AWS and Azure on the verge of becoming 'guardians' in the EU cloud: what changes for businesses

The European Commission formally opened market investigations in November 2025 to assess whether Amazon and Microsoft's cloud services should be subject to the Digital Markets Act (DMA). On June 25, 2026, the European Executive notified both companies of its preliminary position: it considers that Amazon Web Services (AWS) and Microsoft Azure should be designated as gatekeepers or access guardians, despite not meeting the standard quantitative thresholds of the regulation.

According to Bloomberg reports cited by various media, the Commission is preparing the final findings with a decision expected for November 2026. This deadline coincides with the twelve-month limit set to close the formal investigation. Until the final decision is published, Amazon and Microsoft retain their right to defend themselves and submit allegations that could modify the preliminary conclusions.

The designation of gatekeepers under the DMA is usually based on clear quantitative criteria: a market capitalization exceeding 75 billion euros and at least 45 million monthly active users in the EU. Neither AWS nor Azure directly reaches these thresholds, as their main clients are businesses and not individual end-users.

However, the Commission has resorted to qualitative criteria to justify the measure. Teresa Ribera, Executive Vice-President for Clean, Fair and Competitive Transition, argued that European dependence on the cloud is growing and that these services act as critical infrastructure. Henna Virkkunen, Executive Vice-President for Technological Sovereignty, added that more than half of EU companies rely on these services, making them essential gateways between businesses and their clients.

If the designation is confirmed, AWS and Azure will have six months to adapt their services to the DMA obligations. The main focus of the regulation is to combat vendor lock-in, a practice that makes switching platforms difficult due to high technical and contractual costs.

The most relevant obligations for the cloud sector include:

• Forced interoperability: clients will be able to port their data and workloads between providers without artificial technical frictions.
• Data portability: excessive fees and technical barriers for information extraction will be limited.
• Self-preferencing restriction: prioritizing own AI or software services over third-party ones in cloud offers will be prohibited.
• Contractual transparency: clarity in exit conditions and costs associated with migration will be required.

For organizations operating in Europe, this measure does not imply an immediate change in infrastructure, but it alters the balance of power in contractual negotiations. The regulation aims to make switching providers a viable commercial decision and not a technical odyssey. This is especially relevant for companies with complex architectures where data portability is a critical factor of cost and risk.

However, experts warn that the regulation will not make a deeply integrated cloud environment portable overnight. Companies must use this period to audit their dependence on proprietary services and document their data flows. The ability to migrate with guarantees will become a more important purchase criterion than simple feature availability.

This designation is part of a broader EU strategy to strengthen its digital sovereignty. The Commission has indicated that AWS and Azure jointly control approximately 70% of cloud revenue in Europe, a concentration that limits competition and innovation from alternative providers.

The measure aligns with other initiatives such as the EU Data Act and the NIS2 directive, which reinforce portability and cybersecurity. By subjecting the two dominant providers to the same rules as large consumer platforms, the EU seeks to create a more level playing field that allows European and third-party providers to compete on equal terms.

The DMA provides for severe sanctions for gatekeepers that fail to meet their obligations. Fines can reach 10% of global revenues of the company in case of serious infringement, and up to 20% in case of recurrence. Additionally, the Commission can impose interim measures or require structural changes if it considers that behavioral obligations are not sufficient.

For Amazon and Microsoft, the risk is not only financial but also reputational. Being designated as access guardians in the cloud sector could influence the purchasing decisions of large European corporations and public administrations, which increasingly prioritize technological neutrality and exit capability in their contracts.