EU Opens DMA Probes into AWS and Azure Cloud

The European Commission has opened formal market investigations into Microsoft Azure and Amazon Web Services under the Digital Markets Act (DMA), signalling a possible expansion of EU gatekeeper obligations into cloud infrastructure and setting the stage for a year-long regulatory review of whether hyperscale cloud providers should face stricter, ex‑ante controls.

Background / Overview​

Cloud computing today underpins vast swathes of Europe’s digital economy: enterprise applications, national public‑sector services, critical communications and the compute backbone for generative AI. That systemic role is why Brussels is treating the issue as more than a conventional antitrust inquiry and is instead using the DMA’s investigatory and designation tools to assess whether the market structure and provider behaviour amount to “gatekeeper” power in practice. The Commission has launched two focused market investigations — one on Amazon Web Services (AWS) and one on Microsoft Azure — and a third, horizontal probe that will examine whether the DMA’s current toolbox is suited to address the particular competition frictions observed in cloud markets. The Commission expects to conclude those investigations within approximately 12 months. Why the DMA? The DMA is an ex‑ante regulation aimed at a defined set of “core platform services” and the firms that operate them when they reach specified thresholds. Gatekeepers designated under the DMA are subject to mandatory obligations — covering non‑discrimination, interoperability, data portability and bans on self‑preferencing — and face significant fines (up to 10% of global turnover for first breaches and up to 20% for repeat breaches). The question Brussels now faces is whether cloud infrastructure and managed platform services should be treated the same way as app stores, search engines or social networks.

---

What the investigations will examine​

Core lines of inquiry​

The Commission’s announced probes will look at multiple dimensions where converging risk factors have attracted regulatory attention:

• Market concentration and entry barriers: whether AWS and Azure’s scale and integrated feature sets create entrenched positions that impede rival competition and new entrants.
• Lock‑in mechanisms: contractual, technical and economic frictions — notably licensing arrangements, proprietary managed services and egress pricing — that increase the cost or complexity of switching providers.
• Preferential treatment and bundling: whether first‑party cloud offerings or platform services are favoured in ways that disadvantage independent software vendors or competing infrastructure providers.
• Technical interoperability and portability: the availability and real‑world effectiveness of migration tools, open interfaces and standard APIs that would enable rapid multi‑cloud failover or workload portability.

A third, procedural question: is the DMA fit for cloud?​

Brussels is also probing whether the DMA’s enforcement model and obligations — originally designed for consumer‑facing platforms measured by end‑user metrics — map cleanly onto enterprise cloud markets, which use different metrics (contract value, business‑user accounts, infrastructure capacity) and operate under complex procurement and licensing regimes. That review could lead to either an adaptation of DMA tools or the design of targeted, sector‑specific remedies.

---

Why regulators moved now: concentration, outages, and AI demand​

A few converging facts have prompted the EU’s step:

• Market concentration: independent analyses and national regulators have shown that hyperscalers command a very high share of cloud spending in many jurisdictions; the CMA’s UK investigation, for example, concluded that AWS and Microsoft each account for a substantial share of the market and flagged persistent structural barriers.
• High‑impact outages: recent control‑plane and global edge incidents at hyperscalers exposed the systemic fragility that can accompany such concentration — when DNS, global routing fabrics or managed databases fail, the cascading effects can be broad and sudden. Several investigative summaries tie those operational failures to the urgency of regulatory attention.
• AI’s compute hunger: generative AI has strengthened providers’ ability to bundle value‑added, hard‑to‑replicate managed AI stacks, specialised accelerators and tightly integrated data services, raising the stakes of vendor lock‑in and intensifying competition policy concerns.

Taken together, those drivers create a political and regulatory window in which EU authorities are prepared to test the boundaries of the DMA in a strategically significant infrastructure market. Reuters’ reporting confirms the Commission’s decision to open the probes and frames the move as part of broader DMA enforcement against structural dominance in digital markets.

---

How the DMA could change cloud markets — practical scenarios​

The DMA provides a palette of ex‑ante obligations that, if applied to cloud services, could produce measurable changes in how hyperscalers operate and how customers procure cloud capacity.

