7MAY

Commission says DMA is fit, eyes cloud

2 min read

10:13UTC

The European Commission published its first Digital Markets Act review on Tuesday 28 April, finding the law fit for purpose and naming cloud services and AI as priorities for future enforcement expansion. The consultation received 450-plus responses.

← Back to CISPE moves first; Brussels misses again Jump to analysis ↓

TechnologyDeveloping

Key takeaway

The Commission's first DMA review names cloud and AI as the next enforcement priority.

The European Commission published its first Digital Markets Act (DMA) Review Report, filed as COM(2026) 178, on Tuesday 28 April ¹. The report concludes the law is "fit for purpose" and identifies cloud services and artificial intelligence as critical priorities for future enforcement expansion. The consultation drew 450-plus responses.

The review lands on the back of an active enforcement run. The Commission served preliminary DMA measures on Alphabet over Article 6(11) on 16 April , and earlier this year fined Apple €500 million, Meta €200 million under the DMA, and X €120 million under the Digital Services Act . It opened DMA cloud gatekeeper probes against AWS and Azure last autumn , the same probes that triggered the United States' Section 301 counter-response. Naming cloud and AI as the next expansion priorities does not commit The Commission to designating a cloud gatekeeper, but it is the closest thing to a public statement of direction The Commission has issued since the package slipped.

Deep Analysis

In plain English

The Digital Markets Act (DMA) is an EU law that forces large technology companies like Apple, Google, Meta, and Amazon to play by fairer rules, for example by letting users install apps from outside official app stores, or by requiring companies to share data with rivals. On 28 April 2026, the European Commission published its first formal review of the Act, concluding it is working as intended. More than 450 organisations had submitted comments. The Commission also said it wants to extend the Act's powers to cover cloud services and AI companies in future, which would bring more of the technology sector under these rules.

Source Landscape

This story draws on neutral-leaning sources from Germany, Belgium and 1 more

Belgium×2

Germany

United States

LeftRight

Primary parallel: The European Commission's 2020 review of the ePrivacy Directive found it 'fit for purpose' while simultaneously identifying enforcement gaps that prevented it from achieving its stated objectives. The review produced a recast proposal (ePrivacy Regulation) that remained blocked in Council through 2025. The DMA Review follows the same diagnostic path: confirming adequacy while identifying conditions that make adequacy insufficient.

Counter-parallel: The 2022 review of the EU Platform-to-Business Regulation found it fit for purpose and produced no legislative follow-on; the identified gaps were absorbed into the DMA's broader obligations rather than generating a standalone revision. The DMA Review's cloud and AI findings may follow this aggregation route into existing frameworks rather than triggering new legislation.

Consensus view: Friends of Europe's Dharmendra Kanani argues the 'fit for purpose' finding is a political baseline, not an operational verdict: the Review Report explicitly notes that cloud and AI enforcement requires additional Commission investigatory resources that were not in the 2023 DMA staffing plan, meaning the Act is legally adequate but practically under-resourced for the sectors it most needs to cover.

Counter-view: IISS's Franz-Stefan Gady, assessing the national-security implications of cloud enforcement expansion, contends that extending DMA obligations to military and dual-use cloud infrastructure would be counterproductive, because the Act's interoperability requirements would force security-cleared cloud environments to create API access points that European intelligence services consider operationally unsafe.

The 450-plus consultation responses likely include multiple defence-ministry submissions on exactly this point.

Key tension: Whether The Commission can expand DMA enforcement to cover sovereign cloud and AI without creating a carve-out regime that replicates the regulatory fragmentation the Act was designed to eliminate.

Sources:IT Pro·Handelsblatt·Digital Watch Observatory

Mentions:European Commission →Google →IISS →Digital Markets Act →Meta →United States →Section 301 →Alphabet →Azure →Digital Services Act →Apple →Amazon →

First Reported In

Update #4 · CISPE moves first; Brussels misses again

IT Pro· 7 May 2026

Read original →

Different Perspectives

United States (Google/Alphabet)

Alphabet lost its final Android appeal on 2 July with no further court to hear it, a result its Computer and Communications Industry Association allies frame as precedent, not deterrence, since the €4.1bn fine changed nothing about Google's Play Store terms across eight years of litigation.

UK Department for Science, Innovation and Technology

DSIT opened its £96m second Sovereign AI wave on 3 July, switching from April's equity stakes to fixed-price contracts because Britain has no domestic hyperscaler or Bpifrance-style lender to fund capacity another way. It is betting on buying outcomes it controls alone rather than joining an EU-wide framework.

German federal government

Berlin backed both German deliverables this week, Infineon's fab and Aleph Alpha's merger, but is finding one far harder to close than the other. It wants enforceable protective rights inside Cohere's cap table before the merger closes, a legal instrument the Bundeskartellamt has no filing to review yet.

European Commission

The Commission banked a clean CJEU win on the eight-year Android case on 2 July, removing Google's last comparator argument before President von der Leyen rules on the far larger DMA self-preferencing fine due 27 July. Brussels treats Infineon's early Dresden delivery as proof the Chips Act mechanism works, at the node Europe already led.

Bruegel (EU industry sceptics)

Bruegel economist Mario Mariniello argued the EU sovereignty package mimics US and Chinese strategy while EU cloud providers hold roughly 15% of their home market; using nationality as a proxy for security without fixing the underlying capital and energy gaps that drive the dependency creates €86bn of migration cost without the security benefit it is sold as delivering.

France

France published a joint sovereignty definition with Germany at VivaTech and mobilised €13bn under Tibi Phase 3, placing SAP's partnership with Mistral as the working proof that a German enterprise-software giant running a French sovereign model inside public administration is what digital sovereignty looks like in practice.