Until now, the UK’s digital markets regime has been aimed at consumer-facing technology: search engines, app stores, mobile operating systems. On 16 October 2026, the Competition and Markets Authority took it somewhere new, publishing a proposed decision to designate Microsoft as having strategic market status in respect of its business software ecosystem. It is the first time the regime has been turned on the software companies buy for themselves rather than the platforms their customers use.
This matters in two directions. If you sell software that competes with, or plugs into, the Microsoft stack, the regime may reshape the terms on which you do so. If you buy that stack, and most UK businesses do, the CMA has opened a consultation giving you a direct route to tell the regulator what your licensing experience actually looks like. That window closes at 5pm on 13 November 2026.
What has changed?
The CMA opened a strategic market status investigation into Microsoft’s business software ecosystem on 14 May 2026. On 16 October 2026 it published its proposed decision, running to 179 pages with four appendices, alongside a separate roadmap of possible interventions.
Under the Digital Markets, Competition and Consumers Act 2024, the CMA may designate a firm as having strategic market status in respect of a digital activity where the firm has substantial and entrenched market power in that activity and a position of strategic significance, and where the turnover condition is met.
The CMA provisionally concludes that all three limbs are satisfied. On market power, it points to integration and native links between Microsoft products, commercial bundling, Enterprise Agreement discounting and sustained profitability. On entrenchment, it is not persuaded that cloud migration or developments in AI will erode that power within the next five years. On strategic significance, it points to Microsoft’s reach across organisations of every size and sector, and its central role in enterprise IT.
The turnover condition is comfortably met: the CMA records global revenue of $331.8 billion, approximately £247.2 billion, against thresholds of £25 billion global or £1 billion UK turnover.
The CMA is explicit that designation does not imply wrongdoing. It is a regulatory status, not a finding of infringement.
Who is affected?
The proposed designation covers a single grouped digital activity, Microsoft’s Business Software Ecosystem, made up of five component activities:
-
PC operating systems — Windows 10 and 11, Azure Virtual Desktop, Windows 365
-
Productivity software suites — the Office and Office 365 applications, including Word, Excel, PowerPoint, Outlook, Exchange, SharePoint, OneDrive and Teams, together with the Microsoft 365 Copilot family
-
Security software — Entra, Active Directory, Intune, Defender, and certain Purview, Security Copilot and Agent 365 functions
-
Server operating systems — Windows Server
-
Relational database management systems — SQL Server and the SQL Database Engine
Three groups should pay attention. The first is independent software vendors and SaaS providers whose products compete with these or interoperate with them: security tooling, collaboration applications, AI assistants and agents, database products, and anyone building on Microsoft APIs. The second is cloud providers and the partners who resell or host Microsoft workloads; the roadmap treats cloud licensing as a focus area adjacent to the designated ecosystem.
The third, and largest, is the buy side: any UK organisation running Microsoft 365, Windows Server, SQL Server or the Microsoft security stack. These businesses are not regulated by the regime, but they are the customers whose experience the CMA is assessing, and the terms available to them are what any eventual intervention would be designed to change.
Note that designation attaches to the designated firm, not the sector, so competitors and customers take on no new compliance obligations, and the regime addresses conduct only as it affects UK users and UK competition.
What are the key legal requirements?
Today. Nothing. Microsoft is not designated, and no conduct requirement applies. The only live step is a consultation.
If designation is confirmed. Designation lasts five years. It unlocks, but does not itself impose, three sets of powers.
Conduct requirements. The CMA may impose requirements on the designated firm in pursuit of three statutory objectives named in Section 19(5): fair dealing, open choices, and trust and transparency. Section 20(2) permits requirements obliging the firm to do things, such as trading on fair and reasonable terms. Section 20(3) permits requirements preventing it from doing things, such as applying discriminatory terms to particular users. The CMA must consult before imposing a conduct requirement, and breach carries a fixed penalty of up to 10% of worldwide turnover.
