 396 915) (16 506 392 649) 3.18. PM18: Vendor-neutral EU cloud/AI skill certificates The goal of this policy measure is to create a vendor neutral cloud and AI computing services training programme and curricula for the re -skilling and upskilling of workers in key digital technologies for the single market. Targets of these certification a nd training programmes are individual workers and students, not organisations. Nowadays, many cloud service providers offer training and certification programmes (see for instance AWS71, Microsoft Azure 72 or Google73) but they are vendor specific and tailored to their technologies. And this, despite the commonalities that exist across different cloud 71 https://aws.amazon.com/certification/ 72 https://learn.microsoft.com/en-us/credentials/browse/?credential_types=certification&products=azure 73 https://grow.google/intl/europe/courses-and-tools/?category=career&topic=cloud-computing 111 platforms: architectural patterns, cloud security controls, and development lifecycle management methodologies, among others. There are few vendor-neutral cloud skills certification programmes in the market, and they are majorly focused on security 74, leaving aside important aspects such as the design and architecture of cloud native applications, AI services, DevOps, AIOps or FinOps75. University degrees include some of these subjects, but they are typically integrated in long studies, target undergraduate students and are not usually available as vocational training for professionals. Under this policy measure, it will be created a curriculum of vendor neutral courses, as well as their content, both for the materials and the exams. In principle, obtaining these certificates will be a voluntary mechanism intended for developers whereas companies may require them in certain job offers at their discretion. One-off adjustment costs for the European Commission . The adjustment costs modelled result from the subcontracting of a study under a public tender procedure that will 1) define the gaps on the current skills panorama to develop and deploy cloud and AI computing services prioritising the most relevant areas; and 2) develop the materials and content covering the prioritized areas, including also the exams. Substance-wise, as hinted previously, the main focus is to ensure that existing cloud professionals upskill themselves, from knowing how to use the products from a single vendor to a vendor-agnostic / multi-vendor skill set. This contract has been estimated at EUR 750 000 and running for two years (2027-2028) with the aim of developing 15 courses. For the drafting of the specifications as well as for the follow up of the implementation of this study, it has been estimated 1 FTE of the Commission. An additional cost at EUR 252 806 was estimated to establish a training accreditation mechanism. One-off adjustment costs = external contract + (effort to draft the specifications * labour cost) One-off administrative costs for the European Commission. Here the costs to set up the mechanism to ensure the quality of the training materials and the skil ls certifications are ensured as well as the infrastructure for the training. This is estimated at 3 FTEs spanning for a year. Recurrent administrative costs for the European Commission stem from the operational costs of running the training certification programme. This is estimated at 1 FTE. Recurrent savings for the European Commission are the result of having a coordination mechanism that may avoid duplication in the creation of a skills framework or training materials. This has been estimated at 0.25 FTEs. 74 The most certificates recognized in the market include ISC2 CCSP (https://www.isc2.org/certifications/ccsp) and CompTIA Cloud+ (https://www.comptia.org/en-us/certifications/cloud/) 75 DevOps is a philosophy that aims to close the gap between the development and operation teams involved in the development and deployment of software applications, including cloud native and focusing on automating the procedures such as integration and deployment. AIOps is a similar concept focusing on the development and operation of AI applications automating also the data pipelines. Finally, FinOps is the means in which financial and development teams can jointly manage the expenditure resulting from deploying services onto the cloud. The goal is to minimize the expense but maximize performance, quality and velocity. 112 Recurrent administrative costs for cloud and AI experts: Training fees are assumed at EUR 100 per training. Recurrent savings for cloud and AI computing service providers stem from the vendor - neutrality of the proposed certificates. A person aim ing to become cloud developer or a cloud architect can obtain one vendor -neutral certification, containing the main principles and patterns that can be applied to every technology with little effort in customisation or learning the specificities of said te chnologies, instead of getting the certificates from all technologies used. The aim is to avoid the multiplication of costs that currently developers incur by needing to get certified in multiple technologies for their professional development (savings of 3 days per course). The vendor – neutral certification “Certified Cloud Security Professional CCSP”76, manages to certify 3,000 – 3,500 people globally per year. AWS reports to have 1.05 million unique individuals certified77. There is no similar availabl e data for Google or Azure. The number of potential beneficiaries of these certificates assumed for this analysis varies per year as follows: 1 000 experts in the first year and increasing at 10 000 after three years after which 300 experts per year. The assumption is that each certified person typically obtains around three certifications. This reflects the average number of certificates an individual holds across different technologies or providers. Recurrent savings = number of people to get certified * (days saved per course * labour costs) * number of certification courses followed by a person Indirect savings: the effects over the economy of having a more cloud savvy and vendor - agnostic workforce are indirect and discussed in sections 6.1.4 and 6.1.5. Sensitivity analysis: The values to be challenged in this policy measure are as follows: 1) the number of experts that can potentially be certified on a yearly basis ranging from 100 to 500 experts; 2) the certification fees ranging from EUR 50 to EUR 150; 3) the effort saved by opting for a vendor-neutral certification i,e., the number of certifications from other technologies and days saved; 4) the yearly coordination savings for the EC from avoiding duplication of effort ranging from zero to EUR 21 067 per year and 5) the total reduced costs in the certification of similar technologies from different providers stemming from the sensitivity introduced on the number of experts that could potentially get certified. Results for all stakeholders aggregated an d for the years covered by this measure are summarised in the table below. Benefits outweigh costs systematically across the average, min and max scenarios. The min max ranges are characterised by the difference in the cost savings, and more specifically i n the certification of similar technologies from different providers accounts for, as well as the number of people that can potentially be certified. Table 38. Vendor neutral EU cloud/AI skill certificates (PM18) Cost types Cloud & AI providers (€) Public authorities (€) European Commission (€) Total Value (central, €) Total Value (min, €) Total Value (max, €) one-off administrative - - 252 806 252 806 252 806 252 806 76 https://destcert.com/resources/ccsp-certification-statistics 77 https://aws.amazon.com/certification/ 113 recurrent administrative - - - - - - one-off adjustment - - 834 269 834 269 834 269 834 269 recurrent adjustment - - - - - - one-off regulatory fees - - - - - - recurrent regulatory fees 285 906 - - 285 906 47 651 714 765 one-off enforcement. - - - - - - recurrent enforcement - - 2 301 224 2 301 224 2 301 224 2 301 224 Total costs 285 906 - 3 388 299 3 674 205 3 435 950 4 103 064 Total benefits (78 001 031) - - (78 001 031) (18 812 153) (122 871 064) Net impact (77 715 125) - 3 388 299 (74 326 825) (15 376 203) (118 786 000) 3.19. PM19: Mandatory specific award criteria for the procurement of cloud and AI computing services This policy measure has different components. First, with a view to reducing critical dependencies, this measure makes the use of the non -price award criteria under PM16 mandatory. Public procurement represents a significant share of the EU GDP (14%) and constitutes one of the most powerful instruments available to public authorities to shape market dynamics. Traditionally, procurement decisions in the cloud sector have been governed predominantly by technical and financial criteria, such as different supported features, performance benchmarks, level agreements, and price. While these remain important, they do not present a complete picture of the sheer complexity of a cloud service. The conditions under which a service is delivered, its supply chain, hardware and software, the innovation behind it and where it is conducted, and who ultimately controls the whole chain of entities, are equally relevant, particularly for the public sector. The competitive effect of non -technical award crite ria in cloud and AI computing services procurement operates primarily through the demand side. When major public contracting authorities, notably national authorities, and large public bodies, award points for supply chain, innovation, security, interopera bility, portability, and transparency, they send a clear market signal about the criteria that matter for public sector contracts. This helps to create strong incentives for providers to invest in the capabilities that score favourably, irrespective of any regulatory mandate. Non-technical award criteria in public procurement are not just a technical adjustment to tendering practices. Used strategically and at scale, they can be an instrument of industrial and digital policy, capable of redirecting public p urchasing power towards outcomes that the market, left to its own dynamics, would not spontaneously produce. In the cloud sector, where market concentration, exposure to third country laws , and strategic dependency are pressing concerns, the proposed criteria offer the mechanisms to strengthen European competitiveness, build sovereign digital infrastructure, and ensure that the public sector leads , rather than follows, the transition to a more open, resilient, and European digital ecosystem. All the assumpt ions under PM16 remain valid, except in the adoption of the measure by contracting authorities that in this policy measure applies to all of them and to all tenders of cloud and AI computing services. Administrative costs for national public authorities. 114 Plans. National public authorities would be required to draft and adopt a Cloud and AI development plan, covering highly critical use cases involving the purchase of sovereign services, including on how they intend to use public procurement t o increase the uptake of highly innovative cloud and AI computing services. The plans shall (i) assess the value of the procurement contracts of sovereign cloud and AI computing services for critical uses cases; (ii) identify priority areas where strategic autonomy is required; (iii) monitor the procurement of innovative services, including those provided by SMEs and small-cap European providers; (iv) ensure consistency with other existing or planned national strategies. To limit administrative burden, the plan should remain concise and non -binding, focusing on priority areas, intended procurement approaches and objectives. This activity is expected to generate one -off administrative costs for public authorities, estimated as 3 FTEs per Member State (1 -5 for sensitivity purposes). Member States are also expected to face ongoing administrative costs to update the strategies, estimated as 3 FTEs every 5 years. As a follow -up, the uptake of such services, would be monitored through a centralised, Commission-led monitoring exercise (see PM21) . This would create synergies with other measures within this Policy Option that are aimed at assessing the market presence of EU providers and/or existing dependencies on third country providers with respect to specific services (cfr. PM21). T his activity would produce recurrent administrative costs for public authorities estimated at approximately 5 FTEs (3-7 for sensitivity) per authority. One-off adjustment costs for cloud and AI computing service providers . Providers who choose to participate in procurement processes including the specific award criteria need to align with the public procurement procedures for cloud and AI computing services. This includes adopting and aligning their processes and improving them to meet these criteria, with an estimated one-off effort of up to 20 staff days. Recurrent administrative costs for cloud and AI computing service providers , are the costs needed to adequate the offers, assumed to be 2 staff days per bid. These days are arbitrary but were validated during the interviews as part of the supporting study. They assume only administrative work for companies who would be eligible. The cost is calculated multiplying this effort by the number of bids presented in a year and the average salary of the cloud and AI computing service providers. Recurrent administrative cost = number of bids presented * effort / bid * labour costs Recurrent savings for cloud and AI computing service providers. Revenue gains are possible, especially for providers who can differentiate due to the award criteria. These are however not modelled. Indirect savings: There are notable indirect benefits for cloud and AI computing service providers that are able to comply with the different non -specific award criteria. For instance, additional revenue gains, increase in reputation and the possibility to enlarge the scope of their solutions which in turn may lead to an increase of sales. Sensitivity analysis: The impact of this policy measure is sensitive to the number of public authorities procuring cloud and AI computing services, the number of tenders and offers per year and the number of cloud and AI computing service providers and the costs to adapt the offers. 115 Results for all stakeholders aggregated and for the years covered by this measure are summarised in the table below. Total costs are estimated between EUR 104 million and EUR 226 million, consisting mainly of recurrent administrative costs related to coordination, reporting, and compliance activities, alongside smaller one -off administrative and adjustment costs. Total cost savings are limited, ranging from EUR 4 million to EUR 13 million. Costs outweigh benefits across the average, min and max set of parameters. The difference in the min and max is mainly caused by the number of CSP and AI providers participating in public procurement every year across EU. Table 45. Mandatory specific award criteria for cloud and AI computing service procurement (PM19) Cost types Cloud & AI providers (€) Public authorities (€) European Commissio n (€) Total Value (central, €) Total Value (min, €) Total Value (max, €) one-off administrative - 8 333 909 - 8 333 909 3 389 039 13 480 600 recurrent administrative 53 945 915 80 878 153 - 134 824 068 94 364 632 177 304 770 one-off adjustment 3 560 007 - - 3 560 007 3 560 007 13 708 048 recurrent adjustment - - - - - - one-off regulatory fees - - - - - - recurrent regulatory fees - - - - - - one-off enforcement. - - - - - - recurrent enforcement - - - - - - Total costs 57 505 922 89 212092 - 146 7170984 101 313 678 204 493 419 Total benefits - (6 520 539) - (6 520 539) (4 347 026) (13 041 078) Net impact 57 505 922 82 6912 523 - 140 197 445 100 049 519 213 032 412 3.20. PM20: Boosting open source in public administrations Open source software represents a strategic policy response to vendor lock-in and the excessive dependence on vertically integrated non -EU providers. By broadening the available offer of digital solutions, open source can bridge some of the gaps left by European solution providers and reduce the public sector's reliance on large foreign technology companies for the delivery of critical services. A wider adoption of open source would also create tangible competitive advantages for EU companies, enabling them to leverage existing software building blocks and recombine them efficiently to develop and bring new solutions to market at scale. Open source solutions can equally reduce the costs associated with digital service delivery in the public sector through use, reuse, and interoperability. When a solution is developed once and reused across multiple public administrations throughout the EU, its fixed development costs are amortised over a significantly larger user base. The creation of the EU Digital COVID Certificates illustrated this principle clearly: it demonstrated both the critical importance of interoperability for cross-border public services and the capacity of open source to accelerate deployment at EU scale. That same case also showed that open source can be a powerful vector of trust for public authorities and citizens alike. Under this measure, public sector organisations shall take the appropriate measures to promote the use of open standards and open source software when it is equivalent or superior to proprietary one, in terms of functionalities, total cost, user-centricity, cybersecurity or other relevant duly justified objective criteria. Under the share and reuse of open source software principle, public sector organisations shall consider the release of their software assets available for public use in an open source repository connected to the EU Open Source (OSS) catalogue . To be able to do so, the public sector 116 organisation will have to ho ld the intellectual pro perty rights. As part of the due diligence required when releasing and deploying open source software, the terms of reference should be expected to request both static and dynamic security analysis of the code, in order to mitigate risks of interference by malicious actors exploiting the publicly accessible nature of the codebase. This analysis shall be carried out by the service provider. Public sector organisations shall not have to make their code publicly available in cases where it is restricted for reasons of national security or defence, intellectual property rights held by third parties, or due to technical or economic infeasibility. These two princi ples are mutually reinforcing and should be read as complementary. Encouraging the use of open source software reshapes how digital services are planned and delivered, promoting the secure reuse of existing solutions and fostering collaboration across institutional boundaries . “Share and Reuse ” is expected to expand the pool of reusable , shareable and secure software components. Together, these principles are expected to bring about a gradual, structural transformation in the way software is commissioned, produced, and maintained in the public sector. The measure also includes the organisational and technical arrangements required to implement these principles, such as the establishment of Open Source Programme Offices (OSPOs), repositories for public-sector code, and shared infrastructure for collaboration, compliance, and training. OSPOs, as part of their role in their technical, legal, procedural and strategic – related tasks, may provide contracting authorities with advice on licenses, security, or maintenance aspects. The creation and nurturing of a Network of OSPOs would also help in further promoting, collaborating, and exchanging practices related to the use, reuse and sharing of open source, through guidance, templates or recommendations thereby sharing expertise costs across the public sector rather than requiring each OSPO to develop this capacity independently. Overall, this measure could contribute to reduce dependencies on proprietary software products and vendors, increase public -sector use , reuse and contribution to open source, and enable efficiency and innovation gains across the European digital ecosystem. Furthermore, this measure would stimulate broader market participation, encourage new entrants, reduce vendor lock-in and improve the overall competitiveness of offers received by public authorities. Finally, it would contribute to the growth of the open source services sector in Europe, whic h is well positioned from increasing public sector demand for interoperable, auditable and sovereignty solutions Open source is already the backbone of cloud services and is used in all the different layers. Without them, cloud services would not have reac hed the current level of technical maturity. Some examples of open source used in cloud services include: - Infrastructure as a Service: RedHat’s Open Stack is the base technology used by many European providers for the provision of Infrastructure as a Servi ce, which is later on adjusted to accommodate to the needs of the CSPs. Open Stack allows to manage a pool compute, storage, and networking resources to build and control private and public clouds, acting as a cloud operating system. - Data storage: Open source data bases such as MySQL, PostgreSQL or MongoDB are heavily used by cloud service providers both for relational and NoSQL databases. - Orchestration: An orchestrator allows to automate and coordinate complex tasks across cloud environments, such as prov isioning servers and storage, handling application deployments in an automated way ensuring consistency, efficiency and security. The 117 golden standard solution used nowadays by most cloud service providers is Kubernetes, originally developed by Google, but released as open source. - Horizontal functionalities such as Identity and Access management as well as telemetry are also heavily implemented through the use of open source solutions. For the first, Keycloak is a relevant solution used, whereas for telemetry several solutions exist such as Grafana (for visualization), Prometheus and the Elastic Stack (ELK) and are of common practice in the industry. - Development management lifecycle: A cloud service is mainly composed of software components that need to be a rchitected, developed, tested and deployed. The use of open source solutions to manage the lifecycle of the service is heavily spread. For instance, for the code management and versioning, the open source GitLab is steadily growing against GitHub, owned by Microsoft, which dominates the market. Continuous integration (CI) allows companies to automate the integration of the changes and new developments made resulting in several release cycles a day. Several open source solutions for this activity exist with Jenkins CI, Travis CI and Gitlab CI being the most used. OpenAPI Swagger is also a good example of an open source solution that allows to create Application Programming Interfaces (API) to foster interoperability within the components of the application and with other applications. The above are just some examples of how important open source is for the development and provision of cloud services. Hyperscalers also use open source software as baseline for their own solutions. As an example, AWS uses Open Telemetry78 as the underlying technology for their solution AWS Distro 79. Furthermore, c loud service providers, both non -EU (AWS, Oracle, RedHat) and European ones (e.g. SAP, Telefónica, Aruba, Atos, Deutsche Telekom) are large contributors to existing op en source communities such as the Cloud Native Computing Foundation, which encompasses relevant projects for cloud and edge. One-off adjustment costs for national public authorities. National public authorities will incur setup costs to establish open source repositories and the governance mechanisms defining contribution, review, and acceptance procedures. This has been estimated at 2 FTE per MS. Setting up repositories and understanding the challenges and governance mechanisms calls for a fruitful and engaging community, the assumption is that 5 repositories per MS will be initially created with an initial effort of 10 FTEs. Nine Member States already maintain a national Open Source Programme Office or equivalent coordination structure. The measure therefore focuses on strengthening governance and coordination, aligning existing offices and governance mechanisms , and supporting those Member States that do not yet have one. For modellin g purposes an assumption of additional 12 OSPOs created is taken, with a set-up cost of approximately EUR 2m. The estimates assume consistent institutional capacity across Member States, although in reality, OSPO maturity and reuse potential vary widely. One-off adjustment costs (NPA) = (number of OSPOs * set-up cost) + ((labour cost * effort to set-up the repositories and guidance)) * MS Recurrent adjustment costs for national public authorities. As software solutions developed by the public authorities are released as open source, new repositories or projects in repositories 78 https://opentelemetry.io/ 79 https://aws-otel.github.io/ 118 will have to be created, operated and maintained. The flagship initiative in this respect is Developers Italia that has created 408 repositories in a GitHub repository si nce 2017 80, averaging 50 a year but with different brea dth and scope. One new repository will be created every other year. This is a very conservative assumption. Reusing and re leasing source code open source incurs into additional costs as extra quality assurance procedures must be put in place such as DevOps CI/CD pipelines, Static Application Security Testing (SAST), Dynamic Application Security Testing (DAST), Software composition analysis (SCA), vulnerability testing, as well processes continuously automated, and generation of the software bill of materials (SBOM) for each piece of software released and reused. This is estimated in 10 FTEs yearly per MS. The repositories shall have to be continuously maintained and governed. The assumption is that the e ffort dedicated to these activities increase in 1 FTE every other year, in a similar manner to the number of repositories. For this impact assessment it is assumed that all repositories created along the timespan under study will remain active. However, this is often not the situation, where repositories become deprecated due to various circumstances such as low uptake and engagement. Recurrent adjustment costs (NPA) = ((number of new repositories every other year * effort * labour cost) * MS) + (cost of releasing open source code * MS) One-off administrative costs for national public authorities stem from the adaptation of the procurement templates to the notion of promoting the use of open source software, reusable across the board for all bids. This is estimated in 30 days. One-off administrative costs (NPA) = (effort to adapt templates * labour costs) * MS Recurrent administrative for national public authorities will involve the operation of the additional OSPOs accounted for (12, as a reference number), for a recurrent cost of approximately EUR 1m per OSPO. However, certain institutional costs (e.g., existing OSPOs) are considered as marginal coordination expens es rather than recalculated in full to avoid double counting. Recurrent administrative costs (NPA) = number of OSPOs * cost to maintain an OSPO Recurrent savings for national public authorities. By reusing and adapting existing software rather than commissioning bespoke solutions, administrations can reduce duplication of effort and lower the total cost of ownership (TCO) of ICT projects. Empirical evidence 81 82 and national case studies suggest that reuse can reduce costs by 10 –40 %, depending on ma turity and governance capacity. Savings stem from the avoidance of duplication, the possibility to reuse existing solutions increasing project efficiency and the decrease of the total cost of ownership. Reusing open - source software solutions, both from oth er public authorities and available in open source communities results in savings mainly through the avoidance of duplication of efforts but also because the time-to-delivery of a software solution is also shortened. These have been estimated as a percenta ge of an average contract value of custom -built mid -software development projects, estimated at EUR 500 000. For public administrations it is assumed a cost decrease of 80 https://github.com/orgs/italia/repositories? 81 European Commission (2021). The impact of Open Source Software and Hardware on technological independence, competitiveness and innovation in the EU economy 82 Frank Nagle (2019). Government Technology Policy, Social Value, and National Competitiveness. Harvard Business School Working Paper No. 19-103. 119 25% due to avoidance of duplication. The rate of adoption is set to 5% for 2027 and the n increasing at 2% yearly until 2036. Recurrent savings (NPA) = (Total cost of ownership * MS) + (savings for not duplicating the software * (Percentage of public procurement development projects addressed with OS solutions + Δ%) * number of tenders) Strengths and limitations of the assumptions in this policy measure There is only a small number of reputable studies and case examples that provide inputs for the detailed parameters underpinning the assumptions, and where such evidence exists, i t is often too coarse or anecdotal to support a full analysis. Consequently, the main quantitative assumptions draw on stakeholder consultations with industrial practitioners, open source communities and public administrations, conducted through interviews in the supporting study. Despite these constraints, open source has a clearly documented economic impact. At macro level, a 2021 study for the European Commission estimated that in 2018 open source software and hardware contributed between EUR 65 bn and E UR 95 bn to EU GDP . Stakeholder consultations in the course of the study highlighted vendor lock-in as a major cost driver, with public bodies becoming dependent on single, typically US based suppliers using de facto anti- competitive practices, and one sou rce estimating the resulting cost for European public administrations at around EUR 1.1 bn per year. Where cost savings are concerned, the literature and case material mainly qualify effects in terms of total cost of ownership, reuse and productivity, whic h are reflected in the modelling of this policy option, albeit public, detailed quantifications remain scarce. As part of the supporting study, these assumptions were cross checked with established open source organisations familiar with the costs of sett ing up OSPOs and the effort required to release code under an open source licence, and with public administrations that are already actively publishing open source software. In addition, the final validation workshop with software integrators, public authorities and cloud service providers was used to test and confirm several of the key assumptions. Given the aforementioned uncertainties, this option is accompanied by a more attentive sensitivity analysis than other measures, explicitly illustrating the range of possible outcomes resulting from the variability in the main assumptions. Sensitivity analysis: The parameters used for the sensitivity analysis include: 1) the number of the initial repositories that MS put in place at an initial stage, ranging from 5 (min and central value) to 25 ; 2) the effort to maintain and govern those repositories, with values moving between 0.6 FTE to 1.2 FTE, with the central value being 1 FTE ; 3) the costs to set up and maintain the OSPOs, ranging respectively from EUR 2m to EUR 3m (central value is EUR 2m) and EUR 8m to EUR 28m (central value is EUR 12m); 4) the effort and contract values of the OS projects developed in and for the public administrations. Whereas the effort varies from 2 FTEs to 5 FTEs, the average contract value ranges from EUR 400 000 to EUR 600 000; 5) the total cost of ownership (TCO) and 6) the sa vings for not duplicating software, ranging from EUR 80 000 to 4500 00, depending on the size of the project Indirect savings: Open Source can have broader economic effects. When public administrations increase their procurement and use of open source software, they create additional demand for open and 120 interoperable solutions across the wider economy. Evidence from France83 shows that a change in public procurement rules led to measurable increases in open source activity, firm -level adoption, and software-related employment. The same mechanism, applied at EU scale, would be expected to stimulate market growth and innovation in related sectors. These spillover effects are par ticularly relevant at regional level, where increased public sector use of open source can strengthen local digital ecosystems and create opportunities for SMEs to participate in public procurement through open interfaces and shared repositories. Innovation and productivity. Increased public-sector participation in open source development contributes directly to the European open source knowledge base. Studies 84,85 associate higher open source contribution rates with stronger productivity growth, faster di ffusion of digital innovation, and broader SME participation in the digital economy. Interaction model and mechanisms of impact. The policy measure operates through both endogenous and exogenous mechanisms. Endogenously, the adoption of open source first practices enhances the technological capability of public administrations. Reuse of existing code reduces project complexity and risk, while exposure to open development practices increases staff proficiency and institutional knowledge. This leads to lower operational costs and greater autonomy in managing digital systems, strengthening technological sovereignty and reducing dependency on specific vendors. Exogenously, wider public -sector use and release of open source software generates spillover effects ac ross the domestic IT ecosystem. Local suppliers are better able to engage with open codebases and participate in collaborative development, which can lower market entry barriers, increase competition, and improve the quality of public-sector digital solutions. These dynamics reinforce each other: a more capable public administration interacts with a more dynamic local IT environment, creating a self - sustaining cycle of capability and innovation. Results for all stakeholders aggregated and for the years cove red by this measure are summarized in the table below. Total implementation costs are driven largely by recurrent adjustment costs related to setup of the OSPOs and the repositories as well as adaptation efforts. Estimated cost savings range widely, from EUR 1.6 bn to EUR 12.0 bn, depending on the realization of efficiency gains. The variation in the min and max costs from the perceived costs of the proprietary software development tools along with the savings for not duplicating the software needed. Table 40. Boosting open source in public administrations (PM 20) Cost types Cloud & AI providers (€) Public authorities (€) European Commission (€) Total Value (central, €) Total Value (min, €) Total Value (max, €) one-off administrative - 10 389 481 - 10 389 481 6 926 321 13 852 642 recurrent administrative - 90 711 949 - 90 711 949 60 474 632 211 661 213 one-off adjustment - 108 623 131 - 108 623 131 56 488 617 184 117 928 recurrent adjustment - 1 654 037 343 - 1 654 037 343 1 050 849 399 2 373 048 085 one-off regulatory fees - - - - - - recurrent regulatory fees - - - - - - one-off enforcement. - - - - - - 83 Orientations pour l'usage des logiciels libres dans l'administration 84 "Free and Open Source Software and Hardware." Harvard Business School Technical Note 724-380, September 2023 85 European Commission (2021 ). The impact of Open Source Software and Hardware on technological independence, competitiveness and innovation in the EU economy. 121 recurrent enforcement - - - - - - Total costs - 1 863 761 904 - 1 863 761 904 1 174 738 970 2 782 679 868 Total benefits - (5 251 290 954) - (5 251 290 954) (1 653 692 346) (11 955 210 083) Net impact - (3 387 529 050) - (3 387 529 050) (478 953 376) (9 172 530 215) 3.21. PM21: Mandatory sovereign risk assessments for the use of cloud and AI computing services in the public sector Policy Measure 21 ( PM21) consists of two elements. First, it turns what is only a recommendation under policy measure 15 into a binding requirement for Member States. Member States shall carry out at least one sovereignty risk assessment and repeat it at least every four years or more frequently if deemed necessary. The purpose of the sovereignty risk assessment is to identify which public sector use cases within a Member State require the use of which sovereignty level as described under PM11. The sovereignty risk assessmen t would assess, inter alia, the risks induced by the access to such data by a third -country authority or third-country legal entity; or the risk of possible service disruption due to dependence on a single or limited number of third -country services provid ers. On the basis of dedicated discussions conducted with 3 different public authorities representing about 200 contracting authorities, this assessment assumes that the matching of sovereignty levels to public sector demand follows the following pattern: 70% of use cases would require a sovereignty level 1; 20% for level 2; 9% for level 3; and 1% for level 4. Even though the scheme is novel and does not correspond to existing frameworks, this assessment fits with broad orders of magnitude that can be inferred from existing analyses conducted in several Member States that have introduced risk assessments for their public sector clouds, such as France, Poland86 or Italy87. Critical use cases, defined as the use cases whose disruption would affect operational autonomy or public order, correspond to use cases covered by level 2, 3 and 4. The risk assessment would have to consider the reality of the supply market to avoid unrea listic outcomes, such as mandating the use of services that don’t exist (yet) in the market. To facilitate appropriate and coherent sovereignty risk assessments, the European Commission would develop guidelines for Member States to conduct such assessments and provide a sample risk assessment methodology (note that these guidelines concern the conduct of risk assessments and differ from PM12, which consist in explaining the different levels of sovereignty assurance). For Member States to have up -to-date information about the market conditions of cloud and AI sovereign solutions, the Commission would also produce market monitoring reports that will point Member States to possible gaps in the coverage of some services. The Member States would have to determine which public authorities are required to procure specific levels of sovereignty and make this mandatory at national level, ensuring that procurement aligns with the risk assessment, unless duly justified. While PM11 only puts forward the definition of sovereignty levels, PM 21 goes further by putting forward a framework through which the respective levels of sovereignty can be assessed. Cloud service providers shall submit the relevant evidence that demonstrate that they comply with the sov ereignty assurance criteria to the designated competent authority. For assurance 86 See Cloud in Government Services 87 See Strategia Cloud Italia 122 level 1, the service provider may issue a ‘Statement of conformity’ where they show that they comply with the cumulative criteria of this level. T he cloud provider will make the statement of conformity publicly available, and shall submit it, along with the necessary evidence, to the designated competent authority . Cloud computing service providers qualifying as SMEs will not be required to undergo the validation by the national competent authority. The assessment of the compliance of the service against the criteria for sovereignty level 2-3- 4 will be performed through independent third party’s auditors. In this case, the service provider will submit the audit report and the ‘positive’ audit opinion, along with the audited evidence, to the competent authority of the country of establishment who shall verify them, without undue delay and within 60 days . The result of this activity is a draft acceptance, request for more information or rejection decision. • In case the assessment is positive, the decision will be notified to the other Member States, who have a 60 day review period to confirm the initial acceptance conclusions by the MS of the country of establishment . During the period of review there is a recourse possibility for the Member States. If no reasoned objection has been submitted in the framed period , the validation of the audit report and audit opinion shall be considered accepted by all Member States and the service shall be recognized across the Union as a service provider that can participate in public procurement procedures across the Union . On the other hand, if reasoned objections exist, the competent authority shall assess them and decide on the maintenance or revocation of their original decision. In cases of continued objection, the Commission shall assess it. This may entail a request for additional information from the competent authorities . The Commission decision shall be binding. • In case the assessment yields a n initial rejection, the competent authority will contact the cloud provider and give the opportunity to the organization to provide comments on the evaluation. The competent authority will take into consideration these comments. • In the case where the competent authority assesses that the submitted evidence is not sufficient, it will request the cloud service provider additional information to be provided within a certain time limit, in order to be able to issue a decision. The competent authorities should register the decision in a Union repository, maintained by the Commission. The repository of sovereign cloud and AI computing services will be a public list of audited sovereign cloud and AI computing services that verifiably comply with the sovereignty requirements. The benefits are for providers and users alike: providers will enhance their visibility and users their market research. To cater for market evolutions, the sovereignty criteria of all levels and evaluation evidence proposed, but not limited to, would be modifiable by comitology. This evaluation evidence would help independent third party auditors in their assessment of the service and ensure full harmonisation in the way different auditors conduct their assessment and for Member States to ensure that the procedures have been followed. The assessment would be periodically renewable following the same evaluation methodology. 123 Policy measure 21 implies that the Commission sets up and maintains a repository of the services audited against level 2-3-4, and that public authorities assume the actual transfer cost to change from a non-sovereign service to a sovereign service (cloud porting). This measure is primarily designed to contribute to the protection of public order by enhancing the resilience in the public sector, which is SO4. Nevertheless, European providers would face less costs and efforts to meet sovereignty conditions. When it comes to meeting the criteria to demonstrate sovereignty level 1 and 2, EU providers can more readily substantiate that they are not affected by third -country policies affecting data access or limiting service continuity. As well, level 3 and level 4 sovereignty can only be served by service providers owned and controlled by EU entities. This implies that PM15 will also contribute to decreasing the overall reliance on non-European cloud and AI computing services, which is SO3. Second, private sector essential entities listed under Annex I of NIS 2 are encouraged to integrate into the cybersecurity risk assessment they already conduct, the assessment of the risks stemming from their use of cloud and AI computing services. This includes an analysis of the laws applicable to the computing service and the extraterritorial reach of such laws; the risks associated to the possible unauthorised third country governm ent access to and transfer of data; the risks associated to service continuity and quality; the operational dependency and possible loss of autonomy. One-off adjustment costs for the European Commission Setting up and maintaining the repository of sovereign cloud and AI computing services under the sovereignty levels . These costs include the drafting of the tender specifications for an external provider to build, develop and maintain the repository plus additional time for the evaluation and the definition of their governance procedures. This has been estimated to 120 staff days. The repository will be developed by an external contractor with a contract value of EUR 500 000. One-off adjustment costs (EC) = (time to draft tender specifications for the repository) * labour costs + external contract to develop the repository Guidelines for MS to perform the sovereignty risk assessments . In order to support Member States in the implementation of their sovereignty risk assessments, the Commission will publish guidelines. These guidelines would include the process to carry out the risk assessment, the criteria that would allow them to identify the scope, for instance by means of use cases and / or applications, the data classification process, where the marke t surveillance or information on sovereign services can be found . The estimated effort for the development and publication of these guidelines is 2 FTEs over 1 year. Recurrent adjustment costs for the European Commission. Maintenance of the repository for sovereign services. Another important activity is related to the maintenance of the repository of audited services and adjacent activities, including: • Yearly hosting costs of the repository, estimated to be of EUR 200 00088. The repository will be deployed on a sovereign cloud at the Commissions’ premisses and telemetry and FinOps procedures will be put in place to control expenses. 88 Estimation based on the values of Simpl 124 • Yearly maintenance of the repository, performed by an external contractor, includes the upgrades of the software libraries amidst identified vulnerabilities, correction of errors and bugs and additional features. The estimated effort assumed for this is 2 staff days on a weekly basis. • Oversight of the repository, including the follow -up of the contractors’ activities, estimated in 2 staff days per month by the Commission staff. Recurrent administrative costs (EC) = costs of the yearly hosting + external contract for the yearly maintenance of the repository + (number of days for the oversight of the repository * labour costs) Market monitoring. In order to assess the status of the cloud and AI computing services market, the Commission will run a study for the first three years after the adoption of CADA. The goal is twofold. On one hand, it will provide input for the dependency analysis to be carried out and on the other, it will provide a deeper knowledge of the status and evolution of the cloud and AI computing services to serve for the procurement of sovereign cloud and AI services (see PM19). The limited timespan of the study is due to the following rationale: while initially this will be of importance due to , in some cases, low knowledge of existing offers, the repository and the catalogue of sovereign services would allow for a wider and deeper knowledge of the market by the contracting authorities. This study is estimated to cost EUR 300 000 / year for three years. One-off adjustment costs for national public authorities. Risk assessments. National public authorities and regional or federal authorities in the case of decentralized Member States are mandated to perform a sovereignty risk assessment, with the aim of mapping sovereignty assurance levels to cloud and AI computing services used i n the public sector, taking into consideration aspects such as sensitivity and criticality of the data processed, risk associated to the potential unlawful access to data by third country legislation, potential disruption of the services, the service type based on a taxonomy that the Commission will publish as part of their guidance, existence of cloud and AI computing services audited under that sovereignty level, among others. The estimated number of authorities is 267, considering the NUTS-0 and NUTS-1 distribution. The output of this result assessment will be a classification of application s or use cases categories mapped to the minimum sovereignty assurance level permitted for the procurement of cloud and AI services serving those cases. An important e lement of the sovereignty risk assessment is that the existence of sovereign commercial offers will be considered as part of the exercise . This will allow to not request offers that are not available in the market or that would cause disproportionate costs to the contracting authorities as part of the procurement process. The estimated effort for this sovereignty risk assessment is of 10 FTEs. This is a new activity for which there is yet few expertise in the Member States. It is consi dered that in the initial iteration, Member States will need to understand well the sectors, applications and type of data, among other aspects , that will drive their risk appetite to request one sovereignty level or another. It is expected that initially this will be an activity encompassing various ministries and agencies and therefore an intensive collaboration is expected. The guidelines from the Commission, however, should alleviate this effort. The risk assessments will start in 2029, once EUCS and the sovereignty scheme are in place. 