EU DMA Probes AWS and Azure as Cloud Gatekeepers

The European Commission has formally opened a set of market investigations into Amazon Web Services (AWS) and Microsoft Azure under the Digital Markets Act (DMA), testing whether the world’s two largest cloud platforms should be treated as regulated “gatekeepers” and whether the DMA’s toolbox can be sensibly applied to enterprise cloud infrastructure.

Background​

Cloud computing has moved from a commodified utility to the strategic backbone of digital economies, powering everything from national public services to the compute-hungry workloads of generative AI. Regulators in Europe have for some time been concerned about high concentration among hyperscalers and structural barriers that can make migration and competition difficult. Those concerns underlie the Commission’s decision to open parallel market investigations into AWS and Microsoft Azure and a third, horizontal probe to examine DMA’s applicability to cloud services.
The DMA is an ex‑ante regulatory framework designed to impose obligations on digital “gatekeepers” to prevent self‑preferencing, ensure interoperability, and reduce lock‑in. Traditionally focused on consumer-facing platforms, the DMA has quantitative thresholds and a qualitative test for designation — but mapping those parameters to enterprise cloud contracts, capacity metrics, and technical control planes is legally and technically complex. The Commission’s third study explicitly asks whether the DMA’s existing instruments are fit for cloud or require sector-specific adaptation.
National regulators have already prepared much of the ground for Brussels. The UK Competition and Markets Authority (CMA) produced provisional findings pointing to very high shares of cloud spend held by the major hyperscalers and documented friction points like egress fees, licensing differentials and bundling that can impede switching. Those national probes and industry analyses are part of the evidentiary mosaic the Commission will examine.

---

What the Commission will investigate​

The Commission’s inquiries are both structural and behavioural. They combine market‑level analysis with detailed technical fact‑finding, focusing on a discrete set of concrete practices regulators and rivals have repeatedly flagged.

Core lines of inquiry​

• Gatekeeper designation — whether particular cloud services (IaaS, PaaS, managed platform primitives) function as indispensable intermediaries between business customers and end users in ways that enable durable market power.
• Switching friction and portability — the role of egress fees, slow or lossy export tooling, and contractual exit terms that raise the cost of moving workloads or data from one provider to another.
• Licensing and pricing practices — whether software licensing or bundled pricing creates a materially cheaper or more convenient path to run workloads on the incumbent provider, disadvantaging rivals.
• Self‑preferencing and bundling — whether first‑party managed services, marketplaces, consoles or AI stacks are given preferential placement, pricing or performance that disadvantages independent ISVs and competing platforms.
• Technical interoperability and control‑plane access — whether proprietary APIs, platform primitives, or absent open interfaces make practical multi‑cloud operations infeasible or unreliable.
• DMA fit for purpose — if cloud services are found to behave like gatekeepers, do the DMA’s remedies (non‑discrimination, data portability, interoperability mandates, bans on self‑preferencing) translate into workable, technically precise obligations for infrastructure markets? The Commission will test that explicitly.

---

Why Brussels moved now​

Several converging dynamics explain the timing and scope of the Commission’s action.

Market concentration and switching costs​

Independent trackers and national authorities have repeatedly shown that a small number of hyperscalers — chiefly AWS, Microsoft Azure and Google Cloud — account for a very large share of cloud spending in Europe. Those concentrated market positions increase the risk that scale economies, combined with proprietary features and contracts, create durable lock‑in and raise barriers for challengers. The CMA has documented that Microsoft and Amazon together account for an especially large share of UK cloud spend.

AI and specialized compute​

Generative AI and large‑scale model training intensify the demand for specialized hardware, integrated software stacks, and managed services that are difficult to replicate. Hyperscalers’ ability to bundle specialized accelerators, model hosting and proprietary AI tooling increases the strategic value of cloud lock‑in and raises the potential for cloud control to translate into advantages in AI markets. Regulators view this linkage as a central policy concern.

Systemic outages and resilience concerns​

High-impact cloud outages over recent years have underscored that many critical systems depend on a handful of cloud primitives — DNS, global edge fabrics, identity, managed databases. When those primitives fail, the cascade can affect governments, financial services and telecoms, turning a competition issue into a public‑policy risk. That systemic dimension strengthens political appetite for regulatory scrutiny.

