The UK cloud market has moved from rumour to remedy. On 28 January 2025 the Competition and Markets Authority (CMA) published provisional findings on public cloud infrastructure. On 31 July 2025 the CMA issued its final decision, concluding that competition is not working well and recommending the use of new digital powers to police the biggest providers. For CIOs and heads of procurement, this is not a debate about theory. It is a chance to translate regulatory momentum into better contracts, lower egress exposure and more credible switching plans.
Point-clé: The CMA’s final decision finds adverse effects on competition and points to targeted interventions under the Digital Markets, Competition and Consumers Act through Strategic Market Status investigations. Buyers can use this direction of travel to re-open terms.
What exactly has the CMA said?
The CMA’s final summary sets out three pillars. First, the market is highly concentrated. Microsoft Azure and Amazon Web Services each account for around 30 to 40 percent of UK spend in infrastructure services, with Google far behind at 5 to 10 percent. Second, switching is exceptionally rare, under 1 percent per year. Third, commercial and technical barriers lock customers in, with data egress fees singled out as a key barrier to multi-cloud and switching.
Point-clé: Egress is not a footnote. The CMA labels its presence and magnitude a key commercial barrier that depresses switching and dulls price competition.
The numbers are stark. UK organisations spent about £10.5 billion on cloud in 2024. The CMA notes that even a modest 5 percent overcharge in a less competitive market would imply roughly £500 million of extra annual cost for UK customers. Those are figures that strengthen a negotiating hand.
What will actually change for buyers in 2025 and 2026?
The final decision does not impose immediate price caps. Instead, the CMA recommends launching Strategic Market Status investigations on Microsoft and AWS under the DMCC Act. That route allows conduct requirements tailored to digital markets, including interventions on behaviours that restrict interoperability or switching. The Board expects to consider options in early 2026. In plain English, the regulatory gears are engaging, and the largest providers know they are under the microscope.
For buyers, the consequence is practical. Provisional findings in January and a firm final decision in July together create the perfect moment to refresh playbooks. The policy wind favours portability, reversibility and transparency. Contracts signed now should assume tougher conduct rules later and lock in the benefits early.
How concentrated is the UK cloud market, and why does that matter?
Concentration in IaaS remains high, with Azure and AWS as the clear leaders. The CMA reports that both have earned sustained returns above the cost of capital, while many customers either do not switch or remain with a single primary provider even when they experiment with more than one cloud. The forward-looking concern is that the leaders’ positions endure as economies of scale and broad product portfolios raise barriers to entry. That is the backdrop for your negotiations on egress, licensing portability and term length.
Point-clé: Less than 1 percent of customers switch provider each year. If you cannot credibly threaten to move, you will not extract value. Build the threat.
The buyer’s playbook: ten anti-lock-in moves to action now
Here is a concise Top 10 that maps directly to the CMA’s diagnosis and gives you executable clauses and practices.
Anti-lock-in clauses. Prohibit technical tying that prevents you from running equivalent workloads on rival clouds, and insist on parity APIs or documented migration paths.
Egress fee ceilings. Set explicit monthly caps and free allowances for cloud-to-cloud transfers used for migration or active multi-cloud, including a schedule of stepped reductions when volumes exceed thresholds.
Snapshot portability. Require VM and database snapshot formats that are convertible with tooling published by the provider, plus a commitment to publish any breaking changes 180 days in advance.
Performance benchmarks. Reserve the right to run independent benchmarks across providers and to rebalance workloads when price-performance deviates beyond an agreed delta.
Minimal viable multi-cloud. Mandate two independent regions per provider and at least one second provider in active-passive for critical workloads, with periodic cutover drills.
Contractual reversibility. Define exit assistance obligations and a named team, with time-boxed support and rate cards for data export, schema conversion and re-platforming.
Security audits. Include annual right-to-audit that covers supply-chain dependencies, identity configurations and incident reporting SLAs aligned to your regulator.
Cost alerting. Enforce spend alerts and anomaly detection at the account level. Require access to raw billing data in near-real-time for your FinOps tooling.
Credit negotiation. Tie credits to measurable milestones rather than spend lock-ins. The CMA notes credits are not currently considered harmful, yet they can still distort choices if not structured carefully.
A 90-day exit plan. Bake a runbook that moves a defined reference workload out within 90 days, with success criteria, rollback and a pre-agreed dispute path.
What does a viable multi-cloud look like in practice?
The CMA recognises that multi-cloud is less common among small and mid-size firms, often because benefits seem outweighed by cost and complexity. That is a real constraint, yet you do not need symmetry to gain leverage. Start with a small portfolio of portable workloads and a second provider in passive mode, prove that migrations complete inside your change window, then extend. The point is not to spread everything. The point is to create a credible alternative so your main provider knows you can move.