125 Designation of the competent authority, which has an estimated of 0.2 FTE per MS, which will be responsible to verify the audit reports received from the providers that had their services audited at sovereign level 2 at least. Costs of migration to sovereign cloud by the public sector. Detailed information is provided in Annex 12 on the methodology and calculation of the costs for the migration and porting of cloud applications to sovereign cloud services. Both the migration of the legacy-to-sovereign cloud and cloud-to-sovereign cloud applications will be performed in a linear distributed manner in a time frame spanning 5 years, starting in 2029, once there is a set of sovereign audited services. The average cost of porting a single application to a new cloud varies from EUR 30 000 and EUR 600 000 depending on the size of the application, and not much on the type of cloud at origin or destination, as they are mainly based on human effort (400 to 8000 hours of work). See Annex 12 for an explanation of these figures. These costs are illustrated with the real use cases in Section 6.1.2 of the main text but have not been quantified in the cost-benefit analysis, although they are described in detail in Annex 12. Since they represent planned expenditure that would be incurred in the future as part of the regular cloud contract renewal cycles and independent of the present policy measure, they have been considered outside of the cost-benefit so as not to conflate structural renewal costs with the incremental financial impact of the measure itself. Recurrent administrative costs for national public authorities. Sovereignty risk assessment. This risk assessment shall be renew ed every 4 years. The effort estimated for this reassessment of the sovereignty risks is estimated to be 5 FTEs, a lower effort than implementing the risk assessment from scratch, given that the activity is already ramped up and the Member States would already have a good understanding of their situation. Revision of the audit reports by the competent authorities, estimated at 5 days per service audited at sovereign level 2 -4. After verifying the audit report, opinion and evidence and consulting with the other competent authorities, the evaluating competent authority will adopt a decision that would allow a service provider to participate in public procurement activities. Recurrent savings for national public authorities Running applications on the cloud. Operating applications on the cloud, if performed well, with a continuous FinOps verifying that services are not overprovisioned can lead to significant savings. Literature sources estimate that the total cost of ownership (TCO) savings can amount to 20-50% in the case of legacy -to-cloud migrations89. No savings are here accounted for in the operation of applications migrated from cloud-to-sovereign cloud, as the applications would have already been benefitting from the total cost of ownership savings. Simpler p ublic procurement. Savings in this respect stem from the simplification of systematically using procuring audited services, which are part of the repository of sovereign cloud and AI computing services. This shall allow public administrations to save time in the verification of the documentation for the evaluation of the offer. This will result in 2 staff days 89 Chatzithanasis & Michalakelis (2018) estimates 24% to 50% The Benefits of Cloud Computing:. Ali Khajeh-Hosseini, David Greenwood, Ian Sommerville 126 per bid, and assuming that there are 3.5 potential contractors presenting bids in each tender procedure. Recurrent savings = Average number of yearly service bids requiring sovereignty assurance level 2 – 4 * staff costs savings per bid Sovereign services. The savings from using sovereign services cannot be quantified due to the intangible nature of sovereignty and resilience. Costs for service providers to develop sovereign services Assessing the cost and benefits for providers to prov ide sovereign services is a complex task that involves many parameters and differs greatly from provider to provider. As well, in the absence of an established market for sovereign services, data sources are rather anchored in providers’ business plans, no t in ex post analysis of established businesses. Such data is confidential to companies, and the below considerations are based on targeted discussions with stakeholders that requested to remain anonymous. A first consideration is that the consulted companies unanimously indicated that, in developing the business plan for these new services, they count on new large critical use cases that are today not in the cloud; in other words, they see sovereign services to generate a new source of income, but not to substitute existing. Cost wise, new costs notably include the amortisation of all one -off adjustment costs such as the additional cost induced by using EU-located infrastructure, the additional compliance costs induced by the audits, the additional costs of being certified under EUCS; and proper recurrent costs such as the higher salaries of employing EU workforce. As an illustration, speaking under the condition of anonymity for business secrecy reasons, one of the largest EU service providers of sovereign services speaks of a n overall investment of EUR 1.5 bn , including hardware, for a broad range of IaaS and PaaS services (for an unspecified computing capacity). Conversely, another EU service provider with an established range of non -sovereign services speaks of an overall investment in the range of EUR 20 -40 m to adjust existing hardware and software to the stricter norms that a sovereign service entails, with plans to invest progressively should the market develops. The benefits for service providers to develop sovereign se rvices are covered under section 6.1.5. Benefit wise, cloudifying legacy on -premises services means new revenues. As to the move from traditional cloud to sovereign cloud, today’s few available sovereign services come with a mark-up which is still too uncertain to draw conclusions (see discussion under Problem Driver 4 in 2.3.4) . To this additional income, consulted EU service providers see also sovereign services as niche market where they have a demonstrable added value that could spill over to other market segments. The consulted companies unanimously indicated that it is too early to confirm whether, over the span of the next ten years, the incremental cost and benefits would reach the same balance (i.e. margins) as with equivalent non-sovereign services, which is today commonly assumed to be around 30%90; to cater for this uncertainty, this assessment assumes that stakeholders’ margins vary from 25% to 35%. 90 Amazon Web Services profits squeezed as AI arms race drives spending surge – GeekWire 127 One-off adjustment costs for cloud an AI computing service providers Ultimately, the decision of a provider to subject to the sovereignty assessment one or more services is their own business decision. However, in order to have a sense of magnitude of how many providers could be affected by the sovereignty scheme and based on extensive desk research conducted as part of the preparatory study (Technopolis et al., 2025), it was identified that services from 59 non-EU headquartered cloud service providers meet Level 1 requirements and would be able to qualify to Level 2 should they decide so. 226 EU headquartered providers could qualify their services as Level 2 and would be able to qualify their services as Level 3 should they decide so. If only large companies are considered and SMEs are excluded, the figure goes down to 59 EU headquartered large companies. The assumptions are as follows: 600 services will be audited from 2029 until 2034, with the assumption of 30 audits the first year , and an annual growth of 8 2%. This builds over the number of services currently qualified in comparable national qualification and certification schemes91, and the FedRAMP mechanism. As of September 2025. the FedRAMP repository contains 530 authorised services under level moderate and high. Audit: Services may be audited under different assurance levels, provided that the criteria mentioned above (see PM11) are met. For the purpose of this impact assessment, it is estimated that the proportion of services that get a positive audit report across the different assurance levels will be mirroring the needs of the public authorities (see below). This would then make that out of the estimated 600 sovereign cloud services 92: • 70% of the services will be Sovereignty Assurance Level 1, making 420 services • 20% of the services will be Sovereignty Assurance Level 2, resulting 120 services • 9% of the services will be Sovereignty Assurance Level 3, amounting to 54 services • 1% of the services will be Sovereignty Assurance Level 4, resulting in 6 services. The effort needed to get audited as sovereign under the sovereignty assurance level 2 -4 is estimated to be 15 FTEs. This includes the definition and implementation of the necessary legal, organisational and technical measures to reach sovereignty assurance level 2 – 4 and the auditing procedure carried by the third party auditor . This effort was validated in the Final Validation workshop held as part of the study led by Technopolis. One-off adjustment cost of new audits (CSAP) = (effort to get audited sovereignty assurance level 2 – 4 * labour costs) * number of audited services assurance level 2 – 4 One-off regulatory fee for cloud and AI computing service providers New audits, the fee is assumed to be EUR 20 000, for the estimated number of services awarded sovereignty assurance level 2– 4. One off regulatory fee for new audits (CSAP) = regulatory fee * number of services sovereignty level 2 – 4 Recurrent regulatory fee for cloud and AI computing service providers Renewal of audits: fee is assumed to be EUR 14 000.. 91 For this impact assessment ES, IT, and FR have been considered as baseline as their data is public. (92) see footnote 90 128 Recurrent regulatory fee for new audits (CSAP) = regulatory fee * number of audited services assurance level 2 – 4 Recurrent administrative costs for cloud and AI computing service providers Audits: These compliance costs stem from the audits . to maintain the positive audit report , where the goal is to verify that the conditions under which the sovereignty level was obtained remain valid (e ffort estimated as 3 FTE/year per service). Compared to the effort needed to achieve the award of a sovereignty level , the effort dedicated to the intermediate audits has been assumed to be lower than obtaining the initial qualification, in spite of the annual reporting obligations set out above. Recurrent administrative compliance cost of sovereignty level renewal = (time to be audited * labour costs) * number of services sovereignty level 2 - 4 Recurrent savings for cloud and AI computing service providers Audits. A crucial matter in the analysis of the recurrent savings for cloud and AI computing service providers is the single market effect especially considering the mandatory nature of this policy measure. Providers will be abl e to audit their services in one MS and be able to offer them in public procurement procedures in all EU-27. The analysis assumes that in the business- as-usual scenario one cloud service provider would seek to run the audit for one service in 10 MS to be on the conservative side. Given the costs of compliance, in a business-as-usual case, a cloud and AI computing service provider would carefully prioritize in which MS(s) it would seek to obtain a similar audit of a service usually taking into consideration aspects such as the market share or other commercial opportunities. Saving costs audit valid throughout the EU = Number of MS where the Cloud and Service Providers would get audited * cost to get audited * number of audited services assurance level 2 - 4 Public procurement. Another relevant saving stems from the fact of not having to collect and resubmit all the evidence necessary to demonstrate that the criteria are fulfilled for each bid, given that the certified services are listed in the repository and accessible for the contracting authority. The assumption is that undertakings will save 2 staff days / year p er service and bid. The number of yearly bids amounts to 50 a year. Business costs saved: = Businesses time saved per evidence submission in a tender procedure * number of submitted bids Recurrent administrative costs for the private sector (Auditors) Third party audits. In this PM, as mentioned above, the target number of cloud and AI computing services audited as sovereign is estimated to reach 600 by 2032 93, whereas 30 of these will reach sovereign level 2 -4 during the first year . The assumed CAGR is 82%. The assumption under this policy measure follows a linear progressive uptake of the audit scheme. The estimated average effort for auditing a service under Sovereignty assurance level 2 -4 is 110 days / audit. The same effort is considered for the renewal process. 93 Assumption taken considering the current valid authorised cloud services in FedRAMP moderate and high, which amounts to 531 as of 26 September 2025. 129 Recurrent administrative costs for the private sector (Private sector essential entities operating in sector listed under NIS2 Annex I) Risk assessment. These are the costs incurred by essential private sector entities listed as under annex I of NIS2 to sovereignty related risks in their current risk assessments. The effort estimated is 60 staff days per essential entity for the first year and 12 staff days for the following ones to account that the novelty generates larger work that re-doing it. The SWD published as part of the proposal for the Digital Omnibus 94 estimates that the number of all entities, essential and critical, from the private and public sector, affected by NIS2 Annex I amounts to 160 000. France's NIS2 available data, indicates that 20% of its entities are classified as essential entities under Annex I, with the remaining 80% designated as important entities under Annex II95. Re-using the same ratio for the EU implies 160 000 * 20% = 32 000. To which the private sector is assumed to represent 80%, or 32 000 * 80% = 25 600. Indirect savings: Similarly to PM15, through this measure, cloud and AI computing services able to adequate their processes to comply with the audit scheme will increase trust from public administrations, and notably for the use cases identified as need -to-be sovereign based on the sovereign risk assessments performed. This will result in more trustworthy, credible and very specialized as well as very advanced offers responding to challenges such as resilience and autonomy. Given the mandatory nature of this PM, the indirect savings are expected to be larger in this measure than in PM15. Sensitivity analysis: The most affected parameters for this Policy Measure are as follows: 1) the effort needed by a cloud and AI computing service provider to obtain the audit; 2) the number of MS where cloud and AI computing services would seek the audit in the absence of a single market; 3) the initial number of cloud and AI computing services audited during the first year and the annual growth; 4) the number of submitted bids per year ; 5) effort by the private sector for the risk assessments, 6) effort by public authorities for the risk assessments. Results for all stakeholders aggregated and for the years covered by this measure are summarised in the table below. The main source of variation in the min and max comes from the cost savings, and notably the savings from the EU-wide validity per service for cloud and AI computing service providers and the number of countries where providers would audited/validated, in the event the scheme would not exist. Table 41. Mandatory sovereign risk assessment for the use of cloud and AI computing services in the public sector (PM21) Cost types Private sector Cloud & AI providers (€) Public authorities (€) European Commission (€) Total Value (central, €) Total Value (min, €) Total Value (max, €) one-off administrative - - - - - - - recurrent administrative 1 439 144 597 80 856 542 562 624 1 520 563 763 540 444 577 2 763 406 090 one-off adjustment - 254 272 125 154 624 928 693 692 409 590 745 247 443 239 571 738 249 recurrent adjustment - - 68 603 894 2 965 857 71 569 751 44 128 193 44 128 193 one-off regulatory fees - 3 022 890 - - 3 022 890 3 022 890 3 022 890 94 SWD(2025)836 final 95 Cybersécurité : la transposition de la directive NIS 2 examinée le 11 mars au Sénat 130 recurrent regulatory fees - 3 367 639 - - 3 367 639 3 367 639 3 367 639 one-off enforcement. - - - - - - - recurrent enforcement - - - - - - Total costs 1 439 144 597 341 519 196 223 791 446 3 659 549 2 008 114 787 838 406 538 3 385 663 062 Total benefits - (3 349 440 466) (2 507 623) - (3 351 948 089) (1 676 992 882) (5 085 107 859) Net impact 1 439 144 597 (3 007 921 270) 221 283 823 3 659 549 (1 343 833 301) (838 586 344) (1 699 444 797) This policy measure would trigger an acceleration of porting of some applications to sovereign cloud services of assurance levels 2 to 4, requiring an anticipation of expenses of EUR 3 to 15 bn. These costs are estimated and reported under section 12.4 of Annex 4. Since they represent planned expenditure that would be incur red in the future as part of the regular cloud contract renewal cycles and independent of the present policy measure, they have been scoped outside of the summary cost table so as not to conflate structural renewal costs with the incremental financial impact of the measure itself. The benefits accruing from the risk reduction, notably an increased autonomy and strengthened operational resilience through the adoption of sovereign cloud and AI computing solutions are intangible and cannot be expressed in qua ntitative terms. While these benefits cannot be quantified, they are acknowledged as a significant consideration underpinning the policy rationale. 3.22. PM22: EU-level Procurement of cloud and AI computing services PM22 builds on top of PM17, establishing in addition a framework for the public procurement at EU-level of data centre, cloud and AI computing services. Cloud Capacity in the Public Sector. Same assumptions as in PM 17 are taken for all impacts related to t he public sector cloud federation. Same number of p ublic authorities at all levels participate in the public sector cloud federation. Joint Procurement. The Union procured 2,5 trillion EUR in services in 2024, from 250.000 public authorities 96. Section 2.4.3 (“Public procurement contract values for cloud and AI computing services”) of this annex shows that cloud and AI computing services represented 0,68% of the total services procured by the public sector in Europe in 2024. The value of cloud and AI contracts procured by the public sector in that year (0.68% x EUR 2,5 trillion = EUR 17 bn) is projected to the future using the CAGR observed in the period 2021-24 (20%) for the first years up to 2030 and a half of that from then on. A progressive roll-out of the EU -level joint procurement is considered, starting at 2% of the procured service volume (EUR 340 m) and increasing by 2 additional percentage points every year, reaching 22% at the end of the 10-year period (EUR 21 bn). The level of savings will also increase over time as higher volumes are aggregated, and experience is gained, starting at 10% and growing annually by 4 additional percentage points till 2032, reaching 30% in that year. One-off adjustment costs for the European C ommission include those related to set up the platform for federation, procurement, brokering and service aggregation. These costs include 4 persons half time in 2027 (2 FTE) from the Commission to run the procurement process for the 96 From Public Procurement Data Space: https://www.public-procurement-data-space.europa.eu/en 131 platform (define requirements and prepare the call, assess and refine the proposals and award the contract), that will be tasked to a subcontractor for development and deployment at an estimated cost of EUR 40 000 000. This figure represents additional EUR 20 000 000 with respect to the federation platform considered in PM17 to cover the service repository, procured service catalogue and brokering and service aggregation functionality. One-off adjustment costs = Platform costs + EC Staff costs for platform procurement Recurrent adjustment costs for the European Commission relate to hosting the platform in a cloud, estimated at 1.5 million EUR per year, operating, maintaining and evolving the federation platform, with an effort of 100 contractor FTEs per year (40 additional to th ose required in PM17 to cover the extended functionality). The Simpl programme has been used as a reference for the underlying costs assumption97 . Recurrent adjustment costs = Hosting + Maintenance & Integration contractor costs Recurrent administrative costs for the European Commission, stem from the costs to manage the cloud federation and the operation of the joint procurement process. In addition to the resources of PM17 to set up the public sector cloud federation, a further 12 FTEs are dedicated in 2027 to design and setup the joint procurement framework. On a yearly basis, in addition to the resources estimated in PM17 to manage the cloud federation, a further 20 FTEs are dedicated to run the EU-level procurement processes. Recurrent administrative costs for the European Commission = costs to manage the federation + operation of the joint procurement process One-off and recurrent adjustment costs for national public authorities . The Public Authorities dedicate the same effort as in PM17 to participate in the setup of the public sector cloud federation, and to connect the infrastructures and keep updated the characteristics of the shared resources in the federation platform. Recurrent savings for national public authorities. Recurrent savings from federation, coming from reducing idle capacity, getting cheaper computing resources and reducing the coordination effort for sharing cloud, are the same as in PM17. With regards to the procurement of cloud and AI computing services, it is assumed that each Public Authority dedicates an average of 3 FTEs. Thanks to joint procurement, 0.5 FTEs are assumed to be saved in the procurement process in each of the Public Authorities. The demand aggregation and service composition provided by the service platform will save additional 0.5 FTEs per Public Authority, coming from buying more efficient pre-integrated solutions. The participation in the joint procurement framework and the aggregation of demand in the common EU-level procurement process will produce 2 effects: a reduction in the FTEs required for procuring cloud and AI computing services (see above) and a reduction in service prices coming from higher scale, purchase power. 97Simpl: Cloud-to-edge federations empowering EU data spaces 132 Recurrent savings = saved effort in PAs x NPA staff cost x number of PAs + cloud and AI computing service procurement volume x % procured at EU-level x % discount The share of cloud and AI computing services procured at EU-level and the discount achieved by aggregating demand at EU -level grow over the years at the rate described above in this section. Indirect savings: The increase in public procurement of cloud and AI sales volume that is addressable by European providers may help to increase their scale and competitiveness and their share in the European and global cloud and AI markets. Joint procurement and federation can also help in accelerating cloud and AI adoption in public administrations thanks to the reduction in service costs. Sensitivity analysis: The results have been challenged in terms of savings for national public authorities namely: 1) Yearly administrative time saved thanks to fewer coordination needs for national public authorities; 2) FTEs saved thanks to joint procurement – yearly; 3) Savings in terms of effort incurred by parti cipating PAs due to the possibility to aggregate demand and compose services - yearly; Considering IaaS + PaaS + SaaS, deployment automation. Midsized application. All values were set to range between a min of 0.1 to a max 0.5 FTEs corresponding to a min of 22 days to a max of 110 days; 4) capacity shared by each MS with the federation ranging from 5% to 15% which impacts the savings in terms of idle capacity reduction. Results for all stakeholders aggregated and for the years covered by this measure are summarised in the table below. In all scenarios including the average, min and max savings outweigh costs. The main source of variation in the min and max comes from the cost savings, and notably the savings in terms of idle capacity reduction. Table 42. EU-level Joint cloud and AI Procurement (PM22) Cost types Cloud & AI providers (€) Public authorities (€) European Commission (€) Total Value (central, €) Total Value (min, €) Total Value (max, €) one-off administrative - - - - - - recurrent administrative - 18 689 579 18 689 579 18 689 579 18 689 579 one-off adjustment - 4 613 563 40 009 806 44 623 369 44 623 369 44 623 369 recurrent adjustment - 213 669 483 163 981 548 377 651 032 334 125 766 421 176 297 one-off regulatory fees - - - - - - recurrent regulatory fees - - - - - - one-off enforcement - - - - - - recurrent enforcement - - - - - - Total costs - 218 283 046 222 680 933 440 963 980 397 438 715 484 489 245 Total benefits - (34 199 254 362) - (34 199 254 362) (19 170 613 237) (49 227 895 486) Net impact - (33 980 971 315) 222 680 933 (33 758 290 382) (18 773 174 523) (48 743 406 241) 3.23. PM23: Financial support for SMEs to adopt cloud and AI This policy measure puts forward a targeted scheme to provide financial support to SMEs for adopting cloud and AI computing services to increase their productivity and competitiveness. A yearly budget of EUR 40 050 000 is considered over the 10 -year period . Th is is done for modelling purposes only and does not pre-empt the next MFF: 133 • Most of it, EUR 38 500 000, is dedicated to supporting the design and planning phase of cloud and AI-based transformation projects for SMEs. o The grants are fixed amounts that the SMEs can spend in consultancy services to design digital transformation projects based on cloud and AI technology. o The amount will depend on the size of the SME: small SMEs (10 to 50 employees) will receive EUR 10 000 and midsize SMEs (50 to 250 employees) EUR 25 000. o The grants can be spent in services from a catalogue of self-published organizations maintained by the Commission that will include consultancy service providers from the IT sector in all MS. The catalogue would be populated based o n an objective and transparent process. o The objective is reaching 2% of the small (10 to 50 employees) and midsize (50 to 250 employees) SMEs over the 10-year period. • Every year, the SMEs that have designed the most innovative cloud and AI -based transformation project plans will receive additional support to fund their implementation: o small SMEs would receive EUR 100 000 each. o midsize SMEs would receive EUR 250 000 each. o Total yearly budget for awards would be EUR 1 050 000. o A jury will assess the pr oject plans designed every year and select the ones to be awarded. • The rest, EUR 500 000, serves to communicate and create awareness of the programme, and disseminate the results, giving visibility to the most successful and innovative project to serve as relevant references that may inspire SMEs across the different sectors and MSs: o The awards will be communicated and made visible through reports, social media, and events, and the project descriptions will be made available in a web site to serve as references. o The awards will reward innovation and its transformation impact in terms of efficiency, productivity and competitiveness. o There will be a balanced distribution of the awards among sectors and MSs, so that relevant references are created across all markets. o An SME project assessment team will define specific criteria for awarding the grants and select the awarded SMEs out of the presented proposals. The calculation of the evaluation efforts considers that there are 5 proposals presented for each awarded grant. The SME Performance Review report shows that there are 26.1 million SMEs in Europe, out of which 24.5 million are micro enterprises (less than 10 employees), 1.4 million are small enterprises (10 to 50 employees) and 214 ,000 are midsize companies (50 to 250 employees). The cloud adoption scheme applies to small and midsize enterprises, with the objective of reaching 2% of each category in the 10 -year period. This means a total of 32 200 companies engaged, 28 000 small ones and 4 200 midsize ones, will be direct beneficiaries. The awarded SMEs will use the award to contract consultancy services from a catalogue provided by the Commission that will contain service providers from different MS and diverse profiles. These providers will be mostly local IT SMEs with skills in cloud and AI technology, that will be indirect beneficiaries from this policy measure. Eurostat reports 1 281 000 businesses in the ICT sector 2, out of which 820 800 are dedicated to computing, consultancy and related services. From Eurostat’s database3, the number of micro companies (less than 10 employees) in the ICT sector is 1 220 000 (as of 2020), 53 000 are small (10 to 50 employees) and 12.000 are medium size (50 to 250). The catalogue of digital consultancy se rvice providers will contain some of the European small and midsize IT 134 enterprises (66.8% of the ICT sector, 43 420 companies in EU) that have the right skills and resources. Assuming that each service provider manages 5 consultancy projects along the 10 - year period, the policy measure could indirectly benefit 6 440 IT SMEs that would support the awarded SMEs in their project design and planning. One-off and recurrent administrative costs in the European Commission. The Commission will apply an effort of 1 FTE for the design and set up of the cloud and AI adoption programme, requiring consultation with stakeholders (Member States, associations and SME representatives) and the elaboration of the programme description. The infrastructure required to run the programme, manage the calls and monitor its execution would re -use existing infrastructure and is accounted for here. The cost of the catalogue and the onboarding of IT consultancy service providers are considered negligible. On a recurrent basis, the Commission will need 100 staff days to administer the cloud and AI adoption programme, including the preparation, launch, management and closing of the different calls, and 0.6 staff days to assess each of the proposals presented. The grants will amount for EUR 10 000 and EUR 25 000 for small and mid-sized SMEs respectively. One-off administrative costs in SMEs. The effort to prepare a project proposal is estimated to be 2 persons for 10 days (20 staff days). A sensitivity check for this parameter is accounted for. Cost savings in SMEs. The benefits stem from the design of the projects supporting the AI- based transformation. The percentage of small and mid -sized companies benefitting respectively from the EUR 10 000 and EUR 25 000 grant is 2%. Indirect savings: the expected increase in the adoption of cloud and AI computing services in European SMEs from different sectors resulting from this initiative is discussed in section 2.5.5 of this annex. Sensitivity analysis: The policy measure depends mainly on the targeted reach (% of benefitted SME). Results for all stakeholders aggregated and for the years covered by this measure are summarised in the table below. Table 43. Financial support for SMEs to adopt cloud and AI (PM23) Cost types SMEs (€) Public authorities (€) European Commission (€) Total Value (central, €) Total Value (min, €) Total Value (max, €) one-off administrative 55 373 982 - 84 269 55 458 251 27 725 295 83 443 215 recurrent administrative - - - - - - one-off adjustment - - - - - - recurrent adjustment - - 339 317 286 339 317 286 171 954 564 509 704 787 one-off regulatory fees - - - - recurrent regulatory fees - - - - - - one-off enforcement. - - - - - - recurrent enforcement - - - - - - Total costs 55 373 982 - 339 401 554 394 775 537 199 679 859 593 148 002 Total benefits (328 412 809) - - (328 412 809) (164 206 405) (495 604 785) Net impact (273 038 827) - 339 401 554 66 362 727 35 473 454 97 543 217 135 3.24. PM24: Tools to enrich EU cloud and AI computing services offering This policy measure sets up actions to improve the competitiveness of European cloud and AI computing services by facilitating tools to improve their service offer and meet the demand for cloud and AI computing services in different sectors. The aim is to a) promote the development of open source tools that allow to combine, compose and integrate diverse functionality to deliver more complex services and ease their consumption, deployment and o peration (the “Toolbox”), b) make visible these tools and other open source software components for cloud and AI computing services in a repository at Union level (the open source Cloud and AI “Repository”). The Repository will improve their visibility and accessibility to the cloud and AI service provider community, and the Toolbox will facilitate smaller providers to enrich and enable a more integrated and competitive offer of cloud and AI services, reducing the functionality gap with the rich marketplaces provided by the dominant players. One-off administrative costs for the European Commission . The Commission will dedicate 0.5 FTEs during the first year to design the programme (s) for the development of Toolbox components. Recurrent administrative costs for the European Commission . 0.5 FTE is estimated to manage every year the repository , review and monitor the programme(s) and run administrative, compliance, financial , communication and community engagement work associated to the Toolbox development and the open source Repository. One-off adjustment costs for the European Commission. The Commission will allocate 500 000 EUR as one-off cost for building the cloud and AI service toolbox repository and will dedicate 0.5 FTEs to procure it and set it up. Recurrent adjustment costs for the European Commission. The EC will engage an external contractor to maintain the service repository with each year 1 FTE. The EC will host the platform with a yearly cost of 100 000 EUR. A community of cloud and AI computing service providers, software and technology providers, cloud and AI consumers from different sectors , research organizations and public sector organizations will be set up to help in defining requirements and objectives for the development programmes and for the repository , and provide feedback about the results to steer them properly. Indirect savings: the expected benefit is an qualitative improvement of the offer of Cloud and AI computing services from European providers that will increase the competitiveness of their portfolios and help them gain market share and scale. The open source nature of the developments will also contribute to the compatibility, interoperability and portability of solutions among European cloud and AI service providers , improving the freedom of choice for customers and competition. Due to the community nature of the development, it will also increase innovation by allowing contributions and reach for small companies and individuals. Sensitivity analysis: The benefits are only presented from a qualitative perspective. Results for all stakeholders aggregated and for the years covered by this measure are summarised in the table below. Table 44. EU cloud and AI toolbox (PM24) 136 Cost types Cloud & AI providers (€) Public authorities (€) European Commission (€) Total Value (central, €) Total Value (min, €) Total Value (max, €) one-off administrative - - - - - - recurrent administrative - - - - - - one-off adjustment - - 542 134 542 134 542 134 542 134 recurrent adjustment -. - 2 364 883 2 364 883 1 938 373 2 791 393 one-off regulatory fees - - - - - - recurrent regulatory fees - - - - - - one-off enforcement. - - - - - - recurrent enforcement - - - - - - Total costs - - 2 907 017 2 907 017 2 480 507 3 333 527 Total benefits - - - - `- - Net impact - - 2 907 017 2 907 017 2 480 507 3 333 527 4. STRENGTHS AND LIMITATIONS OF THE ANALYSIS This impact assessment uses as main basis the results and the modelling stemming from the study carried out by Technopolis Group. In spite of extensive efforts to collect relevant data through surveys, interviews and workshops certain gaps remain. There are a number of points for which projections and estimat es had to be considered. For instance, there is no clear objective value on the deployed data centre capacity in the EU. The s tudy carried out by Technopolis et al. (2025) has developed a first -of-a-kind methodology to estimate current capacity in the EU, which has then cross-referenced with reported literature sources. As for the international comparison, several reports on US data centre capacity exist, but the numbers for China are not so conclusive. The estimation on the use of energy and water currently used by data centres present similar issues. The reported values stem from literature sources. Both the data centre capacity figures as of today as well as the growth scenarios have been thoroughly assessed with one -to-one interviews, CATI interviews and in the two workshops organized along the timeframe of the study. Determining the m arket size for cloud and AI computing services remains methodologically heterogeneous. Sources differ notably because they don’t look at same layers (IaaS, PaaS or SaaS) or don’t aggregate them the same way (e.g. IaaS and PaaS, or IaaS-PaaS-SaaS), resulting in partial overlaps and limited comparability across studies. As a consequence, t he figures presented here should not be read as precise point estimates. To mitigate these limitations, a triangulation of these estimates across multiple sources was performed, validating the ranges to establish a robustness check. There is also no hard evidence with respect to the number of public authorities procuring cloud and AI computing services, nor on the contracts awarded or the number of IT systems that are either cloud-aware or cloud-native. The data base from Tenders Europe Daily (TED) has been taken as the baseline since it contains all the notices published in the supplement of the Official Journal of the European Union. However, not all contract services are published on TED – only those surpassing a certain value, namely EUR 143 000 for cent ral governments and EUR 221 000 for local and regional governments are required to be published. Furthermore, the absence of a distinct code under the common procurement vocabulary for cloud and AI computing services required a complex query using combinat ions of keywords. This poses some limitations in the completeness of the data. Other aspects considered in the impact assessment 137 such as the federation of resources or the sovereignty risk framework, for which little hard evidence exists due to their novelty, were based on existing pilots (e.g. Simpl 98) along with interviews to public administrations and cloud and AI computing service providers to verify the validity of the assumptions. These were further verified in the final validation workshop organized the Technopolis Group with stakeholders from different profiles. It is also important to note that the direct cost and cost savings/ benefits identified in the analysis for the Policy Measures under Section 3 above do not incorporate wider eco nomic impacts, which have been excluded due to limitations in available data for monetising these effects. Therefore, the results above, do not represent a comprehensive assessment of total policy value, but should rather be interpreted as partial estimates of efficiency of each policy measure for the stakeholders under consideration. Finally, wherever there was a gap that could not be covered through interviews, CATI surveys, or literature, the study team drew reasonable assumptions. These assumptions have been tested in the final validation workshops, which helped provide elements to confirm or adjust these assumptions. In the event these unknown parameters played a pivotal role in the assumptions, the contracting team applied a min-max approach to demonstrate the robustness of the data. 5. SENSITIVITY ANALYSIS A scenario-based sensitivity analysis was run to understand the CBA model output behaviour in response of changes of its inputs to evaluate its overall stability and reliability. It was conducted to verify the uncertainty range (confidence interval) of the values estimated in the CBA for the most impactful policy measures. A min and max variation for the parameters was introduced to create word and best case scenarios for each measure. The parameters that were varied have been selected according to the following logic: • When the formulation of the parameter involved a high degree of arbitrary assumptions, e.g. time savings due to administrative simplification. • Due to the parameters’ highly volatile nature: for example, the number of proposals submitted per year or the cost for a software applicati on. To be noted that this variability does not only reflect the size of the company / public authority affected (that is modelled separately), but captures elements that are not easily separable, such as different organisational or business model choices. • When stakeholders reported during interviews minor to no costs or costs savings the min. value is set to zero, while the maximum value is the parameter identified according to other assumptions (i.e. stemming from the literature or other expert assumptions). It is important to underline that the sensitivity analysis presented here provided a bounded variation assessment, through which each policy measure has been tested under a minimum and maximum scenario. As the measures differ considerably in their desi gn, target audience, and the type of impacts generated, the variables are not always uniform or comparable. Therefore, the min-max range is not to be interpreted as a consistent sensitivity interval across all measures. The objective of the exercise was to understand how their costs and benefits would have varied under minimum and maximum conditions, when the most influential assumptions are varied within plausible ranges. This has allowed to assess the stability of each 98 The second specific contract for Simpl includes a technical feasibility analysis to assess a federation of cloud resources across several Member States. More information: https://ec.europa.eu/info/funding- tenders/opportunities/portal/screen/opportunities/tender-details/14888 138 measure’s performance across a realistic range of assumptions. The variation was based on evidence coming from interviews, observed practice and feasibility considerations. The Table below presents the scenario -based ranges for each policy measure, which capture the uncertainty stemming from changes in key parameters and assumptions varied jointly under best and worst case scenarios. Individual net benefits/costs of the measures expressed in NPV over 10 years can be seen under each Policy Measure in Section 3, as the main indicators of the net value of each measure. The results and interpretation , presented in the table below, show that most PMs exhibit strong robustness across all tested ranges, with net positive impacts even under pessimistic conditions. Table 45. Interpretation of the parameters used for the sensitivity analysis Policy Measure Key Parameters varied Central NPV and scenario range (€ m)99 Result and interpretation PM3: Adopting guidelines on building sustainable data centres in the EU • Adoption rate of guidelines by DC projects (30%-70%) • Time saved per project for operators (5-15 days) • Time saved per project for authorities (5-15 days) • Adoption effort by operators (10- 30 days) 5.8 [-3.6 – -11.7] PM3 delivers net costs in both min and max scenarios, as administrative efficiencies and reduced operator/authority workload are not sufficient to match the adoption effort by operators and authorities . Results are sensitive to assumptions, with outcome ra nges exceeding 100% of the central estimate, indicating uncertainty around magnitude. PM4: Project facilitators for the roll-out of data centres • Time saved in permitting processes (4-8 months) • No. of DC projects benefitting from this PM by 2036 (30%-70%) and proportionately the previous years. • Implementation costs for authorities (3-5 FTEs) • Time savings by authorities (10- 20 days) 4 617.6 [1 859.9 – 8 632.9] PM4 generates net savings, which increase significantly under the max scenario, where more projects benefit, and time savings are larger. This shows that the measure becomes increasingly efficient when permitting time reductions scale. Estimates vary widel y across assumptions, with a relative spread of at least 100%, implying moderate confidence in direction but limited precision. PM5: Mechanism for Member States to identify areas to fast-track data centre deployment • Time saved in permitting processes (6-10 months) • No of DC projects using the areas by 2036 (30-70%) and proportionately the previous years. • National authorities’ effort to set up and administer the new process (1-8 FTEs/year) • Energy efficiency (PUE, i.e. amount of data centre power dedicated to IT). 11 861.4 [6 158.1 – 18 874.9] PM5 provides large net benefits, which grow considerably when more new DC facilities use fast-track areas or when more months are saved. All scenarios show net benefits, although large differenc es between best and worst-case outcomes (≥100%) point to relevant scenario dependence. PM6: National funding support for data centres • National authorities’ effort for setting up and administering the funding scheme (2-4 FTEs) • Number of MS administering the scheme (25%-75%) -10.8 [-3.7 – -21.2] PM6 represent s an adjustment and administrative cost for public authorities and operators. Given the voluntary nature of the scheme, no benefits are available or quantifiable. The costs are expected to increase 99 NPV refers to the net present value of benefits minus costs. Positive values indicate net benefits; negative v alues indicate net costs. 