techUK estimates that the EU’s proposed Cloud and AI Development Act could cost the UK economy up to £22.34bn over five years by locking UK providers out of sensitive European public sector work. The trade body wants Brussels to judge cloud suppliers on the security controls they can prove rather than on where their owners are based.
What happened
On 10 November 2026, techUK published a report titled Protecting Sovereignty Through Partnership. It looks at the European Commission’s proposed Cloud and AI Development Act (CADA), one of the main parts of the European Technological Sovereignty Package that Brussels unveiled on 3 June 2026. It concludes that if UK providers are excluded from the higher tiers of CADA’s sovereignty framework, the UK economy could lose between £19.55bn and £22.34bn over five years.
The trade body ran two cases. Its conservative case assumes UK firms are shut out of a rising slice of EU public cloud and AI work, roughly 10% at first and 15% after two years, with private buyers slowly adopting the same CADA tests. Its more severe case adds the gradual loss of public contracts UK suppliers hold today. techUK says both figures are probably too low because they exclude compliance costs, including recurring supply chain audits.
The timing is deliberate. The UK-EU Summit takes place in Brussels on 20 November, and techUK wants ministers to use it to secure a UK-EU Digital Partnership. Sabina Ciofu, techUK’s international policy and strategy lead, said in comments reported by ITPro that judging suppliers on nationality rather than controls “breaks those links without making anyone safer”.
How it works
CADA would create four levels of “Union assurance” for cloud and AI services bought by European public bodies. Member states would carry out sovereignty risk assessments and decide which public sector workloads need which level. ITPro says it would cover almost every cloud model, including SaaS, PaaS and IaaS.
The top two levels are where UK providers would be shut out. Level 3 and Level 4 would require EU-based staff and processing and storage entirely inside the EU, and would exclude providers under third-country control. techUK says UK firms would find Level 3 contracts very hard to win and that Level 4 would effectively be closed to them. The draft does let the Commission recognise qualifying third countries, but techUK’s reading of Article 18 is that recognition would apply only at Level 3, not at the top tier.
The Commission expects only around a tenth of public procurement to fall into the top two levels. techUK says that underestimates the damage, for two reasons. EU incumbents have an incentive to push more workloads into the higher tiers, and private buyers in regulated sectors tend to copy public sector practice. The UK exported £412.8bn of digitally delivered services in 2025, and techUK estimates that about 36% of that went to the EU, so even a small change in eligibility has a large effect.
techUK’s alternative is to base sovereignty credentials on technical safeguards that can be tested: customer-exclusive encryption keys, zero-retention policies, data portability and service continuity planning.
Why it matters for UK organisations
The most obvious impact is on UK cloud, managed service and AI providers that sell into European governments, health systems and defence supply chains. But the effects go further. Many UK companies are headquartered here and have operating subsidiaries across the EU, and techUK notes that these groups do not fit neatly into a nationality test. A UK provider running a SOC for a French public body could find renewal hinging on its ownership chart rather than its ISO 27001 scope.
The rules also affect UK organisations that buy cloud services. If European hyperscaler regions and sovereign cloud offerings split into tiers based on ownership, UK buyers with EU operations may end up running different architectures on each side of the Channel.
There is a regulatory overlap issue too. UK firms already deal with NIS2 in the EU and, at home, the Cyber Security and Resilience Bill, which would bring managed service providers and data centres into scope. In its analysis of the Commission’s 2027 work programme, techUK points out that Brussels is aiming for agreement on a revised Cybersecurity Act by the end of 2026. It argues that simplification should cut duplicated work such as parallel incident reporting. CADA pulls the other way, adding a sovereignty layer on top of security requirements that firms already have to meet.
Expert view
I have spent much of my career assessing whether a supplier’s environment is actually secure, and I have never yet seen a passport stop an intrusion. In real incidents, the things that decide whether data is protected are mostly technical and operational: who holds the encryption keys, whether administrators reach production through hardened, monitored paths, how quickly a provider detects and contains an intrusion, and whether a customer can leave without losing service. Ownership matters geopolitically, but it is a weak proxy for security.
That said, the EU’s worries are not imaginary. Jurisdictional reach, compelled access and politically driven service cut-offs are real risks for critical services. In my view, a sensible outcome would recognise trusted partners while keeping strict technical requirements on key custody, staff vetting and operational independence. The open questions are whether Brussels will extend recognition beyond Level 3, and whether the summit produces anything more binding than warm words.
The £19.55bn to £22.34bn range comes from techUK’s own modelling, and the trade body represents the firms that would lose out, so readers should treat it as an industry estimate rather than an independent forecast. It is still worth taking seriously: CADA’s final wording will shape EU procurement for years.
What to do now
- Map your EU public sector exposure. Identify contracts, bids and renewals with European public bodies or their prime contractors that could be classed as high assurance.
- Document your ownership and control position. Prepare a clear account of where your staff, data processing, support functions and corporate control sit, because procurement teams will ask.
- Invest in evidence you can demonstrate. Customer-managed or customer-exclusive keys, zero-retention options, tested data portability and documented continuity plans will help under any version of the regime.
- Keep the security basics provable. The five Cyber Essentials controls (firewalls, secure configuration, user access control, malware protection and security update management) are a baseline many buyers expect to see.
- Review your own cloud dependencies. If you buy European cloud services, check whether CADA-driven tiering could change pricing, available regions or exit terms, and update supplier risk registers.
- Engage now. Feed real examples through trade bodies and to DSIT and Department for Business and Trade officials before the 20 November summit and during the European Parliament and Council negotiations that follow.
Bottom line
CADA is still a proposal, and techUK’s multi-billion-pound figure is an industry estimate rather than a certainty. Even so, the core issue is real: if sovereignty is judged by ownership rather than by controls that can be verified, UK providers could be shut out of Europe’s most sensitive cloud work regardless of how secure they are. UK firms with EU business should gather the evidence and make the case now, while the text can still change.
Sources
- techUK: Protecting Sovereignty Through Partnership
- ITPro: New EU cloud sovereignty laws could lock British firms out of public contracts
- techUK: What the European Commission 2027 Work Programme means for UK tech
- techUK: Europe’s Technology Sovereignty Package: what CADA and Chips Act II mean for UK tech
