EU Flags AWS and Azure as DMA Gatekeepers — 25 June 2026: What Every UK Business Running Cloud Needs to Do Now

On 25 June 2026 the European Commission delivered a decision that quietly redraws the map of the cloud-computing industry. In a preliminary finding addressed to Amazon and Microsoft, the Commission set out the view that Amazon Web Services and Microsoft Azure should be designated as “gatekeepers” under the Digital Markets Act (DMA) — the EU’s flagship rulebook for the most powerful digital platforms. It is the first time the DMA’s gatekeeper machinery has reached into cloud infrastructure itself, the layer on which almost every modern business now runs. For the operators of the two largest cloud platforms on earth, it is the opening move in a regulatory process that, if it runs its course, will force open data portability, mandate interoperability and prohibit self-preferencing within their sprawling service estates.

What makes the 25 June finding striking is how the Commission reached it. Neither AWS nor Azure met the standard quantitative thresholds the DMA normally uses to identify a gatekeeper — the €7.5 billion of EU-specific annual turnover, the 45 million monthly active end users, the 10,000 yearly active business users. Instead, the Commission invoked its discretionary qualitative designation power, arguing that both platforms hold an entrenched and durable position regardless of the headline numbers. It cited deep customer lock-in, punishingly high switching costs, and the increasingly decisive role that each platform’s artificial-intelligence portfolio now plays in cloud procurement. For UK SME leaders the immediate question is not one of legal compliance — Brexit places UK businesses outside the DMA’s direct obligations — but one of strategy: how deeply is your organisation embedded in AWS or Azure, what would it actually cost you to move, and does your IT roadmap account for a regulatory environment that is now actively trying to lower those switching costs? This article unpacks the finding, the timeline, the market context, and the 10-step cloud-strategy programme every UK business running on these platforms should run this quarter.

What the European Commission Actually Decided on 25 June 2026

The Commission’s announcement is a preliminary position, not a final ruling. In plain terms, the regulator has told Amazon and Microsoft that, on the evidence gathered so far, it considers AWS and Azure to be gatekeepers for cloud-computing services within the meaning of the DMA. Both companies now have the right of defence: they may respond in writing, present arguments and supporting data, and contest the Commission’s reasoning before any final decision is taken. A stakeholder roundtable is scheduled for 1 July 2026, at which competitors, customers and industry bodies will give evidence on the state of competition in the cloud market. Only after that process concludes will the Commission decide whether to confirm the designation.

The substance of the finding rests on three arguments. First, the Commission concluded that the operational capacity and capital investment of AWS and Azure have “significantly outpaced” their rivals — the scale of their data-centre footprints, global networks and engineering resources places them in a category of their own. Second, it found that both platforms benefit from pronounced lock-in effects and high switching costs: once an organisation builds on a platform’s proprietary services, the technical and commercial cost of leaving rises steeply over time. Third, and most contemporary, it judged that each platform’s AI portfolio has become “a decisive factor in cloud procurement” — buyers increasingly choose a cloud not only for compute and storage but for the AI models, accelerators and tooling bundled alongside it, deepening the gravitational pull of the incumbents.

Two senior Commission figures framed the decision. Teresa Ribera, Executive Vice-President for Competition, said that “cloud services must be provided in a fair, open and competitive environment”. Henna Virkkunen, Executive Vice-President for Technological Sovereignty, added that “cloud services have become a cornerstone of Europe’s economy — and a prerequisite for AI”, noting that more than half of EU businesses now depend on them. The language matters: the Commission is positioning cloud not as a discretionary IT purchase but as critical economic infrastructure, and treating concentration in that infrastructure as a matter of strategic concern rather than ordinary competition policy.

How We Got Here — The DMA Cloud Timeline

The 25 June finding did not appear from nowhere. It is the latest step in a deliberate, months-long investigative process, and understanding the chronology helps UK leaders judge how fast the consequences could arrive.

The Cloud Market the Commission Is Looking At

To understand why the regulator acted, it helps to see the shape of the market. Global cloud-infrastructure spending grew 35 per cent year on year to reach roughly $129 billion in the first quarter of 2026, according to Synergy Research Group. Within that expanding pie, the distribution of share is remarkably stable and remarkably concentrated. The chart below shows the approximate global market positions the Commission is weighing — and the gap between the top two and everyone else is exactly the concentration the DMA was designed to scrutinise.

The figures explain the regulator’s logic. AWS and Azure together account for roughly half of all global cloud-infrastructure spending; add Google Cloud and the top three hold close to two-thirds. The remaining third is fragmented across dozens of regional and specialist providers, none of which has the capital base to build a competing global platform from scratch. When a market grows 35 per cent a year and the leaders keep their share, scale compounds rather than erodes — which is precisely the dynamic the Commission described when it said the incumbents had “significantly outpaced” their competitors. For UK SMEs the practical reading is simple: you are almost certainly buying from one of the top two, and the structural forces that made them dominant are not weakening.