Strategic policy and digital sovereignty​

European policymakers are explicitly concerned with digital sovereignty — ensuring that public services and strategic workloads run on trusted, contestable platforms that give governments sufficient guarantees on data residency, access and legal recourse. That industrial policy context increases the political cost of inaction.

---

What gatekeeper designation would mean in practice​

If the Commission ultimately designates AWS or Azure (or specific cloud services) as gatekeepers under the DMA, several immediate legal and operational consequences could follow.

• Mandatory non‑discrimination — obliging providers to treat third‑party services and customers fairly across pricing, access and functionality.
• Interoperability and open interfaces — technical obligations to publish and maintain interfaces, or to adopt standardized control‑plane behaviour that allows portability and multi‑cloud orchestration.
• Data portability — requirements to ensure safe, performant and verifiable export of data and workloads.
• Bans on self‑preferencing — stopping providers from giving first‑party managed services preferential placement, performance or bundled pricing that forecloses rivals.
• Significant penalties — the DMA provides for heavy fines for breaches, potentially up to double‑digit percentages of global turnover for serious or repeat violations.

These remedies would need to be carefully specified to avoid undermining the security, performance and economies of scale that deliver cloud value. The Commission’s horizontal study is explicitly designed to test whether such obligations can be drafted in technically precise and evidence‑based ways.

---

Legal and technical challenges ahead​

Bringing cloud under the DMA faces difficult mapping problems.

• Metric mismatch — the DMA’s original thresholds were devised for consumer platforms measured by monthly active users or advertising reach. Cloud markets are governed by contract values, reserved capacity, latency requirements and enterprise account structures — different metrics that complicate quantitative designation tests.
• Defining the “service” — cloud providers offer layered products (IaaS, PaaS, managed services, AI accelerators). Regulators will need to define which specific services, APIs or control‑plane elements are gatekeeper-relevant without inadvertently sweeping in optional addons that are competitively neutral.
• Technical feasibility of remedies — mandating open interfaces or standardized control‑plane behaviour risks fragmenting operational models or creating subtle performance and security regressions if done clumsily. Regulators must engage deeply with engineers to avoid prescribing brittle or harmful technical solutions.
• Investment and scale trade‑offs — imposing heavy ex‑ante obligations could affect incentives for hyperscalers to invest in costly infrastructure (data centers, specialized accelerators). Policymakers will need to balance contestability with continued investment in capacity and resilience.

---

How Microsoft and Amazon have responded (and how they may react)​

Public statements so far indicate cooperation and engagement. Microsoft has stated it will cooperate with the probe, emphasizing partnership with EU authorities while defending its business practices. AWS and Microsoft are also likely to mount technical and legal arguments about the difficulty of transplanting consumer‑platform DMA rules into enterprise infrastructure markets. Expect robust evidence submissions, detailed technical rebuttals, and intensive lobbying over the coming months.
Regardless of the legal posture, both providers will likely pursue pragmatic mitigations: offering enhanced migration tooling, clarifying contract clauses, or tweaking pricing on egress and managed services to blunt regulator concerns while arguing that many of the market frictions are technical, not anticompetitive.

---

Potential risks and unintended consequences​

The regulatory path the Commission chooses matters; remedies that are poorly scoped could generate collateral harms.

• Fragmentation — prescriptive interoperability rules could lead to divergent vendor-specific forks or slow innovation if vendors are forced to maintain legacy or low‑efficiency compatibility layers.
• Security trade‑offs — opening control planes or exposing more internal interfaces increases the surface area regulators and engineers must secure. Without careful design, interoperability mandates could introduce vulnerabilities.
• Rising compliance costs — obligations to document, certify and maintain portability could raise costs that trickle down to customers, particularly smaller businesses.
• Investment chill — heavy, ambiguous obligations may deter investment in specialized AI hardware and regional capacity if hyperscalers perceive regulatory unpredictability.
• Cherry‑picking remedies — imposing only behavioural fixes without addressing structural concentration may provide temporary relief while leaving long‑running market power intact. Balanced, well‑targeted measures will be essential.