139 Policy Measure Key Parameters varied Central NPV and scenario range (€ m)99 Result and interpretation • Business efforts to respond to the calls/prepare an application (35- 55 working days) • No. of proposals submitted every two years (6-18) moderately in the max scenario due to higher efforts and MS administering the scheme. Considering potential policy impacts, these cost variations could be considered not very sensitive to changes in assumptions. Best- and worst -case results diverge (≥50%), suggesting moderate robustness with scenario -sensitive magnitude. PM7: Set deployment targets and monitor progress • Time needed per operator to participate in the monitoring exercise (0.5-1.5 days/year) • Time needed by authorities to participate in the verification of data (2-4 working days) • Time and resources needed by the Commission to set up and manage the monitoring (1-2 FTEs and 20- 30 days per year) - 2.3 [-1.7 – -2.8] PM7 reflects only administrative and adjustment costs, with benefits being largely indirect (e.g. improved monitoring, market transparency). Costs increase slightly with higher participation or expanded monitoring roles. Sensitivity is limited and cost impacts remain modest when compared with other PMs. Net costs are consistently observed across scenarios with limited variation, indicating high robustness. PM8: EU funding for R&D and innovation ecosystems for cloud and AI • Total effort for the Commission to administer the scheme, i.e. set-it up (2-4 FTEs) and manage it periodically (1-2 FTE) • Business efforts to respond to the calls/prepare an application (35- 55 working days) • No. of proposals submitted every two years (16-24) - 2.2 [-1.4 – -3.1] PM8 generates adjustment costs for the Commission to set up and manage the scheme and administrative costs for businesses applying to receive possible funding. Given the uncertain nature of the possible funding, benefits have not been monetised. Thus, this PM appears only as a cost measure. Overall costs remain relatively low with respect to other measures. All scenarios indicate net costs, but differences between outcomes exceed 50%, yielding high confidence in direction and moderate confidence in magnitu de. The range reflects the variation in staff needs and effort, based on eventual proposal and funding volumes. PM9: EU deployment funding for strategic projects • Total effort for the Commission to administer the scheme, i.e. set-it up (2-4 FTEs) and manage it periodically (1-2 FTE) • Number of proposals every two years • Business efforts to respond to the calls/prepare an application (35- 55 working days) • No. of proposals submitted every two years (11-19) -1.9 [-1.2 – -2.7] Similarly to PM8, PM9 includes only administrative and adjustment costs for key stakeholders. As in PM8, sensitivity is relatively low to the varied parameters. Net costs occur across scenarios, with moderate dispersion (≥50%) between outcomes. Costs increase with higher proposal volumes and staffing assumptions. PM10: EU-level identifications of areas to fast-track data centre deployment • Time saved in permitting processes (2-4months) • No of DC projects using the areas by 2036 (30-70%) and proportionately the previous years. 7 979.7 [4 663.8 – 12 114.0] Similarly to PM5, PM10 generates large net savings due to the benefits brought by earlier commissioning and operational efficiencies, multiplied by the new DC projects that would benefit from this measure, under the specific growth scenario. 140 Policy Measure Key Parameters varied Central NPV and scenario range (€ m)99 Result and interpretation • National authorities’ effort to participate (5-15 days/year) • Cost savings for authorities (0.5- 1.5 FTEs/year) • Energy efficiency (PUE, i.e. amount of data centre power dedicated to IT). Net benefits a re robust across scenarios, though assumption -driven variability above 50% reduces precision, yielding medium –high confidence overall. The PM is sensitive to months saved and PUE levels. The latter significantly influences overall OPEX. NPV increases by around €1.1 m per month of time saved and by €0.7 m for every 0.01 improvement in PUE. PM11: Creating a EU-level harmonised criteria for sovereign cloud and AI computing services • Number of procuring authorities (50% - 100%) • Share of procurement procedures that will voluntarily request the alignment with the definition of sovereignty (5% - 10%) 0.3 [0.2 – 0.4] PM11 shows a moderate level of sensitivity with the max scenario double the min one. Net benefits are observed consistentl y across scenarios and assumptions, with limited dispersion, indicating high robustness. However, the absolute scale remains small, indicating that even if assumptions vary the overall impact of this PM is limited in economic terms. PM12: Creating EU guidelines for sovereign cloud and AI computing services for public procurement • Share of public administrations using the definition in their procurement activities (50%- 100%) • Number of public administrations procuring cloud services • Time needed by public administrations to adopt the procedures • Time for public administrations to evaluate bids • Number of cloud and AI computing service providers that can participate in procurement processes aligning with the guidelines (244-350) 1.3 [-0.6 – 9.4] PM12 shows high variability, as the outcome shifts from a small net cost in the min scenario to a very large net saving in the max one, which represents a considerable shift in magnitude and direction of impact. Therefore, the results of this measure depend heavily on the underlying assumptions. Results alternate between net costs and net benefits across scenarios, combined with large dispersion, implying low robustness and high sensitivity to modelling choices. The variability is driven by mainly two parameters. First, the average number of procured contracts every year for highly critical services in the EU public sector, spanning from 67 in the central and min values to 133. While the maximum value stems from the projections calculated considering th e existing TED data multiplied by the estimated value of highly critical use case (5%, based on input from stakeholders), the interviews as part of the study led to the conclusion that a more conservative value for the central value was needed. Secondly, o n the number of cloud providers that could participate in the bids. The study yielded the result that more than 400 cloud and AI computing service providers offer their services in the EU, while the estimates of providers that could comply with the 141 Policy Measure Key Parameters varied Central NPV and scenario range (€ m)99 Result and interpretation sovereignty criteria for their services range in the values of over 300. PM15: Voluntary sovereignty risk assessments for the use of cloud and AI computing services in the public sector • No. of FTEs required to get audited (10-20 FTEs) • No. of FTEs to maintain the audit (2-5 FTEs) • No. of MS that designate the competent authorities to carry out audit (5 - 27) • No. of MS that adopt and apply the voluntary sovereignty scheme, (5-27 MS) 316.8 [83.0 – 333.8] PM15 generates high net savings in both scenarios, with outcomes improving greatly under the max assumptions.. PM16: Non- mandatory specific award criteria for the procurement of cloud and Ai computing services • No. of public authorities procuring cloud and AI computing services • No. of tenders and offers per year • No. of cloud and AI computing service providers • Providers’ effort to align to the award criteria -17.1 [-4.9 – -28.3] PM16 results in net costs in both min and max scenarios. While the PM generates some savings, these are not sufficient to outweigh costs. As above, this could be drive by the no. of estimated authorities procuring cloud and AI computing services and to the administrative effort needed by the providers to adapt to the new criteria. PM17: Public Sector cloud federation • Capacity shared by each MS with the federation (5%-15%) • No. of Member States participating in the federation • Energy efficiency (PUE, i.e. amount of data centre power dedicated to IT). 12 192.4 [7 878.4 – 16 506.4] PM17 delivers high net cost savings across all scenarios. Given the difference between min -max scenarios, the PM looks sensitive to the underlying assumptions, e.g. MS participating in the federation or even capacity shared. This a ssumption- driven variability above 50% reduces precision, yielding medium –high confidence overall. As additional capacity is shared among MS, benefits increase substantially, as one could expect. PM18: Vendor- neutral EU cloud/AI skill certificates • No. of experts that can be certified on a yearly basis (100-500) • Certification fees ranging (EUR 50-150) • Effort saved by opting for a vendor-neutral certification, i.e. the number of certifications from other technologies and days saved • Coordination savings for the Commission from avoiding duplication of effort (EUR 0-21 067) • Reduced costs in the certification of similar technologies from different providers 74.3 [15.4 – 118.8] PM18 generates net cost savings in both min and max scenarios, with benefits increasing significantly under the latter. The large dispersion (≥100%) reflects strong sensitivity to assumptions. Despite this, it consistently delivers a positive impact and becomes more efficient as cost savings scale. PM19: Mandatory specific award criteria for the procurement of cloud and AI computing services • No. of services audited on a yearly basis (NUTS 0:100- 500; NUTS 1: 50-150; NUTS 2: 50- 150; NUTS 3: 20-30; min 220 services and max 830) • No. of hours saved due to automated dependency analysis per year (5 - 300 hours) - 152.6 [-100.0 – - 213.0] PM19 shows net costs across scenarios with medium -low variability. 142 Policy Measure Key Parameters varied Central NPV and scenario range (€ m)99 Result and interpretation PM20: Boosting open source in public administrations • No. of initial repositories that MS put in place (5 – 25) • Effort to maintain and govern repositories (0.6 - 1.2 FTE) • Costs to set up the OSPOs (EUR 2m-3m) • Costs to maintain the OSPOs (EUR 8m-28m) • Effort of OS projects developed in the public administrations (2-5 FTEs) • Contract values of OS projects developed for the public administrations (EUR 400 000- 600 000) • Savings for not duplicating software, (EUR 80 000 – 450 000) 3 387.5 [478.9 – 9 172.5] PM20 produces substantial net savings across all scenarios, making it one of the highest impact measures. Given the increase in savings from the min to the max scenario, the PM can be considered highly sensitive to the underlying assumptions. Indeed, extreme sensitivity to assumptions significantly weakens confidence in both magnitude and stability. Despite this large variation, it remains a robust measure generating net savings even un der conservative assumptions. PM21: Mandatory sovereignty risk assessments for the use of cloud and AI computing services in the public sector • Effort to obtain the audit • No. of MS where CSPs would seek the audit/validation in the absence of a single market (5-27) • No. of cloud and AI computing services in possession of the audit • No of submitted bids per year. 1 343.6 [838.6 – 1699.4] PM21 delivers consistent savings across all scenarios, with a modest level of sensitivity to the underlying assumptions. A ssumption-driven uncertainty above 50% implies moderate confidence in scale. PM22: EU-level procurement of cloud and AI computing services • Time saved thanks to fewer coordination needs for national public authorities (0.1 - 0.5 FTEs) • FTEs saved thanks to joint procurement (0.1 - 0.5 FTEs) • Savings in terms of effort incurred by participating PAs due to the possibility to aggregate demand and compose services (0.1 - 0.5 FTEs) • Capacity shared by each MS with the federation (5% - 15%) 33 969.5 [18 940.9 – 48 998.2] PM22 delivers large net cost savings across all scenarios. The increase from min to max indicates that the PM may be quite sensitive to the underlying assumptions. This large dispersion limits quantitative certainty. Despite this, it remains robust as even in the min scenario, cost savings are significant. PM23: Financial support for SMEs to adopt cloud and AI • Resources dedicated by SMEs for applications (10-30 working days) -66.4 [-35.5 – -97.5] PM23 presents net costs across all scenarios, although the overall scale is modest with respect to the other measures. Net costs stem also from the non -quantified strategic benefits generated by this measure. Assumption sensitivity introduces uncertainty (>50%) around central estimates. Policy measures affecting permitting timelines and data centre deployment ( PM4-PM5 and PM10) deliver substantial net savings/benefits in both minimum and maximum scenarios . Although the magnitude of savings is sensitive to adoption rates, months saved, deployment trajectories and PUE reductions, the impact of the measures remains positive even when such parameters change, demonstrating the efficiency of interventions that accelerate data centre project delivery. PM6-PM9 represent measures highlighting only costs for operators, national public authorities or the Commission as their benefits were either non-quantifiable or indirect. These measures exhibit low sensitivity overall , with modest variations across min -max scenarios and relatively small impacts with respect to the other measures. Results for PM11- 143 PM24 show a wide range of impacts . Most measures generate net savings under the different scenarios, even under conservative assumptions, thus demonstrating the robustness of results. At the same time, several PMs show high sensitivity to the underlying parameters . PM17, PM20, PM21 and PM22 stand out for their high impact and strong robustness, with large savings, while PM12 shows a mixed performance, shifting from net costs t o net cost savings across the min and max scenarios. The variability of PM12 is driven by mainly two parameters. First, the average number of procured contracts every year for critical services in the EU public sector, spanning from 67 in the central and min values to 133. While the maximum value stems from the projections calculated considering the existing TED data multiplied by the estimated value of highly critical use case (5%, based on input from stakeholders), the interviews as part of the study led by Technopolis led to the conclusion that a more conservative value for the central value was needed. Secondly, on the number of cloud providers that could participate in the bids. The study led by Technopolis yielded the result that more than 400 cloud an d AI computing service providers (see Annex 4) offer their services in the EU, while the estimates of providers that could comply with the sovereignty criteria for their services range in the values of over 300. These values were cross validated in the final validation workshop from the study led by Technopolis. A sensitivity assessment was also performed for the measures evaluated using a discounted cash flow approach. While several variables influence project value, the analysis focused on those parameters that could be directly influenced by the policy intervention, i.e. 1) Power Usage Effectiveness (PUE), which affects operating costs and consequently the project’s NPV and 2) Time savings, which impact the timing of revenues and discounting of future cash flows. In the model, reducing the project development timeline from 32 months to 26 months (6 - month acceleration), increases NPV by around EUR 6.4 m, implying a sensitivity of around EUR 1.1 m of NPV per month of time saved. PUE affects operatin g costs by determining the electricity needed per unit of IT load. Reducing PUE levels while keeping the other assumptions unchanged, leads to around EUR 0.7 m of NPV for every 0.01 improvement in PUE. While the model is sensitive to additional variables, these cannot be directly tackled by the class of policy measures under review. Utilisation and revenues are mostly influenced by market demand and commercial strategies. CAPEX levels are determined by construction market dynamics and technology costs, unless specific subsidies are applied. The WACC is predominantly affected by financial market conditions and sovereign risk, necessitating macro- financial instruments rather than operational regulations to influence it. Taxation and depreciation are dictated by national fiscal policies. Power prices are shaped by wholesale market rates and grid tariff structures. Therefore, the analysis concentrates on timeline and PUE, as both can be technically managed through targeted policies and hold significant economic importance. This analysis will be particularly useful to better understand how to tailor future policy design. Given the available evidence and heterogeneity of measures evaluated, it has been instrumental to understand where the outcomes of each policy measure where more assumption-dependent or stable. 6. MULTI-CRITERIA DECISION ANALYSIS The multi-criteria analysis has been carried out by Technopolis et al (2025) under the study “Study: cloud and AI” . The models used, the criteria, weights of the im pacts as well as the attained results are detailed next. 144 6.1. Models used for the multi-criteria analysis The multi -criteria decision analysis (MCDA) has been implemented using three complementary models: 1) A simple additive model based on Multi-Attribute Utility Theory (MAUT) 2) Preference Ranking Organisation Method for Enrichment Evaluation (PROMETHEE II) 3) ELimination Et Choix Traduisant la REalité (ELECTRE III) The use of multiple models allows to triangulate the results . Firstly, MAUT provides transparent aggregation, while PROMETHEE II and ELECRE III introduce preferences and outranking logics that test the robustness of the findings. The three methods provide three different categories of models: full compensatory (MAU T), partially compensatory (PROMETHEE II), and non-compensatory (ELECTREE III). The three models are designed to work in combination: 1) MAUT provides a clear and transparent baseline; 2) PROMETHEE II is an outranking method and incorporates preference thresho lds, capturing the strength of differences, allowing partial compensation; 3) ELCETREE III tests robustness and non-compensatory consistency, identifying cases where trade-offs between criteria are not acceptable. It also belongs to the outranking methods, but it incorporates preferences, indifferences and veto thresholds. All models use the same normalised and weighted option -level dataset, enabling consistent interpretation across approaches. 6.1.1 Multi-Attribute Utility Theory (MAUT) The MAUT approach 100 is a classical multi -criteria decision-making method based on utility theory. It uses utility functions to evaluate and compare alternatives based on multiple criteria. The process in MAUT typically involves the following approach: 1. Definition of the relevant criteria; 2. Assignation of weights to the criteria to reflect their relative importance; 3. Normalisation of the performance for each alternative; and 4. Computation of the utility function per policy option, as a weighted sum of its scores across all criteria, capturing the overall desirability of each option. This approach makes it a fully compensatory model, meaning that a strong performance in one impact can offset weaker performance in another. The benefits of this model are simplicity and transparency. It provides a clear overall ranking of options while allowing the decomposition of results by impact area, making it easy to identify which dimensions drive performance differences. In the current analysis, each policy option is assigned a normalised score for every sub-impact area based on the CATI surveys carried out with external stakeholders101, and on the estimated 100 Jansen, S.J.T. (2011). The Multi-attribute Utility Method. In: Jansen, S., Coolen, H., Goetgeluk, R. (eds) The Measurement and Analysis of Housing Preference and Choice. Springer, Dordrecht. https://doi.org/10.1007/978-90-481-8894-9_5 101 The CATI survey gathered feedback from key stakeholder groups, including public authorities, data centre operators, cloud and AI service providers, industry associations, and domain experts. Respondents were asked to assess the expected effectiveness and impact of a series of policy measures addressing two main problems: limited availability of sustainable 145 data on costs and savings presented in the sections above . These are multiplied by their respective impact and sub -impact weights. Th e resulting composite scores provide a straightforward and replicable measure of performance across scenarios. The MAUT model employ s an additive aggregation structure , assuming preferential independence across criteria. Each policy option 𝐴𝑖receives a utility score calculated as: 𝑈(𝐴𝑖) = ∑ 𝑤𝑘 ⋅ 𝑢𝑘(𝐴𝑖) 𝑛 𝑘=1 where: 1) 𝑢𝑘(𝐴𝑖)is the normalised score for impact 𝑘under option 𝐴𝑖; 2) 𝑤𝑘is the composite weight derived from the impact and sub-impact levels. The MAUT additive model serves as the foundation for comparison with the more preference- based methods (PROMETHEE II and ELECTRE III), as described next. 6.1.2 Preference Ranking Organisation Method for Enrichment Evaluation (Promethee II) The Preference Ranking Organisation Method for Enrichment Evaluation (PROMETHEE II)102 is a preference-based and partially compensatory method. It differs from the additive models by considering how strongly one policy option is preferred over another on each criterion, rather than aggregating scores directly. PROMETHEE II compares every pair of alternatives across all criteria and calculates a preference degree that expresses the extent to which one option performs better than another. These degrees are then combined into positiv e and negative preference flows to establish a final net ranking of the option. A positive flow represents how much the option outranks the other while a negative one shows how much it is outranked. The net flow (positive minus negative) provides a full ra nking of the alternatives. This approach is valuable because it incorporates thresholds to reflect realistic decision-making behaviour, recognising that small performance differences may be insignificant while larger one signal a clear preference. Thresholds For each criterion k, two thresholds are defined: 1) an indifference threshold (q), below which the difference between two options is negligible. This was set to 0.25 of the total score range. 2) a preference threshold (p), beyond which one option is clearly preferred. This was set to 0.50 of the total score range. computing capacity infrastructure in the EU, and limited availability of European cloud services including for highly critica l use cases. Each measure w as rated on a likert seven -point scale from strong decrease to strong increase, complemented by ranking exercises to identify the most effective packages and instruments. 119 stakeholders (114 economic operators and 5 Public Authorities) assessed expected changes in impact areas under each policy measure using a seven -point scale (from strong decrease = -3 to strong increase = +3). 102 J. Figueira, S. Greco, M. Ehrgott. Multiple Criteria Decision Analysis State of the Art Surveys. Springer, Berlin (2005). 1045 pp 146 By using these thresholds, the model allowed limited compensation and avoided over-ranking options that performed only marginally better on criteria. PROMETHEE II is therefore effective for policy evaluations involving mixed quantitative and qualitative evidence, as it can reflect nuanced stakeholder preferences while still providing a complete ranking of options. PROMETHEE II is a preference-based, partially compensatory method relying on pairwise comparisons between alternatives. For each pair (𝐴𝑖, 𝐴𝑗), the method compute s a preference degree 𝜋𝑖𝑗 𝑘 ∈ [0,1]for each criterion 𝑘, based on the difference in their performance: 𝜋𝑖𝑗 𝑘 = 𝑓𝑘(𝑑𝑖𝑗 𝑘 ) where 𝑑𝑖𝑗 𝑘 = 𝑢𝑘(𝐴𝑖) − 𝑢𝑘(𝐴𝑗)and 𝑓𝑘is a preference function defined by: 1) Indifference threshold 𝑞𝑘: differences below this are considered negligible; 2) Preference threshold 𝑝𝑘: differences above this imply strict preference. The overall preference index between 𝐴𝑖and 𝐴𝑗is: Π𝑖𝑗 = ∑ 𝑤𝑘𝜋𝑖𝑗 𝑘 𝑛 𝑘=1 Positive (𝜙+) and negative (𝜙−) flows are then computed: 𝜙+(𝐴𝑖) = 1 𝑚 − 1 ∑ Π𝑖𝑗, 𝜙−(𝐴𝑖) 𝑗≠𝑖 = 1 𝑚 − 1 ∑ Π𝑗𝑖 𝑗≠𝑖 The net flow (𝜙(𝐴𝑖) = 𝜙+ − 𝜙−) provides a complete ranking of the alternatives. 6.1.3 ELimination Et Choix Traduisant la REalité (Electre III) The ELimination Et Choix Traduisant la REalité (ELECTRE III )103 method is an outranking approach. Unlike MAUT, or PROMETHEE II, it does not assume that trade-offs between criteria are always acceptable. Instead, it tests whether there is sufficient evidence to state that one policy option outranks another, i.e. performs at least as well overall, without being significantly worse on any major criterion. ELECTRE III is a non -compensatory model, which makes it useful when some criteria (e.g. environmental sustainability) are considered essential and should not be fully offset by gains elsewhere. It combines two types of information: 1) Indifference threshold (q): small differences are ignored. This was set to 0.25 of the total score range. 2) Preference threshold (p): a preference threshold (p), larger differences indicate a clear preference. This was set to 0.50 of the total score range. 103 Uzun, B., Bwiza, R.A., Uzun Ozsahin, D. (2021). ELimination Et Choix Traduisant La REalité (ELECTRE). In: Uzun Ozsahin, D., Gökçekuş, H., Uzun, B., LaMoreaux, J. (eds) Application of Multi -Criteria Decision Analysis in Environmental and Civil Engineering. Professional Practice in Earth Sciences. Springer, Cham. https://doi.org/10.1007/978-3-030-64765-0_5 147 3) Veto threshold (v): if the difference exceeds this level, one criterion can block the overall outranking regardless of others. Thresholds are set to match chosen the way the PROMETHEE model is configured. ELECTRE III is particularly beneficial in regulatory and policy contexts, as it can identify incomparability i.e. cases where neither option is clearly superior, which mirrors complexity of multi decision- making. Summarizing, ELECTRE III is a non-compensatory outranking method that assesses whether one alternative “outranks” anoth er by combining concordance (agreement) and discordance (veto) indices. For each pair of alternatives (𝐴𝑖, 𝐴𝑗): 1) A concordance index 𝐶𝑖𝑗expresses the degree to which criteria support the statement “𝐴𝑖 is at least as good as 𝐴𝑗”: 𝐶𝑖𝑗 = ∑ 𝑤𝑘 𝑐𝑘(𝐴𝑖, 𝐴𝑗) 𝑘∈𝐾 where 𝑐𝑘is the partial concordance per criterion. 2) A discordance index 𝐷𝑖𝑗measures the extent of opposition to that statement, identifying criteria where 𝐴𝑗substantially outperforms 𝐴𝑖. 3) A credibility index 𝑆𝑖𝑗is then computed as: 𝑆𝑖𝑗 = 𝐶𝑖𝑗 × ∏ 1 − 𝐷𝑖𝑗 𝑘 1 − 𝐶𝑖𝑗 𝑘∈discordant which quantifies the overall strength of the outranking relation. The final ranking is obtained through exploitation procedures, balancing credibility thresholds and identifying dominance, indifference, and incomparability relations 6.1.4 Summary of models used for the multi-criteria analysis The table below depicts a summary of the models used for this MCDA with their main characteristics. Table 46. Summary of models used for the multi-criteria analysis Feature MAUT PROMETHEE II ELECTRE III Method type Compensatory, utility-based aggregation Outranking with pairwise preference flows Outranking with credibility and discordance indices Compensation Fully compensatory Semi-compensatory Non-compensatory (veto can block dominance) Output Full ranking Full ranking Partial ranking Thresholds None Uses preference functions Uses explicit indifference, preference and veto thresholds 148 Feature MAUT PROMETHEE II ELECTRE III Strengths Easy and clear to communicate Pairwise comparisons Handles uncertainty, and incorporates veto Data used Quantitative scores and weights Quantitative, but requires s electing preference functions Mixed data, requires defining discordance and credibility indices 6.2. Development and comparisons of policy options (MCDA) The multi-criteria decision analysis allows to evaluate the relative performance of different policy options under study. It enables a systematic comparison of alternatives when multiple and often conflicting objectives must be considered. The analysis combined quantitative data from two sources: 1) Survey data, in which 119 stakeholders (114 economic operators and 5 Public Authorities) assessed expected changes in impact areas under each policy measure using a seven -point scale (from strong decrease = -3 to strong increase = +3). The sample is described below. 2) Estimated data developed through quantitative modelling, covering administrative costs, adjustment costs, and cost-saving for each policy measure. All data is first combined and harmonised to create a single dataset covering all policy options, policy measures, impact areas, and sub-impact areas. Weights are applied to reflect the relative importance of each impact and sub -impact. The reference case is equal weighting. Given the different nature that the two problems deal with, different weights for problem 1 and problem 2 are also considered. The impact-level weights define the overall direction of the assessment by indicating which broad dimensions c arry the greatest influence under each scenario. In the equal weighting scenario, all four impacts – economic/effectiveness, costs/efficiency, social and environmental - are weighted equally (25%). Under Problem 1 (P1), the weighting shifts towards the economic/effectiveness dimension (40%), highlighting the priority of accelerating deployment and enhancing efficiency, while social impacts receive reduced emphasis (5%). For Problem 2 (P2), the weighting moves towards costs and economic/effectiveness (55%) impacts, reflecting a focus on sovereignty, trust, and resilience. Table 47. Impacts weighting (Source: Technopolis et al. (2025)) Impact Equal weighting [EW] P1 weights P2 weights Economic/effectiveness 25% 40% 55% Costs/efficiency 25% 35% 35% Social 25% 5% 5% Environmental 25% 20% 5% The sub-impact weights specify how the detailed components within each impact contribute to the overall evaluation. Under the equal weighting scenario, the weights are balanced across sub-criteria. Under Problem 1, the emphasis shifts towards sub -impacts linked to rapid deployment, computing capacity, and cost efficiency, aligning with the scenario’s objective of speeding up infrastructure expansion. Conversely, Problem 2 introduces a strong emphasis on digital sovereignty, open source capacity, customer choice, and transparency, consistent with 149 its social and governance orientation. Environmental sub -impacts source also adjust, prioritising reductions in data centre footprints un der Problem 1 and digital sovereignty, and resilience under Problem 2. Table 48. Sub-impacts weighting (Source: Technopolis et al. (2025)) Sub-Impact Equal weighting sub - impact P1 weights sub - impact P2 weights sub - impact Speed of construction and deployment of data centres 14% 30% 0.5% Computing capacity for AI services and general purpose computing 14% 20% 0.5% Adoption of high-performance, low- carbon, energy-efficient cloud and AI computing services 14% 25% 0.5% Cross-border market access for EU- based cloud and AI computing service providers 14% 10% 14.5% Digital sovereignty and resilience in the public sector including through public procurement 14% 7% 50% Open source capacity 14% 5% 14.5% Ensuring customer choice and the ability to switch providers across layers of the AI compute stack 14% 3% 19.5% Administrative costs 25% 15% 15% Adjustment costs 25% 15% 15% cost savings 25% 30% 30% net costs 25% 40% 40% Transparency and citizen trust 50% 60% 65% Citizen/community engagement 50% 40% 35% Data centres environmental footprint (energy, water use, greenhouse gas emissions) 50% 70% 50% Leveraged investments from public and private actors for sustainable infrastructure and services 50% 30% 50% In this framework, the sub-impact weights shown in the table below are derived from the product of the higher -level impact weights and t he relative importance of each sub -impact within that impact area. The calculation works in two steps: 1. Each main impact area, Economic /effectiveness, Costs /efficiency, Social, and Environmental, is first assigned an overall weight at the impact level (for example, under Problem 2: Economic /effectiveness = 55%, Costs = 35%, Social = 5%, Environmental = 5%). 2. Within each impact area, that total weight is distributed across its constituent sub - impacts according to their relative importance in the scenario. The weight of each sub- 150 impact is therefore the impact -level weight multiplied by its share within that impact group. For instance, under Problem 2, the Economic/effectiveness impact (55%) is subdivided across seven sub-impacts, with digital sovereignty and resilience receiving a larger internal share than speed of construction. Multiplying this impact weight (55%) by the internal share of digital sovereignty and resilience (around 35%) yields a sub -impact weight of roughly 12.3% in the table. The same proc ess applies across all impact areas: the economic /effectiveness weight (55%) multiplied by the internal weighting for digital sovereignty and resilience in the public sector including through public procurement (50%) produces a final sub -impact weight of 27.5%. This hierarchical weighting ensures that the total of all sub -impacts adds up to 100% and that each sub-impact’s influence on the final composite score reflects both: 1. The relative priority of its parent impact area (e.g. Social vs Effectiveness/economic), and 2. The specific emphasis placed on that sub -impact within the impact group (e.g. within Social, transparency outweighs engagement). Table 49. Sub-impacts weighting used (Source: Technopolis et al. (2025)) Sub-Impact Equal weighting sub - impact P1 weights sub - impact P2 weights sub - impact Speed of construction and deployment of data centres 3.57% 12.0% 0.3% Computing capacity for AI services and general purpose computing 3.57% 8.0% 0.3% Adoption of high-performance, low- carbon, energy-efficient cloud and AI computing services 3.57% 10.0% 0.3% Cross-border market access for EU- based cloud and AI computing service providers 3.57% 4.0% 8.0% Digital sovereignty and resilience in the public sector including through public procurement 3.57% 2.8% 27.5% Open source capacity 3.57% 2.0% 8.0% Ensuring customer choice and the ability to switch providers across layers of the AI compute stack 3.57% 1.2% 10.7% Administrative costs 6.25% 5.3% 5.3% Adjustment costs 6.25% 5.3% 5.3% cost savings 6.25% 10.5% 10.5% net costs 6.25% 14.0% 14.0% Transparency and citizen trust 12.50% 3.0% 3.3% Citizen/community engagement 12.50% 2.0% 1.8% Data centres environmental footprint (energy, water use, greenhouse gas emissions) 12.50% 14.0% 2.5% 151 Sub-Impact Equal weighting sub - impact P1 weights sub - impact P2 weights sub - impact Leveraged investments from public and private actors for sustainable infrastructure and services 12.50% 6.0% 2.5% 6.2.1 Summary of results multi-criteria decision analysis In both Problem 1 and Problem 2, all policy options perform better than the baseline, consistently across the three methods tested and stakeholder groups (AI and cloud service providers, data centre operators, National Pub lic Authorities and SMEs). The assessment therefore confirms that maintaining the status quo is the least attractive option, and that intervention is warranted from both an effectiveness and efficiency perspective. The multi-criteria analysis is based on the original specification of policy options. While some measures were subsequently refined, the options were retained in their initial form to ensure comparability across scenarios. The results draw on stakeholder survey data collected in August-September 2025 and cost inputs updated in early 2026. As such the findings should be interpreted as indicative, reflective the relative performance of the options. The table below presents an overview of the comparative performance of the options across methods and weighting schemes. Table 50. Summary of option performance across methods and problems (Source: Technopolis et al. (2025)) Problem Method Main conclusion P1 MAUT PO1-B and PO1-C are strongest, especially under P1 weights. P1 PROMETHEE II PO1-B and PO1-C clearly ahead; PO1-A only modest improvement. P1 ELECTRE III Ranking: PO1-B > PO1-C > PO1-A = baseline P2 MAUT Under P2 weights, PO2-B and PO2-C are strongest P2 PROMETHEE II PO2-C best, PO2-A second; PO2-B weak, close to baseline under P2 weights P2 ELECTRE III PO2-C clearly first; PO2-A and PO2-B at best marginal over baseline Problem 1 For Problem 1, all three options (PO1-A/B/C) deliver a clear improvement over the baseline in all three methods, namely, MAUT, PROMETHEE II and ELECTRE III. Under equal weighting, MAUT shows that all options achieve positive total scores, while the baseline remains negative. When Problem 1 weights are applied the differences between options become more pronounced. In this configuration, PO1-B and PO1-C clearly outperform PO1-A, and the baseline remains the weakest. Across the three methods, a consistent pattern emerges: • PO1-B (legislative and financial intervention enforced nationally) and PO1-C (legislative and financial intervention enforced at EU-level) are the strongest options and both strongly dominate the baseline. • PO1-A (collaborative framework) provides only a moderate improvement over the baseline: positive overall, but not comparable in magnitude to the more interventionist options. 152 The baseline never outranks any option and is always clearly dominated in the outranking analyses. At measure level: • For PO1-A, PM3 (guidelines on sustainable data centres) is the main driver of performance, as it is the only measure that clearly turns the cost score positive under Problem 1 weights and contributes solidly to the total score. PM1 (Alliance working group) and PM2 (stakeholder forum) add small but consistent gains on effectiveness and social criteria but remain modest. • Within PO1-B, performance is driven by PM4 ( project facilitator for the roll -out of data centres) and PM5 (fast -track area identification). These measures combine improved cost outcomes with strong effectiveness and therefore explain the option’s high overall score. • In PO1-C, all measures contribute positively, but PM10 (EU -level identification of fast - track areas) stands out, especially under Problem 1 weights, by delivering the best cost outcome in the package alongside strong effectiveness. PM8 (EU R&D funding) and PM9 (EU deployment funding) generate clear environmental and social benefits with a high effectiveness but retain slightly negative cost scores, reflecting the associated cost burdens. Stakeholder-specific results show that all groups are better off than in the baseline for all options, but they differ in their preferred bundle: • Economic operators favour PO 1-B, with PO1 -C close behind, driven by better cost and effectiveness outcomes. • National public authorities also obtain the highest scores under PO1 -B, followed by PO1- C; PO1-A is positive but less attractive. Improvements for authorities arise mainly from better cost outcomes relative to the baseline and small social and environmental gains, rather than from direct effectiveness. • CSPs and AI service providers see substantial improvements under all options but show a clear preference for PO1-B, particularly when Problem 1 weights are applied, reflecting the importance of streamlined permitting and deployment-oriented measures. • SMEs benefit substantially from all options relative to the baseline, but PO1 -B is the most favourable bundle, as it combines improve d costs with higher effectiveness and social scores for this group. The evidence for Problem 1 suggests that PO1-B is the most attractive option when priority is given to deployment and cost efficiency, while PO1-C is favoured when it comes to social and environmental benefits, at the expense of somewhat higher perceived cost intensity in EU-level funding measures. PO1-A offers a modest, low-intensity improvement but does not match the performance of the more ambitious packages. Problem 2 For Problem 2, all three options (PO2 -A/BC) perform clearly better than the baseline across the three MCDA methods. Under equal weighting in MAUT, total scores for all options indicate broad improvements in effectiveness, social and environmental outcomes. When Problem -2 weights are applied all options improve further and remain clearly above the baseline, with PO2-B and PO2-C achieving the highest MAUT scores. However, once outranking approaches are considered, a stable pattern emerges: • PO2-C (EU-coordinated procurement and framework) is the strongest option overall. Both PROMETHEE II and ELECTRE III identify PO2 -C as the preferred option, under both equal and Problem-2 weights. 153 • PO2-A (transparency and visibility) is consistently a secondary but clearly positive option, always better than the baseline but not reaching the performance of PO2-C. • PO2-B ( voluntary EU framework ) is, at best, marginally better than the baseline in ELECTRE III and is clearly weaker than PO2 -C (and often PO2 -A) in PROMETHEE II, particularly when Problem-2 weights are applied. At measure level: • For PO2 -A, the strongest contributors are PM11 ( creating a sovereign cloud and AI computing services definition), PM12 (guidelines for sovereign services) and PM14 (interoperability flanking measures). These measures are seen as useful and relatively low- cost, particularly once sovereignty and resilience gain more weight. PM13 (annual sovereignty conference) provides only limited added value and mainly adds some cost, resulting in lower total scores. • In PO2 -B, performance is driven by PM15 ( sovereignty scheme) and PM17 (cloud federation), which combine neutral or positive cost impacts with solid effectiveness and social gains. PM18 (training programme) generates moderate, clearly positive contributions, while PM16 (voluntary award criteria) is weaker. • Within PO2-C, PM20 (promotion of open source use) and PM22 (EU-level procurement and federation) are the main drivers of performance, combining manageable or slightly positive cost effects with strong effectiveness and social benefits when sovereignty-related dimensions are prioritised. PM21 (mandatory use of audited services and award criteria) becomes more attra ctive under Problem -2 weights, while PM23 (SME support) has low totals and negative cost scores, limiting its contribution to the option’s overall strength. Stakeholder-specific results for Problem 2 again indicate clear improvements relative to the baseline for all groups, but with notable differences in preferences: • Economic operators see all options as an improvement, but clearly prefer PO2 -C, which combines the strongest cost outcome with robust effectiveness and social gains. PO2-A is generally second, with PO2-B weaker overall. • National Public Authorities favour PO2-B under EW and PO2-C under P1 weights. PO2-A remains positive but leaves a more significant cost burden; PO2-C offers smaller gains and only marginal cost improvements from their perspectiv e versus PO2 -B also under P2 weights. • Cloud and AI computing service providers see substantial gains under all options, but PO2- C is the preferred grouping, particularly when Problem-2 weights are applied, with PO2-A second in EW and PO2-B only marginally improving over PO2-A under P2 weights. • SMEs benefit substantially from all options compared to the baseline, but PO2 -A is the most favourable option under EW and PO1-C is the preferred one under P1 weights , as it combines the least negative cost scores with the highest economic and social benefits for this group. The results for Problem 2 indicate that PO2 -C is the most robust option at system level, especially when non -compensatory trade -offs and sovereignty -focused priorities are considered, wh ile PO2 -B is most attractive for national public authorities and PO2 -A is particularly beneficial for SMEs. All three options remain markedly superior to the baseline, confirming that a policy response to Problem 2 is justified. 6.2.2 Multi-criteria analysis for Problem 1 MAUT results for Problem 1 show a clear improvement of all three policy options (PO1 - A/B/C) over the baseline across both weighting schemes. Under equal weighting, all options 154 deliver positive total scores (0.399 for PO1-A, 0.575 for PO1-B, 0.513 for PO1-C), while the baseline is distinctly negative (-0.359). This reflects the fact that the measures jointly improve effectiveness, environmental and social outcomes relative to the status quo, while also reducing the net cost burden. Social impacts are consistently positive for all options and negative for the baseline, and environmental impacts also improve slightly relative to the baseline under equal weighting. When shifting to the Problem 1 weighting (which places more emphasis on effectiveness and cost impacts, and sustainability), the overall ranking is broadly stable but the differences between options become more pronounced. PO1 -B and PO1 -C clearly dominate, with total scores of 0. 688 and 0. 545 respectively, compared to 0. 312 for PO1 -A and -0.387 for the baseline. The reweighting particularly favours PO1 -B, which combines the strongest performance in terms of effectiveness with the best cost-benefit outcome (costs turning positive under P1), while still performing better than the baseline on environmental and social dimensions. This suggests that, under a deployment-focused policy perspective, PO1-B (and to a slightly lesser extent PO1 -C) represent the most attractive bundle of measures among the options considered. Table 51. MCDA Aggregate Results MAUT – Problem 1 (Source: Technopolis et al. (2025)) The PROMETHEE II results for Problem 1 clearly indicate that PO1 -B and PO1 -C are the strongest options, with PO1-B emerging as the preferred options once Problem 1 priorities are reflected. Under equal weighting, most options improve on the baseline which shows strongly negative net flows at both impact and sub -impact level (–0.917 and –0.798). At impact level, PO1-B strongly outperforms PO1-C with positive impact-level flows (0.500 vs 0.189), while PO1-A delivers only a modest gain with respect to t he baseline (-0.189). At the sub -impact level, PO1-B still outperforms PO1 -C but the difference between the two options decreases (0.312 vs 0 .289), suggesting a marginal advantage when all criteria are treated as equally important. When the Problem 1 weigh ting is applied, the ordering becomes more pronounced. The baseline remains negative ( –0.867 at impacts; –0.671 at sub -impacts), and PO1-A remains negative at both levels (–0.447 impacts; –0.331 sub-impacts), indicating limited alignment of this option with deployment- and cost-driven priorities. By contrast, PO1-B and PO1-C both achieve high impact-level flows (0.583 and 0.147). At the sub -impact level under P1, PO1 -B (0.413) outperforms PO1 -C (0.252), which points to PO1-B as the best overall option once implementation-level effects and the stronger emphasis on effectiveness and cost criteria are considered. Table 53. PROMETHEE II - Problem 1 (Source: Technopolis et al. (2025)) Option EW - Impacts EW Sub-impacts P1 - Impacts P1 – Sub-Impacts Baseline -0.917 -0.798 -0.867 -0.671 PO1-A -0.189 -0.112 -0.447 -0.331 PO1-B 0.500 0.312 0.583 0.413 PO1-C 0.189 0.289 0.147 0.252 Impact Costs Economic Environmental Social Total Costs/efficiency Effectiveness Environmental Social Total Option EW P1 EW P1 EW P1 EW P1 EW P1 Baseline -0.538 -0.714 0.242 0.470 -0.037 -0.134 -0.026 -0.008 -0.359 -0.387 PO1-A -0.119 -0.128 0.246 0.421 0.055 -0.024 0.216 0.043 0.399 0.312 PO1-B -0.011 0.143 0.298 0.543 0.074 -0.041 0.214 0.043 0.575 0.688 PO1-C -0.089 0.017 0.307 0.520 0.078 -0.036 0.216 0.044 0.513 0.545 155 For Problem 1, the ELECTRE III outranking analysis shows a very consistent pattern: at impact level, both under equal weighting and under the P1 weights, the descending o rder is PO1-B > PO1-C > PO1 -A = baseline, meaning that PO1 -B outranks PO1-C, and both outrank the baseline, while PO1-A does not. At the sub-impact level, in both EW and P1 options the ranking changes making PO1-C > PO1 -B > baseline = PO1 -A, with high credibility indices for the outranking relations between PO1 -C and the other options. In other words, once non- compensatory trade -offs and detailed criteria are fully taken into account, PO1 -C is the strongest option, closely followed by PO1-B, while PO1-A is barely better than or equal to the baseline and never outranks the two more ambitious options . The difference in these results between the impact level and the sub -impact results reflects how the structure of the analysis influences the comparison of the options. When impacts are assessed at a broader level, strong performance in one area can offset weaker performance in another, i.e. making PO1-B appear preferrable. However, when this analysis is performed at sub -impact level, the trade -offs are no longer absorbed within the broader categories , i.e. PO1 -C performs more evenly and therefore emerges as the strongest option. The different ranking thus reflects the differences in how balanced the policy options are. PO1-B appears to generate higher overall impacts bu t with greater divergence across cost -benefit, effectiveness, environmental and social dimensions, whereas PO1 -C delivers more balanced, though less pronounced results across these criteria. Importantly, PO1-B and PO1-C both outperform PO1-A which does not improve over the baseline and thus represent improvements over the status quo. Table 54. ELECTRE III ranking of options – Problem 1 (Source: Technopolis et al. (2025)) Option Impact level (EW) Sub-impact level (EW) Impact level (P1) Sub-impact level (P1) Overall judgement PO1-B 1 2 1 2 Very strong PO1-C 2 1 2 1 Very strong PO1-A 3 = Baseline 3 = Baseline 3 = Baseline 3 = Baseline Weak improvement over baseline Baseline 3 = PO1-A 3 = PO1-A 3 = PO1-A 3 = PO1-A Reference Stakeholder analysis For economic operators, all three options represent a marked improvement over the baseline, but with a clear hierarchy. Under both equal weighting and the Problem 1 weighting, PO1 -B performs best overall (0. 