Microsoft’s Software Empire Just Got a Warning from the UK

On 16 October 2026, the UK Competition and Markets Authority proposed giving Microsoft “strategic market status” (SMS) in its business software system. The consultation closes on 13 November 2026. The final decision is expected by 13 February 2027.

The CMA did not surprise Microsoft. In March 2026, the CMA board decided to open an SMS investigation. On 14 May, it formally launched the case and sent Microsoft an investigation notice. In October, it published its proposed designation. Five months passed from case opening to proposed designation.

The CMA found that Microsoft holds a strong market position in five digital activities: PC operating systems, productivity software suites, security software, server operating systems, and relational database management systems. These five areas connect. Windows is the entry point. Office and Teams are the daily working interface. Copilot is the AI layer inside them. Security products and server infrastructure support enterprise deployment.

The CMA’s main finding is that Microsoft’s market power comes from switching costs, not from a monopoly in any single product. When a company’s workflows, file formats, collaboration habits, and IT infrastructure all sit on Microsoft’s system, switching to an alternative costs money and time. Training, data migration, compatibility risks, and organizational inertia add up. Most customers keep using Microsoft even when they are not fully satisfied.

Those barriers do two things. They limit what customers can choose. They also weaken the pressure that other software developers can put on Microsoft. The CMA notes that Microsoft’s business practices and integration advantages “can incentivize customers to adopt Microsoft products, creating additional barriers that other software developers cannot easily overcome.”

Three areas the CMA is looking at

First, AI tools. The CMA will assess whether customers can freely choose the AI tools and features that fit their needs. It will also look at whether alternative AI providers can compete with Copilot on equal terms. Timing matters. 2026 is the window when AI features are moving from add-ons to infrastructure. Agentic AI is entering everyday enterprise workflows. The CMA is focused on Microsoft bundling web-based Copilot Chat for free into most M365 and Office 365 enterprise licenses. The CMA’s concern: if customers finish their buying decisions with AI features already bundled in, alternative AI tools face a market entrance that is already closed.

The CMA is also investigating a related issue. After Microsoft added Copilot to its 365 Personal and Family plans, customers were moved at renewal to higher-priced plans. The annual fee for Personal rose from £59.99 to £84.99. Family rose from £79.99 to £104.99. If the CMA finds this practice misleads customers, it becomes more than a consumer protection issue. It becomes evidence under the SMS framework that business practices may restrict competition.

Second, security products. The CMA is examining whether Microsoft’s bundling and integration of security products limits customer choice. Microsoft Defender, Entra, and other security tools are integrated into Microsoft 365 E3 and E5 licenses. That creates a “good enough and already included” structure. For a corporate Chief Information Security Officer, choosing an independent endpoint detection or identity management solution means arguing why the security features the company already paid for are not enough. That argument itself is a barrier.

Third, software licensing and cloud choice. The CMA will determine whether customers can choose which cloud platform to deploy their software licenses on. It will also look at how Microsoft’s licensing practices affect that choice. This investigation continues from the CMA’s earlier cloud services market study. That study found Microsoft’s software licensing practices may “make it more difficult for other providers to compete on equal terms in non-Microsoft environments where customers wish to use Microsoft software.” The investigation team recommended that the CMA board consider SMS designations for Microsoft and Amazon AWS, the two largest market participants. The CMA chose to open an SMS investigation only into Microsoft. It accepted voluntary commitments from both companies on reducing data egress fees and improving interoperability.

What SMS means

SMS comes from the UK’s Digital Markets, Competition and Consumers Act 2024 (DMCCA). The law took effect on 1 January 2025. To get an SMS designation, a company must meet two tests. It must have global turnover above £25 billion or UK turnover above £1 billion. It must also have “substantial and entrenched market power” and “strategic significance” in a digital activity.

An SMS designation does not mean the company broke the law. It gives the CMA a legal basis to intervene later. Once designated, the CMA may impose conduct requirements. These are specific legal obligations on the company’s future behavior. The CMA can impose them without proving the conduct is an abuse of dominance. The CMA may also use pro-competition interventions. These are structural or behavioral remedies when competition has been harmed.

In October 2025, the CMA made SMS designations for Google (search and search advertising) and for Apple and Google (mobile platforms). If Microsoft is designated, it becomes the third tech giant under the regime.

Who supports it and who doesn’t

The CMA’s invitation to comment closed in June 2026. The regulator received responses from 25 organizations. The vast majority supported an SMS designation for Microsoft. The Open Cloud Coalition estimates the public sector pays about £60 million more each year because of Microsoft’s licensing practices.

Microsoft responded: “All of our products, including Copilot, are open and interoperable, and customers can use them alongside competing services.” Microsoft said it would continue to engage constructively in the investigation. That statement sits awkwardly next to the CMA’s findings on switching barriers and bundling. The CMA sees a system designed to lock customers in. Microsoft sees an integrated product built for customer convenience.

Why now

In its proposed designation, the CMA notes the business software industry “is changing rapidly, with AI features increasing and familiar workplace tools moving toward agentic AI.” That tells you the CMA’s logic. It is not regulating what Microsoft did wrong in the past. It is regulating what Microsoft may do in the future.

If Copilot becomes the default AI layer for enterprise workflows, Microsoft could become the gatekeeper for enterprise AI infrastructure. The CMA’s window is now, before AI features fully harden into infrastructure.

This matches the logic of the EU’s Digital Markets Act toward gatekeeper platforms. But the CMA’s path leans more on case-specific evidence and proportionality. In its SMS designation, it says it will take a “proportionate, innovation-friendly approach.”

Another factor is digital sovereignty. The CMA notes that for governments and critical organizations, “the ability to choose, switch, and combine digital services (especially AI) is increasingly important for resilience and strategic autonomy.” When technology supply chain security is a national security issue, keeping UK businesses and the public sector out of a single provider’s system adds a national security dimension to economic competition.

What happens before February 2027

From now until the statutory final decision deadline of 13 February 2027, the CMA still has work to do. It must analyze consultation responses, publish non-confidential responses, give Microsoft a chance to make oral representations, and deliberate on the final decision.

If the SMS designation is confirmed, later conduct requirements or pro-competition interventions will not start immediately. They will go through an independent investigation and design process. For Microsoft, the SMS designation will not change its UK operating model in the short term. In the medium term, it may face structural adjustments. These could cover license design, product bundling, default settings, and interoperability standards. For the CMA, this investigation will test whether the SMS regime can intervene in business software, an area tied to enterprise operations but far from consumers’ daily experience. For the wider tech industry, this case will answer a question: as competition issues move from consumer platforms to enterprise infrastructure, do regulatory tools need to be upgraded, and can they be?