Documentation helps. Many teams struggle to keep architecture notes, runbooks and visual assets consistent across providers. Mid-project, create standard cards that combine service maps and cost guardrails. If your comms team needs quick visuals for internal briefings, you can merge images to place a topology sketch alongside a cost trend, then export a lightweight graphic for Teams or Slack. For release notes that compare latency before and after a partial migration, merge images again so charts and screenshots travel together. When you distribute a one-pager to the steering group, merge images a third time to assemble the revised network diagram and a simple risk matrix. Simple tools can work here, and when bandwidth returns, a single template in Adobe Express can repurpose the same asset for different audiences.
How should we handle Microsoft licensing in the mix?
The CMA dedicates significant analysis to Microsoft’s software licensing. It finds that Microsoft’s practices reduce the competitiveness of rivals when customers want to use Microsoft software on non-Azure clouds. Some licences cost more for AWS and Google than Microsoft’s own customer-facing prices. Certain products are not made available under licensing agreements to those rivals. For an enterprise buyer, the implication is clear. Add licensing asymmetries to your risk register, price scenarios with and without Bring-Your-Own-Licence options, and document the total cost impact over the contract life.
Point-clé: If your estate depends on Windows Server, SQL Server or the Microsoft productivity stack, stress-test your non-Azure plans early. The frictions are real and well-documented by the regulator.
Costs, credits and the egress knot
From a FinOps perspective, two controls do most of the work. First, enforce account-level budget alerts that trigger at 50, 75 and 90 percent of forecast, with an operational response in your runbook. Second, cap egress exposure in your contract so migration projects cannot be held hostage by traffic bills. Providers will argue that committed spend agreements already offer discounts and predictability. The CMA’s view is that these agreements exist, yet in their current form and application they do not by themselves harm competition, which means you should evaluate them on value rather than accept them as inevitable.
A useful exercise is to simulate the first 30 days of a live migration between two clouds. Count the number of distinct data egress lines on your bill, flag which ones are migration-related, then run a shadow invoice with your proposed egress ceiling and free allowance. If the delta is material, you have a number to take back to the vendor.
Procurement and the public sector
The CMA notes that Microsoft and AWS are also the largest suppliers to the UK public sector. Procurement frameworks aim to preserve competition through competitive tendering, yet better market outcomes would still rely on easier switching and clearer portability. If you sit on a public body, audit your frameworks to ensure they encode reversibility, independent benchmarks and active exit assistance, rather than treating them as optional extras. assets.publishing.service.gov.uk
Benchmarks and portability, without the drama
Independent benchmarks unlock two wins. First, they give you a neutral basis to rebalance workloads mid-contract. Second, they expose when a service differentiation is just interface friction rather than functional necessity. Coupled with snapshot portability commitments, they reduce the surprise factor during exits. Include a schedule that defines how a provider must disclose breaking changes to image formats, storage APIs or network behaviour at least six months ahead. Agree a maintenance window for migration cutovers that respects your change freeze periods.
Building your 90-day exit runbook
Treat the 90-day exit as a live artefact. Pick a reference workload, define Day 0 to Day 90 milestones and link each to a named owner. Bring the legal team in early so exit assistance is bound to timelines and rates. Include a litigation-lite escalation ladder that keeps engineers talking while legal counsel works. Test the runbook in a low-risk environment twice a year. The goal is not a theatrical move to a new cloud. The goal is that everyone at the table believes you could do it.
What to watch next
Watch the CMA Board and the timeline for Strategic Market Status investigations under the DMCC Act. Watch for providers adjusting conduct voluntarily, for example by widening free egress allowances for migration or publishing more open conversion tooling for snapshots and images. Watch government procurement guidance for signals that portability and reversibility are becoming non-negotiable in public tenders. And keep an eye on market shares and switching behaviour, since these are the statistics that the regulator will keep under review.
Point-clé: The centre of gravity has shifted. You do not need to wait for the next enforcement step to secure better terms. Use the CMA’s findings as your evidence base.
FAQs
Is the CMA forcing providers to cut egress fees today?
Not immediately. The final decision recommends using DMCC Act powers through Strategic Market Status investigations. That path can target behaviours like barriers to switching. Use the momentum now to negotiate ceilings and allowances.
How concentrated is the UK market?
Very. Azure and AWS each sit around 30 to 40 percent of UK IaaS spend, with Google at 5 to 10 percent.
Do most customers use multi-cloud?
Large firms experiment, yet spending is usually concentrated with one provider. Switching remains under 1 percent per year, which weakens buyer power unless you plan for exit.
Are credits a trap or a perk?
The CMA does not consider credits to be harming competition in their current form, but they can still bias choices. Tie them to milestones, not lock-ins.
Where can I read the source documents?
Start with the CMA’s provisional findings and the final decision summary on GOV.UK, then read independent explainers for context.
Show Comments (0)