Executive summary
For the first time, the EU is preparing to apply its flagship platform law to cloud infrastructure rather than consumer services. The European Commission plans to name AWS and Azure as gatekeepers under the Digital Markets Act in November, The Next Web reported on 2 October citing Bloomberg; the decision is still a draft and its timing could slip. If confirmed, a six-month compliance window would land almost exactly as the Data Act’s ban on cloud switching charges takes effect on 12 January 2027. For banks and Fintechs, the practical consequence is that exit and portability move from an audit-ready document to an enforceable commercial level. The window to use it is this quarter. Source: The Next Web (citing Bloomberg)
Key statistics: AWS, Microsoft Azure and Google Cloud together accounted for 67% of all cloud infrastructure revenue in Q2 2026, up from 63% in Q3 2025, according to Synergy Research.
The development
On 25 June 2026 the Commission informed Amazon and Microsoft of its preliminary view that AWS and Azure should be designated as gatekeepers for their cloud computing services, finding that the two largest cloud services in the EU act as an important gateway between businesses and their customers. The investigations opened in November 2025; the DMA gives the Commission about a year to complete such reviews, which fits the November date.
The route is unusual. The DMA presumes gatekeeper status once a firm crosses quantitative thresholds (EEA turnover of €7.5 billion or market capitalization of €75 billion, plus 45 million monthly active users). Neither AWS nor Azure meets those thresholds for cloud, so the Commission has used the market-investigation route that allows designation on qualitative criteria alone. That precedent is the real story: centrality in critical infrastructure can trigger platform obligations on its own. Source: European Commission
An AWS spokesperson said the EU already regulates cloud through the Data Act and that further rules risk undermining investment and innovation. EU officials state that no conclusive determination has been reached.
What drove it
The investigation was prompted by the concentration of critical digital infrastructure in a few providers, brought into public view by several large outages, including an AWS failure in late October 2025 that disrupted numerous services. The pattern continued this month: Google Cloud’s London zones suffered disruption on 20 October affecting multiple services. The Commission also listed AI tools and AI-cloud partnerships as a decisive factor in cloud procurement, linking infrastructure lock-in directly to the AI stack.
The timeline below places the DMA process against the Data Act’s switching-charge countdown.
The two proposed gatekeepers hold roughly half of global cloud infrastructure spending; in the EU specifically, the Commission describes them as the first- and second-largest providers.
Banking and FinTech Relevance
Financial institutions are the natural first movers, because they already owe their supervisors most of the evidence the Data Act now requires. A documented Data Act switching evidence pack, covering notice periods, transition and retrieval windows, exportability and functional-equivalence testing, can be reused for DORA’s exit-strategy and transition-period requirements. As switching charges disappear and interoperability specifications follow, exit friction is likely to recede as a differentiator, placing more weight on service quality, security and resilience.
For GCC institutions the EU rules do not apply directly, but they matter in three ways. First, regional supervisors already require documented exit plans: as covered in the September ITS sovereign-cloud article, Qatar Central Bank’s cloud regulation and the Central Bank of the UAE’s outsourcing standards both address vendor lock-in and exit explicitly. The EU’s enforcement model gives those requirements a reference benchmark. Second, global hyperscalers rarely maintain two contract templates; portability terms conceded in Europe tend to propagate. Third, GCC banks with EU subsidiaries or EU-hosted workloads will be inside the regime regardless.
Insight: The price is not cheaper exits. It is the ability to price concentration risk explicitly in every cloud contract, and to shift that risk back to the provider through enforceable portability terms.
Enterprise implications and opportunities
- Contract timing. Advisers are recommending that commitments signed this quarter stay short and that AI spend be kept unbundled, because a three-year commitment runs through designation, the switching-charge ban and the compliance deadline.
- Architecture. Providers are already competing for mobility: Google Cloud’s “Modernize” program, launched 7 October, explicitly targets AWS EKS migrations to GKE. Kubernetes-centric, provider-neutral platforms turn a regulatory obligation into a negotiating position.
- AI procurement. Separate model access from infrastructure commitments so that AI partnerships do not become the next lock-in layer.
Risks and challenges
- Timing. The decision is a draft and may slip.
- Trade politics. The US administration has repeatedly characterized European regulation as discrimination against American companies.
- False comfort. Egress fees can be legislated away; data gravity, proprietary services and skills cannot. Google has said switching fees represent about 2% of the total cost of migrating to a new provider.
Outlook
Expect designation in November or shortly after, intense argument over implementing specifications through 2027, and a wave of “sovereign” product packaging from all three hyperscalers. The strategic question for 2027 is whether regulated enterprises use the window to renegotiate, rearchitect, or both.
Executive takeaways
- Build the exit-evidence pack now; it satisfies DORA (or QCB/CBUAE equivalents) and strengthens every cloud negotiation before January 2027.
- Keep commitments inside the regulatory transition and separate AI spend from infrastructure spend.
- Put a cloud-concentration metric in front of the board alongside credit and liquidity risk.
- Track the implementing standards, not the headlines; they decide whether portability is real.
- Treat sovereignty as a product category with a premium, and test whether the controls are substantive.
