Regulation & Policy
Britain’s competition regulator is examining AI choice, security bundles and cloud licensing. Its proposed designation is not a finding of wrongdoing—or an immediate remedy.
By Eleanor Whitcombe, Editor · · 6 min read
Britain’s Competition and Markets Authority is proposing to designate Microsoft’s business software ecosystem with strategic market status, opening the way to possible targeted competition measures. The immediate business issue is whether customers can choose rival AI, security and cloud services without Microsoft’s existing software relationships making that choice impractical. The proposal remains provisional: neither designation nor specific remedies have been settled.
According to the CMA’s announcement on GOV.UK, Microsoft’s business software serves more than a million UK businesses and public-sector organisations, with around 20 million monthly users. Its reach extends from Word, Excel, Outlook, PowerPoint and Teams to Copilot, security products, servers and operating systems. That breadth makes this an inquiry into the workplace’s underlying machinery, not merely its preferred word processor.
The regulator provisionally finds Microsoft strong across all five areas of digital activity it examined: personal-computer operating systems, productivity suites, security software, server operating systems and relational database management systems. Its concern is that switching barriers weaken the competitive pressure other developers can exert, while commercial practices and integration advantages encourage customers to adopt more Microsoft products.
Alongside its proposed designation, the CMA has published an indicative roadmap for gathering evidence and considering interventions. It identifies three particular questions: whether alternative AI providers can compete fairly with Copilot; whether bundled and integrated security products restrict choice; and whether licensing practices constrain the cloud on which customers deploy software. Easier integration for other developers is also part of the proposed work.
These are areas for investigation, not instructions already imposed on Microsoft. Strategic market status does not establish wrongdoing. If designation proceeds, the CMA could consider conduct requirements or pro-competition interventions, but those would still need to meet the relevant legal tests. A proposed regulatory status is not, by itself, an order to unbundle products or rewrite licences.
The CMA’s central argument is that a supplier’s strength can extend beyond the merits of individual applications. Customers may face barriers when replacing software, and developers may struggle to replicate the advantages enjoyed by products integrated into an established ecosystem. A competing service can therefore be available in principle without exerting much pressure in practice. The investigation is concerned with that gap.
AI raises the stakes because new capabilities are arriving inside tools organisations already use. The CMA describes a shift towards agentic AI in familiar workplace software and wants customers to be able to combine services from competing suppliers. Its question is not simply whether Copilot is useful, but whether an organisation can realistically choose something else for particular tasks.
That is distinct from the question of whether AI spending produces a measurable return, examined in our coverage of the gap in measuring AI value. Competition policy concerns the conditions under which buyers choose; value assessment concerns what they receive. Easier access for rival tools would broaden the contest without establishing which product delivers the best results.
Security presents a different version of the same problem. The CMA will examine whether Microsoft’s bundling and integration limit customer choice; it has not announced that integration itself is harmful. The distinction matters because combining products and excluding alternatives are not synonymous. Nor is this a security-performance assessment: the business safeguards raised by the UK cyber bill belong to a separate policy discussion.
Cloud licensing adds a contractual dimension. The CMA wants to determine whether customers have effective choice over where their software licences can be deployed. Technical portability and licensing freedom are separate questions: moving an application is of limited commercial use if the terms governing its software make the destination unattractive. The announcement does not yet prescribe changes to those terms.
For government and critical organisations, the regulator also frames supplier choice as a matter of resilience and strategic autonomy. Dependence on one technology provider is therefore more than a purchasing concern in its analysis. The ability to switch or combine services, especially AI, can affect how much control an organisation retains over its digital operations.
Sarah Cardell, the CMA’s chief executive, argues that organisations should be able to select suitable products, change providers and use Microsoft software alongside alternatives. Her stated objective is greater freedom to combine services, rather than the removal of Microsoft from workplaces. That distinction leaves room for customers to retain familiar applications while choosing competitors elsewhere.