623 and 0. 742), closely followed by PO1 -C, with PO1 -A some distance behind. The main driver is the combination of improved cost outcomes and stronger effectiveness scores: PO1 -B is the only option that yields clearly positive cost results for operators under EW (0.045), while also outranking the other options under P1 weights in terms of costs. PO1-B delivers the highest effectiveness score (0.538) under P1 weighing while PO1- C outperforms it under EW. Environmental scores for operators improve modestly under equal weighting but turn slightly negative under P1 (reflecting the lower weight and some trade-offs), whereas social scores are clearly higher than the baseline for all options. The data suggest that economic operators have better results with national simplification and fast-track mechanisms (PO1-B) as they are offering the best balance of lower burdens and stronger business opportunities, with EU -level interventions (PO1 -C) being also attractive but slightly less beneficial in net terms. For national public authorities, all options also outperform the baseline, but preference patterns differ and the gains are more modest. Under equal weighting, PO1-B slightly dominates (0.281 156 vs 0.259 for PO1-C and 0.050 for PO1-A), driven by the strongest combination of cost, social and environmental scores. Under the Problem 1 weighting, PO1 -B still has t he highest total score (0.408), but PO1-C moves farther (0.185), while PO1-A remains the weakest performer, albeit still clearly above the baseline. A notable contrast with operators is that the effectiveness dimension for public authorities is closer to, or slightly below, the baseline, especially under P1, suggesting that administrations anticipate less direct effectiveness from the measures. Instead, their improvement comes mainly from better cost outcomes relative to the baseline (particularly under PO1 -B) and small but positive social and environmental effects. In sum, authorities tend to favour the national level option (PO1 -B), which offers a better overall balance of impacts from their perspective, even i f PO1 -C performs best in terms of environmental impact (under EW) and social impacts , mostly in relation to the measures focused on funding for strategic and energy-efficient projects. Table 55. MCDA Economic Operators and Public Authorities MAUT – Problem 1 (Source: Technopolis et al. (2025)) For cloud and AI computing service providers, all three options improve on the baseline when impacts are equally weighted, with total scores rising from 0.267 (baseline) to 0.440 (PO1-A), 0.542 (PO1-B) and 0.572 (PO1-C). Since cost impacts are neutral under this Problem (all zero), the gains come from stronger effectiveness and social performance, with modest environmental improvements under equal weighting. Under the Problem 1 weighting, which amplifies effectiveness dimensions, the picture is more nuanced: PO1 -A is essentially indistinguishable from the baseline (0.378 vs 0.381), while PO1 -B and PO1-C provide clear net benefits (0.499 and 0.488 respectively), driven by higher effectiveness scores. Environmental scores for providers become slightly more negative under P1, indicating perceived trade -offs as deployment objectives are prioritised, but these are more than offset by the effectiveness and social gains in PO1-B and PO1-C. For data centre operators, the options deliver very substantial improvements over the baseline across b oth weighting schemes. Under equal weighting, the total score rises from –0.501 (baseline) to 0.505 (PO1-A), 0.767 (PO1-B) and 0.654 (PO1-C), with a similar pattern under P1 (–0.438 to 0.399, 0.848 and 0.670 respectively). The baseline is characterised by strongly negative cost scores and only modest effectiveness, whereas PO1-B in particular moves higher (0.767 EW, 0.848 P1) while also delivering the highest effectiveness and social scores. PO1-A and PO1 -C also perform very well, but their cost outcomes are weaker than PO1 -B’s. Environmental performance improves markedly relative to the baseline under equal weighting Impact Costs Effectiveness Environmental Social Total Economic Operators Option EW P1 EW P1 EW P1 EW P1 EW P1 Baseline -0.529 -0.703 0.260 0.504 -0.038 -0.141 -0.003 -0.004 -0.309 -0.344 PO1-A -0.137 -0.156 0.238 0.410 0.040 -0.036 0.203 0.041 0.344 0.259 PO1-B 0.045 0.216 0.298 0.538 0.058 -0.058 0.223 0.045 0.623 0.742 PO1-C -0.063 0.049 0.313 0.527 0.059 -0.057 0.229 0.046 0.538 0.564 National Public Authorities Option EW P1 EW P1 EW P1 EW P1 EW P1 Baseline -0.390 -0.478 0.143 0.374 -0.125 -0.160 0.000 0.003 -0.373 -0.262 PO1-A -0.064 -0.055 0.063 0.096 -0.010 -0.038 0.063 0.013 0.050 0.015 PO1-B -0.023 0.108 0.188 0.333 0.004 -0.056 0.113 0.023 0.281 0.408 PO1-C -0.097 -0.101 0.195 0.304 0.021 -0.047 0.141 0.028 0.259 0.185 157 (especially in PO1-C), though again becomes slightly negative under P1 as the model places more emphasis on economic deployment. Ov erall, operators clearly favour the more interventionist national package in PO1 -B, with PO1 -C and PO1 -A still representing substantial improvements over the status quo. For SMEs104, results show that all three options perform substantially better than the baseline, with PO1-C as the most favourable option under EW and PO1-B under P1 weights. All options improve over the baseline levels, yielding positive totals of 0.444 (PO1-A), 0.612 (PO1-B) and 0.629 (PO1-C) under EW. The improvement is driven by higher effectiveness scores (up to 0.320 for PO1 -C) and clearly positive social and environmental contributions. When the Problem 1 weighting is applied, the ordering changes: PO1-B performs best (total 0. 561), followed by PO1 -C (0.526) and PO1 -A (0. 391), showing that as economic deployment is emphasized over other criteria, SMEs tend to favour PO1-B rather than an EU-level approach. Indeed, under P1, PO1-B improves mainly driver by higher effectiveness (0.569) compared to the other options and the baseline. Table 56. MCDA Cloud and AI Computing Service Providers and Data Centre Operators MAUT – Problem 1 (Source: Technopolis et al. (2025)) 6.2.3 Multi-criteria analysis for Problem 2 For Problem 2, all three options outperform the baseline clearly under both equal weighting and the Problem 2 weighting, but with a distinct ordering. Under equal weighting, total scores move from a negative baseline (-0.183) to moderately positive values for all options (0.439 for PO2-A, 0. 418 for PO2 -B, 0.48 8 for PO2 -C), reflecting broad improvements across effectiveness, social and environmental dimensions despite remaining negative on costs. When the Problem 2 weighting is applied, placing greater emphasis on economic and sovereignty- related aspects, overall performance improves substantially and differences between options 104 SMEs account for cloud and AI computing service providers. Data centers are not included. Impact Costs Effectiveness Environmental Social Total Cloud and AI Computing Service Providers Option EW P1 EW P1 EW P1 EW P1 EW P1 Baseline 0.000 0.000 0.262 0.508 -0.026 -0.129 0.031 0.002 0.267 0.381 PO1-A 0.000 0.000 0.223 0.386 0.028 -0.046 0.189 0.038 0.440 0.378 PO1-B 0.000 0.000 0.286 0.520 0.050 -0.062 0.205 0.041 0.542 0.499 PO1-C 0.000 0.000 0.306 0.514 0.046 -0.070 0.220 0.044 0.572 0.488 Data Centre Operators Option EW P1 EW P1 EW P1 EW P1 EW P1 Baseline -0.534 -0.711 0.253 0.492 -0.083 -0.191 -0.137 -0.029 -0.501 -0.438 PO1-A -0.142 -0.164 0.298 0.509 0.089 0.002 0.260 0.052 0.505 0.399 PO1-B 0.046 0.219 0.342 0.609 0.087 -0.039 0.292 0.059 0.767 0.848 PO1-C -0.063 0.048 0.340 0.576 0.109 -0.008 0.269 0.054 0.654 0.670 SMEs Option EW P1 EW P1 EW P1 EW P1 EW P1 Baseline 0.000 0.000 0.233 0.453 -0.039 -0.132 -0.028 -0.011 0.166 0.311 PO1-A 0.000 0.000 0.222 0.386 0.039 -0.032 0.182 0.036 0.444 0.391 PO1-B 0.000 0.000 0.314 0.569 0.062 -0.056 0.237 0.047 0.612 0.561 PO1-C 0.000 0.000 0.320 0.529 0.061 -0.053 0.248 0.050 0.629 0.526 158 become more marked. The baseline remains negative (-0.220), while PO2-A rises to 0.572 and PO2-B and PO2-C reach 0.709 and 0.928 respectively. The shift to the P2 weighting particularly benefits PO2-B and PO2-C because they combine improved cost outcomes (costs turn positive under P2 for both) with strong gains on the effectiveness dimension, which carries the highest weight in this scenario. Social scores are consistently positive and higher than the baseline for all three options in both weighting schemes, and environmental scores, while modest, also improve relative to the status quo. PO2- A and PO2 -B perform well but are clearly dominated PO2-C under P2, indicating that more ambitious and coordinated intervention on sovereignty and uptake delivers a better balance of costs and benefits when judged against the Problem 2 policy priorities. Table 57. MCDA Results MAUT – Problem 2 (Source: Technopolis et al. (2025)) The PROMETHEE II results for Problem 2 clearly point to PO2 -C as the best -performing option, with PO2 -A a solid second and PO2 -B consistently weakest. Under equal weighting, all options improve on the baseline ( –0.333 at impact level; –0.213 at sub-impacts), but PO2- C achieves the highest net flows both at the impact level and sub -impact (0.333 and 0.162), ahead of PO2 -A (0. 000 and 0. 130) and PO2 -B (0. 000 and –0.079). When the Problem 2 weighting is applied, this ordering becomes even clearer: PO2-C again records the highest net flows (0.333 at impact level and 0.443 at sub-impacts), PO2-A remains positive at sub-impact level but more moderate (0. 150) and becomes negative at impact level ( -0.133), performing worse than the baseline. Similarly, PO2-B is negative at the impact level and sub -impact (– 0.400, - 0.072 at sub-impacts) and therefore appears poorly aligned with the sovereignty - and resilience-focused P2 priorities. Thus, PROMETHEE II indicates that PO2-C offers the strongest and most robust performance across both impact and sub -impact structures, with PO2 -A preferable to the baseline in most cases, and PO2-B clearly the least attractive option. Table 59. PROMETHEE II - Problem 2 (Source: Technopolis et al. (2025)) Option EW - Impacts EW Sub-impacts P2 - Impacts P2 – Sub-Impacts Baseline -0.333 -0.213 0.200 -0.521 PO2-A 0.000 0.130 -0.133 0.150 PO2-B 0.000 -0.079 -0.400 -0.072 PO2-C 0.333 0.162 0.333 0.443 For Problem 2, ELECTRE III at the impact level, under both equal weighting and the P2 weights, the descending ranking is PO2 -C > PO2 -A = baseline = PO2-B. PO2-C is the only option that outranks all the other options and the baseline. At the sub-impact level, PO2-C again dominates in both EW and P2 options the ordering is PO2 -C > PO2-A = baseline = PO2 -B, with credibility values close to 1 for the outranking of the other options. This means that, when non-compensatory logic is applied and deal-breaker criteria are allowed to veto weak options, PO2-C is the clearly preferred option for Problem 2, while PO2-A and PO2-B offer at best a marginal improvement over the status quo. Within the second group of options, PO2 -C Costs/efficiency Effectiveness Environmental Social Total Option EW P1 EW P1 EW P1 EW P1 EW P1 Baseline -0.361 -0.547 0.242 0.345 -0.037 -0.007 -0.026 -0.010 -0.183 -0.220 PO2-A -0.098 -0.103 0.241 0.614 0.048 0.010 0.249 0.051 0.439 0.572 PO2-B -0.009 0.168 0.228 0.490 0.046 0.009 0.199 0.041 0.418 0.709 PO2-C -0.027 0.257 0.192 0.612 0.056 0.011 0.229 0.047 0.488 0.928 159 generates a meaningful improvement relative to the status quo, while PO2-A and PO2-B do not materially change outcomes compared to the baseline. Table 60. ELECTRE III ranking of options – Problem 2 (Source: Technopolis et al. (2025)) Option Impact level (EW) Sub-impact level (EW) Impact level (P1) Sub-impact level (P1) Overall ELECTRE III judgement PO2-C 1 1 1 1 Clearly strongest PO2-A 2 = Baseline = PO2-B 2 = Baseline = PO2-B 2 = Baseline = PO2-B 2 = Baseline = PO2-B At best marginal over baseline PO2-B 2 = Baseline = PO2-A 2 = Baseline = PO2-A 2 = Baseline = PO2-A 2 = Baseline = PO2-A At best marginal over baseline Baseline 2 = PO2-B = PO2-A 2 = PO2-B = PO2-A 2 = PO2-B = PO2-A 2 = PO2-B = PO2-A Reference Stakeholder analysis For economic operators, all three Problem 2 options deliver a clear improvement over the baseline, but with different strengths. Under equal weighting, PO2C clearly dominates PO2A and PO2B (0.552 vs 0.453 vs 0.421), reflecting that transparency measures and coordinated EU frameworks are seen as offering broad benefits even if costs remain mildly negative. When the Problem 2 weighting is applied, PO2C again becomes the standout option (0. 851 vs 0.634 for PO2B and 0.611 for PO2A). This is driven by the fact that PO2C comb ines the strongest cost outcome for operators (costs shift from negative at baseline to clearly positive (0.036) with robust effectiveness and social gains. PO2-A still delivers the highest social score for operators (0.051) under EW and P2, but its weaker cost performance means it ranks second overall once the higher weight on effectiveness and cost dimensions is considered. For national public authorities, preferences differ. All options again improve substantially on the baseline, but PO2 -C is the most attractive option when judged against the Problem 2 priorities. This is mostly drive by its cost performance, which outranks the other options and the baseline. Under equal weighting, PO2-B already has the highest total score (0.215 vs 0.184 for PO2A and 0.136 for PO2C), largely because it nearly eliminates the negative cost gap while improving effectiveness and social outcomes. Under the P2 weighting, PO2B’s advantage becomes less pronounced than PO2-C, which improves cost burdens for public authorities with respect to the baseline . By contrast, even though it outranks the other options across all dimensions under P2 weights, PO2-A leaves authorities facing notable net costs, which lowers its overall impact . In short, operators tend to strongly favour the EU -coordinated support package in PO2 -C, whereas public authorities place greater value on PO2-C than PO2-B, specifically when applying P2 impacts, focused on d igital sovereignty and resilience in the public sector including through public procurement. Table 61 Economic Operators and Public Authorities MAUT – Problem 2 (Source: Technopolis et al. (2025)) Impact Costs Effectiveness Environmental Social Total Economic Operators Option EW P2 EW P2 EW P2 EW P2 EW P2 Baseline – P2 -0.369 -0.563 0.260 0.375 -0.038 -0.008 -0.003 -0.006 -0.149 -0.201 PO2-A -0.074 -0.044 0.244 0.597 0.036 0.007 0.247 0.051 0.453 0.611 PO2-B -0.009 0.113 0.181 0.474 0.036 0.007 0.195 0.040 0.421 0.634 PO2-C 0.036 0.180 0.238 0.615 0.045 0.009 0.234 0.047 0.552 0.851 160 For CSPs and AI service providers under Problem 2, the MAUT results show that all three options perform markedly better than the baseline, but PO2-C emerges as the best-performing configuration overall. The baseline records negative total scores under both equal weighting (– 0.102) and the Problem 2 weighting (–0.205), driven by cost penalties and limited effectiveness and social effects. Under equal weighting, total scores improve to 0.411 for PO2-A, 0.392 for PO2-B and 0.509 for PO2-C. When the Problem 2 weighting is applied the results are further confirmed. PO2-C becomes the clear leader with a total of 0.812, ahead of PO2-B (0.601) and PO2-A (0.567), while PO-A still performs well in terms of effectiveness and social outcomes. For SMEs105 results indicate that all three options improve substantially on the baseline, with PO2-C as the most favourable option under P2 weights and PO1-A under EW . Under equal weighting, all options outperform the baseline, with 0.508 for PO2-A, 0.499 for PO2-C and 0.394 for PO2-B, mainly by increasing effectiveness, social and environmental scores. When the Problem 2 weighting is applied, the contrast with the baseline becomes weaker: the baseline total increases to 0.352, while PO2-C reaches 0.723, compared with 0.653 for PO2-A and 0.518 for PO2-B. In this scenario, PO2-C combines clearly better cost outcomes and environmental impact, despite PO2-A has a slightly higher effectiveness and social score, indicating that more ambitious measures offer SMEs the most advantageous balance under Problem 2. Table 62. MCDA Cloud and AI Computing Service Providers and Data Centre Operators MAUT – Problem 2 (Source: Technopolis et al. (2025)) 7. ENVIRONMENTAL IMPACT ANALYSIS The analysis of the environmental impact of data centres estimates the operational electricity consumption and associated CO₂ emissions of projected data centre capacity in the EU over the 105 SMEs account for cloud and AI computing service providers. National Public Authorities Option EW P2 EW P2 EW P2 EW P2 EW P2 Baseline – P2 -0.318 -0.475 0.143 0.053 -0.125 -0.025 0.000 0.004 -0.300 -0.443 PO2-A -0.153 -0.180 0.157 0.392 -0.016 -0.003 0.195 0.039 0.184 0.247 PO2-B -0.024 0.075 0.146 0.318 -0.022 -0.004 0.116 0.023 0.215 0.413 PO2-C -0.030 0.111 0.129 0.307 -0.025 -0.005 0.063 0.013 0.136 0.425 Impact Costs Effectiveness Environmental Social Total Cloud and AI Computing Service Providers Option EW P2 EW P2 EW P2 EW P2 EW P2 Baseline – P2 -0.369 -0.563 0.262 0.363 -0.026 -0.005 0.031 0.000 -0.102 -0.205 PO2-A -0.074 -0.044 0.229 0.559 0.026 0.005 0.229 0.047 0.411 0.567 PO2-B 0.009 0.113 0.171 0.445 0.029 0.006 0.183 0.037 0.392 0.601 PO2-C 0.036 0.180 0.225 0.582 0.033 0.007 0.215 0.044 0.509 0.812 SMEs Option EW P2 EW P2 EW P2 EW P2 EW P2 Baseline - P2 0.000 0.000 0.233 0.346 -0.039 -0.008 -0.028 -0.013 0.166 0.325 PO2-A 0.000 0.000 0.237 0.598 0.038 0.008 0.233 0.048 0.508 0.653 PO2-B 0.000 0.000 0.174 0.473 0.034 0.007 0.186 0.038 0.394 0.518 PO2-C 0.030 0.092 0.217 0.580 0.043 0.009 0.210 0.043 0.499 0.723 161 period 2025-2036 under the baseline and the three different policy options (PO1-A, PO1-B and PO1-C). The calculation proceeded in four steps: 1. Use of installed IT capacity forecast under the baseline and the respective policy options (MW) 2. Adjustment for utilisation and efficiency 3. Conversion of electricity demand into TWh 4. Application of EU electricity emission factors to derive CO₂ emissions106 7.1. Installed IT capacity Annual projections of maximum IT power draw (MW) are taken as the starting point for each scenario (Baseline, PO1 -A, PO1 -B, PO1 -C), reflecting different trajectories of data centre deployment. Public sector capacity is tracked separately but aggregated into total capacity for environmental calculations. These projections imply compound annual growth rates of approximately: 11% (Baseline); 12% (PO1-A); 13% (PO1-C); 15% (PO1-B) 7.2. Utilisation and efficiency assumptions Installed IT capacity is converted into effective operational load using a utilisation factor of 63%, reflecting the weighted average of data centre utilisation rates reported by Technopolis et al. (2025). These rates came from the CATI survey for colocation providers in primary markets (coming out at 50% utilised), with desk research used to calculate the utilisation rate for colocation providers in secondary and developing markets (45%) and hyperscaler sites (9 0% utilised). This yields the “effective IT load” for each year and scenario. Power Usage Effectiveness (PUE) . Colocation PUE was calculated using information from Data Center Map (coming out an overall average of 1.39) whereas hyperscaler PUE was calculated using the latest reported hyperscaler figures for their EMEA sites from 2023 (coming out at an average of 1.1). These figures were validated against market participants during interview programmes and during both the interim and final workshop. Total facility electricity demand is derived using scenario-specific PUE trajectories: • Baseline improves gradually from 1.29 in 2025 to 1.23 in 2036 • PO1 scenarios assume faster efficiency improvements, reaching: 1.18 (PO1-A), 1.12 (PO1-B), 1.05 (PO1-C) by 2036 These assumptions reflect accelerated uptake of efficient cooling, infrastructure optimisation, and best-available technologies under policy intervention. For further details see section 2.3.4. Total electrical load is therefore calculated as: Total DC load = Effective IT load × PUE This produces declining electricity intensity per GW over time (TWh/GW), even as total consumption increases due to capacity growth. 7.3. Conversion to annual electricity demand Electricity consumption is computed using the standard conversion: Annual electricity (TWh) = Load (GW) × 8,760 hours × 0.001, equivalently: MW × 0.00876 = TWh/year. This yields total annual electricity demand for each scenario, rising from approximately 99 TWh in 2025 to: 314 TWh (Baseline), 339–340 TWh (PO1-A / PO1-C), 408 TWh (PO1-B) by 106 All policy scenarios use the same grid decarbonisation trajectories . Differences in emissions therefore arise exclusively from differences in compute deployment and efficiency. 162 2036. Cumulative electricity demand over 2025–2036 ranges from 2 571 TWh (Baseline) to 3 028 TWh (PO1-B). 7.4. Emissions calculations Electricity consumption is translated into CO₂ emissions using EU-average electricity emission factors from the European Environment Agency. The emission factor declines from 0.25 kg CO₂e/kWh in 2025 to 0.16 kg CO₂e/kWh in 2036, reflecting projected grid decarbonisation107. Annual emissions are calculated as: CO₂ emissions (Mt) = Electricity demand (TWh) × Emission factor (Mt/TWh). The same emission factor trajectory is applied across all scenarios. Despite improving energy efficiency (declining PUE and falling emissions per GW), total emissions increase due to strong capacity gro wth. By 2036 baseline annual emissions are expected to reach 50 Mt CO₂, PO1-A / PO1-C around 54 Mt CO₂, PO1-B reaches 65 Mt CO₂ At the same time, emissions intensity per GW declines by 41–49% across scenarios, illustrating that efficiency and grid decarbonisation partially offset, but do not fully neutralise the impact of capacity expansion. Efficiency improvements substantially reduce emissions per unit of compute. However, rapid expansion of data centre capacity dominates overall outcomes. Policy scenarios that accelerate deployment without parallel structural decarbonisation of power supply materially increase absolute emissions. This highlights the importance of coordinating compute expansion with grid investment and clean generation. 7.5. Limitations This assessment provides an order-of-magnitude estimate of operational electricity demand and associated CO₂ emissions from projected EU data centre capacity. Several limitations should be noted: • The analysis covers operational electricity consumption (Sc ope 2 emissions) only. Embodied emissions from construction, hardware manufacturing, and network infrastructure are not included. Life -cycle studies indicate these can be material, particularly during rapid build -out phases, meaning total climate impacts a re likely understated. • EU average grid emission factors are applied uniformly across scenarios. In practice, incremental electricity demand from new data centres may be met by marginal generation sources that differ from the average mix, possibly leading to higher or lower real -world emissions. A constant utilisation rate is also assumed across scenarios and years. Actual utilisation can vary widely over the asset lifecycle, which introduces uncertainty into absolute electricity estimates. • Power Usage Eff ectiveness improvements are modelled as smooth, deterministic paths. Real-world efficiency gains depend on site-specific factors (climate, cooling technology, density, heat reuse) and may be slower or more uneven than assumed, particularly for retrofit facilities. • The methodology does not distinguish between Member States or regions. Local grid carbon intensity, cooling requirements, and permitting constraints can substantially affect environmental outcomes, but are not captured in this EU-wide aggregate approach. 107 EEA’s indicator shows that the GHG intensity of power generation in the EU has been falling for decades and was about 40% lower in 2024 than te n years before. See here: Greenhouse gas emission intensity of electricity generation in Europe | Indicators | European Environment Agency (EEA) 163 Taken together, these limitations mean results should be interpreted as indicative ranges rather than precise forecasts, and primarily as a tool for comparing scenarios on a consistent methodological basis. 8. SO3 – HOW REALISTIC IS IT TO SET AN OBJECTIVE FOR EU PROVIDERS TO REACH A MARKET SHARE OF 30% BY 2035? Specific objective 3 sets the objective that, by 2035, this intervention should increase the market share of European cloud and AI computing service providers in the European market to 30%. The figure is not used for further calculation in this assessment , but it is worth reflecting on whether this is realistic altogether: what would it take for this figure to become reality? A first element is that cloud adoption varies significantly depending on the user. According to Eurostat the adoption of cloud by businesses in 2023 is estimated at 45.2%, but while around 78% of the large enterprises use cloud services, only 59% of medium ones and 41.7% of small organisations have adopted cloud 108. The level of adoption of cloud in the public sector was estimated at 30% in the context of PM15 and PM21. This gives a sense of where non-cloudified markets are and which ones offer the biggest potential for EU providers to gain new markets and improve their market share overall. Looking at the different categories: • Large customers could display a modest increase in the use of EU suppliers, causing the EU market share to grow by 3.5 % CAGR for this segment . Large organisati ons, such as banks, telcos, IT or the manufacturing sector, are global industries that need to ensure service continuity around the world and will, for an ample part, retain international providers who can offer such geographic coverage: t hey are expected . Growth drivers for EU providers include, for example, multi-cloud strategies, reduction of vendor lock -in, and the shift towards sovereign solutions, especially for the more critical workloads. to be among the largest drivers in cloud expenditures in the following years 109. For instance, some sources estimate the cloud expenditure in the banking and financial sector accounts for 27% of the overall market expenditure in the EU110. Other large customers, who are less global such as the aeronautic sector are moving their critical workloads to sovereign cloud services111. • SMEs could show a steady and more pronounced increase in the use of EU suppliers, causing the EU market share to grow by 7% CAGR, driven by the fact that a large percentage of SMEs are not yet on the cloud. With only 42 – 59% of SMEs (depending on the size) having adopted cloud, SMEs represent a large greenfield opportunity for EU cloud providers. Key enablers are lower swit ching costs and price sensitivity favouring regional providers. To this end, the SME programme (PM23) can act as real catalysers. Some companies like Odoo, a SaaS company offering a broad range of Open Source enterprise applications, are specialised in this type of market. • The public sector could increase their use of EU suppliers much more rapidly, causing the EU market share to grow by 15% CAGR. This reflects the potential impact of joint procurement practices as well as procurement of sovereign services. This sector exhibits 108 European Commission, Cloud Computing 109 IDC 110 Dimension market research 111 See Airbus 164 the strongest sovereignty imperative with directly applicable policy levers, such as public procurement measures, sovereignty concerns, and NIS2 compliance, among others. Warning: the respective CAGR, though presented with plausible explanations, have been picked to broadly match the desired outcome. The figures are presented to show a plausible evolution, and do not constitute a forecast. Synergy puts today’s market share of EU providers at 15%, a figure which, for the sake of this exercise, it is assumed to be the same across all three segments. The evolutions over the three segments would see the EU share grow as follows: Table 67. European Cloud and AI computing service providers share of revenues - per customer segment (%)112 Segment 2025 2026 2027 2028 2029 2030 2031 2032 2033 2034 2035 Large enterprises 15.0 15.5 16.1 16.6 17.2 17.8 18.4 19.1 19.8 20.4 21.2 SMEs 15.0 16.1 17.2 18.4 19.7 21.0 22.5 24.1 25.8 27.6 29.5 Public sector 15.0 17.1 19.5 22.2 25.3 28.9 32.9 37.5 42.8 48.8 55.6 Today’s cloud market is assumed to be divided into three segments: large customers (LC) amounting for 60% of the market 113, small and medium enterprises (SME) being around 26% and the public sector (PS) 14% of the market. Assuming this distribution remains the same, the share of the market for EU providers could evolve as follows: Table 67. European Cloud and AI computing service providers share of revenues – aggregated (%) Segment 2025 2026 2027 2028 2029 2030 2031 2032 2033 2034 2035 Total Share 15.0 15.9 16.8 17.9 19.0 20.2 21.5 23.0 24.5 26.3 28.2 112 Shares indicate the proportion of cloud spend by each customer segment captured by European providers. Projections reflect assumed growth in sovereign demand, procurement preferences in the public sector, and gradual diversification of enterprise cloud sourcing. Total EU share is weighted by segment revenues. 113 This is in line with w hat several s ources estimate of the cloud market share for large organisations in Europe. See for instance GMInsights 165 9. TYPES OF PROCEDURES, PERMITS AND DATA CENTRE DEPLOYMENT TIMELINES PER MEMBER STATE Table 68. Types of permits and timeline per MS selected (Source: Technopolis et al. (2025)) Zoning & land allocation Building permit Utilities & grid connection114 Environmental permit/s Average timeline (months) Czech Republic Prague115 116 117 • Zoning and land allocation for a data centre in Prague generally takes 6 -12 months • The city’s zoning plan is updated quarterly or semi - annually. Incorporating changes into the valid zoning plan typically takes 1.5–2 months after approval by the city council From submission to the relevant Building Authority (stavební úřad) for general construction works to decision and issuance, it takes 6-12 months 2 to 4 years for medium-sized projects, but can extend to 5 years or more for large -scale or high-capacity facilities • Integrated into the permitting procedure under the new Building Act (effective July 2024) • EIA is required for large urban/industrial projects; national screening applies based on size/impact • Screening and scoping take 30 days and the public consultation about 30 days. Then, the EIA authority issues a binding opinion on environmental impacts, which is incorporated into the joint building permit (~10 months total) 24 - 60 114 When it comes to grid connection procedures, a 3 months d eadline for receiving information on treatment of the connection request (i.e., the result of the permitting procedure) has b een introduced by 2024 amendments to the Directive (EU) 2019/944. It also sets basic rules for third party access to electricity infrastructure in a non-discriminatory and transparent manner, applicable to all grid users, including DCs. 115 https://geoportalpraha.cz/en/data-and-services/articles-and-projects/uzemni-plan 116 https://cms.law/en/int/expert-guides/cms-expert-guide-on-real-estate-data-centre-consenting/czech-republic 117 https://www.czechbusinessguide.com/content-of-book-permitting-construction-permitting-processes/ 166 Zoning & land allocation Building permit Utilities & grid connection114 Environmental permit/s Average timeline (months) Estonia Tallinn118 119 120 121 122 • If a detailed spatial plan is required <3 years • If only design specifications are needed ~30 days From submission to the Tallinn Urban Planning Department to approval it takes 2-6 months • For standard/small connection (<2 MW) it takes 6–12 months • For large -scale/hyperscale projects (>10 MW), it can take 1–3 years or more • The EIA is integrated into the permitting process, and its approval is a prerequisite for the building permit • The need for an EIA follows the EU EIA Directive: screening for Annex II projects (urban development/industrial zones) • If needed , the Environmental Board (Ministry of Environment for large projects) determines if an EIA is required (30 days), the scoping and EI study take 6 -12 months. Then there is a public consultation (30 days) and the approval comes 3-6 months after it • The devel oper then must submit again the building permit application to the local municipality after EIA approval (1 -3 months in practice) • Total duration is 11-24 months 6-24 118 https://www.tallinn.ee/en/ettevotjale/spatial-planning-procedures-and-timelines 119 https://cms.law/en/int/expert-guides/cms-expert-guide-on-real-estate-data-centre-consenting/estonia 120 Data collected through interviews 121 https://www.datacentermap.com/estonia/tallinn/datahouse@tallinn/ 122 https://investinestonia.com/estonia-has-the-most-advanced-data-center-in-the-region/ 167 Zoning & land allocation Building permit Utilities & grid connection114 Environmental permit/s Average timeline (months) France Paris123 124 125 126 127 • If the land is already zoned for warehouse/data centre use, allocation takes weeks to months • If a zoning change is needed: 12–18+ months • Large projects require additional regional approval, adding up to 3 months • From the application electronically to the Paris City Hall (Basu office) to approval takes average 3-6 months • If the project triggers environmental thresholds, an EIA is required by DRIEAT (Regional Directorate for the Environment, Planning, and Housing), bringing up the duration to 6-18 months • Standard grid connections with RTE/Enedis takes 1.5– 3 years • On utility -ready/pre- connected sites, time is under 1.5 years • For large or complex projects timeline may exceed 3 years • EIA must be done before the building permit is granted, if required • EIA is required if emergency generators exceed 50 MW thermal output • Initial screening takes 1 month, whereas the EI study preparation takes 612 months • Once the public consultation starts (30 days), the approval comes 3-6 months after • After EIA approval, the developer submits the building permit application to Basu office • Total duration is 13-32 months 24 - 60 Germany Frankfurt128 129 130 131 • Specific “suitability areas” (e.g., Sossenheim, Rödelheim, Griesheim, Gallus, Ostend, • From the consultation with the City Planning Department (Stadtplanungsamt) and the Construction Supervisory • Average waiting time for a new grid connection in Frankfurt (and for Germany)) is up to 7 years • The EIA is integrated into the building permit process and must be completed before the permit is granted 24 - 84 123123123 https://cms.law/en/int/expert-guides/cms-expert-guide-on-real-estate-data-centre-consenting/france 124 https://en.institutparisregion.fr/resources/publications/data-center-growth-and-proposals-for-regulation/ 125 https://www.linkedin.com/posts/stephanieelkhoury_datacentres-energy-connection-activity-7329060095772856320-ubcp 126 https://en.institutparisregion.fr/fileadmin/NewEtudes/000pack4/Etude_3025/Etude-DataCenter-english_2023_VF.pdf 127 https://www.edf.fr/sites/groupe/files/epresspack/9635/PR-Data-center-Vdef-1.pdf 128 https://frankfurt.de/english/service-and-city-hall/service-and-administration/municipal-offices/city-planning-department/construction-advisory-services 129 https://www.germandatacenters.com/en/news-en/detail/figures-of-the-month-data-center-ecosystem-germany-may-2025/ 130 https://www.lw.com/en/insights/energy-infrastructure-insights-data-centres-in-frankfurt-a-city-fit-for-the-future 131 https://www.dlapiper.com/en/insights/publications/real-estate-gazette/real-estate-gazette-infrastructure/power-grid-connections-for-data-centers-in-germany 168 Zoning & land allocation Building permit Utilities & grid connection114 Environmental permit/s Average timeline (months) Fechenheim, Seckbach) where company - independent (cloud/colocation) data centres can be developed (outside these areas, new data centres are not permitted) • If land is not zoned or is in a restricted/exclusion area (usually the case) a change or amendment to the development plan (Bebauungsplan) is required • Amending or creating a new developmen t plan involves public consultation, environmental review, and approval by city authorities, governed by the German Building Code (BauGB) • Timeline is 6-12 months if there is land available in a suitability area and 1 -2 years if a zoning plan amendment is required Office (Bauaufsicht) to approval, most German states require the building permit to be granted within 6 months • 6–12 months is typical for well-prepared, straightforward projects in designated data centre zones • More complex or incomplete applications, or those requiring additional permits or plan amendments, can take up to 12–18 months • Only if grid connection has been pre -secured in suitability areas, it can take 6-12 months • EIA is triggered if ba ckup generators exceed 50 MW thermal capacity • If required, the steps involved screening (1 -2 months), scoping and EIA report (6 -12 months depending on complexity), public consultation (30 days), EIA approval (by the regional environmental authority, 3 -6 months). • After EIA approval, the developer submits the building permit application to the Frankfurt Construction Supervisory Office (Bauaufsicht) • The total timeline is 16 -38 months 169 Zoning & land allocation Building permit Utilities & grid connection114 Environmental permit/s Average timeline (months) Greece Athens132 133 134 • 6–12 months is typical for site selection and confirming zoning if the site selected is suitable (industrial use) • If zoning change or plan amendment is needed, timeline is 12 –24 months • The entire application and issuance process is electronic via the TEE e-permit platform • 2-6 months is typical for the building permit to be issued, provided all documentation is complete and the site is already zoned for data centre use • The process can take 6 -12 months or longer, especially if the site is in a sensitive area (archaeological or environmental assessments), or if documentation is incomplete or needs revision • Request must be submitted to the Independent Power Transmission Operator (IPTO/ΑΔΜΗΕ) for high - voltage connections, or to the Hellenic Electricity Distribution Network Operator (HEDNO/ΔΕΔΔΗΕ) for lower voltage • For most new data centre projects in Athens, the grid connection process — including application, technical studies, permitting, construction of substations or upgrades, and final commissioning—takes between 12-36 months • For hyperscale or high - capacity data centres (e.g., 100 MW+), the timeline can be closer to the upper end (2–3 years) • The EIA is a prerequisite for the building permit. The building permit application cannot proceed until the EIA is approved • Data centres with ≥2 MW capacity fall under environmental regulations and EIA is likely to be triggered if capacity is ≥20 MW • The Ministry of Environment and Energy determines if an EIA is required based on project size, location, and potential impacts (1-2 months) • The following steps include scoping (1 -3 months), EIA report (6 -12 months), public consultation (1 -3 months) and approval (3 -6 months post - consultation) • Total timeline is 14-32 months 18 - 56 132 https://en.mitos.gov.gr/index.php/%CE%94%CE%94:Issue_of_Building_Permits_(e-adeies) 133 https://inconde.com/building-permits-in-greece/ 134 https://en.mitos.gov.gr/index.php/%CE%94%CE%94:Issue_of_Building_Permits_(e-adeies) 170 Zoning & land allocation Building permit Utilities & grid connection114 Environmental permit/s Average timeline (months) Ireland Dublin135 136 137 138 139 140 141 142 • If the land is already zoned, it takes 6 –12 months for site selection, plus 2 –4 months for planning permission • If a zoning change is required, the process can extend to 1 –2 years or more • Most new data centres in Dublin are built on pre - zoned “HT – High Technology” or industrial lands Obtaining a building permit with the Dublin city Council takes 2– 4 months for planning permission (longer if appeals or further information are needed), with building control certificates adding another 2 –3 months (often overlapping with construction preparation) • Since late 2021, EirGrid (Ireland’s transmission system operator) has imposed a de facto moratorium on new data centre grid connections in the Dublin area (till 2028) • Outside Dublin, the connection take’s 1 -3 years (new policy from The Commission for R egulation of Utilities, CRU) • The EIA is a mandatory part of the planning process and must be completed before a building permit (planning permission) is granted • A GHG permit required for generators >20 MW and a full EIA is typically required for larger projects • Screening is performed by the Dublin City Council, followed by the preparation of the EI report (6 -12 months), public consultation (1 -3 months) and final decision (8 weeks statutory timeline) • Total timeline is 10-24 months • 24 (fastest case, out of Dublin) • Indetermined for Dublin Italy • If land already zoned for data centre use: 6 –8 months (with due diligence and planning approval) • Permitting and approvals (planning + building permit) takes in average 6–18 months • If the site is already zoned and documentation is complete, • Standard grid connection: 2 to 4 years, due to a single national grid operator (Terna) processing all • The EIA is a prerequisite for the building permit • EIA is required for generators >50 MW thermal output or for 24 - 60 135 https://consult.fingal.ie/en/system/files/materials/22444/26992/BMC%20Vantage%20FCC%20Dev%20Plan.pdf 136 https://www.dublincity.ie/residential/planning/planning-applications/make-planning-application/planning-process-application/planning-application-timelines 137 https://www.dublincity.ie/residential/planning/planning-applications/make-planning-application/planning-process-application/about-planning-process-application 138 https://www.mhc.ie/latest/insights/permitting-irish-data-centres-what-you-need-to-know-1 139 https://www.dublincity.ie/residential/planning/building-control/about-building-control 140 https://www.rte.ie/news/business/2022/0116/1273819-data-centres-eirgrid/ 141 https://www.capacitymedia.com/article/29ot42ikril15nn8s4c2t/news/new-data-centres-in-dublin-face-power-connection-delay 142 https://www.bisnow.com/dublin/news/data-center/regulator-opens-up-possible-data-centre-pathway-amid-fears-dublin-has-been-left-behind-129587 171 Zoning & land allocation Building permit Utilities & grid connection114 Environmental permit/s Average timeline (months) Milan143 144 145 146 • If zoning change or a plan amendment is needed (12– 18+ months) • Brownfield site (with zoning) can happen in 6–8 months (incentive) the process can be on the shorter end (6–8 months) • If zoning changes or complex planning are required: 12 –18 months requests, a large backlog and the need for upgrades • Brownfield sites, pre -zoned or fast track projects can get the connection in 1.5 -2 years • On the other hand, large/complex projects can take 3-5 years a total project capacity >150 MW • The Municipality of Milan determines the requirement (1 - 3 months) and, from there, the preparation, public consultation, approval and building permit review can add up to 17-32 months Netherlands Amsterdam147 148 149 150 151 152 • If the land is already zoned and available: 2 –6 months (plus site due diligence) • If a zoning plan amendment is required: 6– 12+ months • Most new data centre developments are subject to strict municipal controls and sustainability requirements • If the site is already zoned for data centre use: 8 –14 weeks; with an environmental permit (≥15 MW), allow up to 26 weeks • If a zoning amendment or deviation is needed: 6 –12+ months added before the permit can be reviewed • All projects must comply with the Environmental Act (Omgevingswet), including • No new grid connections for data centres in Amsterdam are expected before 2030 unless the project is essential for the city and meets strict criteria • Even fully built data centres may remain idle if they lack a pre -secured grid connection. • Outside Amsterdam e.g., Rotterdam, Westland, grid • The EIA process is integrated into the permitting framework and cannot be conducted in parallel with the building permit • An environmental permit is required at 15 MW and a full EIA is likely for larger hyperscale projects (>70 MW) • The competent authority (municipality or Omgevingsdienst • 12 (fastest possible case, out of Amsterdam) • Indetermined for Amsterdam 143 https://www.assoimmobiliare.it/wp-content/uploads/2024/03/Colliers_Data-Center-Snapshot-2024_Italy__.pdf 144 https://datacentrenews.uk/story/virtus-announces-new-data-centre-plans-for-milan-italy 145 https://www.cliffordchance.com/content/dam/cliffordchance/briefings/2025/05/data-centres-in-italy.pdf 146 https://cms.law/en/int/expert-guides/cms-expert-guide-on-real-estate-data-centre-consenting/italy 147 https://www.stibbe.com/publications-and-insights/increasing-control-of-data-centre-locations 148 https://cms.law/en/int/expert-guides/cms-expert-guide-on-real-estate-data-centre-consenting/netherlands 149 https://cms-lawnow.com/en/ealerts/2022/11/netherlands-prohibits-creating-hyperscale-data-centres-until-national-guidelines-are-passed 150 https://openresearch.amsterdam/image/2020/4/30/the_governance_of_land_use_amsterdam_2017.pdf 151 https://www.haskoning.com/en/newsroom/blogs/2023/navigating-dutch-data-centre-challenges-and-opportunities 152 https://www.portofamsterdam.com/sites/default/files/2020-06/guide-permit-application.pdf 172 Zoning & land allocation Building permit Utilities & grid connection114 Environmental permit/s Average timeline (months) • For hyperscale data centres (>10 hectares/70 MW): New developments are effectively banned in Amsterdam and most of the Netherlands energy efficiency and emissions standards • Engaging with the city and OD NZKG early can clarify requirements and avoid delays connection is possible within 1–3 years Noordzeekanaalgebied, OD NZKG, for larger projects) determines if an EIA is required, by submitting a screening request through the Omgevingsloket (environmental permit portal). This takes 1-3 months • The EI report, public consultation and building permit review in total take from 10-24 months Poland Warsaw153 154 155 156 157 158 • If the site is already zoned: 1–2 months • If a zoning permit is needed: 3–9+ months • If an environmental decision is required: add up to 6 months. • Land acquisition can proceed in parallel, but legal title is needed before the building permit stage • Obtaining a building permit takes 65 days to 6 months • The process is managed by the district authority (starosta) • Starts by submitting request to the network operator (e.g., PGE Dystrybucja, Innogy Stoen Operator) • In general, the process takes from several months–1 year • Full grid connection (total process) is 2–3 years • In large projects (100 MW+) with major upgrades/delays: 3+ years • The EIA is a mandatory preliminary step that must be finalized before applying for the building permit • The EIA requirem ent follows the EU EIA Directive and there is a screening for industrial projects based on size/impact • The screening is submitted to the Regional Environmental Protection Authority i.e., Mazovian Voivodeship and 24 - 45 153 https://cms.law/en/int/expert-guides/cms-expert-guide-on-real-estate-data-centre-consenting/poland 154 https://www.legal500.com/developments/thought-leadership/a-planning-permit-can-be-obtained-in-poland-if-land-to-be-developed-is-located-within-a-development-zone/ 155 https://dwfgroup.com/en/news-and-insights/insights/2024/9/general-zoning-plan-for-warsaw 156 https://consultant.net.pl/en/consultant-article/how-to-obtain-a-building-permit-in-poland-1 157 https://www.gtlaw.com/en/insights/2024/4/data-centres-in-poland-planning-and-electricity 158 https://natlawreview.com/article/data-centres-poland-planning-and-electricity 173 Zoning & land allocation Building permit Utilities & grid connection114 Environmental permit/s Average timeline (months) from there, the total process can take 11-24 months Romania Bucharest159 160 161 162 163 164 165 166 167 • Zoning and land allocation for a data centre in Bucharest can take a few months for small plots (<3,000 sqm) with no PUZ (Zonal Urban Plan) required, or 3 –6 months if a valid PUZ is already in place • For larger plots requiring a new PUZ, the process can take 1–2 years or more but is currently subject to major delays due to legal and administrative gridlock • The Romanian Construction Law stipulates that building permits must be issued wi thin 30 days. In practice, it takes 6- 12 months • Building permits are issued by either the General Mayor of Bucharest or District Mayors, depending on project type and location • Romania’s energy regulator (ANRE) has recently overhauled grid connection rules. As of June 2025, only fully documented projects are placed in the queue, and developers must provide a financial guarantee before receiving a grid connection permit • Timeline is 1.5 –3 years for grid connection, from application to energization. • The EIA is a prerequisite for the building permit • The EIA requirement follows the EU EIA Directive and there is a screening for industrial projects based on size/impact • From sending the screening to the Bucharest Environmental Protection Agency, the total timeline fo r an EIA is 11 -24 months 18 - 36 Spain • The municipality determines the specific • Granted based on the technical project submitted by the developer. 