The U.K. Competition and Markets Authority has moved Microsoft’s business-software ecosystem into a more consequential phase of digital-markets scrutiny, publishing a proposed decision on October 16 that provisionally finds the company meets the conditions for strategic market status under the Digital Markets, Competition and Consumers Act 2024. The consultation runs until 5 p.m. on November 13, and the case page lists February 13, 2027 as the deadline for a final decision.
That matters because the CMA is not looking at one product in isolation. It is examining the connected stack that many organizations run every day: Windows endpoints, productivity software, identity, security controls, server and database tools, cloud licensing, and the Copilot AI layer. The real business question is not whether Microsoft is large or whether customers like integrated software. It is whether a company can use Microsoft where it works best and still retain credible freedom to pick a different cloud provider, a specialist security tool, or an AI assistant without paying a hidden tax in migration risk, retraining, licensing friction, or operational complexity.
For now, nothing changes in the contract drawer on Monday morning. The CMA has not made a final designation, imposed a conduct requirement, fined Microsoft, or ordered any product to be unbundled. But the proposed SMS finding gives the market a clearer signal about where the regulator sees competitive pressure breaking down: switching, interoperability, and the ability to combine Microsoft products with rivals’ services on reasonable terms.
What the CMA is testing
According to the CMA’s case page, the proposed decision is supported by market-power assessments, customer-data analysis, market-outcomes analysis, profitability analysis, and customer research. The investigation itself opened on May 14, 2026. In separate reporting carried by The Indian Express, Reuters said the CMA sees Microsoft as holding a strong position in PC operating systems and in productivity, security, and server/database-management software, reinforced by barriers customers face when switching. Reuters also reported that Microsoft’s business software is used by about 20 million people a month in Britain.
The regulator’s focus is practical. Can customers freely choose AI tools, or does Microsoft’s position in business software give Copilot a structural advantage because it already sits on top of user accounts, files, calendars, meetings, security policies, and permissions? Do bundled security products narrow room for specialist rivals? Do licensing practices shape where a customer can run workloads or how easily it can move them?
Those are distinct questions, but they all point to the same mechanism: an ecosystem becomes hard to contest when each additional product makes the next product easier to adopt and harder to replace.
Where switching gets hard
Enterprise lock-in rarely looks like a single impossible exit. It looks like a chain of manageable frictions that add up.
A buyer that wants Microsoft productivity and security tools while keeping freedom elsewhere runs into several pressure points at once. Identity is one: users, permissions, device policies, and access controls often become deeply embedded in daily workflows. File and message formats are another, especially when documents, email, meetings, and collaboration data are spread across long-lived processes. Security creates its own stickiness because telemetry, alerts, policy baselines, and incident-response playbooks are built around specific tools and support assumptions.
Then there is licensing. A contract may not explicitly forbid switching, but minimum commitments, product bundles, or cloud-linked commercial terms can still influence where a company places workloads. Data portability matters too, not only the ability to export information but the ability to re-create useful workflows, audit trails, and permissions somewhere else without weakening privacy or supportability. Add staff training and procurement overhead, and the “choice” to swap one layer of the stack can end up looking like a multi-department transformation program.
This is why the AI angle matters. Copilot does not arrive as a standalone chatbot entering a neutral market. It can be distributed through existing productivity habits and existing access to business data. A rival AI tool may be technically capable but still less usable if it cannot operate with comparable permissions, integrations, or workflow access.
What a designation could change — and what it would not
If Microsoft is ultimately designated, the main immediate change is legal and procedural, not technical. An SMS designation would give the CMA a firmer basis to consider targeted conduct requirements or other pro-competitive interventions. The public materials do not say which obligations would be chosen, when they would start, or whether they would materially alter Copilot distribution, security bundling, or cloud licensing.
That distinction matters for CIOs and procurement teams. The designation itself would not automatically make switching cheaper. It would create a framework for the CMA to decide whether particular practices need to change in order to produce a measurable customer outcome: more ability to mix suppliers, more realistic portability, or less steering into a broader bundle when a customer wants only one component.
The open question is how far a regulator can push interoperability without damaging the benefits customers also buy from integration. A tightly managed suite can reduce coordination costs, simplify administration, and support more consistent security controls. Microsoft says it disagrees with the CMA’s view and argues that its products, including Copilot, are open and interoperable and can be used alongside competing services. Reuters also reported that AWS and Microsoft have already taken steps aimed at improving customer choice, including connecting data centres with rivals and removing some data-transfer fees for customers switching providers.
Those points do not erase the CMA’s concerns, but they do explain why the remedy stage matters more than the label. A rule that improves portability on paper but weakens support boundaries or creates new security gaps may not help buyers much. Equally, a light-touch remedy that leaves the main switching costs intact would not answer the contestability problem the CMA is trying to solve.
What buyers should ask before February
The most useful response for enterprise customers is not to wait for a final designation and hope for a clean fix. It is to interrogate the stack they already buy.
Ask vendors to document export formats, migration tooling, and any fees attached to moving data out. Press for clarity on identity interoperability, API access, retention and deletion controls, and what happens to security coverage and support if you mix suppliers. Check minimum licensing commitments and whether cloud-related terms affect your ability to relocate workloads. For AI tools, ask a harder question than “does it integrate?”: can a third-party assistant operate on comparable permissions and data access, with equivalent auditability and administrative control?
The CMA is separately engaging with AWS and Microsoft on barriers to switching between cloud providers and to using multiple cloud services, while keeping a formal cloud-sector investigation under review. That makes this Microsoft case more than a narrow software story. It is part of a broader test of whether an enterprise platform in the AI era can remain tightly integrated without becoming functionally unavoidable.
By February, the headline may still be a legal status. For customers, the important measure will be more concrete: whether they can change one layer of the stack without destabilizing the rest.
By
By
By
By
By
By