The regulator presents its approach as proportionate and supportive of innovation. It says stronger competition could lower prices and support growth, but the announcement supplies no estimate of savings. Those are intended outcomes, not measured benefits. It also gives no basis for calculating how a particular organisation’s software bill might change.
The source includes no direct response from Microsoft to the proposed business-software designation, or independent customer reactions. Microsoft’s position on the proposal cannot therefore be inferred from it. The evidence presented here is the regulator’s provisional assessment, subject to consultation, rather than an agreed account between the parties.
On cloud services, the CMA reports a more collaborative process with Microsoft and Amazon Web Services, outside a formal designation investigation. It says engagement, including scrutiny of internal data and product developments, has driven material steps towards greater choice. These include connecting data centres with rivals, beginning with Google, and removing transfer charges for customers changing providers while reducing them for customers using multiple clouds.
Other reported developments include a mechanism through which customers and competitors can request greater interoperability, and AI tools intended to automate technical switching tasks. The CMA nevertheless says barriers remain. Its position is therefore neither that voluntary cooperation has failed nor that the cloud market’s switching problems have been solved.
The CMA is inviting views on both the proposed Microsoft designation and the accompanying roadmap. Its statutory deadline for a final designation decision is February 2027. The announcement does not set a date for implementing any particular remedy, so that deadline should not be mistaken for the arrival of new purchasing rights or revised commercial terms.
Further evidence will shape whether, and how, the regulator intervenes. Under the UK’s Digital Markets Competition Regime, it can design measures for specific aspects of a firm’s digital activity, with participation from large suppliers, challengers and consumer groups. The roadmap signals priorities; it does not settle the eventual scope of obligations.
The separate cloud engagement will focus in part on identity and access management across providers. Microsoft and AWS have also agreed to work on removing unnecessary barriers to deploying and migrating cloud architectures designed for portability. These are operational obstacles, distinct from transfer charges: a cheaper exit is not necessarily an easier one.
AI-assisted migration is likewise a proposed means of reducing technical work, not proof that switching will become effortless. That distinction echoes the business-readiness questions surrounding agentic AI: the presence of an automated tool does not itself establish that an organisation can use it effectively. The CMA’s announcement supplies no quantified migration results.
The regulator will publish another cloud update in Spring 2027 and is keeping a full strategic market status investigation under review. That leaves two separate tracks to watch: a designation decision concerning Microsoft’s business software, and continued engagement with Microsoft and AWS over cloud choice. Progress on one does not determine the outcome of the other.
March
The CMA announced stakeholder engagement on Microsoft and AWS commitments to improve cloud customer choice.
February 2027
Statutory deadline for the CMA’s final decision on Microsoft’s proposed business-software designation.
Spring 2027
The CMA plans to publish a further update on its separate cloud-services engagement.
For a UK business owner, the practical stakes sit in contracts and integration work: whether a preferred AI service can operate alongside existing applications, whether security can be bought separately, and whether software licences can follow workloads to another cloud. For US suppliers selling alternatives into Britain, the same questions affect access to customers already embedded in Microsoft’s ecosystem. US buyers should not mistake a UK proposal for a change to their own contractual rights. The commercially important test will be whether any eventual measures make alternatives usable and economical—not simply whether more products appear on a purchasing shortlist.
Original reporting by AI Business Reality Check. Primary source: CMA (GOV.UK).
Regulation & Policy
The reported investigation targets security incidents, safeguards and marketing claims. Washington’s enthusiasm for AI does not necessarily protect its suppliers from existing consumer law.
By Margaret Lund · 16 Oct 2026 · 6 min read
Regulation & Policy
Most data-protection changes took effect in February 2026; the regulator’s restructuring followed in September. Businesses must distinguish commencement dates from earlier forecasts.
By Siobhan Clarke · 15 Oct 2026 · 6 min read
Regulation & Policy
Ministers promise legislation where needed, but officials have yet to commit to AI-specific amendments. Businesses face an unresolved question over what they might have to report—and to whom.
By Priya Sandhu · 15 Oct 2026 · 5 min read
