Almost every large euro-area bank now runs part of its business on the cloud, and most of the providers are American. Brussels wants a say in who they answer to.
On October 13, CCIA Europe, a trade body whose members include Amazon, Google and Meta, published a study putting the cost of the EU’s proposed Cloud and AI Development Act (CADA) at €115 billion over ten years. CCIA says the Commission’s own upper estimate is €18 billion. CCIA funded the study, so its number carries an interest. Its Mitchell Rutledge said the Commission’s assessment “missed 70% of CADA’s true impact”.
For banks, the clause that matters is Article 31. CCIA says it would let the Commission extend strict sovereignty rules beyond public procurement to private sectors, banking included.
How Dependent Banks Are
Cloud spending went from about 4% of banks’ total IT budgets in 2021 to 17% in 2025, a fourfold rise in four years. The ECB’s Anneli Tuominen wrote in March that banks’ reliance on “a handful of third parties offering cloud services” has been rising sharply. An earlier ECB review found that more than 30% of significant banks’ outsourcing budget sits with ten providers, mostly American, and the ECB’s latest annual report says low substitutability makes that dependence hard to unwind.
Resilience First, Then Sovereignty
The EU’s first response was about keeping systems running. In November 2025 the European Supervisory Authorities named 19 critical ICT providers for direct oversight under the Digital Operational Resilience Act (DORA), among them Amazon Web Services, Google Cloud and Microsoft. The list is refreshed every year. Designation changes how the vendor is supervised. It does not change the bank’s duty to prove it is in control.
CADA, proposed on June 3, asks a different question: who does the provider answer to? It grades cloud services on four assurance levels, from data localisation in the EU at Level 1, through independence from third countries and EU control, to no third-country interference at all, including over the software, at Level 4. The rules formally apply to the public sector, and the act is still a proposal.
US providers have moved anyway. AWS launched its European Sovereign Cloud this year, backed by more than €7.8 billion of investment, and on October 24 cut it off from its global network for several hours to show it “can operate without depending on any infrastructure outside the European Union”. That answers the technical question, not the legal one. AWS is still headquartered in the US, and the US CLOUD Act lets US authorities demand data held by US firms even when it is stored abroad.
What Banks Face
ECIPE, which wrote the CCIA-funded study, puts software rewriting at 69% of CADA’s real-world impact. Gartner expects sovereign cloud infrastructure spending in Europe to more than triple between 2025 and 2027. Whatever the final bill, for banks it arrives as contract renegotiation, exit planning and testing.
The rules can also create a risk of their own. A sovereign label can cut legal exposure without cutting outage risk, since one provider failing can still take down many banks at once. Pushing workloads to a few approved sovereign providers could build a new concentration in place of the old one.
Banks moved to the cloud for speed and cost. Resilience rules ask whether a bank can survive its provider failing. Sovereignty rules ask whose law that provider obeys. Banks that cannot answer both will have the answer written for them in Brussels.
