CMA: Provisional decision on cloud services

CMA: Provisional decision on cloud services

With the recommendation to utilise powers under the DMCC Act, the CMA could be the first regulator to impose asymmetric obligations in the cloud market

The CMA has provisionally recommended that AWS and Microsoft be referred for an SMS investigation in the cloud market

On 28 January 2025, the UK’s Competition and Markets Authority (CMA) issued its provisional decision in its market study on cloud services. The study was opened in October 2023, following a referral of the market to the CMA by Ofcom, which previously completed its own study into the cloud services market. The provisional decision follows the CMA’s working paper on remedies published in June 2024 that largely discounted the potential of structural remedies, such as requiring firms to sell off their cloud business. The CMA also published an updated issues statement in the same month, which highlighted the shift of competition in the market from providers competing for new cloud adopters to competing for the growing workloads of existing users, emphasising the importance of switching and multi-cloud to their ongoing analysis. With these developments in mind, the CMA has provisionally identified competition concerns within the cloud market that it proposes require regulatory intervention. Specifically, the regulator recommends that Amazon Web Services (AWS) and Microsoft be referred for strategic market status (SMS) investigations through its powers under the Digital Markets, Competition and Consumers (DMCC) Act. The CMA is accepting public comment on the provisional decision until 18 February 2025, with a final decision on its inquiry required by 4 August 2025.

Given the concentration of revenue among the highest spending cloud adopters, switching and multi-cloud are key dynamics for sustainable competition

The CMA defines the cloud services market as encompassing both infrastructure as a service (IaaS) and platform as a service (PaaS) provision and identifies Microsoft and AWS as each capturing as much as 40% of these subsectors, with Google ranking in a distant third. According to the regulator’s analysis, the top 1% of cloud users by spend account for over half of total revenues in the sector and are more likely to adopt a multi-cloud solution (i.e. splitting workloads across multiple cloud services), although spending still tends to be concentrated with a primary provider in these scenarios. With these dynamics in mind, the CMA identified both technical and commercial barriers to switching providers and using multi-cloud solutions. Specifically, egress fees charged for porting data to switch or adopt multiple cloud services as well as restrictive software licensing terms adopted by Microsoft are viewed as impediments to competition and limits on innovation. Committed spend agreements were not, however, identified as having adverse effects on competition despite Ofcom’s earlier identification of concerns with volume discounting. The CMA framed its findings as critical to supporting economic growth, citing the £9bn spent on cloud services in the UK in 2023 – a figure that has been growing annually by 30%. By way of illustration, the regulator offered that even a 5% increase in prices due to anti-competitive conduct would have cost the UK £430m in 2023, a figure that will only continue to grow with increased cloud spending and that doesn’t reflect additional losses in quality of service or innovation.

This is the third time the CMA has concluded an ex-post inquiry in favour of using its powers under the DMCC Act

To remedy these harms, the CMA recommends that the Digital Markets Unit (DMU) conduct SMS investigations into Microsoft and AWS, marking the third instance in which the regulator has referred concerns arising from ex-post enforcement activity to its tools under the ex-ante DMCC Act regime. The CMA previously closed inquiries into Apple and Google’s mobile ecosystems and app stores in favour of launching SMS investigations, citing the flexibility and continued monitoring capacity offered by the DMCC Act as more likely to prevent circumvention or distortion. The CMA considered both the provision of cloud computing to AI foundational model developers as well as the linking of AI services to cloud services by the largest cloud providers as one such context in which continued monitoring and the power to construct iterative remedies would be important to sustained competition. While the dynamics of the foundation model market today are not fixed, the regulator does note the potential for partnerships between AI firms and cloud providers to foster anti-competitive behaviour in both markets in the future that could require intervention.

The UK could be the first country to impose asymmetric regulations on cloud providers, though the EU’s Data Act addresses similar concerns

With its provisional decision, the CMA joins a number of other regulators from around the world in issuing findings on the functioning of the cloud market. According to our Market Power Inquiries benchmark in our Platforms and Big Tech Tracker, eight inquiries on cloud services in eight different countries have been opened since 2020. The CMA’s findings are nonetheless notable among its peers as the first decision to recommend intervention through ex-ante competition regulation and the imposition of asymmetric obligations. Both the Autorité de la concurrence (AdC) in France and the Authority for Consumers and Markets (ACM) in the Netherlands have previously pointed to the horizontal provisions of the EU’s Data Act – including limits on egress fees and interoperability requirements – as effective interventions to sustain competition in the market. The contrast is notable in light of the criticism faced by the EC on its continued refusal to designate cloud services providers as gatekeepers offering core platform services under the Digital Markets Act (DMA). With the CMA expecting to launch an additional SMS investigation around June 2025, the UK may be poised to lead globally on stronger intervention into the cloud market and could influence the ongoing inquiries in Denmark and Spain as well as any future investigations that may arise.