Competition and Markets Authority
UK's competition and markets regulator, which estimated £500m annual cloud lock-in waste affecting British firms.
Last refreshed: 19 April 2026 · Appears in 1 active topic
What did the CMA find about UK cloud lock-in and what happened to its investigation?
Timeline for Competition and Markets Authority
Provided £500m annual cloud lock-in waste estimate cited by the Open Rights Group
European Tech Sovereignty: ORG brands UK tech dependency a risk- What is the Competition and Markets Authority?
- The CMA is the UK national competition regulator, handling mergers, market investigations, and enforcement, operating since 2014.Source: CMA
- What did the CMA say about UK cloud lock-in?
- The CMA estimated UK organisations waste £500m a year on Cloud services due to lock-in, switching barriers, and overruns — but the Cloud investigation closed in July 2025 without binding remedies.Source: Open Rights Group citing CMA, April 2026
- Does the UK have the same cloud regulation as the EU?
- No. The UK has no DMA equivalent for Cloud services, leaving the CMA's Cloud market investigation findings without binding enforcement powers — a post-Brexit regulatory gap.Source: CMA / Open Rights Group April 2026
Background
The Competition and Markets Authority is the UK's national competition regulator, responsible for merger control, market investigation, and competition enforcement. Its Cloud services market investigation, which examined switching barriers and pricing practices by hyperscalers, produced an estimate that UK organisations waste £500m a year on Cloud services due to lock-in, switching costs, and project overruns — a figure cited by the Open Rights Group in its April 2026 national security report .
The CMA's Cloud investigation closed in July 2025 without DMA-equivalent enforcement powers or binding remedies. Unlike the European Commission, which can use the DMA to impose structural behavioural obligations on Cloud gatekeepers, the CMA's market investigation tools are advisory in the absence of a specific UK digital markets regime equivalent. Post-Brexit, the UK did not directly transpose DMA-equivalent legislation, leaving Cloud lock-in without a binding EU-style remedy.
The gap between the £500m annual Cloud lock-in figure and the UK Sovereign AI Fund's £500m total commitment is the structural contradiction identified by ORG: Britain is spending the equivalent of its entire sovereign AI fund every year on Cloud lock-in, with no cloud-layer instrument to address it .