3 -12 months (3 -4 • Submitting an access and connection request to Red Eléctrica de España (REE), • An Environmental Impact Assessment (EIA) may be required (e.g., projects > 15 12 - 48 159 https://www.businessforum.ro/real-estate/20241129/investors-in-data-centers-enter-race-for-land-plots-in-romania-1111 160 https://www.property-forum.eu/news/data-center-investors-enter-race-for-land-plots-in-romania/19253 161 https://www.arl-international.com/sites/default/files/2023-11/Fact%20sheet%20for%20planning%20levels_local_Zonal%20Plan.pdf 162 https://cms-lawnow.com/en/ealerts/2022/08/bucharest-tribunal-rules-against-the-city-s-main-zoning-plan 163 https://buildecon.blog/2025/03/20/bucharests-drop-in-residential-permit-and-completion/ 164 https://www.cristinatudor.ro/en/post/unlocking-romania-s-building-permit-process-your-gateway-to-successful-construction-projects 165 https://www.nglsymbio.com/wp-content/uploads/construction-permits-in-cee-practical-guide-1.pdf 166 https://horizons.legal/wp-content/uploads/2025/02/CONSTRUCTION-PERMITS-IN-CEE-01-25-1.pdf 167 https://www.pv-magazine.com/2025/06/16/romania-updates-grid-connection-rules/ 174 Zoning & land allocation Building permit Utilities & grid connection114 Environmental permit/s Average timeline (months) Madrid168 169 170 171 172 planning designation (industrial use) • Amendments/new planning involves, detailed planning, municipal review, and sometimes higher-level regional approvals (6-12 months on top) • There are no land plans or zones that automatically authorise data centres in Madrid; approvals are granted on a case -by-case basis months in straightforward cases) • First Occupancy License (Licencia de Primera Ocupación): obtained after construction, confirming the building complies with the building permit. Involves inspection by municipal officials (3-6 months). • Activity and Opening Licenses (Licencia de Actividad y Licencia de Apertura): confirms regulatory compliance for the intended use. “Declaración Responsable” (responsible declaration), the license is immediate or nearly immediate. For activities requiring a full license procedure (for significant or “qualified” activities), the the national transmission system operator • Undergoing feasibility studies, technical reviews , and regulatory approvals • Construction of new substations or high -voltage lines if required • Final commissioning and energization • <12 months If the site is already near a substation with available capacity, or if a developer has pre -secured grid access • 2–4 years is the benchmark (especially for data centres > 100 MW) MW), depending on the size and location of the project. This can add several months to the process, especially if p ublic hearings or additional studies are needed • The average is 11 -24 months, including the determination request, EI study, public consultation and DIA issuance) • DIA must be issued before the building permit is granted 168 CMS. (2025). Expert Guide on Real Estate Data Centre Consenting: Spain. Retrieved June 17, 2025, from https://cms.law/en/int/expert-guides/cms-expert-guide-on-real-estate-data-centre-consenting/spain 169 Aeclu. (n.d.). Cuánto tarda la licencia de primera ocupación en Madrid. Retrieved June 17, 2025, from https://www.aeclu.com/blog/noticias/cuanto-tarda-la-licencia-de-primera-ocupacion-en-madrid/ 170 Madrid Licencias. (n.d.). ¿Cuánto tarda una licencia de apertura y actividad? Retrieved June 17, 2025, from https://www.madridlicencias.com/blog/cuanto-tarda-una-licencia-de-apertura-y-actividad/ 171 Strategic Energy Europe. (n.d.). Spain DC: Centros de datos y renovables. Retrieved June 17, 2025, from https://strategicenergy.eu/spain-dc-centros-de-datos-y-renovables/ 172 Montel News. (2024, March 21). Spain power demand may get 3 GW boost from data centres. Retrieved June 17, 2025, from https://montelnews.com/news/db842f28-b5f8-4c75-b914-cfd2792d219a/spain- power-demand-may-get-3-gw-boost-from-data-centres 175 Zoning & land allocation Building permit Utilities & grid connection114 Environmental permit/s Average timeline (months) process typically takes 3 -6 months Sweden Stockholm173 174 175 176 • Land designated as “technical facility” use in the municipal zoning plan (detaljplan): 0 months • If not, new/amended zoning plan is needed (municipal approval + public consultation): +12 - 24 months • Building permit (bygglov) average is 2 -3 months (may take longer for complex projects) • After approval, a “start clearance” is needed before construction can begin, and a final clearance before the facility can be used • Initiated in parallel or even before the permitting process by engaging with local grid owner (o ften Ellevio or Vattenfall) • Technical and feasibility studies, land rights and permits, construction and commissioning take 2 -4+ years • Data centres themselves usually do not require a separate environmental permit (integrated within overall permitting) • if the project involves significant water use or heat recovery, additional environmental permissions may be needed (in line with the EU EIA directive) • The steps are screening and scoping (60 days), preparation of EI statement, submission and completeness c heck, public consultation (30 days). • The permit authority (often the Land and Environment Court or Environmental Assessment Delegation) may hold hearings or written consultations with all parties • 24 (average case) • 48+ (worst possible case) 173 CMS. (2025). Expert Guide on Real Estate Data Centre Consenti ng: Sweden. Retrieved June 17, 2025, from https://cms.law/en/int/expert -guides/cms-expert-guide-on-real-estate-data-centre- consenting/sweden 174 City of Stockholm. (n.d.). Building permits in English. https://bygglov.stockholm/in-english/ 175 Node Pole. (n.d.). Node Pole Report (Sweden). https://8866495.fs1.hubspotusercontent-na1.net/hubfs/8866495/Node%20Pole%20Report%20(Sweden)%20-%20FINAL.pdf 176 Rigord, N. (2024). EIA effectiveness in Sweden: a Stockholm case -study [Master's thesis, KTH Royal Institute of Tech nology]. DiVA Portal. http://www.diva - portal.org/smash/get/diva2:1898845/FULLTEXT01.pdf 176 Zoning & land allocation Building permit Utilities & grid connection114 Environmental permit/s Average timeline (months) • Timeline is 6-18 months and up to 24 months for complex cases • The building permit cannot be granted until the environmental permit (including the EIA) is in place ANNEX 5: COMPETITIVENESS CHECK 1. OVERVIEW OF IMPACTS ON COMPETITIVENESS Dimensions of Competitiveness Impact of the initiative (++ / + / 0 / - / -- / n.a.) References to sub-sections of the main report or annexes Cost and price competitiveness + Section 6.1.5, Annex 4 International competitiveness + Section 6.1.5, Section 6.1.6 Capacity to innovate ++ Section 6.1.1, Section 6.1.4 SME competitiveness + Section 6.1.1 SYNTHETIC ASSESSMENT Cost and price competitiveness CADA will impact both costs and price competitiveness. Building data centres is a capital- intensive and complex activity that requires multiple permits and investments in its whole lifecycle (design, construction and operation). The facilitation of access to l and and streamlined grid connections along with fast -track permitting procedures is expected to reduce total cost of ownership for data centre operators (PO1-B). By shortening approval times, simplifying and harmoni sing requirements the cost of the immobil ised capital as well as transaction costs will be lowered. The introduction of a national facilitator for data centre projects will allow to save administrative time, very important for SMEs. The result of the preferred package is expected to increase the number of providers, enhancing competition and reducing market concentration. Under the preferred package (PM8 and PM9), research and innovation will fund novel technologies (e.g. advanced cooling, AI-based energy optimization, etc..) to achieve much more efficient data centres in terms of use of energy . This innovation is expected to have positive spillovers across the European cloud and AI value chain. Businesses benefitting from the development of such innovations can achieve a lower total cost of ownership (TCO), and transfer part of these gains to customers through more competitive pricing for access to data centre capacity . This is particularly important for E U companies as they operate at smaller economies of scale than their international counterparts. With respect to cloud and AI computing services , PO2-C under the preferred package implies additional costs for cloud and AI computing service providers to be audited with a view of achieving a sovereignty qualification which allows for providing services to public administrations in highly critical use cases. This may result in an increase of prices for sovereign cloud and AI computing services, as the cost of adjusting (e.g. due to the creation of new legal constructs) may be passed on to the customers in the form of a price premium. This will be the case until the market has stabilised, and the providers have recuperated the investment undertaken (short-term). The risk sovereignty mechanism is expected to be an important cost aspect for SMEs due to the effort needed to obtain and maintain the audit. Over time, however , a harmonised and recogni sed mechanism valid across the EU will reduce transaction costs and increase trust and market access. 178 Joint procurement and federation are likely to have a two-fold cost impact. First, they will create economies of scale on the demand side, reducing unit prices for procured services . Second, they will generate predicta ble demand signals, which will decrease the risk premiums of the suppliers. Joint procurement and federation can reshape the market by creating a large pool of aggregated demand open to multiple providers, notably allowing smaller providers to compete for specialised services. This will result in an overall improved situation of the public sector using cloud and AI computing services, mitigating the risk s stemming from dependence on a small number of providers . An additional element is transparency: through the access to large contracts , smaller cloud and AI computing service providers can retain customer acquisition costs (CAC) and amorti se fixed development expenditures. This will result, in the medium term, in a more stable cost structure and greater price competitiveness. The creation of a cloud and AI toolbox is expected to promote further competition by allowing European providers to better integrate their service offerings . Currently, there is a large fr agmentation across national markets and cloud , and AI computing services are not comparable which create uncertainty. This is expected to have a positive impact in SMEs. The directly affected sectors are data centre operators and the providers of cloud and AI computing services. While both sectors will need to undergo some adaptation in the way they work, this is not expected to not cause a disruption and will mostly result in benefits, such as savings in construction time, aggregated offers, and more secur ity and resilience. Indirectly affected sectors are on one end of the value chain the public sector and the customers of the cloud and AI computing services market and on the other, the semiconductor industry, energy systems and utilities. Cost-price impacts of the preferred package (PO1-B + PM8 + PM9 + PO2-C) are expected to be different depending on the problem driver targeted. Faster permitting and access to land as well as clear procurement criteria will cause effects in the short term (0 -2 years). In the medium term (2-5 years), the effects will arise from the go-to-market of the research and innovation funds, the putting in place of the federation mechanisms, which will allow an intensification of competition, a decrease of prices and effici ency gains. Long -term impacts (>5 years) will come from the combination of selected locations for computing infrastructure and the access to energy and other natural resources, notably by gaining location advantage. The preferred package shall notably improve competitiveness. It implies a learning curve to implement some of the policy measures proposed (e.g. energy efficiency technologies, research and innovation, federation, interoperability) and network effects (e.g. open source). However, one of the major risks is on the implementation of permitting and access to grid and how they are managed (e.g. sequentially, in parallel) as these have an effect on the structural costs and durable price competitiveness. International competitiveness CADA strengthens the competitive position of data centre operators active in the EU and of European cloud and AI computing service providers. In the case of data centre operators, it will reduce structural cost disadvantages stemming from the fragmented permitting regimes existing nowadays (see Annex 4, section 8). Data 179 centre operators in the EU will be able to expand their capacity faster at lower cost. Simplification of administrative procedures will reduce entry barriers, notably for mid - sized firms, favouring the scalability of European players (PM4, PM5). Both EU and non- EU players, however, will benefit from vast economies of scale. The deployment of computing infrastructure across the EU, and notably the deployment of sovereign cloud and AI computing serv ices, will allow the EU to decrease its dependencies on data infrastructure located outside of the EU and its dependence on non- European providers of cloud and AI computing services , while increasing the economic security of the EU in the field of cloud an d AI. The creation of a common definition of sovereignty, with clear criteria, along with the mandatory sovereignty risk assessment (PM21), will boost the trust and credibility of sovereign services, allowing their providers to differentiate themselves in markets where security, sovereignty and compliance are key items. Providers of sovereign services will hence be able to compete on trust, transparency and robustness rather than on price alone. The establishment of research and development funding, addressing technological asymmetries with global incumbents will allow to develop next -generation technologies for energy efficiency, AI and other aspects (PM8, PM9) . Currently, non -EU providers often lead with proprietary solution s. The use, reuse and promotion of open source in public administrations, will accelerate innovation allowing EU companies to compete in terms of performance, energy efficiency, and novel offers (PM20). All measures under this initiative are conceived to be in line with the EU’s international trade obligations . The initiative looks to incentivi se local investment and aggregate demand by anchor customers, ensuring that competitive advantage is grounded in trust and operational excellence rather than on market power. Finally, the initiative seeks to enable European providers to gain market share at EU and international level, by equipping them with the necessary mechanisms to enhance the scale and scope of their service offering . In the mid to long term, the l evers proposed in this initiative (e.g. fast-permitting, national facilitator, funding mechanisms, joint procurement, federation) to solve very clear challenges of today (e.g. sustainability, skills, leverage of open source, aggregation of demand, sovereignty) will allow European providers to expand their market presence, in the EU and beyond. Capacity to innovate CADA goes directly at the heart of improving the capacity to innovate (PM8, PM9) and the improvement of skills (PM23). The funding mechanisms (PM8, PM9), complemented with the cloud and AI adoption scheme targeted towards SMEs and the skills certification (PM23) will boost the capacity to innovate at product, service and process level. The spillover effects of research funds, where a myriad of EU stakeholders can participate (e.g. academia, SMEs, large enterprises), allow also for the initiative to anchor intellectual capital and innovation capabilities within the EU. Other aspects such as the promotion of open source in the public sector enlarge the amount of resources available for future innovative products and services (PM20). Open source allows to balance open innovation with adequate intellectual property protection. EU public sector bodies are hence able to reuse and extend these solutions under clear legal certainty, lowering entry costs for smaller innovators. 180 Finally, the use of well-defined sovereign criteria (PM21) are expected to create a demand- pull effect in the market, where companies will invest in R&D in order to develo p technologies that will equip them to meet these criteria in a more efficient way. SME competitiveness The initiative directly affects SMEs, mostly in a positive manner. By r emoving bureaucratic friction and accelerating permitting times, boost ing innovation capacity and mechanisms to adopt or migrate to cloud and AI and allowing to share resources and services, the initiative levels the playing field between smaller and larger providers by reducing fixed regulatory costs that otherwise would deter SMEs from participating in the operation of data centre s and the provision of cloud and AI computing services . The measures allow SMEs to compete on merits and specialization, not marketing budgets. The audit scheme, however, generates a burden for SMEs, both to obtain it and to renew it on a yearly basis. But this can have a double effect. First, since it will be valid throughout the EU, it may open new markets to providers that now are out of reach due to other requirements (e.g. national certification schemes or labels), notably in the context of public procurement. Second, being audited under clear sovereign criteria may be used by SME providers to capture part of the private sector market dealing with highly critical data (e.g. defence) and to overcome the buyers’ bias towards solutions offered by larger providers. The minimisation of the burden on SMEs is one of the goals of this intervention, as well as simplification, proportionality, harmonisation, supportive ecosystems and open access. All these considerations stay at the core of the initiative, by for instance, transforming compliance into an innovation catalyst, by providing compensatory enablers (e.g. grants, national support measures). For more information see Annex 6 SME check. 181 ANNEX 6: SME CHECK OVERVIEW OF IMPACTS ON SMES Relevance for SMEs Based on SME filter and the (first) ISG discussion, this initiative is relevant for SMEs177 (1) IDENTIFICATION OF AFFECTED BUSINESSES AND ASSESSMENT OF RELEVANCE Are SMEs directly affected? In which sectors? SMEs are directly affected, though in different ways depending on their role in the data centre, cloud and AI value chain. Firstly, on the limited and geographically concentrated availability of computing capacity (P1), the affected SMEs are those companies building and operating data centres , which encompass data centre operators, cloud service providers that build and operate their own data centres, construction and real estate companies. Building data centres is a capital-intensive activity and hence the number of SMEs affected is limited. Secondly, on the dependence on cloud and AI computing services supplied by non -European providers (P2) there are two strands of SMEs stakeholders affected by the current initiative . First, cloud and AI computing service providers, that is, those organizati ons that develop and offer their services to business and governmental customers and on the other, SMEs that use cloud and AI computing services. Estimated number of directly affected SMEs SMEs directly affected by the initiative, i.e. involved in building or operating data centres are approximately 150 across the EU 178. Furthermore, t he Technopolis et al. (2025) mapped179 existing cloud service providers in the EU (284) and the results yielded that around 60% of the identified providers are SMEs or startups headquartered in the EU (175) whereas including non-EU headquartered, the number amounts to 200180. The same mapping e xercise was carried out for AI service providers but the results to quantify the affected organizations are less conclusive. Beyond cloud and AI computing service providers, the policy measures under consideration, notably the cloud and AI adoption scheme for SMEs, also affect ICT SME companies181 (65 000) that wish to use cloud and AI computing services. More broadly, 177 https://ec.europa.eu/docsroom/documents/63274. 178 Technopolis et al. (2025), “Study: cloud and AI” 179 The mapping carried out by Technopolis et al. (2025), “Study: Cloud and AI” included a manual search cross checked and complemented by existing market reports, entities participating in the Alliance for industrial data, edge and cloud, and MS reports (e.g. qualified entities by SecNumCloud). 180 In contrast, the study identified 59 large cloud service providers headquartered in the EU. 181 According to Eurostat, there are closed to 1.3 bn ICT companies, divided as follows: 1.2 bn are micro, 53,000 are of small size and 12,000 are of midsize. For this domain, only small and midsized companies have been taken into consideration. 182 SMEs in general (1.6 bn)182 will also be affected by the broader availability of cloud and AI computing services, and through the cloud and AI adoption scheme. Estimated number of employees in directly affected SMEs The directly affected SMEs, i.e. those building or operating data centres and those who would increase their user of cloud and AI computing services , are likely employed between 50 and 250 people each, as they are typically small/medium-sized, highly specialised technology firms. With roughly 300 such SMEs across the EU, the total number of employees directly affected can be estimated at around 75.000 people EU- wide. Are SMEs indirectly affected? In which sectors? What is the estimated number of indirectly affected SMEs and employees? The value chain consists of three types of SMEs : data centre operators, cloud and AI computing service providers and cloud and AI computing service users. Service providers deploy their service s on a data centre and offer the services to the user. Depending on the policy measure, service providers are either directly targeted or indirectly. In the context of the first problem, the limited and geographically concentrated availability of computing capacity , the policy measures directly affect data centres operators and indirectly affect cloud and AI computing service provider. A broader availability of data centres will (indirectly) affect positively cloud and AI computing service providers as they will be less s ubject to a shortage of infrastructure where to deploy their applications and services or where they can train or inference their models. This is particularly the case for European SMEs leading in AI, which face significant challenges in obtaining the resources, funding, and market opportunities they need, often finding themselves pushed into early commercial dependencies with infrastructure providers. The number of cloud and AI computing service providers aligns with the values indicated above. In the context of the second problem , the dependence on cloud and AI computing services supplied by non-European providers, the policy measures directly affect SMEs that provide cloud and AI computing services and indirectly affect those SMEs that use these services. Here, the extent of SMEs indirectly benefiting from a n increase cloud and AI update is virtually all of them as for example such services are increasingly necessary to declare taxes, produce electronic bills or manage the day-to-day operations of a business, even for single persons’ businesses. The same logic applies for the subset of SMEs that need sovereign cloud and AI computing services with a higher level of protection. 182 SME Performance Review - Internal Market, Industry, Entrepreneurship and SMEs estimates the existence of 26 bn SMEs, out of which more than 24.5 bn are considered micro. 183 (2) CONSULTATION OF SME STAKEHOLDERS How has the input from the SME community been taken into consideration? Input from the SME community has been taken into consideration through the public consultations (survey and call for evidence) , targeted consultations by the study team , stakeholder workshops, and continuous dialogue with industry associations, and innovators active in AI and cloud technologies. The following SME respondents have participated to the: • Public consultation: 17 SMEs (or 25% of total business replies) • Call for Evidence: 25 SMEs (or 45% of total business replies) • Targeted consultations by the study team • Stakeholder workshops • Bilateral dialogues Are SMEs’ views different from those of large businesses? Yes. SMEs’ views differ significantly from those of large businesses, mainly due to their resource constraints, market position, and regulatory capacity. While large companies generally support st ronger cloud and AI ecosystems, they often focus on scaling infrastructure, interoperability, and competitiveness at a global level. In contrast, SMEs emphasize accessibility, affordability, and simplicity as they need easier access to compute resources, c learer guidance on compliance, and reduced administrative and financial burdens. (3) ASSESSMENT OF IMPACTS ON SMES183 What are the estimated direct costs for SMEs of the preferred policy option? Qualitative assessment PO1-A improves SME access to information through clearer guidelines, reducing costs from information gaps and helping SMEs voice concerns collectively. PO1-B simplifies permitting, cutting legal and administrative burdens and lowering entry barriers to the data centre value chain. PO1-C has similar effects but may feel more distant due to EU- level approval; however, added public R&D and deployment funding strengthens SME participation in advanced projects without heavy capital needs. Potential direct administrative costs under the preferred policy option among these, i.e. PO1-B with PM8 and PM9, would be related to the time required to apply for EU or national funding support. PO2-A provides clarity on sovereign cloud and AI computing services without extra administrative load, while interoperability and the EU sovereignty conference boost SME visibility. PO2 -B lowers verification costs via validity throughout the EU and supports SME cloud and AI adoption, with procurement criteria and vendor-neutral training improving SME competitiveness. PO2 -C delivers the strongest benefits: although mandatory audit adds some cost, EU-wide validity expands market reach, open-source access reduces barriers, funding programmes favour SMEs. Overall, PO2 - C and the SME cloud and AI adoption scheme enhance competitiveness, reduce upfront 183 The costs and benefits data in this annex are consistent with the data in annex 3. The preferred option includes the mitigating measures listed in section 4. 184 costs, and support wider SME digital transformation. Similarly, as above, quantifiable administrative costs for SMEs stem from the time required to apply to receive funding under PM23. Quantitative assessment Under PM23, within PO2-C, SMEs are expected to incur in modest administrative costs related to their need to apply to receive the funding . The effort to prepare a project proposal is estimated to be 2 persons for 10 days (20 staff days) , with total costs estimated at EUR 55 373 928 (NPV, 10-years), considering over 60,000 SMEs applying to receive funding. What are the estimated direct benefits/cost savings for SMEs of the preferred policy option184? Qualitative assessment For PO1-B, SMEs would see direct benefits mainly through reduced legal, consultancy, and administrative costs. Streamlined permitting makes procedures easier to navigate, which cuts the time and external support SMEs typically need to comply with complex rules. Faster approvals also shorten project timelines, lowering costs and making market entry cheaper. With public funding under PM8 and PM9 , SMEs save directly by reducing the upfront capital normally required for R&D, innovation, and deployment projects. Higher funding rates for SMEs lower financial risk and make participation in advanced initiatives more affordable. Funding also helps SMEs join larger consortia more easily, lowering the financial barriers to entering markets that typi cally favour large players. Under PO2-C, SMEs gain the largest net cost savings. Validity throughout the EU of audits means an SME audited in one Member State avoids repeating costly verification processes elsewhere. Support measures for adopting cloud and AI computing services lower training, integration, and compliance costs. Together, these reduce technology investment, administrative overhead, and business development expenses. Quantitative assessment Under PM23, within PO2-C, SMEs are expected to benefit directly from EUR 328 412 809. This policy measure puts forward a targeted scheme to provide financial support to SMEs for adopting cloud and AI computing services to increase their productivity and competitiveness. Most of the yearly budget considere d for this measure , i.e. EUR 38.500.000, is dedicated to supporting the design and planning phase of cloud and AI - based transformation projects for SMEs. The grants are fixed amounts that the SMEs can spend in consultancy services to design digital transf ormation projects based on cloud and AI technology. The objective is reaching 2% of the small (10 to 50 employees) and midsize (50 to 250 employees) SMEs over the 10 -year period. Every year, SMEs that have designed the most innovative cloud and AI-based transformation project plans will receive additional support to fund their implementation. What are the indirect impacts of this initiative on SMEs? 184 The direct benefits for SMEs can also be cost savings. 185 Most of the policy measures contribute to the development of European datacentre infrastructure and cloud computing capacity, a richer European cloud and AI computing service offering and a more dynamic technological and industrial ecosystem, contributing to a higher adoption of cloud. This will improve the efficiency in software and IT projects, increasing productivity of IT staff, ensuring the continuity of business processes (less downtime) and facilitating migration processes, for SMEs and large organizations alike. This impacts not only the efficiency of the IT staff but also the flexibility and capability of the European private sector to adapt in an agile way to evolving market needs and conditions, and to the dynamic technology landscape, increasing its competitiveness. This agility is particularly important for SMEs, who need to continuously adapt their technologies and business models in order to not lose market revenues and remain relevant. This could have been measured in terms of effort saved in IT tasks (FTEs) but it would have been difficult to allocate the specific contribution for each specific measure, adding potential risk of double counting their effect. SMEs outside the cloud secto r also gain from a more trusted and interoperable EU cloud/AI ecosystem through safer access to digital tools, easier cross-border operations, enhanced innovation, and participation in data -driven markets. While quantification in some cases appears difficult, the qualitative impact of the initiative could be summarised as follows: 1. Access to Advanced Digital Services Enhanced trust and interoperability in the EU cloud and AI market gives SMEs in other sectors access to advanced digital services. Businesse s can safely and efficiently adopt cloud-based tools for e-commerce, logistics, HR, or data analytics, even if they are not part of the cloud industry itself. 2. Cross-Border Expansion Standardised regulations and secure, cross-border data flows make it easier for SMEs to expand across Member States. Companies can scale products and services without facing legal or technical barriers, simplifying international operations within the Single Market. 3. Innovation through Collaboration SMEs can integrate AI, IoT, or data-driven services into their offerings, driving modernization in traditional industries. Trusted cloud infrastructure lowers risks and investment barriers, enabling experimentation and digital transformation. 4. Cost Efficiency and Resilience Reliable EU cloud services improve cost efficiency and resilience 185. Reduced dependence on non -European providers decreases operational risks while competitive 185 The adoption of AI and cloud technologies by SMEs can significantly boost economic performance. Some university studies indicate that AI adoption can increase revenue by up to 91% for SMEs, with operational costs potentially reduced by up to 30% and time savings exceeding 20 hours per month arXiv. 186 pricing and high availability could benefit sectors like manufacturing, healthcare, and fintech186. 5. Participation in Sectoral Data Spaces SMEs can participate in sectoral data spaces that provide shared datasets for areas like e.g. health, transport, energy, and finance187. Access to these resources opens opportunities for new products, services, and partnerships, fostering innovation and growth across the Single Market. (4) MINIMISING NEGATIVE IMPACTS ON SMES Are SMEs disproportionately affected compared to large companies? No If yes, are there any specific subgroups of SMEs more exposed than others? N/A Have mitigating measures been included in the preferred option/proposal? Yes, financial support for SMEs to adopt cloud and AI (PM23) CONTRIBUTION TO THE 35% BURDEN REDUCTION TARGET FOR SMES Are there any administrative cost sa vings relevant for the 35% burden reduction target for SMEs? SMEs are expected to benefit directly from PM23. 186 Trusted cloud and AI adoption empowers SMEs across sectors: in manufacturing, AI improves operations and competitiveness ( ScienceDirect); in healthcare, cloud soluti ons enhance patient experiences and administrative efficiency ( ACE Cloud Hosting ); and in fintech, AI tools support revenue forecasting, ris k modelling, and financial decision-making (ResearchGate). 187 In healthcare, AI enhances diagnostics and patient care, improving efficiency and outcomes; in transport, AI optimizes logistics and route planning, reducing costs and emissions; in energy, AI facilitates smart grid management and energy efficiency, supporting sustainability goals; and in finance, AI -driven tool s assist in risk assessment and financial planning, enhancing decision -making capabilities. These advancements are supported by EU initiatives such as the Digital Europe Programme and Horizon Europe, which aim to bolster AI and digital infrastructure across the Union. ANNEX 7: EXTERNAL COHERENCE WITH RELEVANT EU LEGISLATION AND POLICY INITIATIVES For each Policy Option, the table below analyses its external coherence. PO External coherence PO1-A PM1 complements the existing Alliance for Industrial Data, Edge and Cloud. PM2 creates a permanent forum that currently does not exist. PM3 complements existing best practices that focus on operating energy-efficient data centres with guidelines on deployment. PO1-B PM4 complements the upcoming Regulation on accelerating and streamlining environmental assessments, which focuses on administ rative simplification for environmental assessments, by adding a facilitator to accompany all permitting stages (incl. beyond environmental assessments) for a given data centre project. PM5 complements envisaged provisions for industrial acceleration, notably in the upcoming Industrial Accelerator Act, where areas and measures for industrial acceleration focus on manufacturing industries and do not account for the specific needs (e.g. connectivity) and benefits (e.g. their ability to provide flexibility services to the grid) of data centres , which are a services industry and thus not in scope of the Industrial Accelerator Act. PM6 steers national funding towards the deployment of innovative and sustainable data centres, while PM7 complements and ultimately leverages the existing Digital Decade monitoring cycle. The scale of the compute capacity gap and its impact on EU com petitiveness require such dedicated support measures for data centre deployment, which cannot be achieved by horizontal initiatives that omit the specific needs of data centres. PO1-C PM8 complements existing framework programmes, which do not sufficient ly cover data centre innovation and deployment. PM9 creates the possibility, without prejudice to the outcome of the negotiations on the next MFF proposal, for strategic data centre deployment projects to be supported by Union programmes, funds and financial instruments, in accordance with the objectives set out in the regulations establishing those funds and programmes. PM10 is an EU-level version of PM5. PO1-A, B, C PO1 B and C would leverage the future rating scheme for data centres under the Energy Efficiency Directive as a way of identifying particularly sustainable data centres. Moreover, they would build on other initiatives which address data centre input factors, such as the future Grids Package (energy) or the future Digital Networks Act (connectivity). 188 PO External coherence PO2-A PM11 would provide the first-ever definition of a sovereign cloud and AI computing service, going beyond technical cybersecurity and thus complementing the Cybersecurity Act (CSA). PM12 adds guidelines for providers and PM13 is a new way of enhancing visibility of sovereign offerings. PM14 is designed to complement the Data Act’s provisions on interoperability standards by enacting flanking measures that ensure the usability of the tools created by the Data Act, notably by advancing standardisation work. PO2-B PM15 complements the cloud cybersecurity certification under the CSA and uses it as a way of assessing whether a service is sufficiently cybersecure. However, the focus of the sovereignty scheme is fundamentally different as it covers sovereignty in a way that is not addressed by any other initiative, including the AI Act, which is a product safety legislation. PM16 complements the horizontal procurement acquis with the necessary sectoral approach that accounts for the nuances of purchasing cloud services, i.e. services with a global value chain, and empowers public purchas ers to reward specific service characteristics which the horizontal acquis cannot provide for. By focusing on cloud and AI computing services, it is clearly delineated from the AI Act, which sets safety requirements for AI systems and general -purpose AI mo dels. PM17 creates the tools for joint procurement, so far non -existent in this sector. The same is true for PM18 which is an entirely new addition to the EU’s policy toolbox. PO2-C PM20 is a new policy tool, with no legal precedent. PM21 makes the use of the sovereignty risk assessment under PM15 mandatory, leveraging the NIS2 Directive to identify sectors of high criticality. Beyond giving a framework for cybersecurity certification, the CSA deals with supply chain risks with a specific focus on high -risk vendors. However, it does not address public procurement. PM21 complements the CSA in that respect. This is enhanced by PM19, which mandates the use of specific award criteria for all public procurements of cloud and AI computing services , thus complementing the Procurement Directives. PM22 leverages the tools of PM17 and establishes the first-ever EU framework for joint procurement in this sector. PM23 leverages and complements the European Competitiveness Fund, while PM24 presents an entirely new policy tool. PO2- A,B,C All PMs under PO2 would build on the Data Act’s provisions on the right to switch and use different cloud services in paralle l, which is a prerequisite for users to diversify or change the cloud services they use. 189 Several existing and planned pieces of legislation and policy initiatives relate to the specific objectives pursued under this initiative . However, each of them shows gaps with respect to reaching these objectives, which this initiative would fill. The table below illustrates this in detail and elaborates on the relationship of these other pieces of legislation or policy initiatives with the future Cloud and AI Development Act. Specific objective Legislation or policy initiative Gap with regards to specific objective / relationship with the cloud and AI Development Act (“this initiative”) SO1 - Increase computing capacity deployed in the EU through innovative and sustainable technologies The Horizon Europe programme provides funding for research and innovation in the EU, including in digital technologies. Cluster 4 (Digital, Industry and Space) covers enabling technologies like cloud as well as advanced computing. Horizon Europe lacks scale to meaningfully advance innovation in computing capacity. Between 2021 and 2027, the total budget of Horizon Europe amounted to EUR 95.5 bn. Estimat es indicate that in 2023 only, the part of AWS’s R&D spending on cloud computing alone was ca. EUR 18 bn188. This initiative aims to en sure that innovation in computing capacity becomes a stand-alone objective. EU Framework Programmes also suffer from a gap between R&D and commercialisation. For example, the SUNFISH project 189 devoted 4.5 m of Horizon 2020 budget to developing a solution for secure information sharing in federated heterogenous private clouds. However, no European cloud provider was able to capitalise on the project outcomes, which were not widely taken up. This initiative aims to tackle not just the development but also th e uptake of innovative technologies through dedicated deployment measures and incentives for the deployment of innovative data centres. The IPCEI for Next Generation Cloud Infrastructure and Services involves 19 companies from seven The focus of this IPCEI is on research, development and innovation. Beyond that, it only covers the first industrial dep loyment of innovative solutions 188 How much does Amazon invest in R&D? Here's an informed guess. 189 SecUre iNFormation SHaring in federated heterogeneous private clouds | SUNFISH | Projekt | Fact Sheet | H2020 | CORDIS | European Commission. 190 Specific objective Legislation or policy initiative Gap with regards to specific objective / relationship with the cloud and AI Development Act (“this initiative”) Member States: France, Germany, Hungary, Italy, the Netherlands, Poland, and Spain. These seven Member States provide up to EUR 1.2 bn in public funding to developing data processing capabilities, and software and data sharing tool s that enable federated, energy - efficient and trustworthy cloud and edge distributed data processing technologies and related services. (particularly in edge computing). Most notably, the IPCEI focuses on beyond- the-state-of-the-art solutions. Consequently, the IPCEI does not target capacity deployment in a way that would contribute to closing the current co mpute capacity gap. Moreover, compared with innovation efforts by leading international cloud providers, the funds available to European companies under this IPCEI are much lower. However, the research and development efforts supported under this initiative will build on and integrate achievements under the IPCEI. Moreover, deployment incentives will positively affect the broader deployment of solutions developed under the IPCEI. The AI Factories and future AI Gigafactories already/will provide high performance computing capacity to developers and deployers of AI models. The initiatives leverage the EuroHPC Joint Undertaking. These initiatives mainly serve to drive advancements in AI applications across different sectors, g oing beyond the capabilities of general -purpose and AI - optimised data centres. They focus on large concentrations of computing power needed for the training of AI models. They do not address the deployment of more decentralised computing capacity in data centres, necessary for the large- scale uptake of AI throughout the EU and for enabling lower latency . The deployment of AI Factories and Gigafactories may benefit from measures under this initiative, such as identified areas for accelerated deployment. The Energy Efficiency Directive contains measures on improving the energy performance of data centres. It encourages waste heat re -use and requires data centres above 500 kW to report annually on their energy usage and on other sustainability metrics. Th is reporting will form the basis for a future rating scheme , which will be enacted as part of the upcoming Data Centre Package. The Energy Efficiency Directive is the key piece of legislation for guiding the data centre industry towards greater energy efficiency through measures such as reporting and the future rating scheme. However, beyond transparency measures and reputational considerations, the Directive does not set incentives for data centre operators to improve their sustainability performance and does not contain measures for accelerating the roll -out of sustainable data centres across the EU or increasing related investmen t (although the possible 191 Specific objective Legislation or policy initiative Gap with regards to specific objective / relationship with the cloud and AI Development Act (“this initiative”) This will also kick off the work on a separate proposal for data centre minimum performance standards, building on the sustainabili ty metrics established under the Energy Efficiency Directive. establishment of minimum performance standards , stemming from the Directive, could set the minimum specifications of sustainability for future data centres in Europe). The initiative will contain measures to incentivise the roll- out of energy -efficient data centres. To identify which data centres are sustainable, this initiative will refer to the rating scheme developed under the Energy Efficiency Directive. The Regulation laying down ecodesign requirements for servers and data s torage products sets requirements for sustainable products. Data centre hardware is subject to minimum performance and information rules; however, the Regulation does not contain measures to directly incentivise the deployment of innovative and sustainable technologies. The Digital Decade Policy Programme (DDPP) sets the target of 75% of EU businesses adopting cloud services and of 10.000 edge nodes being rolled out by 2030 and measures progress in all Member States and at EU level. Beyond the edge node target, the DDPP does not contain targets for the deployment of compute capacity or data centres in the EU. And beyond setting out targets and monitoring progress (2257 edg e nodes in 2024), it does not contain concrete support measures for such deployment. This initiative will complement the DDPP in this regard: The data centre capacity target would be integrated into the DDPP, and by leveraging the existing yearly monitorin g exercise, this initiative would create synergies with the DDPP. The EU Code of Conduct on Data Centre Energy Efficiency is a reference document to assist data centre operators in identifying and implementing measures to improve the energy efficiency of their data centres. This Best Practice document contains a full list The Code of Conduct does not concern measures to deploy a data cen tre, instead focusing fully on practices for operating it. 192 Specific objective Legislation or policy initiative Gap with regards to specific objective / relationship with the cloud and AI Development Act (“this initiative”) of the identified and recognised data centre energy efficiency best practices within the Code of Conduct. SO2 - Ensure attractive conditions for the deployment of sustainable and innovative computing capacity European Grids Package , put forward by the Commission [on 10 December 2025] aims to modernise and enhance the EU’s electricity grids. It contains targeted legislative changes to the TEN -E Regulation and related regulations and directives, with a view to improving pan -European grid planning. It will consider permitting for grid expansion and cost-sharing in a cross-border context, as well as providing guidance on measures to accelerate grid connections within the current legislative framework. As discussed throughout this assessment, energy is a key input factor for data centres and sufficient grid capacity is a prerequisite for their deployment in the EU. The European Grids Package aims to ensure grids will be in place and ready to uptake future loads in a horizontal manner, as the issue at stake (lack of grids capacity) concerns more stakeh olders. The initiative assessed here focuses on data centres as an ultimate client of grid capacity in the EU. It aims to complement the Grids package by ensuring data centres location considers grid availability, information is exchanged sufficiently in advance to feed into grid planning and hence ensure timely connection of data centres. The guidelines on grid interconnection lay down ways in which Member States can accelerate grid connections, including a more efficient structure of their grid connection queue, for example by considering a project’s readiness and grid-friendly uses as opposed to a pure first-come-first-served approach. It also requires strong involvement of industry, including data centre s ector in the grids planning. This initiative will leverage these considerations, for example by clarifying that public support for strategic projects shall only concern projects which are able to provide needed flexibility for the grid, as required by relevant technical conditions, for the sake of their efficient grid integration. 