7MAY

Commission says DMA is fit, eyes cloud

2 min read

10:13UTC

The European Commission published its first Digital Markets Act review on Tuesday 28 April, finding the law fit for purpose and naming cloud services and AI as priorities for future enforcement expansion. The consultation received 450-plus responses.

← Back to CISPE moves first; Brussels misses again Jump to analysis ↓

TechnologyDeveloping

Key takeaway

The Commission's first DMA review names cloud and AI as the next enforcement priority.

The European Commission published its first Digital Markets Act (DMA) Review Report, filed as COM(2026) 178, on Tuesday 28 April ¹. The report concludes the law is "fit for purpose" and identifies cloud services and artificial intelligence as critical priorities for future enforcement expansion. The consultation drew 450-plus responses.

The review lands on the back of an active enforcement run. the Commission served preliminary DMA measures on Alphabet over Article 6(11) on 16 April , and earlier this year fined Apple €500 million, Meta €200 million under the DMA, and X €120 million under the Digital Services Act . It opened DMA cloud gatekeeper probes against AWS and Azure last autumn , the same probes that triggered the United States' Section 301 counter-response. Naming cloud and AI as the next expansion priorities does not commit the Commission to designating a cloud gatekeeper, but it is the closest thing to a public statement of direction the Commission has issued since the package slipped.

Deep Analysis

In plain English

The Digital Markets Act (DMA) is an EU law that forces large technology companies like Apple, Google, Meta, and Amazon to play by fairer rules, for example by letting users install apps from outside official app stores, or by requiring companies to share data with rivals. On 28 April 2026, the European Commission published its first formal review of the Act, concluding it is working as intended. More than 450 organisations had submitted comments. The Commission also said it wants to extend the Act's powers to cover cloud services and AI companies in future, which would bring more of the technology sector under these rules.

Source Landscape

This story draws on neutral-leaning sources from Germany, Belgium and 1 more

Belgium×2

Germany

United States

LeftRight

Primary parallel: The European Commission's 2020 review of the ePrivacy Directive found it 'fit for purpose' while simultaneously identifying enforcement gaps that prevented it from achieving its stated objectives. The review produced a recast proposal (ePrivacy Regulation) that remained blocked in Council through 2025. The DMA Review follows the same diagnostic path: confirming adequacy while identifying conditions that make adequacy insufficient.

Counter-parallel: The 2022 review of the EU Platform-to-Business Regulation found it fit for purpose and produced no legislative follow-on; the identified gaps were absorbed into the DMA's broader obligations rather than generating a standalone revision. The DMA Review's cloud and AI findings may follow this aggregation route into existing frameworks rather than triggering new legislation.

Consensus view: Friends of Europe's Dharmendra Kanani argues the 'fit for purpose' finding is a political baseline, not an operational verdict: the Review Report explicitly notes that cloud and AI enforcement requires additional Commission investigatory resources that were not in the 2023 DMA staffing plan, meaning the Act is legally adequate but practically under-resourced for the sectors it most needs to cover.

Counter-view: IISS's Franz-Stefan Gady, assessing the national-security implications of cloud enforcement expansion, contends that extending DMA obligations to military and dual-use cloud infrastructure would be counterproductive, because the Act's interoperability requirements would force security-cleared cloud environments to create API access points that European intelligence services consider operationally unsafe.

The 450-plus consultation responses likely include multiple defence-ministry submissions on exactly this point.

Key tension: Whether the Commission can expand DMA enforcement to cover sovereign cloud and AI without creating a carve-out regime that replicates the regulatory fragmentation the Act was designed to eliminate.

Sources:IT Pro·Handelsblatt·Digital Watch Observatory

Mentions:European Commission →Google →IISS →Digital Markets Act →Meta →United States →Section 301 →Alphabet →Azure →Digital Services Act →Apple →Amazon →

First Reported In

Update #4 · CISPE moves first; Brussels misses again

IT Pro· 7 May 2026

Read original →

Different Perspectives

OpenForum Europe / EUI-Fraunhofer consortium

The consortium (OpenForum Europe, European University Institute, Fraunhofer ISI) is lobbying for a €350m EU Sovereign Tech Fund modelled on Germany's existing sovereign tech fund; Michal Kobosko MEP hosted a Parliament breakfast for it on 28 January 2026. No commissioner has named it as a priority and no host institution has been designated.

Chi Onwurah MP / UK SIT Committee

Onwurah wrote to DSIT minister Narayan that his sovereignty letter "fails to set out a coherent strategy for achieving technology sovereignty". Narayan cited the £500m Sovereign AI Unit and a proposed advanced market commitment for AI hardware; Onwurah's challenge signals that Parliament will press DSIT to move beyond an infrastructure-only first cohort.

US Trade Representative (USTR)

USTR confirmed 24 July as the final determination date for its Section 301 investigation into EU digital rules; public hearings began in May. A USTR tariff threat published before the 27 July DMA Google ruling places direct political pressure on DG COMP to moderate its first cloud-AI enforcement decision.

ASML (Christophe Fouquet)

Fouquet told analysts that ASML's 2026 guidance already "accommodates potential outcomes of ongoing discussions around export controls", after China fell to 19% of system sales in Q1 2026 from 36%. ASML co-signed the CEO deregulation letter; the MATCH Act would remove its remaining DUV China revenue.

Mistral AI / seven European CEOs

Arthur Mensch co-signed a 5 May joint op-ed in Handelsblatt and Corriere della Sera after meeting von der Leyen, calling for simplified AI rules and looser merger control. Mistral's signature is the politically significant one: it is the company Brussels most often cites as evidence that European AI sovereignty is viable.

Schwarz Group / StackIT

Schwarz Group anchored the Cohere-Aleph Alpha merger with $600m and already holds StackIT at SEAL-3 in the Commission's €180m framework. Chief Digital Officer Karsten Wildberger called Berlin's backing of the deal "a very strong signal"; Berlin attached conditions that development services remain in Germany and infrastructure deployment remain sovereign.