Possible compliance outcomes and their effects​

• Interoperability and standard APIs: providers might be required to open or standardise control‑plane APIs for essential cloud primitives (identity, routing, storage formats). That would lower the technical barrier to multi‑cloud operations and portable failover. Implementation will be technically complex but could materially reduce single‑provider single‑point failures.
• Limits on self‑preferencing: bans on favouring first‑party managed services in marketplaces, procurement tooling or console UX could level playing fields for independent ISVs and cloud‑native startups. This would change commercial incentives and the economics of provider‑owned managed services.
• Data portability and egress reforms: regulators could cap or standardise egress pricing, require audited migration tooling with performance guarantees, and obligate clear contractual exit terms — measures that would reduce the economic cost of switching.
• Transparency, audits and reporting: gatekeeper obligations include auditability of ranking and resource allocation; analogues for cloud could compel providers to publish objective metrics for resource allocation, network prioritisation and internal routing decisions.

Each of these interventions would need detailed technical specifications; mandating them improperly could produce operational overhead, slow innovation or create legal challenges. The Commission’s third, meta‑investigation into whether the DMA is structurally suited to cloud is therefore central to determining how any new obligations would be shaped and enforced.

---

Strengths of potential EU action​

• Addressing systemic risk: imposing portability, interoperability and greater transparency can materially reduce the chance that a single outage or lock‑in event cascades through European critical infrastructure.
• Countering AI-era lock‑in: rules that target bundle‑and‑bias practices will help prevent compute and data aggregation that would allow a small set of firms to dominate emerging AI value chains.
• Stimulating European industry: clearer portability and lower switching costs would create space for regional cloud providers and specialised entrants to compete on features and price, supporting the EU’s digital sovereignty agenda.

---

Risks, trade‑offs and unintended consequences​

• Regulatory mismatch: the DMA was built around consumer‑facing platforms and end‑user metrics. Mapping those obligations onto infrastructure markets risks ill‑fitting rules that either don’t address the real harms or introduce operational contradictions. The Commission’s own work recognises this gap and has opened a parallel probe to test the DMA’s suitability.
• Investment chill: hyperscale cloud is capital‑intensive. Overly prescriptive ex‑ante constraints could deter investment in European data centres or specialised GPU/accelerator capacity — exactly the investments Europe seeks to attract to build sovereign compute. Industry stakeholders have consistently warned of this risk.
• Technical complexity and fragmentation: mandating standards and APIs without international coordination could fragment global cloud architectures, complicate global deployments and impair security architectures that rely on global threat intelligence and scale.
• Political and trade friction: designating non‑EU firms as gatekeepers for cloud could provoke diplomatic pushback and create transatlantic tensions, especially given the proportion of US firms among hyperscalers. Past DMA enforcement has already strained relations in some policy circles.

---

What the companies say and how they’ll likely respond​

Both Microsoft and Amazon have signalled readiness to cooperate with regulatory inquiries, emphasising their commitment to competition and innovation while warning about the risks of ill‑targeted intervention. Public comments emphasise the benefits customers derive from scale, broad service portfolios and security investments that only large providers can afford. Likely corporate strategies in response to the probes will include:

1. Rapid evidence collection and submission of technical detail showing interoperability options and migration tooling.
2. Highlighting investment commitments in Europe, including planned data‑centre expansions and AI compute infrastructure.
3. Making targeted commercial concessions where risk‑mitigation is feasible (improved migration documentation, clarified egress terms), while litigating or lobbying against broad, prescriptive obligations.

Expect intense engagement from industry trade associations and US government interlocutors during the inquiry period.

---

Practical steps for enterprise customers​

With regulatory uncertainty now heightened, enterprises should treat the Commission’s probes as a trigger for risk mitigation rather than as an immediate market overhaul.

• Map dependencies: inventory critical workloads, identify which cloud primitives (identity, managed DBs, ingress/egress, CDN, identity) each workload requires and where those primitives are provider‑specific.
• Prioritise portability: invest in containerisation, adopt open formats and standard orchestration tooling, and test migration plans for high‑value workloads.
• Rigorously review contracts: assess exit clauses, egress pricing and SLAs; negotiate migration guarantees where possible and obtain clear escalation paths for major incidents.
• Stress‑test resilience: incorporate multi‑region and, where appropriate, multi‑cloud failover strategies for mission‑critical services and plan for manual fallbacks in essential operations.

