Summary

  • The CMA’s 16 October update reports progress on AWS and Microsoft cloud measures, while saying uptake is still limited and outcomes are not mature.
  • The next work turns to cross-cloud identity authorisation and Kubernetes portability; the Board plans to judge the momentum of voluntary dialogue in Spring 2027.

A company can move data out of a cloud and still be unable to move the permissions and operating assumptions that let its applications use that data. That gap is the harder question in the Competition and Markets Authority’s latest cloud update.

The CMA’s 16 October report says Amazon Web Services and Microsoft have progressed measures involving egress, direct data-centre connections, interoperability requests and management of workloads across clouds. But uptake is limited so far, the schemes are not mature, and some announced steps remain outstanding. The annex dates some offers to before the March 2026 action package: Microsoft’s free-switching programme has been available since 2024, and its at-cost multi-cloud offer since 2025. This is a progress review, not evidence that every measure is new or that customers are already switching at scale.

The next priorities expose what cheaper data movement cannot settle. Identity federation can help users authenticate across providers; it does not automatically translate the authorisation rules that decide what those users may do. The CMA says differences in provider languages and models can make that translation costly. Kubernetes offers a common way to deploy containerised applications, yet cloud-specific services and integrations can still bind a workload to its environment. IAM and networking are among the dependencies customers have raised.

The CMA and the two providers will focus on cross-cloud IAM, especially authorisation, and Kubernetes workload portability. They have not agreed a ready-made solution or timetable. The immediate task is to define a process from problem statement to solution and include customers, competitors and wider industry input. The CMA Board will assess in Spring 2027 whether voluntary dialogue is creating sufficient momentum for better UK customer outcomes. That is a review point, not a promised delivery date.

Availability is not the same as choice. The CMA says uptake and wider market outcomes both matter: a customer may gain bargaining power and better terms without leaving its provider. A tally of announced schemes or completed switches would miss part of the effect. The report gives no uptake count, negotiated-price result or measure of how often customers can move a live workload while preserving its security controls.

The GOV.UK publication record lists this cloud update separately from the same-day proposed decision on Microsoft’s business-software ecosystem. That statutory designation proposal is not a new cloud remedy. The CMA said in March that a more formal route remained an option if voluntary steps proved insufficient; the October report does not say that threshold has been crossed.

The practical test is whether the parties can specify what portable authorisation means, how a Kubernetes workload is tested beyond its container image, and what evidence would show a UK customer has a usable exit or bargaining alternative. Until the process and indicators are public, the CMA can report activity more easily than customer-level change.