A designated firm may rely on the countervailing benefits exemption in Section 29(2), showing that the conduct benefits users, that those benefits outweigh the harm to competition and could not be achieved otherwise, that the conduct is proportionate, and that it does not eliminate effective competition. All five conditions must be met, and CMA guidance states that it will require clear and compelling evidence.
Pro-competition interventions. Where the CMA finds a factor adversely affecting competition, it may make an order imposing behavioural or structural remedies, following a separate investigation of up to nine months, extendable by three.
Merger reporting. Under Sections 57 to 64, a designated firm must report qualifying acquisitions before completion — broadly, where its holding crosses 15%, 25% or 50%, cumulative consideration is at least £25 million, and the target is UK-connected.
What does this mean for technology companies?
The roadmap published alongside the proposed decision is the most commercially informative document in the package — provided it is read for what it is. It identifies areas for further evidence gathering. It decides nothing, ranks nothing, and fixes no timetable.
Four areas are flagged. On cloud licensing, the CMA records stakeholder submissions that Microsoft’s practices “have not materially changed since the Cloud MI,” its 2025 cloud market investigation. It raises the possibility of a fair, reasonable and non-discriminatory pricing obligation irrespective of the cloud on which software is hosted, together with changes to how purchased licences may be transferred or deployed.
On AI in productivity software, customers have raised the cost of Copilot licences, unclear return on investment and the prospect of future price rises; the CMA says it intends “to investigate further the nature of these concerns” and whether they reflect an inability to switch to alternative AI providers. Possible measures include parity requirements giving rivals access to ecosystem functionality and data on equivalent terms, rules on prominence and default selection, minimum notice periods for API changes, and unbundling Copilot from existing suites.
On security software, the CMA raises bundling of security capabilities into Microsoft 365 licences and parity requirements comparable to those for AI. On communication and collaboration, the thinking is less developed; the CMA notes that the European Commission’s Teams commitments do not formally apply in the UK — a reminder that EU remedies do not travel automatically across the Channel.
The interoperability point is sharper than it first appears. The roadmap records rival AI providers telling the CMA that the relevant question is not whether APIs exist, but whether the access available to them matches what Microsoft’s own products can use. Whether the CMA adopts that framing remains open, but it is the argument on the table.
What should companies do now?
Respond to the consultation, and check the NDA point first. The CMA has recorded Microsoft’s confirmation that it will not use confidentiality provisions to prevent anyone from responding. Responses go through the CMA’s consultation portal or to business.software.sms@cma.gov.uk.
Assemble evidence that persuades. Regulators act on specifics: licence cost differentials between hosting environments, quoted terms for running workloads on a non-Microsoft cloud, the effect of bundled security licensing on a competing tool you wanted to buy, API changes that arrived without workable notice. Vendors weighing a parity complaint should record contemporaneously where their integration options are narrower than Microsoft’s own products.
Review renewal timing against the regulatory calendar. A final decision is due by 13 February 2027, and any conduct requirement later still. Multi-year agreements signed now will be priced on today’s rules, so where a renewal falls close to these dates, consider shorter terms, renegotiation triggers or price-review mechanics rather than locking in.
Check contracts for portability and change-of-law. Licence transferability, deployment rights across clouds, exit assistance, and change-in-law clauses all gain value if the regulatory position shifts — and are easier to negotiate before a remedy exists than after.
Conclusion
The digital markets regime was widely read as a consumer-platform instrument, and its extension to enterprise licensing, bundling and interoperability signals that the CMA sees the same competitive dynamics in the software companies buy as in the platforms consumers use. Businesses on either side of that market have a short, concrete opportunity to shape what follows, and evidence submitted in the next three weeks will carry more weight than commentary offered after a decision is made.
If you’d like to talk this through, book a 30-minute call with me.
Image designed by Magnific — www.magnific.com