---

The enforcement horizon and plausibility of designation​

Designation as a gatekeeper under the DMA depends on quantitative thresholds (turnover and user metrics) and the Commission’s assessment of entrenched market positions. The DMA also contemplates the designation of specific core platform services; cloud infrastructure (IaaS/PaaS) is already listed among the types of CPS in the DMA’s definitions, though the Act’s thresholds were originally calibrated for consumer end‑user metrics. Regulatory options that the Commission can choose from include:

• Using the DMA’s designation process to treat specific cloud services or providers as gatekeepers and imposing ex‑ante obligations.
• Opting for market‑specific remedies under competition law or sectoral measures that target discrete harms (egress fees, discriminatory licensing) without full DMA designation.
• Combining DMA‑style obligations with other legislative tools (Data Act, AI Act, or bespoke Cloud & AI legislation) to create a hybrid regulatory approach tailored to cloud markets.

The Commission’s third probe specifically tests whether the DMA — in its current form — is fit for purpose in cloud markets. That meta‑question means Brussels could choose a middle path: enforceable remedies targeted at clear frictions while continuing to study the fit of broader gatekeeper obligations.

---

What is verifiable today — and what is not​

Verified facts as of the market opening announcement:

• The European Commission opened two market investigations into AWS and Azure and a third probe exploring DMA fitness for cloud; the Commission aims to complete the inquiries within roughly 12 months. Reuters confirms the Commission’s actions and timeline and notes Microsoft will cooperate.
• The DMA permits fines up to 10% of global turnover for first breaches and up to 20% for repeat breaches; gatekeeper thresholds and CPS definitions are established in the DMA text. These legal parameters are publicly available on EU Commission and Parliament pages.
• The UK’s Competition and Markets Authority and Ofcom have previously highlighted concentration and switching barriers in cloud markets, creating a precedent for regulatory concern. Several prior CMA findings and statements are publicly posted.

Claims that rely on unnamed or single sources — treat with caution:

• Early press accounts that attribute the Commission’s internal thinking to a single Bloomberg briefing should be treated as reported but not independently confirmed until the Commission publishes formal notices. Prior reporting threads have noted the Bloomberg source could not be located or independently verified at time of early summaries. This is a live investigatory story and anonymous sources may shape initial coverage; where reporting depends on such briefings, that dependency should be disclosed.

---

Institutional and geopolitical implications​

Bringing cloud under DMA‑style ex‑ante control would be one of the most consequential moves in EU digital policy since the DMA’s adoption. It would not only reshape competitive dynamics within the EU but could also influence global cloud governance norms, create pressure for standard‑setting in interoperability, and intensify transatlantic engagement on digital trade and regulation.
Policy‑makers must balance three imperatives:

1. Protect contestability and resilience in a sector that now underpins critical infrastructure.
2. Preserve incentives for large capital investments in data centres and specialised compute.
3. Avoid creating technical or legal fragmentation that undermines global cloud interoperability.

Striking that balance will require narrow, evidence‑based remedies that target demonstrable harms — not broad doctrinal retooling absent technical feasibility studies.

---

Conclusion​

The Commission’s decision to open market investigations into Azure and AWS under the DMA represents a defining moment for cloud governance in Europe. It reflects a recognition that cloud infrastructure is not merely a commodity input but a strategic layer whose concentration carries systemic, economic and geopolitical consequences. The probes will test both whether hyperscalers’ behaviour warrants gatekeeper obligations and whether the DMA — a landmark consumer‑platform law — can be adapted to enterprise infrastructure realities. For enterprises, regulators and cloud providers alike, the next 12 months will be decisive: expect technical evidence briefs, intense stakeholder engagement, and carefully calibrated proposals that attempt to reconcile resilience, competition and investment. Where precise outcomes remain uncertain, prudence dictates that businesses prepare now — by mapping dependencies, strengthening portability and revisiting contractual exit terms — while policy‑makers and technical communities work to design remedies that are both legally robust and technically practicable.
(Reporting note: the Commission’s formal notices and the companies’ public submissions will be the definitive record for this inquiry; where press reporting relies on anonymous briefings, those points have been noted as provisional until corroborated by official documents.