193 Specific objective Legislation or policy initiative Gap with regards to specific objective / relationship with the cloud and AI Development Act (“this initiative”) The future Digital Networks Act (DNA) seeks to incentivise the building of the digital networks of the future and improve digital connectivity for end users. The DNA will improve digital connectivity for end users and thus be beneficial to the deployment of data centres in the EU, for which high -performance connectivity is a prerequisite. This initiative will leverage the DNA’s advancements for connectivity and will thus stay focused on the deployment of the data centre (where data processing occurs), not the prior or parallel build - out of the necessary connectivity infrastructure. The two initiatives are thus complementary. The DNA will also address the convergence of netwo rk infrastructure. For example, it will address scenarios where a cloud service provider operates a network and has so far not been subject to obligations under the Electronic Communications Code. The intention is to clarify the modalities of interconnection between operators of networks and other market participants. This relates to a specific market situation and is not impacted by possible measures under this initiative. The Gigabit Infrastructure Act sets rules to accelerate the rollout of Gigabit networks installations. While data centre operators and cloud service providers will benefit from an improved rollout of very high-capacity networks, the Gigabit Infrastructure Act does not cover the constructions of data centres. This initiative would thus build on the advancements in accelerated network deployment under the Gigabit Infrastructure Act. The upcoming Industrial Accelerator Act will set rules for foreign investment contributions and create clusters of industrial activity for the manufacturing sector On permitting, the IAA sets out the principle of ‘one project, one procedure’ and establishes a single digital procedure to cover t he entire permit -granting process. It also puts forward other measures to accelerate permitting (time limits for project approvals, single point of contact, overriding public interest 194 Specific objective Legislation or policy initiative Gap with regards to specific objective / relationship with the cloud and AI Development Act (“this initiative”) etc.). This initiative will leverage the newly created approach to simplified and digitised permitting by cross-referencing the IAA. The IAA will require Member States to designate at least one manufacturing industrial acceleration area/cluster where further business facilitation measures apply (prioritised access to material s, access to EU finance, regulatory sandboxes etc.). However, these areas won’t account for the specific needs of data centres, which are a services sector. While data centres consume a lot of energy, a characteristic they share with other more traditional industries, they present several fundamental differences. First, unlike industries that may adjust energy use based on production schedules, the energy dema nd of data centres are more constant, as their primary purpose is to ensure continuous service and data availability. Moreover, data centres can assist the grid through flexibility services. Second, their quality-of-service obligation imply that data centres are equipped with powerful energy generation capacities that can be leveraged by grid operators for flexibility purposes. Third, unlike other energy -intensive industries, the physical location of a data centre is dictated by the presence of robust connectivity: low latency is critical for supporting the real -time data processing and application needs of other industries, such as financial transactions or AI applications. That is why the cloud and AI Development Act will complement general industrial acce leration measures with measures that are tailored to the accelerated deployment of data centres. 195 Specific objective Legislation or policy initiative Gap with regards to specific objective / relationship with the cloud and AI Development Act (“this initiative”) The future Regulation on accelerating and streamlining environmental assessments will simplify and speed up environmental screenings and assessments. Data centres are not subject to mandatory environmental impact assessments under the existing Environmental Impact Assessment Directive. However, Member States can determine themselves that an individual data centre project should undergo such an assessment, causing them to be de facto mandatory in many Member States. The new Regulation will establish a toolbox with additional provisions ( overriding public interest, tacit approval and dispute settlement) that can be leveraged in sectoral legislation regarding strategic sectors or categories. For all environ mental assessments, the new Regulation establishes streamlined provisions, including maximum timelines for the duration of the screening process and for decisions by compete nt authorities. Procedurally, the proposal sets up a single point of contact for Environmental Impact Assessment and digitises and streamlines assessment procedures (e.g. through the re-use of documents across different stages). The future Regulation on accelerating and streamlining environmental assessments focuses on environmental assessments, not on other steps of the permitting process such as zoning and land allocation and building permits. The cloud and AI Development Act will leverage these simplif ications and complement them , notably by establishing a facilitator to accompany data centre operators throughout their overall permitting journey, not only the possible environmental assessment. The cloud and AI Development Act will also leverage the toolbox established by the new Regulation, by referencing it within the Act to activate the additional provisions for strategic data centre projects. 196 Specific objective Legislation or policy initiative Gap with regards to specific objective / relationship with the cloud and AI Development Act (“this initiative”) The Net-Zero Industry Act (NZIA) sets out to boost the EU’s manufacturing capacity for net -zero technologies, e.g. through simplified permitting and areas for faster deployment. Data centres do not qualify as net zero technologies. The acceleration measures under this initiative are thus not in conflict with NZIA. Data centre operators may however benefit from NZIA as downstream customers or users of net zero technologies such as batteries. The Renewable Energy Directive (RED III) simplifies and accelerates permitting procedures for renewable energy and st orage projects, including by establishing renewables acceleration areas. Data centres may benefit from the increased availability of renewable energy and storage in the EU but are not themselves covered by the Directive. This initiative is thus fully complementary to RED III and can leverage it: Proximity to renewables acceleration areas may be a relevant factor in designating sites for faster data centre deployment. SO3 - Decrease the overall reliance on non- European cloud and AI computing services The Data Act , which enters into application in September 2025, enables cloud switching by removing key sources of contractual, commercial, and technical vendor lock-in. As part of this, it sets rules for fair cloud contracts, creates an EU repository for harmonized standards and open interoperability specifications, and lays the basis for standardization requests. By enabling switching and removing key sources of vendor lock -in, the Data Act seeks to ensure that cloud service providers in the EU compete on quality, innovation, and price. It seeks to enable cloud users to freely choose the provider that best meets their needs and combine offers of different providers in a multi-cloud approach. However, the Data Act does not contain elements to shape up a more competitive offer of EU cloud services or encourage the entry into the market of a more diverse set of cloud service providers. The Data Act opens the path towards a possible reduction of dependencies on non -EU providers but does not build the road towards a more sovereign and trusted EU cloud computing sector. The cloud switching and interoperability provisions, however, make it possible for users to embrace European cloud computing services more strongly. The Data Act is th us an enabler for the cloud and AI Development Act. 197 Specific objective Legislation or policy initiative Gap with regards to specific objective / relationship with the cloud and AI Development Act (“this initiative”) The Digital Markets Act covers cloud services as a core platform service, meaning that cloud service providers designated as gatekeepers would have to comply with a set of obligations, for example re lated to enabling interoperability. So far, no cloud and AI computing service provider has been designated as a gatekeeper for their services (Amazon designated for the marketplace and amazon advertising; Microsoft is designated for LinkedIn and for Windows PC Operating System). On 18 November 2025, the Commission opened three market investigations on cloud computing services under the DMA: T wo market investigations will assess whether Amazon and Microsoft should be designated as gatekeepers for their cloud computing services, Amazon Web Services and Microsoft Azure, under the DMA, in other words whether they act as important gateways between businesses and consumers, despite not meeting the DMA gatekeeper thresholds for size, user number and market position. The third market investigation will assess if the DMA can effectively tackle practices that may limit competitiveness and fairness in the cloud computing sector in the EU. Irrespective of the gatekeeper designation, the DMA does not contain measures that would actively promote the uptake of sovereign cloud services. The DMA aims at remedying specific market behaviours of certain providers that are gatekeepers and thus intervenes at a different level than the cloud and AI Development Act, which focuses on the uptake and use of the services provided. SO4 - Contribute to the protection of fundamental The Public Procurement Directives cover tenders above certain thresholds and prescribe transparency, equal treatment, open competition and sound management for procurement procedures. The upcoming revision of these Directives intends to align Public authorities in the EU rely heavily on non-EU cloud and AI computing service providers. The problem dr ivers justifying the policy measures of the cloud and AI Development Act regarding the public procurement of sovereign cloud and AI computing services in sectors of high criticality are very specific to the technologies and applicable legal frameworks concerned. For example, 198 Specific objective Legislation or policy initiative Gap with regards to specific objective / relationship with the cloud and AI Development Act (“this initiative”) interests of society by enhancing the resilience of supply of cloud and AI computing services, in particular in the public sector them more closely with strategic goals of the EU, including resilience considerations and the announced EU preference in public procurement within strategic sectors. a cloud computing service value chain and the underlying infrastructure used to deploy the service can be distributed across different geographies and subject to corresponding jurisdictions, including those with laws with an extraterritorial effect. Such problem drivers therefore require a nuanced and targeted sectoral approach, which is not covered by the existing Public Procurement Directives and w ould be difficult to account for sufficiently through an overarching EU preference approach . This initiative will therefore provide a sector-specific approach to so vereignty – the many layers of which cannot be addressed in the horizontal acquis that lays down general principles for the design of procurement procedures – which will be complemented by award criteria that are also tailored to the specificities of cloud and AI computing services. The Cybersecurity Act, currently under revision, lays down a voluntary certification framework for ICT processes, services and products – with cloud services considered as a subset of ICT services. It gives the legislative framework for adopting a European cybersecurity certification scheme for cloud services by means of an Implementing Regulation. ENISA has been working on developing an EU -wide cybersecurity certification scheme for cloud services (EUCS), which has not yet been adopted. Certification under the CSA can address technical cybersecurity criteria but is not suited for addressing sovereignty concerns that go beyond these technical elements. This initiative will thus complement the CSA’s cloud cybersecurity focus with sovereignty considerations. A finalised EUCS could be leveraged in the audit scheme for sovereign cloud and AI computing services as a way of ensuring that a service subject to a sovereignty audit meets the highest cybersecurity standards. The Directive on Security of Network and Information Systems (NIS2) sets out cybersecurity risk management and incident reporting obligations to a set The NIS2 Directive improves the cybersecurity risk management of cloud service providers and data centres in the EU, resulting in greater trust. However, it does not contain measures geared at the uptake and use of such 199 Specific objective Legislation or policy initiative Gap with regards to specific objective / relationship with the cloud and AI Development Act (“this initiative”) of essential and important entities across critical sectors, including cloud services and infrastructure. services and rem ains fully focused on technical cybersecurity as opposed to broader sovereignty considerations. This initiative will therefore complement the NIS2 Directive. The Digital Operational Resilience Act (DORA) aims to strengthen the digital resilience of financial entities. It ensures that banks, insurance companies, and investment firms can withstand, respond to, and recover from ICT disruptions, such as cyberattacks or system failures. While DORA shapes compliance obligations for cloud service providers and indirectly covers AI computing service providers if they provide services to financial entities covered by DORA or if their role is significant enough in terms of operational resilience, it has a sectoral scope and is financial -sector specific. Under DOR A, cloud service providers must implement ICT risk management, conduct regular testing and incident response to comply with the requirements for critical third -party service providers. The covered financial institutions, which could be public in nature, mu st carry out due diligence on the cloud providers they work with. The Artificial Intelligence Act (AI Act) sets out rules for AI systems and general -purpose AI models and not cloud and AI computing services. It follows a risk-based approach and provides rules to ensure that AI systems used in the EU are safe, for example by introducing safety and security requirements, such as accuracy, robustness and cybersecurity for data and data governance. The AI Act harmonises rules for AI systems and general-purpose AI models to be placed on the EU market, improving the functioning of the internal market and promoting the uptake of human-centric and trustworthy AI along the value chain. As a product safety legislation, the AI A ct ensures a high level of protection of health, safety and fundamental rights, It does not cover aspects of sovereignty regarding AI computing services , which the cloud and AI Development Act will address. The two initiatives are thus complementary. The EU-US Privacy Framework (DPF) is a mechanism established to facilitate the transfer of personal data from the EU to the US, while ensuring While the DPF addresses transatlantic data transfers, it does not remove sovereignty concerns about dependence on US hyperscalers and on the subsequent exposure to surveillance laws, such as the US CLOUD Act, 200 Specific objective Legislation or policy initiative Gap with regards to specific objective / relationship with the cloud and AI Development Act (“this initiative”) adequate levels of data protection. It replaces various legal frameworks that were invalidated by the EU courts for insufficient protection of personal data (e.g., the Privacy Shield). On 10 July 2023, the Commission issued an adequacy decision recognizing that US organizations certified under the framework offer an adequate level of protection so that data transfers c ould take place without additional legal barriers. On 3 September 2025, the General Court of the EU dismissed an annulment action, confirming that the framework is valid. obliging US providers to hand over data to US authorities even if stored in the EEA. Moreover, the notion of sovereignty goes beyond data transfers and also relates to operational autonomy, an aspect that goes beyond the DPF. This initiative thus complements the DPF. ANNEX 8: KEY TECHNICAL CONCEPTS A data centre provides the walls, cooling, and connectivity needed to run the IT equipment that enables computing, which are typically processors mounted on servers, storage units sometimes called memory, and networking equipment. Data centre capacity is measured in megawatts (MW), indicating the total electrical power made available to the IT equipment190. The capacity of the equipment is therefore limited by the electrical power available in the data centre. Throughout this report, the term ‘computing capacity’ is thus used interchangeably with data centre capacity. The International Standardization Organization (ISO) defines cloud computing as a “paradigm for enabling network access to a scalable and elastic pool of shareable physical or virtual resources with self-service provisioning and administration on demand”. These resources are located in data centres. Operating a data centre and providing a cloud service are two distinct segments of a same supply chain. Data centres can be owned by cloud service providers (CSP s) themselves (vertical integration). Otherwise, d ata centres operators are often specialised independent businesses, which rent out space for customers, including CSPs, to place their equipment in. The data centre can have a single client or multiple, which are referred to as co-location data centre provide rs. Companies which provide cloud services on a very large scale are commonly referred to as hyperscalers , a category understood to include Microsoft, Amazon and Google. For very fast response times, i.e. low latency, data must be stored and processed closer to the user, in edge data centres or edge nodes, which can be seen as mini-data centres (an edge facility can be as small as the size of a fridge, while the largest data centres can be as big as several football fields). While data centres powering traditional cloud services and AI computing services look similar, they present important differences. First, at the microprocessor level: while data centres specialised in AI computing services use a mix of Graphic-Processing-Units (GPUs) and Central-Processing-Units (CPUs), others are exclusively powered by CPUs. Second, GPU-powered data centres, sometimes called ‘AI data centres ’, are much more energy-intensive and require a different physical layout implying a design choice from the outset, making refits difficult. Throughout this assessment, the term ‘data centre’ is used to refer to both types of data centres in order to be future-proof and end-use agnostic. 190 This is a widespread industry practice. However, it is imperfect as it does not reveal the type, quantity and capacity of the chips hosted in the data centre and does consider the efficiency of this equipment. 202 Figure 1. Key concepts along the cloud and AI value chain When training an AI model, longer response times/higher latency are not as problematic while a large concentration of computing power is paramount. The size and complexity of an AI model is often described by the number of parameters it is built on, a figure that can reach a trillion. Training a model, even on the worlds’ largest computing facilities, can take several months of uninterrupted calculation. That is why training is usually executed in High-Performance Computing (HPC). HPC is provided over specialised data centres and differ from cloud computing in the sense that, typically, the pool of resources is not shared and/or not scalable and/or not elastic. Conversely, the fine-tuning, inference and service integration of AI models rely on cloud or even edge computing. Fine-tuning an AI model consists in customizing pre-trained models using domain-specific data. Inference then uses this fine-tuned model to generate predictions or outputs on new, unseen data by applying the learned parameters without further training. Edge computing makes it pos sible to run AI applications close to the data source, allowing for very low latency, for example in AI- assisted real-time imaging and surgery, in autonomous navigation and real-time decision- making in autonomous driving. The different stages of an AI model, reaching from training to application, including with low response times, require a continuum of computing capacity spanning HPC, data centres, and edge nodes. Cloud services are often broken down in three layers: infrastructure-as-a-service (IaaS) consists in supplying basic computing services , essentially storage and raw processing; platform-as-a-service (PaaS) consists in offering a platform over which services can deployed; and software-as-a-service (SaaS) is a software application delivered over the cloud such as an office automation suite or a video streaming service . Cloud service providers can offer services that span across all layers (e.g. Microsoft offers Office 365 running over its own Azure infrastructure), or not (e.g. Netflix operates over Amazon’s infrastructure). Cloud computing and AI are deeply interconnected, each fuelling the other’s potential. Cloud computing provide the scalable infrastructure and computational power AI needs to process data, train models, and deploy applications efficiently. In turn, AI enhances cloud services through automation, predictive analytics, and smarter resource management, making them more adaptive and user -friendly. AI computing services provide computin g infrastructure that allows users to run trained AI model (inference) 203 without hosting the AI system on their own hardware. Moreover, AI functionalities are increasingly integrated into cloud services, for example into SaaS offerings, to enhance their functionalities. This assessment systematically uses the term ‘cloud and AI computing services’ understood as offering computing resources for the running (inference) of AI systems. AI systems, pursuant to the AI Act, are not covered by the sovereignty scheme described in this Impact Assessment. Cloud services may also include other data processing-related services , e.g. data analytics191. Figure 6. Interplay between cloud and AI 191 The Digital Decade Policy Programme, for example, measures uptake for AI, cloud and big data together: 'Path to the Digital Decade': the EU's plan to achieve a digital Europe by 2030 - Consilium. 204 ANNEX 9. BASELINE SCENARIO (POLICY OPTION 0) The baseline scenario represents the reference case against which policy options are assessed. It provides a realistic and neutral projection of how the EU cloud and AI computing services market, and the related data centre infr astructure, are expected to evolve in the absence of additional policy intervention beyond current measures and commitments. The scenario integrates the effects of: • Existing EU legislation, especially for infrastructure development (EED and RED III), that is Problem 1 . In the case of cloud services (Problem 2) , the main applicable legislation is the Data Act, which entered into force in September 2025, whose effects are not yet observable. Similarly, the impact of EU public funding cannot yet be fully assessed, as the current Multiannual Financial Framework (MFF) is still subject to evaluation. In addition, no dynamic outlook on future funding allocations can be provided, given that negotiation on the next MFF have not yet started; • Market-driven technological progress and private investment trends; • Macroeconomic forecasts; • Global developments affecting demand for computing capacity, cloud services, and AI workloads. It covers the period 2025 -2036 and the EU-27, compares to global market evolution and provides a projection of likely developments in the absence of further policy action, thus allowing for the quantitative and qualitative comparison of the policy options’ expected impacts. It describes how each identified pr oblem and their underlying drivers would develop to 2036 without new policy action, drawing on available quantitative evidence and market projections. 1. Limited and geographically concentrated availability of computing capacity For problem 1, The EU’s total installed compute capacity, measured in data-centre IT load, stands at approximately 12.4 GW (and 13.9 GW if public sector capacity is also considered), representing around 20% of global capacity. Growth is projected to reach 42.5 GW by 2036, yet in the central scenario demand data centre capacity is expected to increase to 61.5 GW over the same period, creating a structural capacity gap of 19 GW relative to projected needs, as shown in the figure below. Figure 7. Forecasted data centre capacity and demand in EU-27 (Source: Technopolis et al. (2025)) 205 In this central scenario data centre demand growth is based on the following assumptions: • Enterprise IT budgets across the EU-27 continue to expand at a steady and predictable pace, reflecting a stable macroeconomic environment and a measured approach to digital transformation. • IT spending as a share of enterprise turnover increases gradually, reaching 3.7% by 2032. From 2032 onwards, this ratio stabilises, indicating a maturing digital spending profile with spend ing only increasing to 3.8% by 2036. Within this broader trend, investment in data centre infrastructure grows in line with the historical CAGR of 14% through to 2030, reflecting sustained demand for compute and storage infrastructure. This growth supports both the retrofitting of legacy environments and the deployment of new, AI -capable facilities, particularly in markets where cloud adoption and enterprise workloads continue to scale. From 2032 onwards, the growth rate of data centre spending decelerates, but outlays continue to increase, sustained by lifecycle refreshes, AI-capable retrofits, compliance and resilience upgrades, and steady colocation demand • Workloads evolve steadily, with increased deployment of AI, machine learning, and data-driven services contributing to higher computational requirements. • Digital policies boost private sector demand. As governments roll out e -government services, data-sharing initiatives, and sector-specific AI guidelines, private enterprises respond by adopting initiatives which steadily drive increases in compute and storage requirements. Data centre supply growth is based on the following assumptions: • Capacity growth is around 14% CAGR through 2025 –2030, then eases over 2030 – 2036. • Expansion remains concentrated in FLAP-D hubs, with steady investment in secondary markets (Nordics, Spain, Italy) and slower uptake in developing markets (around 6.49% CAGR) . Capacity expansion follows market trends concentrated in existing hubs, where grid constraints, land availability, and permitting delays limit new deployment. Investment remains market -led; new entrants face high upfront capital costs (around EUR 8-10 million/MW). • Aggregate growth is around 17.7% over 2025 –2030 (consistent with the survey’s ~14% CAGR lens) as committed pipelines, AI -readiness upgrades, and new cloud regions come through. From 2031–2036, growth moderates to around 7.1%, reflecting tighter site selection driven by power and land availability, longer permitting lead times, and higher financing costs. This trend risks constraining AI model training and cloud workloads within the EU, particularly for SMEs and public-sector users. • Electrical grid limitations remain a key issue in certain primary markets such as Ireland and the Netherlands. However, regulators and operators in several markets have begun investing in grid modernisation and demand management. Without targeted policy intervention long lead times for grid connection remain across Europe (>30 months). • The Energy Efficiency Directive requires operators of large data centres to disclose annual energy and water use, improving transparency and benchmarking. Efficiency improvements are moderate, but do not offset the growth in total electricity demand, which is expected to rise from 105 TWh to over 200TWh in 2036. Energy consumption by data centres could reach around 340 TWh annually in 2036, growing at a compound annual growth rate of 11.4%. If electricity production remained stable at the levels 206 reported by the IEA in 2022 then data centres would consume 12% of EU27’s generated electricity. • Energy efficiency in data centres improves gradually; the average Power Usage Effectiveness (PUE) declines from 1.29 in 2025 to about 1.23 by 2036.The carbon intensity of this demand declines as the electricity mix decarbonises under the Fit for 55 package. Incremental advances in cooling, waste -heat recovery, and on -site renewable generation occur as a result of existing regulatory incentives under EED and RED III. • Surveys have identified permitting delays (up to 3-5 years in some jurisdictions), grid- connection queues, and land -use restrictions as principal d availabili new capacity. Without policy harmonisation, these bottlenecks persist, with moderate alleviation from national administrative reforms. Therefore, data centre expansion continues but below potential. Under continued existing conditions, roughly 25 -30 % of announced projects experience significant delay or downsizing • Governments aim to balance digital infrastructure expansion with environmental priorities by introducing power efficiency targe ts, and sustainability requirements. National measures, such as tax incentives for green data centres in the Nordics or Italy’s simplified permitting for renewable-powered facilities, continue at present scale • Policy evolution remains gradual and inconsist ent, creating a fragmented regulatory landscape across Europe. Efforts to modernise infrastructure and streamline permitting are underway, but progress is uneven, often slowed by regulatory complexity and localised decision-making. Under policy option 0, Europe’s compute supply increases in absolute terms but lags behind global competitors. North America and Asia-Pacific expand faster, increasing their share of global compute . The EU maintains its global market share of around 20 -23%. While the region rema ins attractive for investment due to regulatory stability and skilled labour, its relative cost position remains less favourable than that of North America or some Asian economies. Considering the sectors and region’s expected growth and technological developments in AI, quantum computing and 6G, international providers are expected to maintain a strong EU presence under existing trade and competition rules. Goldman Sachs forecast that total global capacity will reach 122GW by 2030, growing at a CAGR of 16%. The forecast produced by the study indicates that EU27 capacity will grow at 18% over the same period, meaning EU27’s share of data centre capacity is expected to grow from 20% (2025) to 23% (2030), as shown in the figure below. Figure 8. EU-27 share of forecast compared to the global capacity (Source: Technopolis et al. (2025)) 207 Estimates for the United States suggest that by 2028 data centres will account for between 7-12% of total consumption. 192 The IEA in turn estimate that data centre electricity consumption in the United States will grow to 240 TWh annually by 2030 (from 180 TWh in 2024). This would equate to 6% of the United States’ 2024 electricity consumption. The IEA also estimated China’s data centre electricity consumption to grow to 175TWh (from 100 TWh in 2024). This would equate to 2% of China’s 2024 electricity consumption.193 2. Dependence on cloud and AI computing servi ces supplied by non -European providers For problem 2, the baseline scenario describes how the market share of European providers evolves without any EU intervention beyond initiatives and regulations already adopted, such as the Data Act. The core aim of the Data Act is to reduce friction when switching from cloud provider, but its full effects will take time to materialise. Since October 2025, a set of standard contractual clauses recommended by the Commission will make contractually easier for cloud users to switch from provider, as they are progressively adopted. Also, by January 2027, switching from one cloud provider to another should be free of charge. Finally, aspects related to the technical switching will take more time to fully materialise. A soon to -be-published Commission study has identified only a handful of industry driven specifications that the Commission will propose to become mandatory through the foreseen mechanisms of the Data Act. This will require the adoption of several implementing acts following which industry will have a 12- month transition period to ensure compatibility of relevant data processing services with the specifications. Further standardisation will have to undergo a formal request from the Commission to the European Standardisation Organisations, a process prone to take time. The effects of the Data Act for facilitating the emergence of an integr ated offering by European providers are at this stage therefore limited and indirect. Finally, it must be noted that switching is a customer -driven operation and the effects on European providers and the growth of their customer base rely on the willingness of customers to make use of their new right to switch The baseline presented for the policy scenario 0 for problem 2 is dynamic and focuses mainly on IaaS and PaaS using data from Synergy194 on the market share (15%) and Statista for the market revenues (EUR 125.22 bn)195. Due to the heterogeneity of the SaaS market and the unclear categorization of what is included in the SaaS category, these are excluded from the baseline scenario. AI computing services can be considered as an extension of cloud services for the specific purpose of running an AI model. The two categories overlap significantly, and AI computing services are currently not separately 192 Berkley Lab (2024) . 2024 United States Data Center Energy Usage Report. Available at: https://escholarship.org/uc/item/32d6m0d1 193 IEA (2025). Energy and AI. Available at: https://www.iea.org/reports/energy-and-ai 194 Synergy Research. Data from July 2025. 195 Statista 208 captured in statistics. That is why the below considerations are based entirely on figures and developments related to the above-mentioned market for cloud computing services. The base year considered for the baseline scenario is the latest full year for which there is stable data available, namely, 2024. In this base year, Synergy shows that EU - headquartered providers account for around 15% of the EU cloud infrastructure market, with the remainder provided by non -EU firms, in particular large US and other global providers. The base-year distribution and levels are taken as factual anchors. The dynamic baseline is built around the following assumptions: • The European cloud market grows at CAGR 17% until 2030, as pointed out by Synergy and from 2031 to 2036, it is assumed to grow at a slower CAGR of 12%. • Within the EU market, the market share served by EU providers, follows a flat scenario until 2036, similar to the almost flat trend that can be observed in the last two years. This is the status quo scenario. • Two sensitivity variants are also considered: o A declining scenario, falling from the current market share of 15% to 10%. This is the pessimistic scenario. o A slightly optimistic scenario, rising from the current 15% to 17%. The time horizon for the baseline spans until 2036, which is the time used for the modelling of the different policy measures, and a reasonable period in which structural changes in the dynamics of the cloud market can be expected. In terms of market volume, the assumption is that , while the market grows, the EU providers’ market share grows in parallel, but it slightly loses weight in the total market, leading to a small decline in European providers ‘overall share of the cloud market revenues. Figure 9. Market share of European cloud providers in the European market (Source: Synergy Research) Within the evolving European cloud market, the central dynamic baseline assumes that EU-headquartered cloud service providers are unable to fully keep pace with their non-EU competitors. Due to a growing demand in the EU, the revenues of the European players keep steady, but their overall position barely holds. 209 These projections are grounded in recent market evidence (see Figure 9) and structural factors. Over the last years, European cloud providers’ local market s hare has declined from roughly 29% in 2017 to about 15% and has since stagnated at that level, despite continued strong growth of their absolute revenues , as it can be seen in the figure above . At the same time, the three leading hyperscalers invest at a s cale (around EUR 10 bn per quarter in European CAPEX according to Synergy research196), which results in very high barriers to significantly increase the market share for smaller European players. This suggests that in the absence of major policy interventi ons or market shocks, the relative position of EU providers is likely to remain broadly unchanged in the mid-term. The only cloud – specific policy currently applicable in the EU, the Data Act, entered into force in September 2025. As explained previously, its effects are not yet observable, rendering difficult to provide a more dynamic outlook than the one shown here. The 15% used as the baseline reflects steady but constrained growth driven by potential gradual demand shifts generated by rising sovereignty expectations and niche market needs, while still facing structural issues (e.g. lock-in to hyperscalers, bundling advantages and integration needs). The 10% pessimistic scenario assumes that there is a widening AI infrastructure investment gap between US and EU cloud and AI service providers combined with regulatory initiatives failing to deliver meaningful constraints on lock -in, dampening switching and interoperability, along with price pressure from bundled offers and potential providers exits triggering a collapse in customer confidence towards cloud. The more optimistic scenario, 17%, assumes improved interoperability and portability and more trusted EU-level assurance, raising conversion rates and accelerating adoption. All three scenarios converge within a narrow seven –percentage-point band because the core competitive disadvantages faced by European cloud providers are deeply rooted. Even in the most optimistic case, European providers only recover to about 17% market share. This is large ly due to Europe’s fragmented regulatory environment and the difficult y of scaling cloud and AI services, that can match the breadth and integration of those offered by the hyperscalers. Conversely, the 10% pessimistic scenario includes the demand of cloud and AI services by highly regulated sectors that are genuinely sovereign. These needs ensure a stable baseline level of demand of cloud services. Other considerations taken into account for the assumptions include structural market factors, demand-side dynamics and competition environment, as described in section 2, notably 2.2. Scenario Market share of EU providers in 2036 Cumulative revenues of EU providers (2025 – 2036) (EUR bn) Cumulative revenues of non-EU providers (2025 – 2036) (EUR bn) Baseline (pessimistic scenario) 10% 438 33.212 Baseline (flat-share scenario) 15% 564 31.956 Baseline (optimistic scenario) 17% 611 31.483 Considered together, the three presented trajectories present a dynamic baseline scenario (Policy Option 0) towards which the EU cloud market is likely to continue evolving if the 196 https://www.mobileeurope.co.uk/european-cloud-providers-tread-water-in-growing-market/ 210 EU will not adopt any additional policy measure s. Under this scenario, the g lobal and European cloud markets would modestly grow but without a strong quantitative shift in the structure. This would lead the EU to remain structurally dependent of non-EU players covering most customers’ needs. Furthermore, EU -homegrown providers’ sc ale and investment in capacity and creation of new services would remain limited, constraining their ability to compete, especially with hyperscalers that present a more integrated and wider offer . In the absence of an EU action , European providers won’t m eaningfully improve their positioning in the market and European cloud users will continue to rely heavily on non-European providers. Policy options under PO2 are measured both in quantitative and qualitative terms. Quantitatively, policy options are evaluated by how much they shift the baseline trajectory in terms of higher market share of European providers and reduced dependency, especially important in highly critical use cases. Qualitatively, the baseline underlines that without an EU intervention the EU market landscape would remain characterised by a high external dependency, limited European scale and persistent asymmetries. These projections serve as the counterfactual reference for quantifying the incremental effects of policy options in terms of infrastructure deployment, environmental impact, and digital sovereignty. The evolution of these challenges under the baseline scenario illustrates why EU-level action may be warranted. The objectives of the intervention, as defined in the problem tree, relate directly to the outcomes described above: Table 69. Link between Policy Option 0 and the intervention Problem Driver Problem Policy Option 0 (baseline trend) Link to Intervention Objectives PD1: Lack of scale and scope of European cloud and AI computing service providers PD2: Bottlenecks to expand data centre capacity in the EU P1: Limited and geographically concentrated availability of computing capacity in the EU • Supply grows but is outpaced by demand for compute • EU share of global compute declines. • Average project lead time ≥ 3 years; grid and permitting delays persist. • Enterprise AI use rises to 40 %, below Digital Decade target (75 % cloud, 75 % AI use in enterprises). “SO1: Increase computing capacity in the EU through innovative and sustainable technologies ”: an increase in capacity is foreseen with a 9% CAGR. However , the industry’s demand for energy will continue to grow. Without strategic energy planning and a focus on s ustainable infrastructures, data centre expansion will challenge existing data centre hubs and regions with high strain on natural resources, at the risk of crowding out electrification objectives in other sectors and generating increasing public opposition. “SO2: Ensure attractive conditions for the deployment of sustainable and innovative computing capacity”: This goal will not be met consistently throughout the EU, with geographical imbalances and potential price increases across regions. PD3: Limited public sector uptake of cloud and AI P2: Dependence on cloud and AI computing • Market share of non -EU cloud providers remains 75- 80%. SO3: Decrease the overall reliance on non-European cloud and AI computing services : Without incentives for European providers to 211 Problem Driver Problem Policy Option 0 (baseline trend) Link to Intervention Objectives computing services supplied by European providers PD4: Absence of clarity around the concept of sovereign cloud and AI computing services services supplied by non-European providers • Cloud use in public services remain • Fragmented definitions persist; sovereignty and limited interoperability. grow in their integrated offers as well as in the demand by main drivers of the economy such as the public sector, the dependency from non -EU providers would increase or remain the same in a positive scenario. SO4: Contribute to the protection of fundamental i nterests of society by enhancing the resilience of supply of cloud and AI computing services, in particular in the public sector : Sovereign-washing would be likely to happen without a clear definition of sovereign cloud and AI computing services and the associated enforcement mechanisms. ANNEX 10. CADA INTERVENTION LOGIC ANNEX 11. OPERATIONAL MONITORING AND EVALUATION SYSTEM The monitoring and evaluation framework has been designed as an integrated system that follows each level of the intervention logic, from outputs to outcomes and long -term impact, based on a coherent set of indicators and baseline values with targets, where available. The monitoring activities will be coordinated at EU level, with the European Commission (EC, DG CONNECT) acting as the coordinator, with the support of relevant EU agencies and Member State authorities for possible data provision. The framework is defined to assess the indicators throughout the lifetime of the intervention and remain coherent with the five-year evaluation horizon. Below are individual sections th at describe how outputs, outcomes and impacts will be tracked over time, based on a coherent set of indicators for each level of the intervention logic (see Annex 10) , accompanied with baseline values and targets. Each table presents data sources, collection method, frequency of collection and the responsible entity for each data input. The underlying assumption of this approach is that digital policies produce effects through various, interrelated channels, i.e. from investment, regulation, energy systems, infrastructure, market dynamics and user behaviour, and over different time horizons. As such, the monitoring and evaluation process is to be intended not only as a tool to understand if the policy objectives ha ve been met but also as a learning mechanism to better inform future policy implementation. 