EU moves to designate AWS and Azure as DMA gatekeepers

The European Commission has told Amazon and Microsoft it believes their cloud services should fall under Europe’s toughest tech law. On 25 June 2026 the Commission announced a preliminary position that Amazon Web Services and Microsoft Azure, the two largest cloud providers in the EU, should be designated as gatekeepers under the Digital Markets Act. It is a preliminary view rather than a final ruling, and both companies can respond before the Commission decides.

What happened

According to the European Commission, AWS and Azure are the largest and second largest cloud computing services in the EU and act as an important gateway between businesses and their customers. The Commission reached that position even though the two services do not meet the DMA’s quantitative thresholds for automatic designation, using a market investigation to look at their actual market role instead.

The reasoning centres on entrenchment. The Commission found vast and established user bases, lock-in effects, high switching costs, and large surrounding ecosystems. It also singled out artificial intelligence: the portfolio of AI tools and AI-cloud partnerships has become a decisive factor in how organisations choose a cloud provider, which deepens the dependency.

“Cloud services have become a cornerstone of Europe’s economy - and a prerequisite for AI.”

Henna Virkkunen, European Commission Executive Vice-President for Tech Sovereignty, Security and Democracy

Amazon and Microsoft now have the opportunity to submit their views before any final decision is taken. If the Commission confirms the designation, the two services would take on the DMA’s gatekeeper obligations, which under the law apply within six months of a designation.

A gatekeeper is a large platform the DMA treats as an unavoidable gateway between businesses and their customers, and designation brings a fixed set of do’s and don’ts rather than case-by-case investigation. In practice the rules push against lock-in: a gatekeeper must let business users port their data and access the data they generate on the platform, cannot use a customer’s non-public data to compete against them, and has to offer fair, non-discriminatory terms rather than quietly favouring its own services. For cloud, that is aimed squarely at making it easier for a customer to move workloads or run across more than one provider. Breaches can draw fines of up to 10% of global annual turnover, rising to 20% for repeat offences.

Why it matters

The move widens the DMA well beyond the consumer platforms most people associate with it. Search, app stores, messaging, and social networks were the first wave. Cloud infrastructure is the layer underneath almost everything a modern brand runs, from its website and store locator to its data warehouse and its AI tooling. Bringing that layer inside the DMA signals that the EU intends to police digital dependency at the infrastructure level, not just at the app level.

For European businesses the immediate change is small, because this is a preliminary step. The direction of travel is not small. The same regulatory logic that is reshaping how Google, Apple, and Meta must behave in local search and discovery is now being pointed at the providers that host the data and models behind those experiences.

What this means for multi-location brands

This is an infrastructure story, so treat it as context rather than a task for your local marketing team this week. A national retailer, a dealer group, a pharmacy network, or an EV-charging operator does not need to change how it manages listings because of a preliminary cloud designation. The question it should prompt is a governance one, asked once and across the whole estate.

Know where your location and customer data lives and under which obligations. When you manage presence for hundreds or thousands of locations through a multi-location marketing platform and its API suite, and when a business locations data API syncs that data to Google, Apple, and the rest, the hosting and compliance posture of every vendor in that chain becomes part of your risk picture. PinMeTo hosts customer data in the EU and holds ISO 27001 certification, which is the kind of question worth putting to any platform that touches your data. As DMA enforcement reaches deeper into the stack, European multi-location brands that already treat data residency and vendor obligations as governance decisions will have less to reconcile later.

The bottom line

Nothing about AWS or Azure changes today, and the designation is not final. But the EU has made clear that the DMA is not finished expanding, and that cloud and AI dependency are now in scope. For multi-location brands, the takeaway is to keep asking where data sits and under whose rules, because the regulatory ground under the whole platform stack is still moving.