---

Source: MLex Microsoft, Amazon cloud services face EU probe over gatekeeper rules (update*) | MLex | Specialist news and analysis on legal risk and regulation

 

[ChatGPT]

The European Commission has opened three formal market investigations under the Digital Markets Act (DMA) targeting Amazon Web Services (AWS) and Microsoft Azure — two focused probes to test whether each cloud business should be classed as a DMA “gatekeeper” service, plus a third, horizontal study to determine whether the DMA’s toolbox can meaningfully be applied to cloud infrastructure and enterprise-grade platform services.

Background​

Cloud infrastructure has become the foundational fabric for modern digital services: enterprise applications, national public-sector systems, critical communications, and the compute-intensive workloads that underpin generative AI. Over the past decade a small number of hyperscale providers — principally Amazon Web Services (AWS), Microsoft Azure, and Google Cloud — have captured a dominant share of global public cloud spending, creating a market environment where concentration, switching friction and bundling are persistent policy concerns.
The Digital Markets Act (DMA) is an EU regulation designed to impose ex-ante obligations on digital platforms designated as “gatekeepers.” Gatekeepers face mandatory duties such as non-discrimination, enhanced interoperability, clear data portability, and prohibitions on self-preferencing, backed by heavy fines for breaches (up to 10% of global turnover for first offences and higher for repeat breaches). While the DMA was drafted with consumer-facing platform services in mind, the Commission has signalled that its scope can be tested and adapted to infrastructure services if the market realities justify it.
Recent regulatory work and national probes have laid groundwork for Brussels’ action. The UK Competition and Markets Authority (CMA) previously produced provisional findings highlighting the concentrated nature of cloud spend and potential switching frictions such as egress fees and licensing differentials. Those national inquiries — together with high-impact outages and the explosive demand for AI-specialised compute — helped crystallise the Commission’s decision to open these inquiries.

---

What Brussels has opened: the three investigations​

1. Market investigation into AWS​

One probe will examine whether Amazon Web Services constitutes a gatekeeper-provided core platform service under the DMA. Investigators will test structural market indicators and probe specific conduct such as egress pricing, portability friction, marketplace placement, and potential self-preferencing of first-party managed services.

2. Market investigation into Azure​

A second, parallel probe targets Microsoft Azure with the same core questions: does Azure’s market role functionally mirror the “gateway” characteristics the DMA seeks to regulate, and are there contractual or technical practices that materially foreclose rivals or disadvantage third-party ISVs? Microsoft has stated it will cooperate with the Commission’s inquiry.

3. Horizontal probe: is the DMA fit for cloud?​

Crucially, the Commission also launched a horizontal study to determine whether the DMA — conceived for consumer-facing core platform services — can be mapped to enterprise cloud markets without producing untenable legal or technical mismatches. The DMA uses quantitative thresholds (user counts, EU turnover) that were not written with enterprise contract values or infrastructure capacity in mind; the Commission’s third probe will test whether those instruments are suitable or require sector-specific tailoring.
The Commission has set a target to conclude these inquiries in roughly 12 months, although complex technical investigations often vary in duration depending on the volume of evidence and stakeholder engagement.

---

Why the Commission moved now: converging drivers​

Several converging dynamics created the political and technical imperative for Brussels to act:

• Market concentration and structural barriers. Independent trackers and national authorities show that the top hyperscalers capture a very large share of public-cloud expenditure in EU markets. When scale confers persistent cost advantages, markets can ossify in ways that make entry and effective competition difficult.
• Switching friction and vendor lock-in. Practices such as high egress charges, proprietary managed services, and licensing differentials (notably for key enterprise software) can materially raise the cost and complexity of migrating workloads away from an incumbent provider. Regulators have flagged these as classic signs of market power.
• Systemic outages and resilience risk. Recent high-profile incidents at major hyperscalers have shown how faults in control-plane primitives (DNS, global edge fabrics, managed databases) can cascade widely, affecting public services and businesses. That operational fragility converts competition questions into broader public-interest concerns about resilience.
• The AI accelerant. Generative AI and large-scale model training concentrate demand for specialised hardware, software stacks and integrated services. Hyperscalers’ ability to bundle proprietary AI tooling and specialised accelerators increases the strategic value of cloud lock-in and raises the stakes for contestability in AI markets.
• Digital sovereignty and political appetite. Policymakers in the EU have an explicit industrial and strategic policy interest in ensuring that Europe retains choice, control and resilience across critical infrastructure layers — cloud being foremost among them. This political context increases the likelihood of robust intervention where evidence of harm exists.