Where reporting relies on single briefings or unnamed sources — for example references circulating about initial briefings to certain outlets — those specific claims should be treated cautiously until corroborated by Commission filings or public notices. The Commission’s formal notices and submissions will be the definitive record for any factual questions that could materially affect legal outcomes.

---

What customers, procurement teams and CIOs should do now​

Although the Commission aims to complete the inquiries within roughly 12 months, the regulatory process will be highly interactive and evidence‑driven. Organizations should use the window to reduce exposure and increase optionality.

• Map cloud dependencies. Inventory workloads, data flows and third‑party managed services tied to particular providers. Know where critical systems and sensitive data live.
• Assess contractual exit terms. Review egress clauses, data export SLAs, and any fees tied to migration. Renegotiate where possible to reduce business risk.
• Invest in portability tooling. Prioritize containerization, infrastructure as code, and automation that make moving workloads less costly and faster when technically feasible.
• Design for multi‑cloud resilience where it adds value. Multi‑cloud brings complexity and cost; apply it to workloads where vendor lock‑in creates unacceptable business risk.
• Engage procurement and legal early. Add migration tests, portability metrics, and audit rights into future contracts. Prepare evidence that your vendor terms either mitigate or exacerbate switching friction.
• Monitor regulatory developments. Follow the Commission’s public notices and industry consultations; participate in technical consultations where possible to help craft workable remedies.
• Plan for change. Build contingencies for pricing shifts, feature changes, or new interoperability requirements that could affect total cost of ownership.

---

Timetable and likely next steps​

The Commission has signalled a relatively brisk fact‑finding calendar and expects to complete the inquiries within roughly 12 months, although complex technical investigations can vary in duration depending on evidence volume and stakeholder engagement. The process will include document requests, technical exchanges, and the possibility of further public consultations or policy proposals if the DMA turns out to require sector‑specific tuning.
If the Commission concludes gatekeeper designation is warranted for certain cloud services, the next phase would involve specifying obligations and enforcement mechanisms — a process that could run longer and involve national authorities and possible appeals.

---

Bottom line: a regulatory inflection point for cloud economics​

This set of DMA probes marks the EU’s most significant move yet to interrogate whether cloud infrastructure should carry the same ex‑ante obligations as consumer platforms. The inquiry is consequential not only for AWS and Microsoft but for cloud customers, challenger providers, and the broader AI ecosystem.

• For customers, the immediate imperative is pragmatic: reduce lock‑in exposure, harden exit plans, and make architecture decisions that preserve bargaining power.
• For hyperscalers, the challenge is to show that current practices are competitive and to offer technical solutions that address regulator concerns without undermining the security and scale benefits customers rely on.
• For policymakers, the critical test will be whether they can design remedies that enhance contestability and resilience without creating technical or investment harms. That balance will determine whether the DMA becomes a decisive tool for cloud governance or whether Brussels opts for a hybrid, sector‑specific approach.

The next 12 months will be dense with technical submissions, legal argument and political negotiation. Businesses that prepare now — by auditing dependencies, strengthening portability, and engaging with technical consultations — will be better positioned to weather regulatory change and to influence practical, evidence‑based outcomes.

---

Conclusion: Europe’s DMA probes into AWS and Azure are more than a regulatory curiosity — they are an attempt to reconcile the realities of modern cloud infrastructure with public‑policy goals of competition, resilience and sovereignty. The shape of any remedies will matter greatly for how cloud services are built, bought and used going forward. Organizations of all sizes should act now to measure and manage their cloud risk while following the Commission’s technical process closely.

---

Source: Mobile World Live https://www.mobileworldlive.com/regulation/microsoft-amazon-hit-by-ec-cloud-computing-probe/

 

[ChatGPT]

The European Commission has launched a trio of market investigations under the Digital Markets Act (DMA) that put Amazon Web Services (AWS) and Microsoft Azure squarely in Brussels’ sights, testing whether hyperscale cloud platforms should be treated as regulated “gatekeepers” and whether the DMA’s toolbox is fit for cloud infrastructure — a move that could reshape procurement, interoperability, AI economics, and resilience across European IT estates.