1. Output monitoring: deliverables and direct effects At the output level, monitoring focuses on the direct and immediate results of the intervention, i.e. how the tools produced by the Cloud and AI Development Act have an immediate effect on processes and procurement dynamics. These outputs can be tracked using administrative data and information reported by operators and Member States , typically quarterly and at the end of the first year /18 months after implementation . Their goal is to ensure that the intervention is proceeding according to plan, and offer early warning on possible bottlenecks, which may need corrective measures during the implementation phase. Indicator Baseli ne Target Data source Collection method Frequency Responsi ble entity No. of national strategies for data centre and AI infrastructure deployment <10 (out of 27 MS) >20 (out of 27 MS) National authorities/ Ministries’ websites Desk research Annual EC with MS validation (if needed) No. of identified DC fast -track areas 63197 >5 per MS in the first year of National authorities/ Ministries’ Desk research Annual EC with MS validation 197 The French government has published a list of sites judged favourable for data -centre implantation to help attract infrastructure investment and compete at the European level. See here: 25112025__Guide Datacenters.pdf; The German government is developing a national strategy to promote the operation and settlement of data centres: National Data Centre Strategy - Federal Ministry for Digital and State Modernisation ; Similar, Italy has developed a strategy for attracting investment in data centres. See: ATTRAZIONE_DEI_DATA_CENTER_2025.pdf. Portugal is finalising its strategy: Governo anuncia estratégia nacional de centros de dados para alimentar procura por Inteligência Artificial - 214 Indicator Baseli ne Target Data source Collection method Frequency Responsi ble entity implementati on Public funding instruments operational for energy-efficient technologies/ strategic projects NA Definition of calls with clear eligibility rules and selection criteria Internal NA Annual/ every two years EC Monitoring framework for monitoring data centre capacity NA Defined methodolog, reporting templates Existing methodolo gy and industry datasets Survey + desk research + interviews Once, to implement PM7 EC Cloud and AI development plans NA >20 (out of 27 MS) National authorities/ Ministries’ websites Desk research Annual EC with MS validation (if needed) Compliance rate with the sovereignty scheme by contracting authorities NA Risk assessments and guidance consistently applied in major public tenders TED data , national authorities data Desk research + interviews with MS representati ves Annual, 1 year/ 18 months after implementati on EC with MS validation Number of sovereign services within the repository NA Repository data NA Annual EC Joint tenders/procurem ent mechanisms launched None Functioning joint calls / tenders TED data, national authorities data Desk research + interviews with MS representati ves Annual, 1 year/ 18 months after implementati on EC with MS validation EuroCloud platform establishment NA Functional platform within 1 -2 years NA NA Annual, 1 year/ 18 months after implementati on EC No. of public sector open source solutions released NA Continuous increase OSS catalogue Desk research Annual EC 2. Outcome monitoring: mid-term change Outcome monitoring assesses the medium -term impact of the intervention on market dynamics, user behaviours and overall ecosystem. Related indicators can be measures Expresso; Netherlands has developed a roadmap for the growth of data centres in the count ry (2019): Opmaak 1 ; Finland has recently developed a national roadmap for data centres. See: National Roadmap for Data Centres : Rapporteur's Report; Spain also developed a national strategy for IA, with measures on the deployment of data centres. See: Estrategia Inteligencia Artificial 2024 215 through market data, structured surveys, procurement records etc. Data collection could correspond to the evaluation phase of the intervention. The monitoring framework is designed to identify key data and ensure that this is collected from a wide range of stakeholders affected by the policy intervention. Indicator Baseline Target Data source Collection method Frequency Responsible entity Installed computing capacity in the EU (IT load) and across MS (outside existing hubs) 12 GW Additional operational IT load and AI infrastructure by 2030 Industry market studies and datasets (EUDCA, DataCentre Map) Desk research + survey (see methodology above) Annual and interim snapshot, 5 years after implementat ion EC with MS validation Share of EU global computing capacity 20% ≥ 25% Industry datasets, market research Desk research Same as above EC No. of MS with simplified frameworks (permitting, zoning, energy access) <5 ≥ 20 by 2030 National authorities Desk research + interviews Biennial EC Average permitting time for new DC projects Average time: 32 months <18 months by 2030 and/or reduction across MS National authorities, data centre operators, real estate analysts Desk/market research + interviews + surveys Annual EC with MS validation No. of pilot projects for innovative/ energy- efficient DC technologies NA Continuous increase Project registries and evaluation Desk research + Survey + interviews Annual EC Annual public and private investment in EU DC NA Increase to close the capacity gap Market analyses Desk research + market research Annual EC Improved energy and water efficiency of deployed capacity PUE, WUE, utilisatio n levels today (see Annex 4) Convergence towards best - available performance; Share of supported sites using specified cooling/powe r technologies TSOs/ DSOs data, providers data Desk research + Survey + interviews Annual EC with MS validation 216 Indicator Baseline Target Data source Collection method Frequency Responsible entity Share of renewable energy used by data centres NA Convergence towards best - available performance TSOs/ DSOs data, providers data Desk research + Survey + interviews Annual EC with MS validation No. of audited sovereign cloud and AI services 0 Continuous increase Repository Administrativ e data Annual EC Market share of EU providers 15% Increase in market share Market data Desk research Annual EC Annual value of EU procuremen t of sovereign cloud and AI computing services 0 ≥ 100% TED data, national authorities data, audited service repository MS reporting obligations + Desk research + interviews with MS representative s Annual EC with MS validation 3. Impact monitoring: long-term structural effects Impacts concern the long -term changes , i.e. materialised over longer horizons (often beyond 5 years) in the EU’s economic, technological and strategic position, following this policy intervention. Since these effects are expected to emerge progressively, they cannot be assessed through monitoring alone but should be the outcome of a more thorough analytical exercises which is able to disentangle the effects of the intervention from other policy choices or natural market developments. Indicator Baseline Target Data source Collection method Frequency Responsible entity EU computing capacity covering EU demand 2025 Gap: 3 GW Future residual gap < 0.5 GW Operator disclosures; ENTSO-E grid connection data; industry market studies Desk research + survey (see methodology above) Annual (Year- 5 interim evaluation synthesis) EC with MS validation Lower carbon intensity of digital infrastructure Estimated kgCO₂e per compute unit (see Annex 4) Decreasing kgCO₂e per compute unit Operator energy reporting; national grid emission factors; life- cycle assessment parameters Desk/ market research + Survey + interviews Annual (full assessment at Year 5) EC with MS validation 217 Indicator Baseline Target Data source Collection method Frequency Responsible entity Market contestability and higher global competitiveness of EU industry Low More bidders, lower lock- in signals , higher market shares for EU providers Public procurement databases (TED), portability metrics from providers Tender analytics + interviews with providers and users + survey (e.g. SME target) At least 5 years after implementation EC/others Improved strategic autonomy and reduced dependencies Baseline study Structural reduction in dependency Market sizing; customs statistics; provider data Desk research Annual + Year 5 EC/others + MS and relevant agencies 4. Evaluation arrangements and timing The evaluation will be structured to understand how the observed impact and changes can be attributed to this specific policy intervention . The study conducted as part of the monitoring of capacity deployment during the first year of implementation will be used to validate indicators, data sources and targets. A mid-term evaluation can be conducted after the third year of implementation of the intervention , to better understand the early outcomes and effectiveness of the interventio n (using data collected above) . The full evaluation is then expected five years after the implementation of the intervention to assess the outcomes and identify early impacts. To prevent parallel reporting , avoid duplication and benefit from synergies with existing initiatives, the programme should reuse: • Eurostat business statistics • National regulatory authorities and BEREC reporting • Procurement electronic databases, e.g. TED • Energy systems data from TSOs and DSOs, national energy agencies • Existing and future programmes, such as the Digital Decade Policy Programme , RRF reporting templates A preliminary set of evaluation questions can be found below. This will be updates and enriched following the implementation of the initiative. Evaluation criterion Assessment objective and possible evaluation questions Effectiveness Goal: assess the extent to which the objectives of the initiative have been achieved and how benefits have accrued to different stakeholders. To what extent did the intervention increase EU installed computing capacity and create the conditions for easier data centre deployment? How did it foster the development and deployment of innovative and sustainable data centres and a better use of energy sources? To what extent did it increase clarity 218 Evaluation criterion Assessment objective and possible evaluation questions around the concept of sovereign cloud and AI computing services? How did it improve the market share of homegrown EU cloud and AI computing service operators? What is their market share? To what extent did it increase federated resources across the public sector and joint procurement for cloud and AI computing services? To w hat extent did it increase the use of open source solutions? Efficiency Goal: assess the extent to which the initiative has been cost-effective, analysing the relationship between expected and actual benefits and costs. Have benefits and cost savings been achieved at proportionate costs for different stakeholders? Relevance Goal: assess the extent to which the objectives of the initiative still reflect current and future needs. To what extent the initiative still addresses relevant needs? How is it still aligned with EU priorities? Coherence Goal: assess the initiative’s internal and external coherence, i.e. if the different elements of the intervention worked together to reach the set goal and if it worked well or overlapped with other initiatives, both at EU level and national level. To what exte nt is the initiative consistent with existing and future energy, digital, competition, environmental, security rules at EU level and national level? EU Added value Goal: assess the extent to which the initiative brought EU added value compared to what could have been achieved by Member States alone. To what extend did EU-level action prevent fragmentation of DC rules? How did it improve cross -border service delivery and competitiveness of EU providers? 219 ANNEX 12. COSTS OF MIGRATING AND PORTING APPLICATIONS Cloud porting consists in moving a service from one cloud provider to another cloud provider Cloud migrating consists in moving a service from on-premises to cloud Today, by and large critical use cases [of the public sector] are not in the cloud. Most of these use cases are instead run ‘on-premises’, that is, on local infrastructure which are not scalable (and cannot therefore be called ‘cloud’). Policy measure 21 creates an obligation for the public sector to carry at least one sovereignty risk as sessment to identify which public sector use cases within a Member State require the use of which sovereignty level as described under PM11. The details of the measure are described in the main text (section 5.2.2) and in annex 4 (section 3.21). None of the proposed policy measures obliges public authorities to port an existing cloud service from one provider to another, or to migrate on- premises service to the cloud or to port. These decisions are made on a case-by-case basis by public authorities alone, considering the authority's specific needs , existing systems, and procurement cycle. Examining costs is however relevant since the results of Member States' sovereignty risk assessments are expected to induce cloud porting decisions 198. As well, the expected increase in trust resulting from the existence of a sovereignty framework is expected to increase or anticipate cloud migration decisions. These costs are not immediate consequences of the intervention's entry into force, but rather potential future expenses that may arise during the normal course of business. 12.1 Considerations about migrating and porting Applications can be broadly qualified in different levels of cloud-readiness: • Legacy ‘on-premises’ applications that are not candidates for cloudification, for example because they are to be phased out, because their use is too small, or because the technology is too old to migrate them. As an example, an important number of banking applications use still today services written in COBOL, a language popular in the decade of the 60s. • Cloud-aware applications: A cloud aware application is designed or adapted to leverage cloud computing features but nevertheless present challenges that span security, architecture, evolvability, and scalability. • Cloud native applications, specifically designed to benefit from the capabilities of the cloud, such as scalability. In the public sector, most applications fall within the two first categories: when cloudified/cloudifiable, they are ‘aware’ but not ‘native’, which requires important 198It must be noted that porting can also be trigger ed naturally as a consequence of regular procurement decisions after the expiration of cloud service contracts. 220 adaptations (e.g. a re-architecting or a refactoring of the code) when seeking to port them to another cloud service. There is no one -size-fits-all when migrating (legacy -to-cloud) o r porting/switching services (cloud-to-sovereign cloud), as it largely depends on many aspects: the technology used to develop the application, the size, its complexity, or third-party dependencies. This process is not automated and is most often a one -off effort that can hardly be repeated , even if economies of scale can exist. Literature explains the process, both from a technical point of view and a business point of view199 but there are seldom reports available on the costs associated to migrating or porting/switching, given that this is mostly an ad hoc, one- off activity with many variables interplaying. At the time of migrating or porting / switching, some key cost elements that should always need to be considered are: • The size, technology, complexity, and third-party dependencies of the system as-is • The specificities of the to-be environment. This will decide how the application will be ported / migrated. In the industry, the 7Rs of migration 200 provide information on what is the most adequa te approach for the problem at hand. In legacy-to-cloud and cloud-to-sovereign cloud migration, these are the approaches most commonly followed in the industry: o Rehost or lift-and-shift, which usually require minimal code changes. This is usually the faste st option to put a service into production, but unless already cloud-native, it incurs into a huge technical debt and post-migration optimization costs. Overall, while the upfront cost of the migration is small, the long-term benefits will be limited, and a large proportion of costs will be spent in optimizing the application to reduce the spendings. o Replatform, where the application is adapted to managed databases or to other technologies such as containers. This is often the ‘by-default’ option that offers the stronger Return on Investment (ROI) over time. Also, this is a much more beneficial option in the mid-term than rehosting an application and can lead to significant operational savings. o Refactor, which requires major or full code rewrites and a new architecture design of the application (e.g. from an n -tier to micro -services or containers), as well as new continuous integration continuous deployment (CI/CD) pipelines, among other considerations. This is a rather costly project and risk -prone, and it is only implemented if the application is expected to deliver large long-term benefits and operational efficiency that outweigh the costs. 199 Orue-Echevarría Arrieta, L. (2016). From software as a good to software as a service (SAAS): a methodology to define the transformation towards the SAAS business model. Universitat Abat Oliba. https://hdl.handle.net/10803/398024 200 The 7Rs of migration include the following: Rehost (lift-and-shift): Move the application to cloud with minimal changes, Relocate: Move VMs without OS or code changes, Re-platform: Moderate changes to leverage managed services, Refactor (rearchitect): Major or Full rewrite for cloud -native architecture., Repurchase (drop-and-shop): Replace with a SaaS equivalent, Retire: Decommission application, Retain (revisit): Keep on-premises for the time being. Adopted from IBM Strategy 221 The cost drivers differ depending on whether it is a porting from a cloud service to another (cloud-to-sovereign cloud) or a migration of a legacy application to the cloud. (legacy-to- cloud) The dominant cost driver of porting an application from one cloud service to another is the labour related to the service re-mapping, re-testing and parallel run in dual infrastructures , and a potential re -adaptation of the application away from proprietary services or older versions of the technologies. Thanks to the entering into force of the Data Act, egress fees are in the process of disappearing or have already disappeared. Conversely, when moving a legacy application to the cloud (‘cloudification’), the dominant cost is the technical team’s labour – architects, software engineers, DevOps - to resolve the technical debt, undocumented dependencies, and architectural incompatibilities with cloud -native patterns, along with the decision to what cloud service to migrate to, both from a technical and a business point of view , and the impact in the organizational processes . The dual run during the cloudification while critical, does not consume any additional cloud resources, as the legacy application keeps on running on-premises. Due to the singularity of each migration and porting project and the lack of data from independent resources, the current analysis addresses two distinct migration scenarios in qualitative terms: (1) migrating an existing on-premise workload to the cloud (legacy-to-cloud); and (2) porting an existing workload from one cloud provider to another (cloud-to- sovereign cloud). The second scenario is presented in the subsequent sections in quantitative terms . This scope decision reflects a limitation in the available literature: cost data for legacy-to-cloud migrations remains highly variable and context-dependent, making reliable generalisation difficult. Cloud-to-sovereign cloud migrations, by contrast, offer a mor e stable basis for estimation, as the source environment is often already well documented, the application containerised, and it is operating under known cost parameters , considerations that have been used for the quantitative modelling presented in the next sections. While both scenarios follow the same broad phases, the effort intensity of the individual activities within each phase of a migration project – that is, how much labour would be dedicated to that specific activity - differs considerably depending on whether the project is a legacy-to-cloud or a cloud-to-sovereign cloud migration. The table below provides a qualitative comparison of the effort intensity per main activity across both scenarios. Table 65. Comparative table of the intensity effort (qualitative) needed to migrate applications legacy- to-cloud and cloud-to-sovereign cloud (Source: European Commission) Activity Legacy-to-cloud effort intensity Cloud-to-sovereign cloud effort intensity Architecture design Medium / High Low Refactoring and code migration High Medium Data migration High High Service re-mapping N/A High Testing and validation High Medium Parallel operation (dual run) Low Medium Tooling and licenses Medium Low 222 Activity Legacy-to-cloud effort intensity Cloud-to-sovereign cloud effort intensity Training in new technologies Medium / High Low Some considerations on the above effort intensities: • Architecture is medium / high in legacy -to-cloud: mapping undocumented dependencies of on-premise software is genuinely complex, often requiring reverse engineering techniques. The output is however well defined; it is a target architecture and a wave plan (migration plan) . In cloud-to-sovereign cloud the effort intensity in architecture is lower, because usually the application deployment and cloud architecture are already often well documented and reverse engineering techniques, if needed, are much less effort consuming . In th is case, the main challenge faced by the architects is to achieve a well and clear structured service- to-service mapping rather than a service discovery and identification from scratch. • Refactoring and code migration is high in legacy-to-cloud. Resolving technical debt, refactoring the code, changing the programming language and technologies, the application of cloud -native or cloud -aware patterns (e.g. load balancers), containerising monoliths or n -tiers, and creating CI/CD pipelines from scratch , represent the hardest engineering work in the entire migration and the one most prone to scope expansion when hidden dependencies surface in the middle of the project. In cloud-to-sovereign cloud this effort is considered to be medium, because the application is a lready cloud-native or cloud-aware. Here, the work is mainly adaptation, not transformation. • Service Re-mapping is high in cloud-to-sovereign cloud and not yet applicable in legacy-to-cloud. Translating proprietary managed services across platforms demands deep simultaneous knowledge of both providers, and incompatibilities in data models or execution environments could trigger some re-engineering that was invisible at planning time. This is why it is critical to carry out this mapping in earlier phases of the migration. In any case, t he migration or porting shoul d be balanced against the costs of not doing anything: • Maintaining legacy applications carries a real and often underestimated cost. Beyond the direct expense of keeping ageing infrastructure operational, including on-premise data centres that frequently fall short of modern standards, organisations must continuously maintain all dependent software compone nts, manage growing security and vulnerability exposure, and remain with a shrinking pool of engineers who retain the relevant skills as technologies become obsolete. Legacy systems also impose additional overhead cost: the older the application, the more difficult and expensive it becomes to modify, extend, or integrate, progressively limiting an organisation's ability to respond to changing requirements. • Remaining with a non-sovereign provider poses a dependency risk not without cost. Vendor lock-in forecloses the price competition that periodic provider switching would otherwise enable. More significantly, a non -sovereign service 223 exposes the organisation to geopolitical risk: a provider subject to third -country jurisdiction may face legally compelled data access requests or pressure to degrade service quality, neither of which the customer can effectively resist or even anticipate. These risks carry a cost, whether measured in compliance exposure, quality of service or the political cost of de pendency, that cannot be easily quantified. The final decision follows a total cost of ownership approach and, in addition to the above, would also have to consider aspects such as the acceptance of the technical debt, the level of dependencies from third -party libraries or proprietary source code, the business case, the return of investment or the risk appetite. As explained above, this decision needs to be taken ad-hoc for each application to be ported or migrated . The prioritization of which applications should be ported is a business -driven decision, often based on which application would report a quicker and bigger return on investment (ROI). 12.2 Cost modelling for public administrations to port services (cloud-to- sovereign cloud) A cost analysis has been c arried out to estimate the expenditure involved in porting an application from one cloud service offered by a cloud service provider to another that is functionally equivalent but either provided by another provider or being the same provider, under another type of technical and legal construct. Published literature on this subject is scarce, largely owing to the highly context -specific nature of cloud migrations: most availabl e sources are online, deal in broad ranges, and provide little explanation of the underlying cost drivers, or the methodology used to derive their estimates the phases considered for the migration , or the type and size of the application ported. Despite these limitations, and in the absence of more rigorous or detailed benchmarks, these online sources remain the only externally available reference point against which the results of this analysis can be validated. They have therefore been used as cross-validation references, with appropriate caution, alongside resources consulted in confidence from existing projects . Given the inherent uncertainty in this type of estimation, a min -max sensitivity analysis has also been conducted to illustrate the plausible range within which porting costs may fall depending on the application characteristics and migration approach. The starting point for this assessment is that sovereignty risk assessment will identify public sector IT systems that will need to be ported to sovereign cloud services of at least sovereignty level 2. To follow a conservative approach, it is assumed that derogations will be exceptional. Moreover, it is assumed that the porting will be from one cloud service to one cloud service (1:1 cardinality). Migrating to multiple cloud services at the same time would add an important layer of complexity and risk to the project 201. Most EU public 201 Alonso, J., Orue -Echevarria, L., Casola, V. et al. Understanding the challenges and novel architectural models of multi-cloud native applications – a systematic literature review. J Cloud Comp 12, 6 (2023). https://doi.org/10.1186/s13677-022-00367-6 224 administrations are still in the process of adopting cloud services 202 under a “clou d first approach”203, and whil e deploying workloads following a multi-cloud204 strategy is a plausible one, this is still a marginal practice. While it has been reported by Member States in various events (e.g. Member States Cloud Coordination Group (MSCCG) as part of the European Alliance for industrial data, edge and cloud) that the migration from on -premise applications to cloud -aware and clou d- native is growing, there is few available public data that clearly quantifies this growth. France reported in 2025 EUR 84 m of public procurement for cloud - in State administration, healthcare, local administrations, budget operators, public establishments or similar, authority or institution - with an annual growth of 62%. The report stresses that these values stem mostly from small projects and a handful of large ones , positioning France in a cloud adoption trend 205. Spain and Germany are investing in the ir own governmental clouds, NubeSara (EUR 84 m 206) and Deutscheverwaltungslcoud respectively but there is no clearly available disaggregated information on the number of workloads on the cloud. The UK, through its G -Cloud offering reports an expenditure of £400 m in hosting services in fiscal year 2024/2025207. 202 See France as an example, in their document Bilan de la doctrine cloud au centre where it is stated: “La dynamique actuelle d'arrivée de nombreux petits projets montre que nous sommes toujours dans une phase d'adoption” (p.6) . This can be extended to various MS, which as part of their RRF plans are in the process of migrating their legacy applications to cloud-aware and cloud-native architectures. 203 See for instance Spain, with its approach “hybrid cloud first” here and here 204 There are several ways to define multi -cloud. Alonso, Orue-Echevarria et al (2023) concluded in their Systematic Literature Review (SLR) which analysed 88 sources from an initial set of 1 000 papers that multi-cloud applications can be characterized as follow s: (a) Replicated multi-cloud applications are deployed across multiple clouds sequentially rather than simultaneously. They migrate between provider s for economic or operational reasons, such as for cost optimisation, backup needs, emergency failover, or contract expiry. They are purpose -built to run on, and transition between, different cloud environments. The primary concern is seamless switching be tween providers, making data portability and interoperability central design requirements. (b) Distributed multi-cloud applications run subcomponents concurrently across resources from multiple providers, drawing on several independent cloud services in co mbination. This simultaneous multi-provider model delivers tangible benefits including high availability, fault tolerance, and cost efficiency. It is typically adopted when no single provider offers the full functionality an application requires, allowing organisations to selectively consume the services best suited to their needs within given cost constraints. However, this approach introduces significant complexity: security governance becomes harder to enforce, operational management grows more demanding , and the distributed architecture raises design -phase challenges such as the partitioning of application logic and data across provider boundaries. (c) Hybrid multi-cloud applications encompass both of the above patterns: combining the sequential provider usage characteristic of replicated deployments with the concurrent, multi - provider model of distributed architectures, offering the broadest flexibility but also the greatest management overhead. 205 Bilan de la doctrine cloud au centre 206 España digital 2026 with a breakdown of the services at Boletín Oficial del Estado , mainly targeting computation power, network and storage. 207 See G-Cloud tab, select “central government”, fiscal year “2025 – 2025” 225 12.3 Phases of a porting operation Next, the different phases are described, adapted from the few existing resources in the literature208 209 210 211 212. Phase 1 – Feasibility assessment (one -off adjustment costs) : The first step before tackling the porting is to have a clear understanding of the problem that the application is solving, perform a technical feasibility analysis to understand well the complexity, the size, dependencies as well as the technology, architecture, licenses, compliance requirements and quantity of data. In addition, it is important to have a clear understanding of what are the features and technologies accepted by the target service as this will determin e the decision on which porting model will be followed. The following activities have been quantified under this phase taking as input the information provided above and consultation with experts and practical experience in the field: • Discovery tooling and licensing • Infrastructure inventory • Dependency mapping • Total Cost of Ownership (TCO) analysis Among the most important challenges to be faced in this step is to underestimate the dependencies across modules (end -to-end calls), the lack of docu mentation which may result in an incomplete inventory and data classification gaps, underestimating the existence of Personal Identifiable Information (PII) or regulated data in unexpected components requiring at a later stage, for instance a DPIA. The main outcomes of this phase is a porting inventory, a dependency graph, risk register, and a porting readiness assessment report. Phase 2 – Strategy and planning (one -off adjustment costs): The second step of the porting is the development of the porting strategy and the planning itself. At this stage, once the characteristics of the application and the target platform are known thanks to the first step, it is a matter of deciding, based on the 7Rs of porting, what is the most adequate approach for the problem at hand: rehost, re-platform or refactor, as the most widely used. 208 Andreas Menychtas, Kleopatra Konstanteli, Juncal Alonso, Leire Orue -Echevarria, Jesus Gorronogoitia, et al.. Software modernization and cloudification using the ARTIST migration methodology and frame work. Scalable Computing : Practice and Experience, 2014, 15 (2), pp.131-152. ⟨10.12694/scpe.v15i2.938⟩. 209 J. Alonso, L. Orue -Echevarria, M. Escalante, J. Gorroñogoitia and D. Presenza, "Cloud modernization assessment framework: Analyzing the impact of a potential migration to Cloud," 2013 IEEE 7th International Symposium on the Maintenance and Evolution of Service -Oriented and Cloud -Based Systems, Eindhoven, Netherlands, 2013, pp. 64 -73, doi: 10.1109/MESOCA.2013.6632736. 210 Orue-Echevarría Arrieta, L. (20 16). From software as a good to software as a service (SAAS): a methodology to define the transformation towards the SAAS business model. Universitat Abat Oliba. https://hdl.handle.net/10803/398024 211 Pahl, C., Xiong, H., Walshe, R. (2013). A Comparison of On-Premise to Cloud Migration Approaches. In: Lau, KK., Lamersdorf, W., Pimentel, E. (eds) Service-Oriented and Cloud Computing. ESOCC 2013. Lecture Notes in Computer Science, vol 8135. Springer, Berlin, Heidelberg. https://doi.org/10.1007/978-3-642-40651-5_18 212 P. Jamshidi, A. Ahmad and C. Pahl, "Cloud Migration Research: A Systematic Review," in IEEE Transactions on Cloud Computing, vol. 1, no. 2, pp. 142-157, July-December 2013, doi: 10.1109/TCC.2013.10. 226 Each option has different consequences in the effort needed to port, the timeline and the risks. Once one of the above strategies have been decided upon – this can be unique for the complete application or alternatively each part of the application may undergo a different strategy - , the next activities include grouping the workloads into migration waves 213, addressing the identified dependencies, mapping the source services with the target services, re-architecting where needed, define the data porting strategy (e.g. bulk, transfer, incremental, …) as well as setting up the porting programme team. As part of this activity, it is also important to keep a rollback mechanism defined in case the porting does not succeed. These are the activities evaluated in this phase: • Cloud architecture design • Porting plan • Provider (target platform) feature evaluation and service re-mapping • Project management setup The main challenges in this phase stem from the gap in the team skills and the lack of one- to-one match across the functionalities of the various cloud services. That is, while cloud services may theoretically be similar or may have an equivalent functionality, there is not a one – to – one match. This matching must be often manually performed therefore by the team members start carrying out the porting. The outcomes of this phase are the porting strategy document, the plan, the target architecture design and topology and the RACI214 matrix. Phase 3 – Target environment set up (one -off adjustment costs): This step includes the provision and configuration o f the infrastructure (e.g. the Virtual Machines), implementing the basic security policy measures (e.g. identity provider), observability environment and logs, the CI/CD pipelines and the Infrastructure-as-Code (IaC) practices on the target environment. Under this phase, these are the activities considered: • VM / compute provisioning • Network configuration (Virtual Private Cloud, DNS, Firewall) • Storage setup • Identity and Access Management, access and monitoring setup • IaC scripting and DevOps pipelines 213 A migration wave breaks down migration proj ects into more manageable batches for synchronized and concurrent migration. This is an iterative approach that allows organizations to minimize business disruption and risk, as well as incorporate the lessons learned from the previous wave into the next one. 214 Responsible, Accountable, Consulted, Informed 227 The main obstacles in this phase have to do with the potential differences in the Identity and Access Management (IAM) roles and permissions, overlapping IPs, the setup of tools such as security scanning tools or a SIEM (Security Information and Event Management). The outcomes of this phase are the network topology, the IAM baseline and the DevOps pipeline. Phase 4 – Porting (one-off adjustment costs): This phase entails the porting of both the business logic of the application as well as the data, while maintaining the integrity, full auditability and minimal downtime of the application. The porting of data may be rather challenging, in terms of duration, strategy, and risks and they require a verification of the integrity of the data at destination (e.g. row counts, checksum, etc) as this is a very error- prone activity. Migrating the business logic may involve refactoring part of the code, re - adapting to new technologies, moving and / or rebuilding the images for the containers , adapting the Kubernetes manifests, redeploying them and reconfiguring certain parts of the application such as the managed services (e.g. load balancers). This step also includes some smoke tests (initial tests) to demonstrate that the application is functional and responsive. Following, the activities considered: • Database porting • VM/server image replication • Application code adaptation (refactoring) and configuration for porting • Porting of the tooling licenses • Parallel infrastructure dual - run The main problems u sually faced during this phase is the data format compatibility, the maintenance of the integrity of the data and the avoidance of data loss during the porting. In terms of application, the integrability and reconfiguration of the different components migrated onto the target platform may hinder the deployment of the application. The deliverables after this phase is the data and application migrated onto the cloud, and the application deployment view. Phase 5 – Testing and validation (one -off adjustment cos ts): This step includes the functional and non -functional testing, including performance, load, stress and resilience testing. Security, vulnerability and penetration testing are also part of this. At this stage, there is a disaster recovery plan in place and clear metrics to ensure business continuity. These are the activities taken into account under this phase: • Functional testing • Performance and load testing • Integration / API testing • Security and vulnerability scanning • Rollback plan validation The main obstacles in this phase entail usually the test coverage and the responsiveness of the application in extreme conditions. Another key aspect is that the targeted application 228 must mirror in functional terms the migrated one so there has to be a paralle l run of both applications for a certain period of time in order to define errors before it goes into production. The outcome of this phase is the test results from the different tests carried out. Phase 6 - Cutover and Switching DNS (one -off adjustment c osts): This is the most critical phase as it involves the switching from the ‘old’ environment to the target environment. When going on production, the DNS records are switched, the application health needs to be ensured, and the code is frozen. The definition of a rollback mechanism is also part of this activity. The tasks included under this phase are: • DNS / traffic cutover • Final data synchronization and delta transfer • Go live • Downtime window management • Incident response and hotfixes The challenges of th ese activities relate to the DNS switching and how stateful sessions are being handled, that is active user sessions could be lost due to the cutover. The outcome of this phase is the application in production. Phase 7 – Post – porting (one-off adjustment costs): After a successful cutover, the source environment will still be running but on standby to identify potential performance problems in production. This parallel run is usually for a certain amount of weeks, for example, 2 -4 week , even if not the who le time . Moreover, this phase covers the decommissioning of resources, the archiving of the source environment configuration for audit purposes and the update of the architecture documents. Subscriptions or licenses shall also be annulled. Under this phase the following activities are considered: • Cost optimization, performance and right-sizing (FinOps) • Monitoring and alerting setup • Old infrastructure decommissioning • Staff training and knowledge transfer The main challenges include the decommissioning of the source before the rollback window expires risking permanent data loss as well as the engineers who led the porting moving on before the documentation is comple te. The outcome of this phase is an application that is operational. Phase 8 – Operation of the cloud service (recurring adjustment); This phase includes the operation of the service, including observability, performance optimization, FinOps, continuous vu lnerability assessment, and maintenance of a functional application (e.g. correction of bugs but also new features being deployed). 229 12.4 Aspects considered for the analysis of costs Since not all use cases have the same complexity, for this impact analysis three types of applications are assumed: small, mid -sized, large, as described below. The criterion are industry standard values and were cross referenced with confidential sources: Table 66. Application taxonomy used for this impact analysis Criterion Small application Mid-size application Large application Code base <10k lines, n -tier (cloud-aware), small number of microservices (cloud-native) 10k – 100k lines, 10 – 20 microservices >100k lines, > 20 microservices or smaller in number but complex microservices Data volume < 100 GB 100 GB – 10 TB 10 TB – PB Third party dependencies Few (1-3) Moderate (5 – 15) High (>20 or tightly coupled) Users < 500 users / < 50 concurrent 500 – 10,000 users / 50 – 500 concurrent > 10,000 users / > 500 concurrent Team size Small Medium Large Typical Estimated Timeline 1 – 3 months 3 - 9 months > 9 months Example application Internal tool / Small application Departmental Heavy stakeholder based, such as healthcare applications As noted above, reliable data on the cost of porting or migrating an application between cloud providers is scarce. This scarcity is structural rather than incidental: each porting project is inherently unique, shaped by how the application was originally architected, the technologies involved, the degree of vendor -specific coupling, and the accumulated technical debt. No two porting project present the same cost profile, which makes meaningful generalisation difficult and explains why the literature has not converged on robust benchmarks. The estimates presented in this section represent a best-effort attempt to triangulate and structurally aggregate the limited sources available reporting costs 215. 215 Cloud migration cost calculator provides a calculator to calculate where the user can insert the type of migration he is targeting (public to public, public to private and to which of the large three hyperscalers, the criticality of the application, the workload size, the data migration size, the migration strategy – rehost, replatform, refactor and other aspects such as observability, landing zone, security hardening, DevOps pipelines, and team training). Cloud Migration Cost Analysis: Lift-and-Shift vs. Refactoring; Software Modernization Costs provides empirical benchmarks from 200+ real-world cloud -to-cloud migration projects out which 35 have reported cost data . This source reports single -point median figures per strategy at enterprise scale, without any distinction per application size Cloudaware: Cloud Migration 230 These sources follow different methodologies – application size count mapping, server of VM count mapping, porting strategy per application type and empirical benchmarks from real world cloud-to-sovereign cloud porting projects and show certain bias as they are companies that offer porting services. Under these considerations, the structured aggregated ranges of costs for porting applications , irrespectively of rehosting, re - platforming or refactoring due to the lack of disaggregated data , can be considered as follows: - Small application: EUR 20 000 – EUR 300 000 - Mid-sized application: EUR 100 000 – EUR 500 000 - Large application: > EUR 500 000 Hence, t hey should be read as informed approximations rather than precise figures. However, t hese have been cross-checked with confidential information on past and existing re-platform porting projects in the public sector. The baseline used are as follows: porting a small workload is estimated at a value of EUR 20 000 - 50 000, a mid -size application as of around EUR 200 000 while the porting of large application is estimated to cost around EUR 500 000. In terms of effort, confidential sources report that the porting of a large application has been estimated in 1 000 activity days , which has been taken as benchmark. In this case, this application will not only be moved to another cloud service but will also undergo an adaptation of some of the technologies used such as changing the proprietary web server and data bases for an open source alternative . This is also the plausible scenario selected for the modelling for this impact assessment, given that it is the go-to scenario in the majority of the cases. There is a rationale behind the distinction of sizes of applications. The cost gap between migrating small and large applications is not only just about volume but largely about dependency and architecture complexity. A factor often underestimated in small applications is the refactoring: the code may be small but poorly documented, with a high technical debt. In mid-sized and large applications, the challenge primarily remains in the integration points (e.g. APIs, databases), which are the main cost drivers and dominate the complexity. Tightly coupled applications, or a bad designed microservices architecture along with a lack of or a bad organizational change management process can outrun the technical costs estimate. The underlying assumptions for the quantification of the costs are detailed next. • The modelling accounts for the porting of an application deployed on a VM (IaaS to IaaS) , but not from PaaS to PaaS or from SaaS to SaaS . While most of the activities may be similar, less literature resources exist in this regard, rendering the estimations highly complicated and uncertain. • The modelling measures the porting costs of moving from a public cloud to a sovereign cloud with sovereignty level 2 – 4. The baseline used for the public Costs in 2026: Complete Guide to Savings, Benefits & Enterprise Planning uses server or virtual machine count rather than application count as the primary sizing unit, which reflects an infrastructure -first (IaaS) perspective well-suited to compute-migration analysis.; Cloud Migration Cost Analysis: Rehost vs . Refactor provides a representative numerical case drawn from their own company, Opsio, which implements migration projects. 