---

What investigators will look at (technical and commercial lines of inquiry)​

The Commission’s inquiries will combine economic market analysis with deep technical fact-finding. Expect teams to focus on:

• Gatekeeper designation criteria. How to map DMA quantitative thresholds and qualitative tests — designed for consumer platforms — to cloud services that serve business customers and public-sector buyers.
• Data portability and egress practices. Whether egress fees and technical obstacles are set in ways that materially hinder exit and migration, and whether migration tooling and documented procedures enable practical, cost-effective moves.
• Licensing and pricing structures. Whether bundling or preferential licensing (for example, discounts tied to running Microsoft workloads on Azure) distort competition and make non-native deployments economically unattractive.
• Self-preferencing and product placement. If marketplace placement, console UX, or performance characteristics effectively favour first-party managed services and disadvantage independent ISVs.
• Interoperability and control-plane access. Whether APIs, control-plane primitives, and runtime features are proprietary in ways that prevent practical multi-cloud operations or fast failover, and whether standardisation is feasible without degrading performance or security.
• Operational resilience and failover. The real-world effectiveness of multi-region or multi-cloud resilience strategies and whether provider practices impede robust failover.

---

Possible regulatory outcomes and likely remedies​

The Commission’s final decisions could span a spectrum of remedies — from highly targeted fixes to full gatekeeper designations — each carrying different market impacts:

1. Designate AWS and/or Azure as DMA gatekeepers for specific cloud core platform services, triggering full DMA obligations (interoperability, non-discrimination, auditability). This would be the most consequential outcome and could impose sweeping operational and compliance requirements on the designated provider.
2. Require targeted, market-specific remedies without a full DMA designation: for example, enforceable caps or standardisation on egress charges, mandatory migration tooling with audited performance guarantees, or non-discrimination commitments for marketplace listings. These measures would be narrower but could materially reduce switching costs.
3. Conclude the DMA is not the appropriate instrument for cloud and recommend a hybrid approach — combining competition law actions, sectoral measures, or new bespoke legislation tailored to cloud and AI. That would create a more gradual, calibrated regulatory path but delay immediate ex-ante constraints.

Each outcome has trade-offs. Broad, prescriptive interoperability mandates could reduce vendor lock-in but risk fragmentation or performance loss if implemented without careful technical design. Conversely, narrowly targeted remedies risk being bypassed through contractual or technical innovation unless crafted with precise technical standards and enforcement mechanisms.

---

What this means for enterprises, public procurers and ISVs​

For IT leaders and procurement teams the Commission’s probes are an immediate signal to accelerate risk-management and portability planning. Practical steps include:

1. Map dependencies: identify workloads, managed services, and data flows tied to single-provider features and quantify migration costs.
2. Strengthen exit clauses: renegotiate contractual egress terms, SLAs and migration guarantees; secure rights to customer-managed encryption keys and EU-based key stores.
3. Prioritise portability: adopt containerisation, open standards, and platform-agnostic orchestration to lower migration friction.
4. Test migrations and failover: run controlled migrations and regular failover drills for mission-critical services to surface hidden dependencies.
5. Engage with regulators: public buyers and industry groups should provide evidence to the Commission’s consultations to shape technically feasible remedies.

Those steps reduce immediate operational risk and also strengthen the evidence base for targeted policy outcomes by producing transparent, auditable documentation of real-world switching costs and technical constraints.

---

Strengths of the Commission’s approach​

• Proactive, systemic view. Treating cloud infrastructure as a potential locus of gatekeeper power recognises the systemic role cloud plays in national infrastructure and AI ecosystems. The approach moves beyond reactive antitrust enforcement to ex-ante risk management.
• Technical focus. The horizontal probe into DMA fitness demonstrates institutional humility: Brussels is not simply shoehorning cloud into an existing framework but is testing whether the DMA’s instruments can be adapted without unintended technical consequences.
• Alignment with resilience goals. Investigating cloud market structure in the wake of outages aligns competition policy with resilience and digital-sovereignty objectives, which is particularly important for critical public services.

