The UK's competition watchdog wants to designate Microsoft with strategic market status (SMS) in business software, allowing the regulator it to intervene to level the playing field, and says it is considering other areas for investigation. Regulators around the world are watching to see what the UK decides in this case, with bodies such as the US Federal Trade Commission (FTC) and the European Commission mulling similar actions. The Competition and Markets Authority (CMA) is opening a consultation on whether to tag the Redmond software giant with strategic market status in respect of its portfolio of business software applications. This follows an investigation the regulator started back in May into Microsoft’s software portfolio including Word, Excel, Outlook, PowerPoint and Teams, plus its security, server and operating systems. The watchdog is also probing whether Microsoft enjoys a position of “substantial and entrenched market power” through the suite of software that could be seen as stifling competition and harming buyer choice. It lays out its proposed decision in a document [PDF] and is inviting comments that must be submitted by November 13. The CMA will make its final decision by February 13, 2027. Bargain spotter The CMA makes it clear the company holds a strong position in each of the five areas it investigated (personal computer operating systems, productivity software suites, security software, server operating systems and relational database management systems), and that customers face barriers when switching providers – limiting their choice and weakening the ability of other software developers to offer rival products. Its proposal document notes Microsoft has been by far the largest provider of business software in the UK for decades. It finds that many customers view Microsoft's portfolio as a unified software environment, forming an end-to-end, integrated stack which makes for easier technical integration between products, with discounted pricing for buying whole bundles of applications together. This makes customers less likely to adopt products from alternative providers that may offer similar or superior functionality, as doing so would duplicate licensing costs for products already in their Microsoft bundle, the CMA says. “Organizations should be able to choose the products that work best for them, switch provider when they want to and combine services from different suppliers. We want to ensure businesses have the freedom to choose how they use Microsoft’s products alongside alternatives,” said CMA chief exec Sarah Cardell. Finding that the criteria for SMS designation are met would not imply or assume wrongdoing on Microsoft’s part, the regulator stresses. A separate document [PDF] spells out the potential interventions that the CMA could make. These include ensuring that Microsoft’s technical design choices do not restrict the ability to use other providers; that commercial arrangements (like bundling) do not limit effective competition; and preventing Microsoft from using its market power in business software to distort competition in adjacent activities, such as cloud services. Rivals back licensing scrutiny Cloud providers previously complained that Microsoft's licensing terms make it more costly for companies to deploy Windows Server instances and services such as SQL Server on non-Microsoft clouds. The proposed SMS designation grew out of the CMA’s investigations into whether the big global players were having a negative impact on the cloud services market in the UK. This largely fizzled out with the watchdog securing undertakings from Microsoft and Amazon Web Services (AWS) that they would work to reduce barriers to switching between clouds and operating multi-cloud deployments. In an update, the CMA says that more can be done to address barriers to switching between cloud providers and using multiple cloud services, and it will continue to work with AWS and Microsoft to address them. It also says it its looking into whether customers can freely choose the best AI tools, and whether alternative AI providers have a level playing field to compete against Copilot. In a statement sent to The Register, Microsoft said it does not share the CMA’s views in its proposed decision on business software solutions. “All our products - including Copilot - are open and interoperable, giving customers the ability to use them alongside competing services and choose solutions that work best for them at attractive prices. We will continue engaging constructively to ensure UK customers and businesses carry on benefiting from robust competition,” a spokesperson told us. However, some pressure groups were quick to signal their approval. The Browser Choice Alliance said it welcomes the CMA’s proposed decision, adding that: “BCA members have long experienced how Microsoft leverages its market power from Windows and productivity software to push users towards its Edge browser, even where they’re trying to use an alternative.” The Open Cloud Coalition, which counts Google as a member, said: “Microsoft’s restrictive software licensing practices distort competition in the cloud, harm choice, and increase costs. This once-in-a-generation opportunity to end these practices can strengthen competition and lower customer costs, if the CMA acts quickly and decisively.” ®