Background / Overview​

Cloud infrastructure has shifted from a commodified utility to strategic digital backbone for governments, banks, healthcare systems and the compute-hungry workloads of generative AI. A small set of hyperscalers — led by AWS, Microsoft Azure and Google Cloud — supply the bulk of public cloud capacity in Europe, a concentration that has prompted repeated regulatory scrutiny from the UK’s Competition and Markets Authority (CMA), national authorities and now the European Commission. The DMA was designed as an ex‑ante instrument that imposes specific obligations on defined “gatekeepers” to prevent exclusionary conduct such as self‑preferencing, to require interoperability where feasible, and to support data portability. While the law’s original thresholds and metrics were written for consumer-facing core platform services, the Commission has the discretionary investigatory power to test services that functionally behave as gatekeepers even if they do not fit the consumer-oriented numerical criteria. The current probes use that investigative route to examine whether certain cloud offerings should fall under DMA obligations.

What Brussels has opened​

The Commission’s action comprises three linked enquiries:

• Two company-specific market investigations: one focused on Amazon Web Services (AWS) and one on Microsoft Azure to determine whether those cloud services perform the role of a DMA “gatekeeper” and whether their conduct raises contestability, portability or non‑discrimination concerns.
• A horizontal, policy-level probe assessing whether the DMA is fit-for-purpose in the cloud domain, or whether its obligations and enforcement model require adaptation to account for enterprise procurement, contract value, performance/latency constraints, and other infrastructure-specific realities.

The Commission signalled an ambition to complete the investigations within roughly 12 months, a timeline intended to deliver a timely fact pattern while allowing for detailed technical and contractual review.

---

Why cloud and why now​

Three converging drivers pushed cloud to the top of Brussels’ agenda:

• Concentration and market power. Multiple analyses and national regulator findings point to a market where the top three hyperscalers capture a dominant share of public‑cloud spending in Europe. That concentration raises the political and competition-policy stakes when critical public services and large enterprise workloads run on a handful of providers.
• Switching friction and lock‑in. Industry evidence and supervisory findings cite contractual and technical frictions — egress fees, proprietary APIs, managed-service bundling, and licensing arrangements — that materially raise the cost or complexity of migrating workloads between clouds. Those frictions are classic signals regulators use to infer effective gatekeeper power.
• AI, resilience and digital sovereignty. The growth of specialized AI stacks and hardware (accelerators), plus high‑profile outages that cascade across sectors when a single provider fails, have crystallised the public‑interest dimension of cloud competition. Policymakers are increasingly framing cloud governance as a mix of competition policy, critical‑infrastructure resilience and industrial strategy.

Taken together, these drivers underpin a pragmatic rationale for the Commission: cloud services are no longer a passive supply input but strategic intermediaries with real-world effects on competition and national resilience.

What the investigations will examine — technical and legal lines of inquiry​

Investigators will gather technical evidence, contractual documents and stakeholder testimony to probe both market structure and specific conduct. Expect focused fact‑finding in these areas:

• Gatekeeper functional test. Do AWS and Azure act as indispensable intermediaries between business customers and end users in ways that enable durable market power? How should DMA metrics — originally framed around “monthly active users” and European turnover — be mapped to cloud metrics like contract value, capacity, enterprise accounts and geography?
• Data portability and egress. Are exit charges, export-tool reliability, or contractual impediments structured to materially deter migration? The Commission will review migration tooling, service‑level commitments and commercial terms.
• Self‑preferencing and bundling. Do first‑party managed services, marketplaces, AI stacks or licensing terms receive preferential performance, placement or pricing that harms third‑party ISVs and rival infrastructure providers? The probe will scrutinise cloud marketplaces, managed-service prioritisation and integration patterns.
• Interoperability and control‑plane access. Are proprietary control‑plane primitives, APIs or orchestration semantics designed in ways that make practical multi‑cloud operations infeasible or unreliable for latency‑sensitive workloads? The Commission will compare actual cross‑cloud portability in production environments.
• Systemic resilience and outages. How do provider outages and control‑plane fragility affect critical sectors and public services? Regulators view resilience as a complementary policy objective tied to contestability.

These lines of inquiry mix economic analysis with deep technical forensics. The horizontal probe will explicitly test whether the DMA’s remedies — non‑discrimination, technical interoperability, and data portability obligations — can be translated into precise, enforceable, and technically feasible obligations for infrastructure markets.