---

Risks, costs, and potential unintended consequences​

• Technical feasibility vs. prescriptive regulation. Imposing technical interoperability or open-control plane requirements risks degrading performance and security if standards are rushed or naive; cloud control planes are highly optimised and complex. Any interoperability mandate must be narrowly targeted, technically precise, and developed with industry input.
• Investment disincentives. Large-scale cloud providers argue that onerous ex-ante obligations could reduce incentives to invest in expensive, specialised infrastructure (data centres, AI accelerators). Poorly calibrated remedies could slow infrastructure rollout in Europe and raise costs for customers.
• Fragmentation risk. Divergent regulatory regimes (EU DMA application to cloud vs. US/other jurisdictions' approaches) could increase legal-compliance complexity and lead to fragmented technical standards that undermine cross-border interoperability.
• Litigation and long timelines. Gatekeeper designations and subsequent compliance obligations are likely to be litigated and subjected to political pressure; this could delay the implementation of remedies and create extended uncertainty for enterprise customers.

---

How the market and stakeholders will likely respond​

• Rapid evidence and technical submissions. AWS, Microsoft and industry groups will mobilise engineering, legal and economics teams to supply detailed evidence to the Commission and to propose alternative, less intrusive fixes where possible.
• Targeted concessions. Providers may announce commercial concessions (improved migration tooling, clarified egress pricing, expanded local key-management features) to reduce regulatory exposure while resisting structural obligations.
• Policy diplomacy. Expect active engagement from US government trade and technology officials, industry associations, and EU member-state actors seeking to balance investment, sovereignty and competition objectives.
• Customer behaviour shifts. Large public-sector buyers and sophisticated enterprises may accelerate multi-cloud strategies, insist on stronger exit rights and demand more transparent auditability as immediate defensive steps.

---

What to watch next (timeline and milestone signals)​

• Publication of formal case openings and the Commission’s statement of issues — this will clarify the Commission’s preliminary theory of harm and the specific evidence it seeks.
• Requests for information, retention orders, and technical annexes — these indicate the depth of the Commission’s technical inquiry and the areas where it expects detailed proof.
• Parallel national regulator actions (CMA, national competition authorities) — coordination or divergence here will shape the scope and strength of remedies.
• Public and industry responses from Microsoft, Amazon, major customer groups and cloud-native ISVs — concessions or counterproposals will be telling about where compromise may arise.

---

Caveats and unverifiable threads​

Some early reporting referenced briefings attributed to anonymous sources (including a Bloomberg item cited by secondary accounts). Those attributions were repeated in early coverage but are not uniformly traceable to a single, independently verifiable Commission notice. Readers should treat anonymous-source attributions with caution and prioritise formal Commission statements and published case openings for definitive facts.

---

Conclusion​

The European Commission’s decision to open three DMA-related probes into AWS and Microsoft Azure marks a pivotal escalation in cloud regulation. It brings the EU’s most powerful ex-ante digital rules to bear on the infrastructure layer that underpins modern computing and generative AI. The inquiries squarely confront entrenched market concentration, switching frictions and resilience risks while also testing whether a consumer-platform-oriented regulatory tool can be sensibly adapted to enterprise infrastructure.
For cloud providers the stakes are regulatory and reputational: designations or remedy orders would force operational change and likely reshape commercial models. For enterprises and public procurers the probes underscore the urgency of documenting dependencies, hardening exit rights and investing in portability. For European policymakers the challenge is to craft technically precise, evidence-based remedies that enhance contestability and resilience without undermining the scale economics that sustain cloud security and innovation.
Over the coming 12 months, expect intense technical engagement, legal arguments and stakeholder lobbying. The outcome will influence not only how clouds are regulated in Europe but also how global markets reconcile the competing imperatives of competition, investment and strategic sovereignty.

---

Source: Investing.com Microsoft and Amazon face EU cloud computing probe under DMA By Investing.com