UK's CMA proposes special status for Microsoft business software, with Copilot in scope

What the CMA proposed

Britain's Competition and Markets Authority (CMA) has proposed giving Microsoft “strategic market status” in business software, a label that would let the regulator impose rules on how Microsoft sells and connects products such as Word, Excel, Teams and its Copilot AI assistant. The CMA published its proposed decision on 16 October, together with a press release and an indicative roadmap of the areas where it could intervene.

The CMA opened the investigation on 14 May 2026 under the Digital Markets, Competition and Consumers Act 2024, the UK law that created a special regime for very large digital firms. Its provisional findings are that Microsoft has a strong position in all five areas it examined, that this strength comes from the barriers customers face when switching, and that Microsoft's commercial practices and integration advantages create further barriers that other software developers cannot easily overcome.

“Organisations should be able to choose the products that work best for them, switch provider when they want to and combine services from different suppliers,” said CMA chief executive Sarah Cardell. If Microsoft is designated, it would be the third company under the regime, after Google in search and Google and Apple in mobile platforms, as Reuters noted.

What counts as Microsoft's business software

The CMA calls the subject of the case Microsoft's business software ecosystem. It covers five digital activities: operating systems for personal computers, productivity software suites, security software, server operating systems and relational database management systems such as SQL Server. The regulator says these products are used by more than a million businesses and public sector organisations in the UK, with around 20 million monthly users.

The proposed decision puts numbers on some of that strength, although many are given as ranges or redacted. It says Microsoft's UK share of supply in security software was 60 to 70 percent in 2025 and has been stable since at least 2020. It puts Microsoft's UK revenue share at 70 to 80 percent for server operating systems and 40 to 50 percent for database software in 2025, and cites Microsoft's own estimate of a 70 to 80 percent global share of PC operating systems outside China.

Crucially for AI, the CMA provisionally treats Copilot as part of the productivity software activity. The roadmap's footnotes list Microsoft 365 Copilot and Copilot Chat, features such as Copilot Cowork and agents for Microsoft 365 Copilot, the Copilot app and Copilot add-ins, plus the Microsoft Graph API, Work IQ, the Microsoft 365 admin centre and Agent 365 where they support that activity. The security activity includes Entra, Active Directory, Intune and Defender, along with parts of Purview, Security Copilot and Agent 365.

Why Copilot is in the frame

The press release says business software is changing fast, with more AI and a shift toward agentic AI in familiar workplace tools. The CMA wants UK customers to be able to “mix and match software and AI services” from competing suppliers, and says that for government and critical organisations the ability to choose and switch AI services without depending on one provider matters for resilience.

The roadmap sets out both sides. Microsoft told the CMA that rivals can reach organisational data through public APIs, so third-party AI providers get substantially the same access to Microsoft 365 data as Copilot. Rival AI providers disagreed. They pointed to customers getting immediate access to the free version of Copilot, which may nudge them toward paid Copilot licences, and to discounted bundles sold through E7 and Enterprise Agreements. They told the CMA the real question is not whether APIs exist, but whether those APIs match what Copilot gets, what they cost, whether rival tools can be found and used inside Microsoft's own apps, and how much work rivals spend chasing API changes. Microsoft keeps deepening those links, as with Copilot Studio agents that get their own Microsoft 365 accounts and SharePoint knowledge bases built for agents.

Customer research carried out for the CMA by Jigsaw Research, dated 28 September 2026, found businesses testing alternatives to Copilot, including Claude and ChatGPT. Anthropic, for one, now offers Claude inside Google Docs, Sheets and Slides. But the research also found customers often choose Copilot for its perceived security and its integration with Microsoft 365, and that some are unsure of the return on what they see as a high licence cost and worry about future price rises. The CMA says it will investigate whether those concerns exist because customers cannot switch.

What the CMA could require

The roadmap is a list of options, not decisions. If further evidence shows a risk to rivals' ability to compete with Copilot, the CMA says possible future interventions could include parity requirements so that other AI providers can reach Microsoft functionality and data on the same terms as Microsoft's own AI features; rules on giving rival products enough prominence in the productivity suite and on how users choose and change defaults; minimum notice periods for API changes and a fair process for interoperability requests; more transparent licensing terms for AI features; and unbundling Microsoft's AI features from its existing suites.

The roadmap has three other focus areas. On cloud, the CMA says its July 2025 cloud market investigation found that Microsoft's licensing limits customer choice and that Microsoft has not changed those practices since; it will look at whether customers can run software licences on the cloud of their choice. On communication and collaboration apps such as Teams, it will consider whether action is needed in the UK in light of Microsoft's commitments to the European Commission. On security, it will examine whether bundling and unequal access to data and APIs hold back rival security vendors, a concern it says will grow as companies build AI agents into their work.

Microsoft's response and the cloud update

Microsoft disagrees with the CMA's view. “All our products — including Copilot — are open and interoperable, giving customers the ability to use them alongside competing services,” a spokesperson told Reuters. Computer Weekly reported that Microsoft has argued throughout the case that it operates in a “vigorously competitive” market, pointing to Google Workspace, macOS, Linux, PostgreSQL and Okta, and that AI is “dramatically lowering the barriers to building high-performing enterprise software.”

The same day, the CMA gave an update on cloud services, where it chose to work with Amazon Web Services and Microsoft without a formal designation. It said both companies had connected their data centres with rivals, starting with Google, removed data transfer fees for customers who switch cloud providers and cut them for multi-cloud use, added a way for customers and competitors to request interoperability, and rolled out AI tools that automate technical switching steps. The next focus is how identity and access management works across clouds. The CMA will publish another cloud update in spring 2027 and keeps a full investigation under review.

Microsoft welcomed that part. “We welcome the CMA's acknowledgement that Microsoft's market position in cloud does not justify a Digital Markets Competition Regime designation,” a spokesperson told Reuters. AWS said it had kept investing in AI, multicloud and open-standard tools that give customers more control.

Timeline and what designation means

Anyone can respond to the consultation by 5pm UK time on 13 November 2026. The CMA says any non-disclosure agreement with Microsoft should not stop a party from responding, and that Microsoft has confirmed it will not use confidentiality terms to block responses. The case page sets out the rest of the timetable: publication of responses and an opportunity for Microsoft to make oral representations in November, more evidence gathering through December, and a final decision report in February 2027. The legal deadline for the decision notice is 13 February 2027.

Designation itself does not assume wrongdoing and changes nothing on its own. It gives the CMA the power to propose conduct requirements or pro-competition interventions, each of which must meet its own legal test and go through further consultation. The CMA has used those powers on Google before: in June it imposed conduct requirements on Google search, including letting publishers stop their content being used for Google's AI features, according to Reuters.

What is still unclear

This section is AI Lookout analysis. The proposed decision is provisional, and the most important numbers in it are ranges or redacted, so outsiders cannot yet judge how large Copilot's lead is. The CMA says only that UK adoption of Microsoft 365 Copilot offerings is substantially higher than that of other providers' AI features. It also says openly that AI in office software is a fast-moving area and that it needs more evidence before acting.

For companies building AI assistants and agents for the workplace, the practical signal is that UK rules on API access, default settings and bundling could arrive in 2027 if Microsoft is designated. For customers, nothing changes yet. Licences, prices and Copilot features stay as they are until the CMA designates Microsoft and then consults on specific requirements.

What to watch: published consultation responses from rival AI and security vendors, any change in Microsoft's position before February, and whether the first conduct requirements target Copilot or cloud licensing. AI Lookout will update this article when the CMA issues its final decision.