231 cloud is AWS eu-central (Frankfurt) and used the prices provided by the calculator available online at the provider ’s site (more details on the instance types selected and their associated costs below) , with a +5% price premium. Sensitivity analysis is +12%, -10%216. • The values for the costs are calculated considering a manual porting process following the traditional software engineering process, as, even if limited, there exist some literature sources in this regard. However, part of this porting could be performed using AI automatic code generation, Agentic AI 217 218 219 or low-code- no-code platforms220 that could have an impact on the costs. However, given the novelty of this technique and its incipient use there is, for the time being, scarce literature sources on the costs and on its results in terms of benefits and quality of the source code generated221. • The number of affected public essential entities under NIS2 Annex 1 equals to 6 400. However, not all essential entities make a similar use of cloud services. To respond to this situation, the number of essential public entities has been stratified, as depicted next: o High-intensive users of cloud services: under this cate gory fall national administrations that make an important use of cloud services either because they have a large proportion of applications on the cloud (both cloud-aware and cloud-native) or the number of services that are deployed on the cloud are low but make a high intense use of cloud services. An example of this could be the national tax services. Based on empirical observations on how the EU public sector is structured, the proportion of this type of users is considered as 20%. o Medium intensive users of cloud services , which include systems from national ministries that are less intensive in terms of cloud usage and some regional authorities / federal authorities that cover for instance healthcare, or tax services (e.g. Autonomous regions of Spain) . B ased on empirical 216 This range is explained in section 2.3.4 of the main document. 217 Agentic AI is an autonomous system that leverages from specialized AI agents to analyse, refactor, transform, and validate legacy codebases with minimal human intervention. Traditional code generation tools often only suggested snippets of code or the structure of the application, whereas agentic AI promises to manage independently the entire end- to-end migration process, including the decomposition of a monolithic application to migrating to the new language and platform maintaining the full functionality 218 See IBM, Reimagining the application migration and modernization value-chain: The agentic way 219 Bandi, A., Kongari, B., Naguru, R., Pasnoor, S., & Vilipala, S. V. (2025). The Rise of Agentic AI: A Review of Definitions, Frameworks, Architectures, Applications, Evaluation Metrics, and Challenges. Future Internet, 17(9), 404. https://doi.org/10.3390/fi17090404 220 Low code platforms is a software development environment that allows for the development of applications using visual, drag-and-drop interfaces instead of extensive manual coding , leveraging from model-driven design (MDD) and pre-built components. No code platforms follow the same approach as low code platforms but in this case, there is no need to write any line of code. While often used together, low code allows for the inclusion of custom code, whereas no code is more restrictive and focused on non-technical users. Source: IBM 221 Wang, H., Gong, J., Zhang, H., Xu, J., & Wang, Z. (2025). Ai agentic programming: A survey of techniques, challenges, and opportunities. arXiv preprint arXiv:2508.11126. 232 observations on how the EU public sector is structured, the proportion of this type of users is considered as 40%. o Low-intensive users of cloud services, upon which national ministries with transactional digital public services are includ ed and regional public administrations. It is to be clarified that while the entities that manage water are considered essential services, they are mostly at municipal level, which help reduce the scope. Based on empirical observations on how the EU public sector is structured, the proportion of this type of users is considered as 40%. • The usage of cloud services has been stratified as per the values above. • Based on discussions with three distinct sets of public stakeholders that represent ~200 public authorities, the essential entities are considered to have each 1 200 IT services, where 30% of the services are already cloudified and would be effect of a cloud-to-cloud porting, 30% are on-premises and will be cloudified, and 40% should remain on premise (e.g. legacy systems that are being phased out, very small IT services). • Based on the discussions mentioned above, the distribution of sovereignty needs resulting from the risk assessment across the public sector are Level 1: 70%, Level 2: 20%, Level 3: 9%, Level 4: 1%. • The effort to migrate a legacy-to-cloud application is estimated to be 1.5x the effort estimated to port a service from cloud-to-cloud, taking as baseline the comparison shown in previous sections. • The ratio of appl ications in terms of size and types of cloud intensity users is stratified as shown next. The proportion of small, mid -size and large applications in the case of high-intensive users of cloud services has been obtained from the experience of confidential sources. For medium and low intensive users of cloud services, the values are estimated, taking as anchor value the potential proportion of large applications that there could be in each type of entity. Table 67. Distribution of types of users of cloud services in public essential entities operating under NIS2 Annex I (Source: European Commission) Small App. Mid-size App. Large App. Total High intensive users of cloud services 50% 45% 5% 100% Medium intensive users of cloud services 60% 37% 3% 100% Low intensive users of cloud services 70% 29% 1% 100% 233 • Labour costs are considered as average costs of EUR 75 / h, irrespective of their profile (cloud architect, developer, DevOps engineer, project manager or external consultant). These costs are higher than the ones considered in the rest of the impact assessment, given the large number of profiles participating in a porting of an application. • Out of the three approaches presented beforehand , the ‘ re-platform’ option has been selected, as being the most plausible one, since it combines porting the application as-is, creating cloud -agnostic components that can facilitate a future porting to another service provider and other common activities such as some adaptations some of the used technologies or a small refactoring of the code. • For the calculations o n the pricing of VMs and storage , comparing sovereign solutions level 2 and sovereign solutions level 3 / 4, internal knowledge has been considered, complemented with desk research data that report, through use cases and empirical analysis, similar prices for computation resources ( VM, sto rage, network)222 223. • Switching charges are considered to be null, as an effect of the Data Act. • For each of the application sizes, the following number of VMs and sizes are considered. Pricing is based on AWS EC2 on -demand rates in eu -central (Frankfurt) in USD (1 USD rounded to 0.9 for EUR for the conversion), and dedicated instances (Prices of March 2026). The rationale for the decision of the instance types is provided next. o T-series such as t3 are burstable instances, which provide a basel ine level of CPU and can burst above when needed. They are recommended for workloads with variable CPU usage such as small web servers or microservices that mostly idle but have occasional spikes. o M5-series are often used as the default instance type for applications that need consistent CPU performance and that do not fit into compute or memory-optimized type of applications. M5 instances are balanced CPU and memory instances , designed for midsize databases and back -end applications. M-instance types are at the crossroads of T (general purpose), C (compute-optimized) and R (memory-optimized) instance types in terms of compute and memory allocation. Both T and M instance types are considered General Compute. Table 68. Types of VMs considered for the cost estimations for small, mid -size and large applications (Source: European Commission based on AWS Calculator, March 2026) 222 See for example this reported experiences https://european.cloud/2025/06/a-basic-look-at-pricing-of-european-cloud- vendors/ , https://www.dataminded.com/resources/cloud-independence-testing-a-european-cloud-provider-against-the- giants, https://www.fromeuropewithlove.eu/en/blog/european-cloud-providers-vs-aws-comparison-2026 223 BCG 234 Parameter Small Mid-Size Large Baseline metric Instance Type t3.large m5.xlarge m5.8xlarge AWS EC2, Dedicated instance, EBS gp3, eu- central (Frankfurt) VM Count 1–3 3–5 5-10 VMs per app vCPU 2 4 32 cores RAM 4 16 64 GB Network bandwidth Up to 5 Up to 5 Up to 25 Gbps Price 0.12 0.39 3.09 EUR/h As anticipated above, across all, labour costs represent the largest component irrespective of it being legacy-to-cloud or cloud-to-sovereign cloud, and in all phases. The calculation of the labour effort stem from the few available sources and estimations provided in confidence by experience d personnel of the public sector who have tackled complex porting projects. Table 69. Estimation of effort incurred in a porting, cloud-to-sovereign cloud, broken down in phases (central values) Porting phases Sovereign Cloud Small application (hours) Mid-size application (hours) Large application (hours) Phase 1 – Feasibility assessment 40 290 470 Phase 2 – Strategy and planning 75 470 1,060 Phase 3 – Target environment set up 28 205 540 Phase 4 – Porting 173 1,496 3,860 Phase 5 – Testing and validation 64 640 1,200 Phase 6 - Cutover and Switching 16 128 410 Phase 7 – Post – porting and decommission 12 108 460 Total one-off effort (hours) 408 3,337 8,000 As mentioned above, the effort for legacy -to-cloud migration is 1.5x the effort shown above. The min-max values considered, and their explanation are as follows: Table 70. Estimation of effort incurred in a migration, min-max values Migration phases Sovereign Cloud Small application (hours) [min value, max value] Mid-size application (hours) [min value, max value] Large application (hours) [min value, max value] Rationale Phase 1 – Feasibility assessment [26, 54] [180, 400] [300, 640] Given the importance of all the activities under this 235 Migration phases Sovereign Cloud Small application (hours) [min value, max value] Mid-size application (hours) [min value, max value] Large application (hours) [min value, max value] Rationale phase, experience demonstrates that a good understanding of the application (assets, dependencies, licenses) are equal and their effort varied. Phase 2 – Strategy and planning [50, 100] [332, 608] [760, 1360] While all values are increased, the main driver for this change is the cloud architecture design. This is a critical activity that, if not performed properly, can result in over- costs in the migration and operation phase, as it can cause over costs. Phase 3 – Target environment set up [18, 38] [138, 272] [380, 700] VM provisioning and configuration is the main effort intense activity in this phase. Configuring the security policies or the computation resources in an incorrect way can result in cost inefficiencies. A common error in this phase is to over- provision capacity to be able to respond to potential load spikes. Phase 4 – Migration [110, 236] [860, 2 132] [2 200, 5 520] The main drivers in this phase are the migration of the data and the adaptation of the application. The success of these activities largely depends on the previous activities 236 Migration phases Sovereign Cloud Small application (hours) [min value, max value] Mid-size application (hours) [min value, max value] Large application (hours) [min value, max value] Rationale such as the dependency assessment or the cloud architecture design and service mapping. Moreover, the skills of the team and the wave plan have also a large effect in the effort needed for the migration of the code. Phase 5 – Testing and validation [42,87] [440, 840] [700, 1 700] All testing activities considered (functional, integration and performance) are driving the min – max values in this phase. The decision of the coverage of the tests plays an important role. A low coverage testing will result in more bugs during production. Correcting errors during production are much more costly and can have further implications if an efficient CI/CD pipeline has not been well implemented. Phase 6 - Cutover and Switching [10, 22] [90, 166] [280, 540] The variation mainly stems from the final data migration and the process of going into production. Phase 7 – Post – migration and decommission [8, 16] [68, 148] [280, 640] Under this phase, the most important activities that drive the increment are setting up the observability mechanisms, the 237 Migration phases Sovereign Cloud Small application (hours) [min value, max value] Mid-size application (hours) [min value, max value] Large application (hours) [min value, max value] Rationale decommissioning of the infrastructure and verifying that everything was correct, and the training of the staff that will be operating the application. Total one-off effort (hours) [264 - 553] [2 108 – 4 566] [4 900– 11 100] The remaining costs of a migration / porting span infrastructure (VM), tooling licenses, and the cost of parallel running both environments during transition. The table below shows the values considered for the min-max approach. Table 71. Estimation of VMs in the different migration phases (min, max, central values) Phase Small Mid-sized Large P3 - Target Environment Setup VM provisioning: ranges between 3 and 6 days [only working hours in 3 weeks] VM provisioning: ranges between 6 and 9 days [only working hours in 3 weeks] VM provisioning: ranges between ranges between 9 and 12 days [only working hours in 3 weeks] P4 - Migration VM / server image replication: ranges between 3 and 6 days [only working hours in 3 weeks] Parallel infrastructure (dual- run): ranges between 8 and 16 days [only working hours in 8 weeks] VM / server image replication: ranges between 6 and 9 days [only working hours in 3 weeks] Parallel infrastructure (dual-run): ranges between 16 and 2 4 days [only working hours in 8 weeks] VM / server image replication: ranges between 9 and 12 days [only working hours in 3 weeks] Parallel infrastructure (dual - run): ranges between 16 and 24 days [only working hours in 8 weeks] 238 Phase Small Mid-sized Large P6 - Cutover and Switching Go live activity: given the criticality of this activity, no ranges are considered. Duration 2 weeks, 24/7 Go live activity: given the criticality of this activity, no ranges are considered. Duration 2 weeks, 24/7 Go live activity: given the cr iticality of this activity, no ranges are considered. Duration 2 weeks, 24/7 P7 - Post- Migration Optimization: given the criticality of this activity, no ranges are considered. Duration 2 weeks, 24/7 Optimization: given the criticality of this activity, n o ranges are considered. Duration 4 weeks, 24/7 Optimization: given the criticality of this activity, no ranges are considered. Duration 4 weeks, 24/7 One-off adjustment costs for the porting and migration of cloud services (legacy-to- cloud, cloud-to-cloud) incurred by public essential entities listed under NIS2 Annex I Based on the consideration above, namely: • 6 400 entities, classified in high-intensive users, medium intensive users, and low intensive users of cloud services, distributed as explain above. • 1 200 IT services are considered, where 30% of the services are already cloudified and would be subject to a cloud-to-cloud migration, 30% are on-premises and will be cloudified, and 40% should remain on premise (e.g. legacy systems that are being phased out, very small IT services). • Three types of IT services depending on the size and complexity, small, mid-sized and large, distributed as explained previously. • Based on the discussions mentioned above, the distribution of so vereignty needs resulting from the risk assessment across the public sector are Level 1: 70%, Level 2: 20%, Level 3: 9%, Level 4: 1%. • The effort to migrate legacy-to-cloud is 1.5x bigger than porting cloud-to-cloud. The total estimated costs of porting cloud – to – cloud for different sovereignty levels (1- 4, 2-4) is shown in the table below. For sensitivity purposes, a baseline for the price markup of sovereign services over current cloud offerings has been set in +5% and a range from + 12% to -10% is considered224. 224 Rationale for the range is described in section 2.3.4. of the main document. 239 Table . Cloud-to-sovereign cloud porting costs (m EUR) of the IT systems of NIS 2 public essential entities for different price markups and sovereign assurance levels (Sovereignty Assurance Level (SAL) 1-4, SAL 2-4) IT system SAL Max (+12%) Base (+5%) Min (-10%) SAL 1-4 288,423 287,629 285,158 SAL 2-4 86,527 86,289 85,547 As shown in the tables above, the price markup of sovereign solutions does not influence significantly the cost of porting or migration as most of this cost comes from the human effort to run that activity.The central EUR 86. 3 bn figures should be regarded as a maximalist estimate of the potential cost of porting applications to sovereign cloud services on levels 2-4 across around 6 400 public entities. This estimate assumes that 30% of the cloudified solutions of these entities, all those requiring sovereignty assurance levels 2 to 4, would be subject to porting because of the intervention. Moreover, this estimate corresponds to a “big bang” implementation scenario, whereby all 6 400 entities would undertake the porting activities in the first year. In practice, this scenario is unlikely to reflect the actual phases of implem entation, as the porting process would typically be expected to occur progressively over a longer period, possibly extending up to five years. Finally, this cost estimate cannot be fully attributed to the policy intervention itself. A significant share of this porting would likely arise anyway as a result of natural procurement decisions taken by public authorities over time, including routine renewal , replacement or migration of cloud services. Treating this full amount as an incremental cost of the intervention therefore overstates its direct impact. Accordingly, under PO2 -C, a more proportionate estimate has been considered. While remaining conservative, as it continues to include 6 400 entities for potential porting costs, it considers only a subset of critical applications for which porting to cloud services with sovereign levels 3-4 could be directly accelerated by the policy intervention. This would correspond to an anticipated range of 1% of applications in the minimum scenario (that considers porting of all SAL4-demanding applications) up to 6% in the maximum scenario (including also the porting of a good part of SAL3 -demanding services), ported over 3 years. On this basis, the estimated cost under this option would amount to approximately EUR 2.5bn in the minimum scenario and EUR 14.8 bn in the maximum scenario. These figures are calculated as the sum of discounted values over a three -year period, following a natural progressive migration approach, starting in 2030 and using 2025 as the baseline year. Under PO2-B, the measures are not mandatory and would thus be expected to apply to a smaller number of public authorities. For this option, the relevant number of entities is assumed to be around 1 600 public authorities, i.e. 25% of the ones considered under PO2- C. As a result, the associated porting costs are assumed to decrease proportionally to 25% of the PO2-C estimates, amounting to around EUR 6 20 m in the minimum scenario and EUR 3.7 bn in the maximum scenario. Recurring operating costs 240 Operating a cloud service requires a continuous monitoring and optimization . Under this impact assessment and in line with industrial practices, operating an IT system on the cloud involves also the release of new features. Some of the main activities under the operation phase include r elease engineering, infrastructure provisioning, and observability , with each one generating their own expenses, even if they all are highly interdependent. Release pipelines offer the earliest opportunity for cost control. Every execution consumes ephemeral compute and produces artifact storage, which means that improvements to build reliability and release validation compound in quick manner. Organizations that invest in release discipline by reducing failure rates, tightening validation gates, and minimizing rollbacks, consistently achieve lower pipeline costs than those running at higher deployment velocity without equivalent quality controls. The returns are direct and measurable. Infrastructure provisioning, typically the largest cost category, responds well to deliberate management. Virtual machines can be right sized to match actual utilization patterns, eliminating the idle compute overhead that accumulates when capacity is provisioned conservatively. Monitoring agents while often overlooked, are similarly important to rationalization. They allow to reduce the overhead per-host that otherwise would scale independently of the application workload. regardless of application load. Organizations that treat infrastructure sizing as an ongoing practice rather than a one time decision tend to maintain materially lower baseline costs. The estimated effort in hours for operating a cloud service, considering also the addition of new features and continuous optimization, per type of application is shown in the next table. This estimation is based on experiences from industry experts. Table . Estimated effort to operate and maintain a cloud service (hours) Migration phases Sovereign Cloud Small app Mid-size app Large app Phase 8 - Operation 968 4.840 6.600 12.5 Limitations of the analysis The cost model presented in this analysis carries several important limitations that must be acknowledged when interpreting its outputs. First, labour rates are modelled as a static band (EUR 75/hr) that does not account for overtime, or additional consultant charges. Second, VM configurations are drawn from tier averages rather than empirically measured utilization profiles, which is the proper way of estimating the sizes, introducing upward bias notably in the infrastructure costs assumed for Phase 3 and Phase 4 through implicit over-provisioning, reflected in the VMs chosen. Third, all infrastructure pricing uses AWS public cloud on-demand rates as a baseline . On-demand instances are on the costly end. Fourth, the two -month parallel infrastructure (dual -run) window in Phase 4 is fixed to several days a week for a longer period of time. This is however one of the riskiest phases that would need to be estimated proportionately and accurately on a case -by-case basis. However, while fixed to several days , these have been estimated considering industry’s 241 best practices. Finally, the cost ranges are based on benchmarks that present total costs of migration, aggregating labour, infrastructure, training, and tooling licensing. Again, this is largely dependent on the as-is situation and the to-be situation. 242 ANNEX 13. COMPARATIVE ANALYSIS OF SELECTED CLOUD SERVICES European cloud providers offer far narrower service catalogues than US hyperscalers: AWS alone spans over 200 distinct services. Yet this gap is less consequential than it appears. The latest Eurostat data for 2025 shows that the services EU enterprises ac tually rely on most are email, office software , file storage , database hosting, and compute power225, which are primarily IaaS and SaaS. Compute power, hosting, file storage and database are the basis for core IaaS workloads: virtual machines, managed datab ases, storage, and nowadays also PaaS, where managed Kubernetes (orchestration) are robustly available across European providers. Email and Office software are SaaS. Given the heterogeneity of SaaS, which is much larger than in IaaS and PaaS , and where eac h application on the web could be called, even if in simplistic terms, software as a service , renders the comparison between US and EU providers, albeit a few exceptions, much more difficult. However, the real gaps are narrower and more specific that it can be initially thought . These include mainly native AI/ML platforms, serverless, and integrated analytics pipelines as they remain areas where European providers have not yet reached hyperscaler maturity but are working towards it . For t he standard private and public sector workloads constituting nowadays the majority of cloud adoption needs, the European providers represent already a fully viable, equivalent in performance, functionalities and quality. The tables below show that major European cloud providers, for the purpose of this analysis, IONOS, OVHcloud, and STACKIT, already offer services broadly equivalent to those of AWS, Microsoft Azure, and Google Cloud Platform across the core infrastructure categories that are most widely used: compute, storage, network, and managed container orchestration. The comparison has been extended to offi ce automation suites, one of the most widely adopted SaaS categories in the public sector, where credible European and open-source alternatives are also available. OVHcloud's226 portfolio spans across compute, storage, networking, container orchestration, databases, analytics, and AI/ML services. IONOS227 mainly covers storage, compute, managed container orchestration, databases, and observability. STACKIT's 228 catalogue includes compute, databases, observability and logging, and security services. Taken together, these providers cover the functional surface that the majority of the private and public sector workloads actually require. The comparisons shown below demonstrate that EU providers already offer the most used services and with a similar level of func tionality. The first table aims to provide a high- level overview of the main cloud services used in the Union and their coverage by EU providers compared to non -EU incumbents. In the public sector, interviews have shown 225 See Eurostat 226 OVH 227 Ionos 228 Stackit 243 that most public administrations use an average of twenty services , instead of the whole range offered by hyperscalers. Table 74. High level overview of cloud services and their coverage by EU providers Service Type Layer Coverage by EU providers Virtual Machines / Compute IaaS Full Object Storage (S3 compatibility) IaaS Full Block Storage IaaS Full Managed Load Balancer IaaS/Network Full VPC / Private Networking IaaS/Network Full CDN IaaS/Network Partial Managed containers / containers (Container as a Service - CaaS) PaaS Full Managed PostgreSQL/MySQL PaaS Full Managed NoSQL / MongoDB PaaS Full Managed Kafka / Streaming PaaS Full Serverless Functions (FaaS) PaaS Partial Serverless Containers PaaS Partial AI/ML Training Platforms PaaS Partial Managed AI Inference PaaS Partial ERP SaaS Full Office automation / Collaboration / Messaging SaaS Full The second set of tables provide a much more granular analysis comparing per feature five of the widest adopted services: compute, storage, network, managed containers and office automation tools. A sample of EU providers have been selected to demonstrate that, also when analysing per functionality, European providers’ offerings are equivalent to those provided by non-EU incumbents. This analysis is based on desktop research, more specifically, through a manual review of each provider's official user guides, technical documentation, and online manuals. Where a service appeared to fulfil the same functionality as its counterpart, but the documentation did not allow for an unambiguous confirmation, the mapping has been marked as partial rather than full. This conservative approach reflects an inherent limitation of the methodology: the analysis is theoretical in nature, derived from published specifications rather than from hands-on testing or validated benchmarking. Table 75. Comparative table compute (selected sample of providers) Functionality AWS EC2 Google Compute Azure Compute OVH Compute IONOS Compute StackIt Compute General purpose VMs ✓ ✓ ✓ ✓ ✓ ✓ 244 Functionality AWS EC2 Google Compute Azure Compute OVH Compute IONOS Compute StackIt Compute Compute- optimized ✓ ✓ ✓ ✓ ✓ ~ Memory- optimized ✓ ✓ ✓ ✓ ✓ ~ Bare metal instances ✓ ✓ ✓ ✓ ✓ (Dedicated servers) ✕ Custom vCPU / RAM ratio ~ ✓ ~ ~ ~ (flexible within tiers) ~ (fixed ratios) Reserved instances ✓ ✓ ✓ ✓ ✓ ✕ Confidential compute ✓ ✓ ✓ ~ ✕ ✓ Legend: ✓ Supported ~ Partial / limited ✕ Not available Table 76. Comparative table Storage (selected sample of providers) Functionality AWS Google Azure OVH IONOS StackIt Block storage (persistent disks) ✓ ✓ ✓ ✓ ✓ ✓ Object storage integration ✓ ✓ ✓ ✓ ✓ ✓ Shared / NFS file storage ✓ ✓ ✓ ~ ~ ~ Snapshot & image management ✓ ✓ ✓ ✓ ✓ ✓ Multi-zone disk replication ✓ ✓ ✓ ~ ~ ~ Encrypted storage at rest ✓ ✓ ✓ ✓ ✓ ✓ Legend: ✓ Supported ~ Partial / limited ✕ Not available Table 77. Comparative table Network (selected sample of providers) Functionality AWS Google Azure OVH IONOS StackIt Virtual private network (VPC) ✓ ✓ ✓ ✓ ✓ ✓ IPv6 support ✓ ✓ ✓ ✓ ✓ ✓ Load balancer (managed) ✓ ✓ ✓ ✓ ✓ ✓ CDN ✓ ✓ ~ ✓ ✓ ✓ Private interconnect / VPN ✓ ✓ ✓ ✓ ✓ ~ 245 Functionality AWS Google Azure OVH IONOS StackIt DNS service (managed) ✓ ✓ ✓ ✓ ✓ ✓ DDoS protection (built-in) ✓ ✓ ✓ ✓ ✓ ✓ Floating / elastic IPs ✓ ✓ ✓ ✓ ✓ ✓ Legend: ✓ Supported ~ Partial / limited ✕ Not available Table 78. Comparative table Containers (selected sample of providers) Functionality AWS (ECS/EKS/Fargate) Google (GKE/Cloud Run) Azure (AKS / ACI) OVH (MKS) IONOS (Managed Kubernetes) StackIt (SKE) Managed Kubernetes service ✓ ✓ ✓ ✓ ✓ ✓ Serverless / managed container service (non-K8s) ✓ ✓ ✓ ✕ ✕ ✕ CNCF certified Kubernetes ✓ ✓ ✓ ✓ ✓ ✓ Vanilla / upstream Kubernetes ~ ✓ ~ ✓ ✓ ✓ Latest K8s version availability speed ~ ✓ ~ ✓ ~ ~ Extended version support (LTS) ✓ ✓ ✓ ~ ✕ ✕ Managed / free control plane ~ ✓ ✓ ✓ ✓ ✓ High-availability control plane ✓ ✓ ✓ ✓ ✓ ✓ Multi-AZ control plane ✓ ✓ ✓ ✓ ~ ~ Dedicated control plane (isolated) ✓ ✓ ✓ ✓ ~ ~ Automatic control plane upgrades ✓ ✓ ✓ ✓ ✓ ✓ Private (API server not public) ✓ ✓ ✓ ✓ ✓ ✓ Cluster self-repair / auto-healing ✓ ✓ ✓ ✓ ✓ ✓ Multiple clusters per project ✓ ✓ ✓ ✓ ✓ ✓ 246 Functionality AWS (ECS/EKS/Fargate) Google (GKE/Cloud Run) Azure (AKS / ACI) OVH (MKS) IONOS (Managed Kubernetes) StackIt (SKE) Multiple node pools per cluster ✓ ✓ ✓ ✓ ✓ ✓ Custom node pool sizing (CPU/RAM) ✓ ✓ ✓ ✓ ✓ ✓ GPU node pools ✓ ✓ ✓ ✓ ✓ ✕ Spot / preemptible node pools ✓ ✓ ✓ ✓ ~ ✕ Node auto-repair ✓ ✓ ✓ ✓ ✓ ✓ Automatic node OS upgrades ✓ ✓ ✓ ✓ ✓ ✓ Bare metal worker nodes ✓ ✓ ✓ ✓ ✕ ✕ Cluster / node autoscaler ✓ ✓ ✓ ✓ ✓ ✓ Horizontal Pod Autoscaler (HPA) ✓ ✓ ✓ ✓ ✓ ✓ Vertical Pod Autoscaler (VPA) ✓ ✓ ✓ ~ ~ ~ Event-driven autoscaling (KEDA) ✓ ✓ ✓ ~ ~ ~ Autopilot / serverless node provisioning ~ ✓ ~ ✕ ✕ ✕ Scale-to-zero / scheduled shutdown ✓ ✓ ✓ ~ ~ ✓ VPC / private network integration ✓ ✓ ✓ ✓ ✓ ✓ Managed load balancer (ingress) ✓ ✓ ✓ ✓ ✓ ✓ Network policies (CNI) ✓ ✓ ✓ ✓ ✓ ✓ Cilium CNI support ✓ ✓ ✓ ✓ ✕ ✕ Service mesh integration (Istio/Linkerd) ✓ ✓ ✓ ~ ~ ~ IPv6 cluster support ✓ ✓ ✓ ✓ ~ ~ 247 Functionality AWS (ECS/EKS/Fargate) Google (GKE/Cloud Run) Azure (AKS / ACI) OVH (MKS) IONOS (Managed Kubernetes) StackIt (SKE) Ingress / Gateway API support ✓ ✓ ✓ ✓ ~ ~ Private nodes (no public IPs) ✓ ✓ ✓ ✓ ✓ ✓ Persistent volumes (block storage) ✓ ✓ ✓ ✓ ✓ ✓ ReadWriteMany (RWX) volumes ✓ ✓ ✓ ~ ~ ~ Managed NFS / file storage ✓ ✓ ✓ ✓ ~ ~ Dynamic volume provisioning ✓ ✓ ✓ ✓ ✓ ✓ Encrypted storage at rest ✓ ✓ ✓ ✓ ✓ ✓ Volume snapshots ✓ ✓ ✓ ~ ~ ~ Managed private container registry ✓ ✓ ✓ ✓ ✓ ✓ OCI & Helm artifact support ✓ ✓ ✓ ✓ ✓ ✓ Image vulnerability scanning ✓ ✓ ✓ ✓ ~ ~ Geo-replication of registry ✓ ✓ ✓ ~ ✕ ✕ Registry integrated with K8s cluster ✓ ✓ ✓ ✓ ✓ ✓ RBAC (role - based access control) ✓ ✓ ✓ ✓ ✓ ✓ OIDC / SSO authentication ✓ ✓ ✓ ✓ ~ ~ Pod Security Standards (PSS) ✓ ✓ ✓ ✓ ✓ ✓ Secrets management (KMS integrated) ✓ ✓ ✓ ~ ~ ~ Network policy enforcement ✓ ✓ ✓ ✓ ✓ ✓ Image signing / admission control ✓ ✓ ✓ ~ ~ ~ 248 Functionality AWS (ECS/EKS/Fargate) Google (GKE/Cloud Run) Azure (AKS / ACI) OVH (MKS) IONOS (Managed Kubernetes) StackIt (SKE) Confidential Kubernetes / TEE nodes ✓ ✓ ✓ ~ ✕ ✓ Audit logging ✓ ✓ ✓ ✓ ~ ~ Built-in monitoring (metrics) ✓ ✓ ✓ ~ ~ ~ Built-in logging ✓ ✓ ✓ ~ ~ ~ Prometheus / Grafana integration ✓ ✓ ✓ ✓ ✓ ✓ Alerting & dashboards ✓ ✓ ✓ ~ ~ ~ kubectl / API access ✓ ✓ ✓ ✓ ✓ ✓ Terraform / IaC support ✓ ✓ ✓ ✓ ✓ ✓ GitOps / ArgoCD support ✓ ✓ ✓ ✓ ~ ~ CLI tooling ✓ ✓ ✓ ✓ ✓ ✓ Native CI/CD pipeline integration ✓ ✓ ✓ ~ ~ ~ PaaS / Cloud Foundry layer ✕ ✕ ✕ ✕ ✕ ✓ Multi-cluster management console ✓ ✓ ✓ ✓ ✓ ✓ Legend: ✓ Supported ~ Partial / limited ✕ Not available Table 79. Comparative table Office automation tools (selected marek of providers) Functionali ty Microsof t 365 Google Workspa ce Nextclo ud + Collabo ra OnlyOffi ce CryptP ad Infomani ak kSuite LibreOff ice Open- Xchan ge US Propriet ary US Proprieta ry EU Open Source EU Open Source EU Open Source EU Proprieta ry EU Open Source EU Open Source DOCUMENT CREATION & WORD PROCESSING Word processor ✓ ✓ ✓ ✓ ✓ ✓ ✓ ✓ 249 Functionali ty Microsof t 365 Google Workspa ce Nextclo ud + Collabo ra OnlyOffi ce CryptP ad Infomani ak kSuite LibreOff ice Open- Xchan ge US Propriet ary US Proprieta ry EU Open Source EU Open Source EU Open Source EU Proprieta ry EU Open Source EU Open Source Advanced text formatting ✓ ~ ~ ~ ~ ~ ✓ ~ Desktop application (offline) ✓ ✕ ✕ ✓ ✕ ✕ ✓ ✕ Browser- based editing ✓ ✓ ✓ ✓ ✓ ✓ ✕ ✓ Mobile editing (iOS / Android) ✓ ✓ ✓ ~ ~ ✓ ✕ ~ Track changes / review mode ✓ ✓ ✓ ✓ ✕ ✓ ✓ ~ Templates library ✓ ✓ ~ ✓ ~ ~ ✓ ~ Mail merge ✓ ~ ~ ✓ ✕ ✕ ✓ ✕ Macro support (scripting) ✓ ~ ✕ ~ ✕ ✕ ✓ ✕ Digital signatures / e-signing ✓ ✓ ~ ~ ✕ ~ ✕ ~ SPREADSHEETS Spreadsheet editor ✓ ✓ ✓ ✓ ✓ ✓ ✓ ✓ Advanced formulas & functions ✓ ~ ~ ~ ~ ~ ✓ ~ Pivot tables ✓ ✓ ~ ✓ ✕ ~ ✓ ✕ Macros / VBA support ✓ ✕ ✕ ~ ✕ ✕ ✓ ✕ Charts & data visualizatio n ✓ ✓ ✓ ✓ ~ ~ ✓ ~ 250 Functionali ty Microsof t 365 Google Workspa ce Nextclo ud + Collabo ra OnlyOffi ce CryptP ad Infomani ak kSuite LibreOff ice Open- Xchan ge US Propriet ary US Proprieta ry EU Open Source EU Open Source EU Open Source EU Proprieta ry EU Open Source EU Open Source Data validation rules ✓ ✓ ~ ✓ ~ ~ ✓ ~ Conditional formatting ✓ ✓ ✓ ✓ ~ ~ ✓ ~ Large dataset performanc e ✓ ~ ~ ~ ✕ ~ ✓ ✕ Import/exp ort Excel (.xlsx) ✓ ✓ ✓ ✓ ~ ✓ ✓ ~ PRESENTATIONS Presentatio n editor ✓ ✓ ✓ ✓ ✓ ✓ ✓ ~ Slide templates & themes ✓ ✓ ~ ✓ ~ ~ ✓ ✕ Animations & transitions ✓ ~ ~ ✓ ~ ~ ✓ ✕ Presenter view ✓ ✓ ✓ ✓ ✕ ~ ✓ ✕ Live audience interaction ✓ ~ ✕ ✕ ✕ ✕ ✕ ✕ Export to PDF / video ✓ ✓ ✓ ✓ ~ ✓ ✓ ~ Embed media (audio/vide o) ✓ ~ ~ ✓ ✕ ~ ✓ ✕ PPTX import/expo rt fidelity ✓ ~ ~ ✓ ~ ✓ ~ ✕ REAL-TIME COLLABORATION Simultaneo us co - editing ✓ ✓ ✓ ✓ ✓ ✓ ✕ ✓ 251 Functionali ty Microsof t 365 Google Workspa ce Nextclo ud + Collabo ra OnlyOffi ce CryptP ad Infomani ak kSuite LibreOff ice Open- Xchan ge US Propriet ary US Proprieta ry EU Open Source EU Open Source EU Open Source EU Proprieta ry EU Open Source EU Open Source Live cursor / presence display ✓ ✓ ✓ ✓ ✓ ✓ ✕ ~ In- document comments & threads ✓ ✓ ✓ ✓ ✓ ✓ ✕ ~ Document version history ✓ ✓ ✓ ✓ ✓ ✓ ✕ ~ Suggesting / review mode ✓ ✓ ✓ ✓ ~ ✓ ✓ ~ Paragraph- locking (conflict free) ~ ✕ ✕ ✓ ✓ ✕ ✕ ✕ Link sharing (no- login editing) ✓ ✓ ~ ✓ ✓ ✓ ✕ ~ Guest / external collaborator s ✓ ✓ ✓ ✓ ✓ ✓ ✕ ✓ EMAIL & COMMUNICATION Email client / webmail ✓ ✓ ✕ ~ ✕ ✓ ✕ ✓ Calendar ✓ ✓ ✓ ~ ✕ ✓ ✕ ✓ Contacts / address book ✓ ✓ ✓ ~ ✕ ✓ ✕ ✓ Tasks / to - do managemen t ✓ ✓ ✓ ~ ✕ ✓ ✕ ✓ Team chat / messaging ✓ ✓ ✓ ~ ✓ ~ ✕ ~ Video conferencin g ✓ ✓ ✓ ✕ ✓ ✓ ✕ ~ 252 Functionali ty Microsof t 365 Google Workspa ce Nextclo ud + Collabo ra OnlyOffi ce CryptP ad Infomani ak kSuite LibreOff ice Open- Xchan ge US Propriet ary US Proprieta ry EU Open Source EU Open Source EU Open Source EU Proprieta ry EU Open Source EU Open Source Webinar / large meeting hosting ✓ ✓ ~ ✕ ✕ ~ ✕ ✕ Screen sharing ✓ ✓ ✓ ✕ ✓ ✓ ✕ ~ FILE STORAGE & MANAGEMENT Cloud file storage ✓ ✓ ✓ ✓ ✓ ✓ ✕ ✓ Desktop sync client ✓ ✓ ✓ ✓ ✕ ✓ ✕ ~ Offline file access ✓ ~ ✓ ✓ ✕ ~ ✓ ~ External file sharing links ✓ ✓ ✓ ✓ ✓ ✓ ✕ ✓ File versioning & restore ✓ ✓ ✓ ✓ ✓ ✓ ✕ ✓ Folder-level permissions ✓ ✓ ✓ ✓ ✓ ✓ ✕ ✓ Self-hosted / on - premise ✕ ✕ ✓ ✓ ✓ ✕ ✓ ✓ Included cloud storage (entry plan) 1TB 15GB Self- hosted 5GB 1GB 15GB Local Self- hosted AI & PRODUCTIVITY TOOLS Integrated AI writing assistant ✓ ✓ ~ ✓ ✕ ✕ ✕ ✕ AI email drafting / summarizat ion ✓ ✓ ✕ ✕ ✕ ✕ ✕ ✕ AI meeting notes / transcriptio n ✓ ✓ ✕ ✕ ✕ ✕ ✕ ✕ 253 Functionali ty Microsof t 365 Google Workspa ce Nextclo ud + Collabo ra OnlyOffi ce CryptP ad Infomani ak kSuite LibreOff ice Open- Xchan ge US Propriet ary US Proprieta ry EU Open Source EU Open Source EU Open Source EU Proprieta ry EU Open Source EU Open Source AI spreadsheet / formula help ✓ ✓ ✕ ~ ✕ ✕ ✕ ✕ No-code app builder ~ ✓ ✕ ✕ ✕ ✕ ✕ ✕ Workflow automation ✓ ✓ ~ ~ ✕ ~ ✕ ~ Forms / survey tool ✓ ✓ ✓ ✓ ✓ ~ ✕ ~ Whiteboard / drawing tool ✓ ✓ ✓ ✓ ✓ ~ ✕ ~ Notes / wiki tool ✓ ✓ ✓ ~ ~ ~ ✕ ~ Legend: ✓ Supported ~ Partial / limited ✕ Not available --- [Bilaga - Sammanfattning av konsekvensbedömningsrapport.pdf] EN EN EUROPEAN COMMISSION Brussels, 3.6.2026 SWD(2026) 503 final COMMISSION STAFF WORKING DOCUMENT EXECUTIVE SUMMARY OF THE IMPACT ASSESSMENT REPORT Accompanying the document Proposal for a REGULATION OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL establishing a framework of measures for strengthening Europe's cloud and AI ecosystem (Cloud and AI Development Act) {COM(2026) 502 final} - {SEC(2026) 502 final} - {SWD(2026) 502 final} 1 Identification of the problem and EU-level dimension Cloud computing and AI have become driving forces reshaping industry, public services, and daily life. They are powered by computing capacity located in data centres. The availability of computing capacity in the EU is limited and geographically concentrated, negatively affecting competitiveness. Moreover, the EU is dependent on cloud and AI computing servi ces supplied by non -European providers. This can result in risks of control over data and operational autonomy. The deployment of computing capacity in the EU i s currently characterised by national policies, leading to fragmentation. The dependence on non -European providers of cloud and AI computing services has the same root causes across the EU, affecting the public and private sector in all Member States. Aim of the initiative The Cloud and AI Development Act (CADA) aims to ensure the functioning of the internal market for cloud and AI computing services and to secure the conditions necessary for the Union’s competitiveness and strategic autonomy. It sets out to: • Increase computing capacity deployed in the EU through innovative and sus tainable technologies • Ensure attractive conditions for such deployment • Reducing the overall reliance on non-sovereign cloud and AI computing services • Contribute to the protection of public order by enhancing the resilience of supply of cloud and AI computing services, in particular in the public sector Value added at EU-level To boost computing capacity, an EU-level action provides a common approach enabling coherent planning and deployment of capacity in a geographically balanced way, while avoiding a race to the bottom and making the regulatory environment clearer for relevant businesses. To reduce the dependence on services supplied by non -European providers, EU- level action delivers benefits beyond what Member States can achieve individually by pooling resources and creating economies of scale. It also strengthens the Union's strategic autonomy of digital infrastructures, safeguarding digital sovereignty a gainst risks related to the use of non -sovereign services and external dependencies. By fostering a robust internal market for cloud and AI computing services, the EU can secure vital digital assets and boost its global competitiveness. CADA supports the development of a resilient and secure ecosystem conducive to innovation via EU-level R&D funding challenges targeting the development of highly innovative Cloud and AI enabling technologies, offering a stable environment to attract investments and to nurture growth. Ultimately, it can enhance the collective bargaining power of Member States in the international arena. Options evaluated & Preferred option The document evaluates six policy options, grouped into two categories : three addressing the limited and geographically concentrated availability of computing capacity in the EU (PO1) and three tackling the dependence on cloud and AI computing services supplied by non -EU providers (PO2). PO1-A enhances the existing collaborative framewor k between Member States, EU institutions and relevant industries to support data centre expansion. PO1-B provides rules and 2 financial support for faster data centre deployment, implemented nationally. PO1-C shifts this implementation to the EU-level. PO2-A contains supporting measures to increase transparency and visibility of sovereign cloud and AI computing services. PO2-B creates a voluntary framework for advancing such services and proposes the federation of resources among the public sector to boost efficiency. PO2-C establishes an EU -coordinated procurement and mandatory support framework for strategic autonomy and sovereign services. In this later aspect, it provides measures for the public sector as well as for private sector essential entities operating under the sectors listed in Annex I of NIS2. The preferred option is the combination of PO1-B, PO2-C and two individual policy measures of PO1-C, related to the funding for the development and deployment of novel technologies for sustainability along the cloud value chain (PM8, PM9) . This package achieves the best balance of costs and benefits , while providing a good balance in terms of social and environmental impacts and respecting subsidiarity and proportionality principles. Stakeholders’ support Data centre operators and cloud service providers have voiced support for PO1-B and PM8 and PM9, aiming to facilitate quicker deployment of data centres by reducing red tape and encouraging investments, particularly those that promote sustainable technologies. They welcome this package as a streamlining of administrative processes to deploy data centres. Cloud and AI computing service providers have expressed support for PO2-C, notably t he joint public procurement mechanisms it puts in place ; the marketplace, which allows smaller providers to scale and be more visible towards incumbents; and the audit mechanism for sovereign services , which would end sovereign -washing. They welcome these measures as they enhance transparency and visibility of service offers, including from smaller providers, and they result in opportunities to distinguish their services. Non-EU service providers have repeatedly stressed their interest in retaining an open European market, including for public procurement. Public sector bodies support PO2-C, notably the public sector federation of cloud and AI computing resources as this would increase utilisation rates of idle resources . They also favour the coordinated approach to public procurement and the clarity it provides on how to safeguard data confidentiality and ensure operational autonomy for highly critical use cases. Benefits and costs of the preferred option The preferred policy package (PO1-B, PO2-C, PM8 and PM9) is expected to have benefits in the short and medium term that outweigh the generated costs over the assess ment period for different stakeholders. Data centre operators would benefit from streamlined processes, fast - track permitting and administrative simplification , while c loud and AI computing service providers would benefit from cost savings stemming mainly from the ability to get a single audit for sovereign services , valid throughout the EU . This is relevant for the public procurement of services for highly critical use cases across the whole EU . National public authorities are also expected to benefit from cost savings, mainly through increased use of open source , joint public procurement and the federation of capacity . This combination of options also entails implementation and transition costs. There are mainly linked to adapting systems and procedures, familiarising stakeholders with the new requirements and ensuring compliance. Most of these costs are one -off or transitional in nature, while several of the expected benefits are recurring over time. This combination of options is expected to deliver a 3 positive balance of costs and benefits, while achieving the objectives in a proportionate and cost-effective manner. Impact on SMEs and competitiveness The impacts on SMEs and competitiveness are predominantly positive, as the comprehensive EU-level intervention aims at enhancing the cloud and AI computing landscape. The preferred package is designed to facilitate access to cloud and AI computing resources for SMEs looking to innovate or expand their digital capabilities. By fostering a more unified and open market, EU-based SMEs can leverage a harmoni sed regulatory environment which simplifies business processes and enhances market opportunities. For competitiveness, the intervention aims to boost the EU’s internal market by reducing dependency on non -European service providers. This shift creates opportunities for local service providers and SMEs, which they can leverage to compete globally. Other significant impacts If implemented, CADA is expected to lead to both environmental and social impacts related to increased data centre capacity. While expanding data centre capacity results in increased resource use, k ey environmental benefits include the use and development of novel energy-efficient technologies in data centres. By supporting such advancements, CADA is expected to help the EU alleviate the carbon footprint of its data centre industry . This will contribute to the EU's broader climate goals and commitments, aligning digital infrastructure expansion with sustainability principles and fostering environmentally responsible growth in the tech sector. Socially, CADA is expected to support innovation and create employment opportunities in the tech sector, leading to high value job creation and skills development. Additionally, sovereign cloud and AI services are expected to enhance resilience and security for public sector operations, protecting sensitive data and ensuring service reliability for citizens. Follow up The Commission should carry out an evaluation f ive years after the adoption date to assess to which extent the objectives of the initiative have been reached.