Will AWS and Azure Become "Gatekeepers"? The EU's Cloud Lock-In Investigation and an Exit Strategy for Businesses

In brief: In June 2026 the European Commission gave a preliminary view that Amazon Web Services (AWS) and Microsoft Azure's cloud services should be designated as “gatekeepers” under the Digital Markets Act (DMA). The Commission's reasoning (per secondary sources): AWS and Azure are the EU's largest and second-largest cloud providers and important gateways for businesses; although they fall below the DMA's quantitative thresholds, their revenues, investments, entrenched user bases and lock-in effects justify it. The decision is not final; both companies criticised the preliminary assessment and, per secondary sources, a final decision is expected toward year-end. If designated, interoperability duties, limits on customer lock-in and restrictions on self-preferencing could follow. This article describes the exit and portability preparation businesses can do without waiting for the likely outcome. Sources: SCL, Computerworld, The Next Web (23 October 2026). I could not directly reach the Commission's own press release; confirm details from the official source.

Last updated: 23 October 2026

What does gatekeeper mean?

The Digital Markets Act (DMA) sets fair-competition rules for large “gatekeeper” platforms in the EU. A company designated as a gatekeeper must avoid behaviour such as favouring its own services, making it hard for users to switch to rival services and restricting data portability. Per secondary sources, fines for breaches can reach 10% of global turnover (20% for repeat breaches).

What is special here: AWS and Azure fall below the DMA's quantitative thresholds; the Commission is considering designating them through a market investigation and a qualitative assessment. Per secondary sources the Commission opened two separate market investigations on 18 November 2025; a third probe looks at whether the DMA can address cloud competition problems such as interoperability and data access.

What is cloud lock-in (vendor lock-in)?

You become so tied to one cloud provider that moving to another becomes very costly, long or risky. Typical causes:

• Provider-specific services: Databases, queues, serverless and AI services that exist only in that cloud.
• Data egress fees: The transfer cost paid when moving your data out of the cloud.
• Skill dependence: The team knowing only one cloud.
• Contract ties: Long-term commitments and discount structures.
• Integration ties: Layers such as identity, monitoring and security being intertwined with one cloud.

Lock-in is not bad in itself: a provider's special services give speed and convenience. The problem is unconscious lock-in.

Why should this decision concern you?

• Companies in many countries use AWS/Azure, especially those serving the EU and holding data in EU regions.
• If a decision comes, the portability and interoperability conditions offered to EU customers may change.
• Whether or not it changes, regulators entering this topic shows that cloud dependence is a real business risk.

But let us also stress: the scope and timing of the decision are uncertain. Preparing “without waiting” will help you whatever the outcome.

An exit strategy: 8 practical steps

1. Cloud inventory: Which services do you use, which are provider-specific and which are standard (e.g. standard databases, containers)?
2. Criticality classification: Which systems stop the business if they fail? Make a portability plan for those first.
3. Lean on standards: Where possible prefer open standards and portable technologies (containers, standard SQL databases, open source tools). For technology choice see our tech stack guide.
4. Keep data portable: Regular, verified, off-cloud backups; export in open formats. See our data migration guide.
5. Calculate exit cost: Estimate a “migration cost” including data egress fees, re-architecture, re-testing and team training.
6. Read the contract: Commitment terms, termination conditions, data return/deletion and price-increase clauses. See our contract checklist.
7. Use multi-cloud deliberately: Running everything in two clouds is costly and complex; a backup/alternative plan for the critical parts may be enough.
8. Rehearse: At least once a year, try on a small scale running a critical system in another environment.

What not to do

• Running everything in two places in the name of “multi-cloud:” Cost and complexity rise.
• Banning provider-specific services entirely: You lose the speed advantage; what matters is a conscious choice.
• Leaving the exit plan to “if needed, later:” You can't plan in the middle of a crisis.

A plain guide for small businesses

• Start with standard technologies (e.g. containers and a standard database).
• Take a regular off-cloud backup of your data and try restoring it.
• Track your invoices and data egress fees.
• Ask your software team/agency in writing which services are provider-specific.

Cloud and architecture with Aktaş Digital

In new projects we design a cloud architecture that balances portability, cost and security; for existing systems we can do a dependency and exit-cost analysis. To get a scope and cost breakdown, use our quote form. Related services: web applications and SaaS platform development.

Frequently Asked Questions

Is the decision final?

No. The Commission gave a preliminary view; the companies can respond and, per secondary sources, a final decision is expected toward year-end. Timing may change.

Will the decision affect my bill?

Uncertain. The possible obligations concern interoperability and limiting lock-in; the effect on prices cannot be predicted at present.

Is it possible to avoid cloud lock-in entirely?

Practically no; the aim is to keep lock-in conscious and measured.

Does it concern a company outside the EU?

The DMA obligations directly bind gatekeepers in the EU; but companies that serve the EU or use cloud in EU regions can be affected indirectly. Consult an expert for a legal assessment.

Should I change clouds right away?

No. First produce an inventory, exit cost and portability plan; if a move is needed, do it in a controlled way.

Conclusion

The EU's assessment of AWS and Azure shows cloud dependence is on regulators' agenda. Whatever the decision, portable data, standard technologies and a tested exit plan protect your business. The first thing you can do today: list the cloud services you use in two columns, “standard” and “provider-specific.”