The CMA spent three years investigating Microsoft and AWS’s grip on the UK cloud market. Its own inquiry group recommended binding rules for both. In March, the board chose voluntary promises instead. Here’s why that matters for your business, and what you can actually do about it.
tl;dr:
What happened? After a three-year investigation, the Competition and Markets Authority concluded in July 2025 that the UK cloud market isn’t working. Microsoft and AWS each hold 30 to 40% of it, and structural barriers like egress fees and technical lock-in make switching painful. The CMA’s own inquiry group recommended designating both firms with Strategic Market Status, which would have given the regulator binding enforcement powers. In March 2026, the CMA board declined. It accepted voluntary commitments from both companies instead, and opened a narrower investigation into Microsoft’s software licensing.
What is the risk for UK businesses? Two American firms control up to 80% of UK cloud infrastructure, and the one regulator with the power to change that has chosen not to use it. The lock-in, the pricing power and the jurisdiction problem all remain, now with less prospect of regulatory rescue.
What is the solution? Stop waiting for the regulator. If your files, documents and collaboration tools sit with a US hyperscaler, the practical fix is to choose a UK provider directly. It’s a decision you control, and you can make it this week.
Last summer, the Competition and Markets Authority published the final decision of its cloud services market investigation. Three years of work, a report running to 600 pages, and a conclusion that surprised nobody who buys cloud services in this country: the market is not competing properly.
The numbers are stark. Microsoft and AWS each hold between 30 and 40% of the UK’s cloud infrastructure market. Google trails at around 10%. Everyone else, including every British provider, shares what’s left. The CMA found that high capital costs keep new entrants out, that egress fees (the charge for taking your own data out of a provider) discourage switching, and that deliberate technical fragmentation makes it expensive to move between platforms or run more than one. It also found that Microsoft uses its position in software like Windows Server to make life harder for rivals hosting those products.
The inquiry group that ran the investigation made a clear recommendation: designate both Microsoft and AWS with Strategic Market Status under the Digital Markets, Competition and Consumers Act. SMS designation is the CMA’s strongest tool. It allows the regulator to impose binding conduct requirements, rules the companies must follow, with penalties if they don’t.
What the CMA actually did
On 31 March 2026, the CMA board announced its decision. It did not designate AWS at all. Instead, it accepted voluntary commitments from both AWS and Microsoft to reduce egress fees and improve interoperability, with a progress review promised after six months. The only formal action was a new, narrower Strategic Market Status investigation into Microsoft’s business software ecosystem, covering the licensing practices around products like Windows Server, Microsoft 365 and Copilot. That investigation began in May and will run for around nine months.
To be fair to the CMA, voluntary commitments can move faster than formal designation, and the Microsoft software probe is genuinely significant. But the gap between what the investigators recommended and what the board delivered is hard to ignore. The regulator’s own team said the two dominant firms needed binding rules. The board settled for promises.
And promises from dominant firms have a shelf life. Voluntary commitments are not enforceable in the way conduct requirements are. If AWS or Microsoft decide in two years that egress fees are worth reintroducing, or that interoperability has become commercially inconvenient, the CMA would have to start again from scratch.
Why this matters even if you’ve never heard of the CMA
If your business runs on Microsoft 365, Google Workspace or anything hosted on AWS, this investigation was about you, whether you followed it or not.
A market where two firms control up to 80% of the infrastructure is a market where those firms set the terms. Prices rise when they decide. Features change when they decide. And as we wrote after Anthropic’s shutdown in June, access itself can be withdrawn when a foreign government decides. The CMA’s report is official confirmation that the concentration is real, the barriers to leaving are deliberate, and the market won’t fix itself.
The March decision adds one more lesson. The barriers won’t be dismantled by the regulator either, or at least not quickly. UK businesses hoping the CMA would force open the market now know the timetable: a six-month review of voluntary promises, a nine-month Microsoft investigation, and possible action some time after that. Meanwhile your renewal notice arrives on schedule.
The part you control
Here’s the thing the CMA can’t do for you and never could: it can’t choose your provider.
Every business in the UK that stores files, shares documents or collaborates online makes that choice, usually by default, usually by renewal. The duopoly persists because the default is never questioned. But the barriers the CMA identified, egress fees, technical lock-in, the hassle of moving, are lowest for exactly the services most businesses actually use: file storage, document editing and team collaboration. You do not need a migration consultancy to move your files.
Choosing a UK provider gets you out of the concentration problem and the jurisdiction problem in one move. A British company operating on infrastructure under UK legal protections isn’t subject to a US export directive, a US price rise driven by tariffs, or the strategic priorities of a Seattle boardroom. Your contract sits under UK law with a company you can actually ring.
That’s what we’re building at Bigby.drive: private, encrypted cloud storage and collaboration, built in the UK, priced honestly, with no lock-in tricks. We support open standards like WebDAV precisely because we think you should be able to leave any provider easily, including us. If the CMA’s findings have made you look harder at where your business data lives, join the waiting list or drop us a message.
FAQs
The CMA’s final decision, published in July 2025 after a three-year investigation, found that the UK cloud infrastructure market is not working competitively. Microsoft and AWS each hold 30 to 40% of the market, and the CMA identified egress fees, technical fragmentation and Microsoft’s software licensing practices as barriers that discourage switching and harm competition.
Strategic Market Status (SMS) is a designation under the Digital Markets, Competition and Consumers Act 2024. When the CMA designates a firm with SMS, it gains the power to impose binding conduct requirements on that firm, with enforcement penalties. The cloud investigation’s inquiry group recommended SMS designation for both Microsoft and AWS, but the CMA board chose not to proceed with either, accepting voluntary commitments instead.
Partly. In March 2026 the CMA accepted voluntary commitments from both firms to reduce egress fees and improve interoperability, and it opened a Strategic Market Status investigation into Microsoft’s business software ecosystem, covering licensing around products like Windows Server and Microsoft 365. AWS faces no formal investigation. The voluntary commitments are not legally binding in the way SMS conduct requirements would be.
The most direct step is to move business-critical services, starting with file storage, document editing and collaboration, to a UK-owned provider operating under UK jurisdiction. This removes exposure to US pricing decisions, US legal reach such as the CLOUD Act, and the lock-in practices the CMA identified. Favour providers that support open standards, so you retain the freedom to move again if you ever need to.