Cross‑checks and independent reporting​

Independent outlets reported the Commission’s move in real time, confirming the MLex coverage and adding explanatory detail. Reuters described the three probes and noted that the Commission plans to conclude the inquiries within one year. AP News issued a separate briefing that highlighted the difficulty of applying DMA user‑based thresholds to enterprise cloud services. Those independent reports corroborate the core facts and the Commission’s intent. At the same time, past regulatory work (notably the UK CMA’s cloud inquiries) and public watchdog reports feed into Brussels’ evidentiary picture: national findings have documented high incumbent shares in many cloud market segments and flagged switching costs as a competitive barrier. Those prior investigations materially influenced the Commission’s calculus.

What gatekeeper designation could mean in practice​

If AWS or Azure (or specific cloud services they offer) are designated as DMA gatekeepers, the following consequences are plausible:

• Immediate obligations. Mandatory duties on non‑discrimination, technical interoperability (where feasible), data portability and constraints on self‑preferencing would apply to the designated services. These rules carry significant implementation requirements for cloud control planes, marketplaces, and APIs.
• Heavy enforcement tools. The DMA allows fines of up to 10% of global annual turnover for initial breaches and higher penalties for repeat violations. Structural or behavioural remedies could also be imposed in extreme cases.
• Procurement and contract changes. Public sector purchasers and commercial customers would gain stronger legal hooks to demand portability guarantees, clearer exit terms and unbiased marketplace behaviour — but they might also face new contractual complexity as providers re‑engineer systems to comply.
• Technical re‑engineering. Cloud providers may have to expose additional interfaces, open or standardise certain APIs, or change platform placement and performance rules — all of which have engineering, latency and security trade‑offs.

Practical implications and risks for enterprises and Windows admins​

This is not abstract policy theatre. For IT leaders, Windows admins and procurement teams, the Commission’s probes imply near‑term operational and commercial risks:

• Contractual shock. Vendors may renegotiate enterprise licensing, egress pricing and bundled discounts in response to regulatory constraint or litigation risk. Contracts signed today could look materially different a year from now.
• SLA, portability and migration pain. Expect renewed vendor focus on migration tooling and egress pricing as regulators probe portability. However, technical portability for complex stateful services (databases, managed AI stacks) is much harder than moving files; enterprises should plan for multi‑phase migration testing.
• Security and resilience trade-offs. Any push to increase interoperability or mandate certain control‑plane exposures must be balanced against security and performance constraints. Poorly scoped obligations could inadvertently increase attack surface or reduce efficiency.
• Procurement and vendor management. Public buyers may shift tender specifications and evaluate provider compliance and portability guarantees as part of scoring. Private enterprises should update risk registers and vendor‑dependency maps now.

Regulatory and industry responses: tone and likely strategies​

Both AWS and Microsoft have publicly signalled different tones in prior exchanges with regulators: Microsoft has indicated willingness to cooperate with investigations, while Amazon has historically cautioned that heavy‑handed designations could stifle innovation and increase costs for customers. Expect both firms to provide extensive technical evidence, customer testimony and commercial data to rebut or contextualise regulator concerns. At the policy level, Brussels faces a delicate mapping problem: how to translate DMA concepts designed for app stores and social platforms into the semantics of IaaS/PaaS. That translation requires careful legal drafting, technical specificity and an appreciation for the investment and performance economies that underpin cloud security and scale. The horizontal probe is where those methodological questions will be tested.

Legal and technical challenges the Commission will face​

• Metrics mismatch. The DMA’s original threshold tests (active users, EU turnover) do not align neatly with enterprise contract structures or capacity metrics. Any gatekeeper designation will need a defensible mapping from “end users” to meaningful cloud‑market analogues.
• Defining the relevant product market. IaaS, PaaS, managed AI stacks, and marketplace services differ materially. Regulators must decide whether to designate entire cloud businesses or discrete services (for example, managed database services or AI model-hosting stacks).
• Enforceability of technical obligations. Requirements such as mandated interoperability need concrete technical specifications to be both effective and enforceable, or they risk becoming ambiguous injunctions that are difficult to monitor.
• Global regulatory spillovers. Any EU-specific obligations could influence global architectures and commercial terms, potentially leading to fragmentation if providers adopt regionally distinct interfaces or contractual models.

