By On June 25, the European Commission told Amazon and Microsoft something neither wanted to hear: their cloud platforms are formally in the EU’s regulatory crosshairs. AWS and Azure received preliminary gatekeeper designations under the Digital Markets Act — the first time cloud infrastructure has ever been pulled into DMA scope. Stakeholder hearings begin today. Final designation arrives by November. Compliance obligations kick in roughly six months after that. If you are building on either platform, this is not abstract EU legalese. It is the most aggressive regulatory push on cloud portability ever attempted, and it already has teeth.
What DMA Gatekeeper Status Actually Obligates
Gatekeeper designation under the DMA is not a recommendation. It is a legal obligation with fines up to 10% of global annual turnover — and up to 20% for repeat violations. For Amazon and Microsoft, that translates to tens of billions of euros. Three specific obligations matter for developers:
Data portability (Article 6(9)): Gatekeepers must provide data in structured, machine-readable formats continuously and in real time. Not a zip file. Not a manual export. Continuous, real-time data access that makes switching technically feasible.
No punitive egress: Transfer fees that make leaving “economically irrational” are directly targeted. The Commission’s own language calls egress charges an unjustified barrier to switching.
No self-preferencing: AWS cannot favor its own database products over third-party alternatives on the same platform. Azure cannot make its own AI services more accessible than competitors’ offerings.
The Egress Fee Problem — With Real Numbers
AWS charges $0.09 per GB for the first 10 TB of internet egress each month. Azure comes in at $0.087 per GB under 50 TB. These look like small numbers until you do the math. Moving 50 TB from AWS to a competitor costs between $3,500 and $7,000 in transfer fees alone — before any engineering time, rewrite costs, or downtime risk. Surveys consistently rank egress costs as the single largest barrier to switching providers among enterprise IT leaders.
The headline rate is also not the real rate. NAT Gateway adds $0.045 per GB on top of the base egress charge. A busy EKS cluster with 10 TB of cross-AZ traffic per month pays an additional $200 or more in network fees that most teams only notice when the bill arrives. Total egress costs typically run 50 to 200 percent above the published rate.
AWS pre-emptively eliminated some exit charges in 2025 after UK regulatory scrutiny. Microsoft cut Azure bandwidth fees for similar reasons. These are not acts of generosity — they are evidence that regulatory pressure already works. The DMA formalizes that pressure at EU scale.
AI Services Are the New Lock-in Layer
Infrastructure egress is the obvious problem. The less-discussed one is AI-era lock-in. Training pipelines on SageMaker use proprietary AWS APIs. Azure OpenAI Service endpoints tie your LLM calls to Azure infrastructure. OpenAI broke Azure’s exclusivity in April 2026 and is now available on AWS Bedrock — but that only moves the problem one layer up. Your SDK calls, your fine-tuned model artifacts, and your deployment configs remain tightly coupled to whichever platform trained them.
The DMA can mandate that AWS and Azure provide portability tooling. It cannot mandate that moving a production ML pipeline is fast or cheap. That gap between legal portability and practical portability is where most enterprises will get stuck.
What DMA Cannot Fix
The DMA is powerful but not magic. It can force egress fee elimination and mandate data portability APIs. Here is what it cannot do: rewrite your provider-specific infrastructure code, shrink the AWS developer ecosystem of four million trained practitioners, or make data gravity disappear. Once 500 TB of training data lives in S3, the switching cost is no longer the egress bill — it is the time required to move the data.
Timeline realism also matters. The final designation arrives by November 2026. Compliance obligations kick in six months later — spring 2027 at the earliest. EU regulatory timelines have a documented history of slipping, and both Amazon and Microsoft have 30 days from June 25 to file formal counterarguments. Counting on DMA to solve your lock-in before 2027 is optimistic.
What Developers Should Do Now
Five architecture choices that improve your position regardless of how the DMA plays out:
- Abstract your storage layer. Cloudflare R2, Backblaze B2, and MinIO all speak S3-compatible APIs. Build against the abstraction, not the native SDK, and migration becomes a config change rather than a rewrite.
- Use Terraform or Pulumi instead of native IaC. CloudFormation and ARM templates are portability dead ends. Cloud-agnostic IaC tools keep your infrastructure definition moveable.
- Prefer Kubernetes over proprietary container services. EKS, AKS, and GKE all run Kubernetes. ECS and Azure Container Instances are proprietary. The operational overhead pays dividends when you need to move.
- Put an adapter layer over your AI calls. LiteLLM or a thin OpenAI-compatible wrapper means switching model providers is a one-line change, not a refactor.
- Know your egress costs today. Most teams discover their egress exposure during a migration panic. InfraCost and cloud cost dashboards can show you the number before you need it.
The EU just made cloud portability a legal requirement for the largest platforms on the market. Whether or not DMA enforcement arrives on schedule, the direction of travel is clear: the era of egress fees as a switching barrier is ending. The teams that build for portability now will spend less engineering time reacting to that change later.
