Regulators vs. the Duopoly

On March 31, 2026, the UK's Competition and Markets Authority drew a line under its three-year cloud investigation, accepting voluntary commitments from AWS and Microsoft on egress fees and interoperability. The mountain labored for three years, produced findings that "competition is not working well", recommended the strongest tool in its new kit, and then delivered a memorandum of understanding.

That arc is worth studying, not mocking, because the CMA case is the cleanest specimen we have of the question this post is about: when regulators finally move against cloud concentration, which remedies change anything real, and which are theater performed for the annual report? My scorecard, argued below: portability mandates and licensing interventions are real, egress concessions are a fee that died years ago wearing a medal, and the credible threat that got traded away was the only thing the duopoly actually feared.

Three years in four beats

Beat one: the CMA's investigation found the structural problems everyone suspected: AWS and Microsoft each holding roughly 30-40% of the UK market, egress fees and technical barriers suppressing switching, and Microsoft's software licensing practices tilting the field against rivals running its products. Beat two: the final decision in July 2025 recommended designating both companies with strategic market status under the Digital Markets, Competition and Consumers Act, the UK's new regime for binding, tailored conduct rules. Beat three: March 2026, the SMS route was shelved in favor of the voluntary commitments. Beat four, and the one to watch: a separate SMS investigation into Microsoft's software licensing spun up regardless, aimed at the practice the findings called out most sharply.

The UK case carries weight beyond the UK, which is why the shelving mattered. The DMCCA regime was built specifically to move faster than classic competition law, other regulators are watching its first outings the way case law gets watched, and the cloud investigation was its most prominent test. A debut that ends in voluntary undertakings teaches every watching authority, and every watched company, what the new powers cost to invoke. Precedents about hesitation travel as far as precedents about action.

Sorting the remedies

Run each remedy through one test: does it change what a customer can do, or what a vendor must say?

Egress commitments fail the test instantly, and we've written the obituary already: exit egress died globally in 2024 under EU Data Act pressure, so promising a regulator the corpse stays dead costs the duopoly nothing and headlines beautifully. It's the pattern from that post repeating at regulatory scale: concessions cluster on the locks vendors stopped defending, never on the ones doing the holding. The same sorting works on any jurisdiction's package, which is the reason to learn it once: the EU's Data Act portability rules pass the test because they changed what a customer can do with their feet, while a dozen codes of conduct since have failed it politely.

Interoperability commitments are contingent: real if they arrive with technical specificity, deadlines, and someone with authority to measure compliance; theater if they stay at the altitude of "committed to open standards", which is where voluntary undertakings historically retire. The licensing intervention is the real one, and the CMA's own sequencing admits it, because licensing is where the findings located actual harm, and licensing is precisely what got carved out for the binding-powers track rather than the handshake track. And the SMS designation itself was the remedy that mattered most by never being used: the threat of tailored, enforceable conduct rules is what brought voluntary offers to the table at all. Trading it away converts a bargaining position into paper, and the price of that trade will be visible in how the commitments age.

The steelman: the handshake might be right

The defense of the CMA's choice is better than it looks. Voluntary commitments arrive in months; SMS designations arrive after years of process and litigation, against opponents with infinite legal budgets, under a regime so new it has no case law, and regulatory humility about untested powers is a virtue, not cowardice. There's also a genuine question of timing: between the Data Act, DORA's exit requirements, and the unbundling the market did on its own, a lot of what a 2023 remedy would have targeted has already moved. Regulate the market you have, not the one your case opened against.

Concede the speed argument whole. The answer is that speed and credibility aren't the same axis: a fast remedy with no enforcement mechanism is just fast, and the entire history of voluntary undertakings in tech is a history of compliance narrowing to the letter while the practice regrows around it. The honest verdict on the CMA case won't be available until the licensing probe shows whether the binding track has teeth. That's the scoreboard to watch, and it's refreshingly concrete: either Microsoft's licensing terms for rivals change in measurable ways by 2027, or the UK's shiny new digital markets regime met the duopoly and blinked.

For everyone downstream, the practical reading is the one this blog keeps arriving at from every direction: regulation will occasionally hand you a right, and rights you can't exercise are decor. The Data Act gave you free exit; portability is what makes it usable. The CMA may yet fix licensing; your architecture decides whether you could act on the fix. Regulators move in years and blink under pressure. Your exit plan doesn't have to do either. Which one are you betting on?