Cloud computing stopped being a migration project somewhere around 2024. In 2026 it is three problems wearing a trench coat: the cost of AI capacity, the legal geography of where data sits, and the discipline of turning a variable bill into a budget you can defend. The good news is that all three are now predictable enough to plan for.
That is a different article from the one this page carried in 2020, when the argument was still about whether remote teams could work through the cloud at all.
What changed since this article was written
| The 2024 version said | What is true in 2026 |
|---|---|
| Remote work was the big driver of cloud adoption | Hybrid work is settled. AI capacity is now the driver, and it is far more expensive per workload |
| Cloud lowers costs | Cloud moves cost from capital to operating, and the bill is now large enough to have its own team, tools and line item |
| Data location is an infrastructure detail | Sovereignty is a purchase criterion: Gartner expects $80 billion of sovereign cloud infrastructure spend in 2026 |
| Compliance is the legal team's problem | The EU Data Act, India's DPDP Rules and the EU AI Act all push compliance into architecture decisions |
| Provider lock-in is a contract clause | In Europe, exit charges disappear in January 2027, which changes what you can demand in a renewal today |
AI capacity is the biggest single cost driver
Gartner expects worldwide spending on AI-optimised infrastructure as a service to reach $42 billion in 2026, a 96% jump in a single year. That is the fastest-growing line in enterprise IT, and it is being bought by companies that mostly cannot yet measure what a token or a GPU-hour costs them.
The practical consequence is that AI has become the workload that blows up a cloud budget. Training is a project cost you can approve; inference is a recurring cost that scales with users, and it is easy to ship a feature that quietly multiplies it.
Three habits separate teams that keep this under control from teams that do not:
- Measure before you commit. Buy on-demand capacity for the first quarter of any AI feature and look at real usage before signing a one- or three-year commitment.
- Put a unit cost on the feature. Cost per request, per document processed, or per active user. A bill that only exists at the invoice level cannot be managed by the team that creates it.
- Separate experiments from products. Sandboxes with hard budget caps, production with alerts. The failure mode is an experiment that becomes a product without anyone changing the guardrails.
Sovereign cloud went from niche to budget line
Sovereign cloud infrastructure spending is forecast to hit $80 billion in 2026, up 35.6%, with China at roughly $47 billion and North America at $16 billion. Gartner also expects organisations to move about 20% of existing workloads from global public clouds to local providers.
The reason is not patriotism, it is procurement. Regulated buyers in finance, healthcare and the public sector increasingly have to show where data is stored, who can access it, and which legal jurisdiction can compel disclosure. A hyperscaler region in your country does not automatically satisfy that: the operator, the support chain and the ownership structure all count.
For most small and mid-sized businesses, sovereign cloud is not a requirement. If you handle payment data, health records or government contracts, it probably is, and it should appear in the RFP as a question rather than a surprise at contract review.
Europe's exit fees are disappearing
The EU Data Act has applied to cloud contracts since 12 September 2025, and from 12 January 2027 providers may no longer charge switching fees, including egress charges, to customers moving to another provider. The European Commission's plain-language explainer sets out the obligations.
If you buy cloud in Europe, or from a provider that serves European customers, this changes your negotiating position now rather than next year. Three things worth putting into a renewal:
- A contractual exit plan with a defined data-export format and timeline.
- Egress pricing that assumes a migration, not just day-to-day traffic.
- A written statement of which charges will disappear on 12 January 2027 and which are service fees that survive the ban.
The same logic applies outside Europe. Even where the law does not bind you, providers are rewriting standard terms globally to match it, and a buyer who asks about exit costs gets a better contract than one who does not.
India's data protection rules now have dates
India notified the Digital Personal Data Protection Rules in November 2025, with obligations phased over 12 and 18 months and full compliance due by 13 May 2027. The official rules cover consent notices, breach reporting and the extra duties that apply to significant data fiduciaries.
For a business running on cloud services, the work lands on data mapping. You cannot answer a consent or deletion request if you do not know which bucket, database or SaaS tool holds the record, and most companies discover in the first audit that personal data sits in six places nobody owns.
The AI Act adds disclosure duties
From 2 August 2026 the remaining provisions of the EU AI Act apply, including transparency obligations: a chatbot has to make clear that it is not a person, and synthetic content has to be marked. The official implementation timeline is the version to work from, because the high-risk deadlines have already been moved once.
Your cloud provider is not going to do this for you. The model may be theirs, but the disclosure duty belongs to whoever puts the interface in front of a user.
Cost discipline is now a design decision
The cheapest cloud architecture is the one designed around data movement, because that is where the surprises hide. Egress, cross-region replication and chatty services between availability zones all bill in ways that a diagram does not show.
The teams that do this well treat cloud cost the way they treat performance: it has an owner, a dashboard and a review. If yours does not, cloud cost optimisation is a better starting point than another round of reserved-instance shopping.
Security and resilience are table stakes now
None of the 2024 arguments about security and disaster recovery were wrong, they just stopped being differentiators. Multi-factor authentication, encryption at rest, tested restores and a documented recovery time are the price of entry, and providers now sell most of them as defaults.
What still separates companies is whether anyone has tested the restore. A backup that has never been restored is a hope, not a control. If you want the longer version, this guide to cloud server security covers the configuration side.
What this means for a small business
- Model the bill before you migrate. A spreadsheet with storage, compute, egress and one support plan beats a vendor calculator.
- Keep the exit in the contract. Export formats, timelines and switching fees, in writing.
- Ask where the data sits, and who can be compelled to hand it over. "EU region" is not the same answer as "operated by an EU entity".
- Give AI its own budget line. It is the one workload that can triple between quarters.
- Pick a platform you can operate. The platform comparison matters less than whether your team can run it on a Sunday.
- Plan the migration before the RFP. Quisitive's cloud migration checklist is a reasonable starting point for sequencing an assessment, a pilot and a cutover.
Related reading
- Cloud cost optimisation and enterprise ROI
- SaaS, PaaS or IaaS: what each one is for
- What cloud server security actually covers
- How to choose a cloud platform for your business
FAQ
Is cloud still cheaper than owning servers?
Not automatically. Cloud wins when demand is spiky or growth is uncertain, because you pay for what you use. A steady, predictable workload running at high utilisation can be cheaper on owned hardware once you count staff time. The comparison that matters is a three-year total cost of ownership, not the monthly invoice against a server price.
Does the EU Data Act apply to my company if we are outside Europe?
It applies to providers offering data processing services to customers in the EU, so a non-EU buyer usually benefits indirectly, because the provider applies the same contract terms globally. If you serve EU customers or store their data, treat the switching and portability rules as directly relevant to you.
How much should I budget for cloud in 2026?
There is no useful percentage, because it depends on how much of your software you rent rather than own. A better approach is to budget per workload: a fixed monthly figure per environment, plus a separate AI allowance that you review quarterly against usage. Anything you cannot attribute to a workload is a candidate for cutting or consolidating.