The Thresholds That Were Not Met — And Why It Did Not Matter

One of the most important technical points in the 25 June finding is that AWS and Azure did not trip the DMA’s automatic, quantitative gatekeeper thresholds for their cloud-specific businesses. The Act sets numerical tests that, when met, create a presumption of gatekeeper status. The Commission’s finding turned instead on its qualitative, discretionary power — a deliberate signal that the headline numbers are not the only route to designation. The donut below shows the relationship between the two paths.

The three quantitative thresholds the Commission looked at were a cloud-specific EU annual turnover of €7.5 billion, 45 million monthly active end users in the EU, and 10,000 yearly active EU business users. On the cloud-services figures the Commission examined, none of these was clearly met — which is itself revealing about how the hyperscalers structure and report their cloud revenue. Rather than treat that as the end of the matter, the regulator used the provision in the DMA that allows it to designate a platform as a gatekeeper following a market investigation where the qualitative criteria — durable, entrenched position; significant impact on the internal market; an important gateway for business users to reach customers — are satisfied. The message to every dominant platform is unambiguous: structuring your revenue to stay below a numeric line will not, on its own, keep you outside the rules.

Where UK SMEs Are Most Exposed to Cloud Lock-In

The regulator’s central finding — that switching costs are high — is not an abstraction. It maps directly onto the architecture decisions UK businesses make every week. The score grid below rates the most common sources of lock-in by how hard they typically are to unwind. Use it as a self-assessment: the more “high” rows that describe your estate, the more deliberate your cloud strategy needs to be.

The pattern is consistent: the more “managed” and proprietary a service is, the more convenient it is to adopt and the harder it is to leave. That is not an argument against using managed services — they deliver real operational value — but it is an argument for adopting them with eyes open, knowing which decisions are reversible and which are effectively one-way doors. The DMA finding is, in a sense, the regulator publishing the same observation at industry scale.

What a Cloud Lock-In Audit Costs by Business Size

A lock-in audit is not a vague exercise — it is a scoped piece of work whose effort scales with the size and complexity of your estate. The indicative bands below reflect the typical shape of a UK SME cloud assessment: mapping every workload, classifying its portability, quantifying egress and switching costs, and producing a prioritised roadmap. Figures are indicative planning ranges, not quotes.

The point of the audit is not necessarily to leave your current provider — for most UK SMEs, AWS or Azure remains the right home for the majority of workloads. The point is to know your position: which workloads are portable, what an exit would actually cost, where a second provider or an open-standards approach reduces risk, and how to negotiate from a position of knowledge rather than dependence. That knowledge is exactly what the DMA is trying to give every European buyer by regulation; a good audit gives it to you directly.

Reactive Dependence vs Deliberate Cloud Strategy

The DMA finding draws a sharp line between two ways of relating to a cloud platform. Most organisations drift into the first without ever deciding to. The comparison below sets out the difference, and where a managed approach takes you.

The 10-Step Cloud-Strategy Programme for UK SMEs

You do not need to react to the DMA finding with a panicked migration. You need a structured programme that turns an unmanaged dependency into a managed strategy. The ten steps below are the sequence Cloudswitched runs with clients, each with an indicative readiness weighting showing how far the typical SME has already progressed.

The early steps — inventory and classification — are achievable for almost any UK SME within a fortnight and deliver disproportionate value: most organisations have never produced a single, authoritative list of every cloud workload and where its data lives. The later steps are where strategy is made, and where an experienced managed partner earns its keep, because they involve trade-offs between cost, resilience, performance and reversibility that are hard to weigh from the inside.

In Cloudswitched assessments, the average UK SME scores in the high-30s out of 100 on cloud readiness — not because their platforms are wrong, but because dependence has accumulated without a plan. The good news is that the score moves quickly once the first three programme steps are complete, because clarity is most of the battle.

At a Glance — The Key Facts

How This Connects to the Wider Regulatory and Technology Picture

This finding does not sit in isolation. It is part of a broader European push to govern the foundations of the digital economy, and it intersects with several stories Cloudswitched has covered recently. The same EU institution driving the cloud finding is enforcing the EU AI Act transparency deadline of 2 August 2026, which carries its own extraterritorial reach into UK businesses — and the Commission’s emphasis that AI is now “a prerequisite” for cloud ties the two directly together. On the data-protection and resilience side, the lock-in conversation is inseparable from how you back up and recover your data, a theme we explored in our guide to the 3-2-1-1-0 backup rule for UK SMEs. Security agencies are also sounding the alarm on AI-enabled threats, as set out in the Five Eyes AI cyber warning — a reminder that concentration of infrastructure is also a concentration of attack surface. And for businesses weighing how AI procurement shapes platform choice, our coverage of Microsoft 365 Copilot’s default model changes shows how quickly the AI layer of a cloud platform can shift beneath your feet.

Frequently Asked Questions

CloudSwitched

London-based managed IT services provider offering support, cloud solutions and cybersecurity for SMEs.