What to do now: a practical checklist for IT leaders and WindowsForum readers​

Enterprises operating on cloud platforms should immediately adopt a three‑track preparedness plan: legal review, technical resilience, and procurement remediation.

• Legal and contract audit
• Catalog exit and egress provisions in existing contracts and quantify historical egress costs.
• Review licensing terms that incentivise running workloads on a specific cloud provider (e.g., certain Windows/SQL Server licensing constructs).
• Engage legal counsel to prepare redlines that limit onerous exit penalties and mandate clearer portability guarantees.
• Technical portability and resilience
• Map application dependencies to provider‑specific services (managed queues, serverless bindings, proprietary control‑plane features).
• Prioritise re‑architecting the most critical workloads for portability where feasible (containerisation, use of open APIs, infrastructure‑as‑code templates).
• Build and test runbooks for failover across cloud providers, and exercise them under realistic load conditions.
• Procurement and vendor governance
• Add portability and compliance criteria to future RFPs, and request detailed migration assessments and proof points.
• Negotiate transitional commitments (e.g., extended onboarding support) to reduce operational friction.
• Monitor provider responses to the DMA probes and maintain contingency clauses that trigger re‑procurement if structural remedies are imposed.
• Governance and risk management
• Update risk registers to reflect regulatory uncertainty and run scenario planning for outcomes ranging from no designation to partial or full designation of services.
• Liaise with industry groups and technical standard bodies to preserve the viability of secure, interoperable standards.

Potential outcomes and timelines​

• No designation, but policy change: The Commission could conclude that while cloud concentration raises concerns, the DMA is not the right tool to impose broad gatekeeper duties on cloud providers. The horizontal study could then recommend sector‑specific instruments or targeted code of conduct.
• Designation of specific cloud services: Brussels could designate a discrete set of cloud services (for instance, certain managed platform primitives) as gatekeeper services while leaving others outside the DMA. This targeted approach reduces legal friction but still forces design and contract changes.
• Designation of entire clouds: The most consequential option: AWS or Azure (or both) are designated as gatekeepers for core cloud services, which would trigger full DMA obligations and heavy compliance burdens. That outcome would be transformative for how hyperscalers operate in Europe.

Expect intense technical engagement, submissions from customers and rivals, and a politically charged debate over digital sovereignty and transatlantic trade. The Commission’s roughly 12‑month fact‑finding window is ambitious but realistic for producing a preliminary decision or recommendation.

Risks, trade‑offs and unintended consequences​

• Regulatory overreach vs. under‑enforcement. Overbroad remedies could undermine economies of scale that fund security and performance investments in hyperscale clouds. Conversely, under‑enforcement risks entrenching lock‑in and systemic dependencies. Brussels must thread a narrow technical and economic needle.
• Fragmentation and complexity. Region‑specific obligations could push providers to create divergent APIs and contractual frameworks across jurisdictions, raising operational complexity for multinational customers.
• Innovation incentives. If compliance costs rise sharply, providers might scale back R&D or consolidate certain services, potentially slowing innovation in managed AI tooling and developer productivity features. That risk must be weighed against the public interest in contestable infrastructure.
• Enforcement practicality. Monitoring compliance with technical interoperability obligations will require new supervisory capabilities and industry cooperation on verifiable standards and test suites.

Conclusion​

Brussels’ decision to open market investigations into AWS and Azure under the Digital Markets Act is a decisive escalation in EU digital policy, reflecting a new priority: cloud is strategic infrastructure with competition, resilience and sovereignty consequences. The probes combine concrete technical fact‑finding with broad legal questions about the DMA’s scope — and the outcome will matter not only to the hyperscalers, but to every organisation that relies on cloud platforms for critical services. For IT leaders and WindowsForum readers, the immediate tasks are practical: map dependencies, harden portability plans, revise procurement terms, and prepare governance for regulatory scenarios that could shift vendor economics and architecture choices over the next 12 months. The Commission’s work will be technical, contested and consequential — and the industry responses will shape the contours of cloud competition, interoperability, and resilience for years to come.

---

Source: MLex Microsoft, Amazon cloud services face EU probe over gatekeeper rules (update*) | MLex | Specialist news and analysis on legal risk and regulation