AI and digital sovereignty dominated this year's Open Source Summit Europe. But beyond the AI noise, the sovereignty discussions offered something useful: practical plans for putting open source to work. The recurring theme of digital sovereignty started right from the first day's keynotes, with Geopolitics, Sovereignty, and the Fight to Stay Open, by the Linux Foundation's Nithya Ruff and Johan Linaker from Research Institutes of Sweden, whose name is considerably longer than its URL: ri.se. This isn't just some European issue. Ruff stressed that it mattered "from Canada, to Sierra Leone, to Trinidad and Tobago." This was followed by Open Source Security as the Foundation of European Sovereignty, focusing on OSS supply chains. Then ORBIT Launchpad: Building the Due Diligence Bridge Between Manufacturers and Open Source, with speakers from Dell and Microsoft discussing OpenSSF's efforts to build catalogs of open source components to help companies achieve CRA compliance, such as CRABFOSC – the CRA Baseline For Open Source Consumption. The EU's Cyber Resilience Act (CRA) is now starting to bite: reporting obligations for actively exploited vulnerabilities and severe security incidents began last month, with its main requirements applying from December 2027. Hearing Dell and Microsoft discuss how to meet those requirements, rather than simply why they matter, was encouraging. Éléonore Daxhelet presented the 2026 report from the EU's Open Source Observatory, or OSOR. Emphasizing that this isn't just an EU matter, she highlighted Diaa, from the Ministry of Digital Transformation of Ukraine, as well as the Swiss EMBAG legislation we recently covered. The slides are online [PDF]. Then, as if to emphasize that further, Kazuki Imamura from Japan's Innovation Platform Agency (IPA) presented the Japan-Type OSS Model. The IPA looked at hundreds of companies in seven countries, and more than 30,000 GitHub repositories, and found that while a lot of organizations are talking about open source, few are actually doing it. Japan has its own three-axis approach, where the public sector attempts to plant seeds and cultivate efforts by local commercial vendors, with a strong emphasis on the need for machine-readable legislation and rules. Again, the slides are online [PDF] and contain some uncomfortable numbers. To pick out the single talk with the most information, it might be Strategic Approach To Demonstrating the Value of OSS Efforts by Dr Dawn Foster of Fast Wonder. She started with the Linux Foundation's report on Measuring OSPO Value, examining open source program offices, and then presented a remarkable amount of guidance and info from the CHAOSS Project. It stands for Community Health Analytics in Open Source Software, and Foster's dense slide deck [PDF] linked to multiple different guides from the CHAOSS Practitioner Guides. There is a lot of reading here, including a series on viability metrics, a guide on demonstrating organizational value, and a guide on how to research software impact. To our eye, this looks like pragmatic stuff: info on how to introduce and run FOSS programs, on how to talk to users, and, perhaps most importantly, on how to explain it to executives. Many talks made reference to Schleswig-Holstein's moves away from the US cloud. One was from two of the people behind Berlin's Strategy for Digital Sovereignty. Berlin is both a city and a German state, with more residents than Schleswig-Holstein. The city government is working with PwC to manage its migration – not the first name that springs to mind in FOSS, but a sign that the giant consultancies see business here too. We were not surprised to see the only mention of KPIs at the entire summit here; we were slightly more surprised by the timescales, which aim to make 70 percent of the software stack on administrative workstations open source by 2032. The slide deck [PDF] reveals a rather bureaucratic planning process, but that's not a big surprise; nor is quite a lot of discussion of Governance, Dependencies, and Measures. Executives, in our experience, tend to like numbers they can measure and targets they can aim for. Emiel Brok from SUSE talked about the State of the OSS Union: Assessing Your Stack's Autonomy Under EU Law. This covered the European Commission's proposed Cloud and AI Development Act (CADA) and how organizations can measure their readiness for it. Some of this revolves around the EU Cloud Sovereignty Framework [PDF], and its definitions of eight Sovereignty Objectives (SOV-1 to SOV-8) and Sovereignty Effectiveness Assurance Level, the SEAL scale, from SEAL-0 (No Sovereignty) to SEAL-4 (Full Digital Sovereignty), defined as "complete EU control, subject only to EU law, with no critical non-EU dependencies." Brok mentioned SUSE's online Cloud Sovereignty Framework Self Assessment, which lets you get an idea of where your organization stands in ten minutes. All this may sound dry beside the kernel GPU driver discussions happening elsewhere at the event. But plans, targets, and measurements are signs that organizations are treating open source as infrastructure rather than an experiment. Sometimes, being bureaucratic is a win. ®
Accedi
