The CMA Microsoft Probe Should Change How UK Firms Buy AI Assistants

Tools & Technical Tutorials

19 October 2026 | By Ashley Marshall

The regulator has not told you to ditch Copilot. It has given you a reason to prove that your chosen assistant actually wins on your own work.

What the CMA has actually said

On 16 October, the Competition and Markets Authority proposed designating Microsoft with strategic market status in its business software ecosystem. That is a provisional decision, not a finding of wrongdoing and not a new rule requiring businesses to replace Microsoft products. The regulator is consulting before a final decision, expected by February 2027. Its question is whether customers have meaningful choice when Word, Excel, Outlook, Teams, Windows, security products and Copilot are intertwined. The CMA says this ecosystem is used by more than one million UK businesses and public sector organisations and around 20 million monthly users. Those figures explain why even small frictions in switching matter. Read the CMA announcement and its case page for the exact procedural position.

The business implication is immediate even though the legal process is not finished. A board buying an assistant in October 2026 should not assume that a familiar button inside its existing software suite is automatically the best answer. Equally, it should not assume that regulatory scrutiny makes an alternative tool superior. The useful question is narrower: can the business compare assistants on its own tasks, permissions, costs and exit terms? If the answer is no, it lacks a procurement decision, not merely a technology preference.

Ask the team to list the five tasks for which it expects Copilot or another assistant to create value. For each, record the data source, the person who approves output, and the acceptable error rate. Then test at least one credible alternative where the integration permits. This is not a campaign against Microsoft. It is the minimum evidence needed to know whether a bundled option deserves your budget.

AI choice is an integration question

The CMA's indicative roadmap says it will gather evidence on whether customers can freely choose AI tools and whether alternative providers can compete fairly with Copilot. That is a more practical framing than the usual model league table. An assistant may produce an impressive answer in a demo yet fail on the actual work because it cannot retrieve the right files, respect permissions, write back safely or fit the approval process. Conversely, a tool with slightly less dazzling answers may be the better purchase if it integrates cleanly and creates a reliable audit trail.

In practice, build one comparable workflow rather than two unrelated demonstrations. Take, for example, a sales proposal assembled from approved case studies and a current price list. Give each candidate the same source documents and the same prompt. Measure how often it cites the correct version, exposes material outside the test user's permissions, invents a customer claim, or needs a human rewrite. Capture the time from request to approved final copy, not just the seconds until an initial answer appears. The relevant metric is usable work, not model fluency.

Do not turn this into an unlimited trial across every product on the market. Pick the incumbent and one serious alternative, run ten representative cases, and document why one wins. Where an alternative cannot access the system of record, record whether that is a product limitation, a policy choice or an integration barrier. This distinction matters. A board can change its internal policy; a supplier can sometimes change an API or commercial term; neither is fixed by writing a better prompt. The CMA case page gives buyers a way to understand the regulatory question without pretending the outcome has already been decided.

Cloud switching gains do not eliminate lock-in

Alongside the software investigation, the CMA reported progress in its engagement with Amazon Web Services and Microsoft on cloud choice. Its October update cites removal of data transfer fees for customers changing cloud providers, lower fees for multi-cloud use, new ways to request interoperability and work on AI tools that automate switching steps. It also says barriers remain, including identity and access management across clouds and whether portable architectures can actually be migrated. These are reported developments, not proof that every customer now has cost-free migration. The October announcement is careful on that point.

For AI buyers, a waived egress charge is only one line of the exit bill. The larger cost may be rebuilding permissions, document connectors, observability, evaluation sets and staff routines. A chatbot whose prompts and retrieval rules are stored in a proprietary interface can become costly to move even when its underlying files are exportable. Likewise, an agent that relies on one provider's identity groups or workflow actions can be trapped by the implementation, not by the contract.

What this means in practice is to price an exit drill before a major rollout. Ask the supplier to export prompts, configurations, conversation records where lawful, source metadata and evaluation results into usable formats. Then have a second team reproduce one workflow on another platform. Record hours and any missing capabilities. A modest rehearsal gives you a credible estimate of switching effort and a negotiating position. It does not require running a permanently expensive multi-cloud architecture. The CMA's March package of actions already identified egress and interoperability as concerns; the October update shows progress and the remaining work.

Procurement questions for the next renewal

Use the next licence renewal as a decision point, not merely a price negotiation. Request a written map of which AI features are included, which are paid extras, which require specific licence tiers, and which business data each feature can reach by default. Ask whether a rival assistant can use the same approved documents through supported connectors or APIs. Ask what changes if you discontinue the AI add-on but keep the core productivity suite. And ask for a documented export and deletion path for prompts, files, logs and generated content.

There is a useful distinction between product bundling and operational standardisation. Standardising on one suite can reduce training and support overhead. That is a valid reason to buy it. It is not a reason to skip the comparison or to count a bundled licence as free. If the assistant increases per-user fees, requires higher security licences, or creates review work, those costs belong in the business case. Equally, stitching together three alternative tools can increase integration and governance expense. Compare full workflow cost, not subscription price alone.

A procurement scorecard can be compact. Give each candidate a score for task quality, permission handling, administrative controls, accessibility, support, total cost and exit effort. Weight the categories before a demonstration so the vendor cannot dictate the test. Add a simple red-line gate: no production access to sensitive records without named ownership and logging. The DWP cloud security policy, updated in October, is a public-sector example of asking suppliers to disclose embedded AI services that may access data and of requiring explicit authorisation before data is used for training. It is not a universal rule for private firms, but it is a useful illustration of the questions a buyer can put in a contract.

Make the choice reversible

The strongest response to uncertainty is not to wait for the CMA's final decision. It is to avoid making today's choice unnecessarily irreversible. Keep source documents in governed systems rather than copying them into disconnected assistant workspaces. Define prompts and evaluation cases outside the vendor interface where possible. Use business-owned service identities, documented connectors and a clear owner for each automation. Review the permissions the assistant inherits, especially where a broad shared drive makes private material technically searchable.

Start with one workflow for four to six weeks. Before buying licences for an entire department, set a baseline: current minutes per task, rework rate, approval time and any customer-impacting errors. Run the pilot on real but appropriately controlled work. Include a failure case such as an outdated price sheet or a deliberately misleading document. If the assistant cannot identify the right version or ask for human approval, the remedy may be data governance rather than a different model. A meaningful pilot ends with a go, revise or stop decision and written evidence.

There is a counterargument: a small firm cannot afford a complex multi-vendor procurement. That is fair. This is not a call for a twelve-month tender. A one-page scorecard, ten matched cases and an exit drill on a single workflow are proportionate. The aim is to preserve choice, not to maximise process. Where the incumbent wins clearly, buy it with confidence and review the decision at renewal. Where an alternative wins, know precisely why and what integration it needs. The CMA's process may alter market conditions later, but a reversible design makes the business less dependent on the timing of a regulator's decision.

What leaders should do this month

First, inventory the AI assistants already in use across Microsoft 365, cloud accounts and departmental software. Note which are bundled, which are separately licensed and which are activated by default. Second, choose one high-volume workflow with a measurable outcome and a named human owner. Third, run a matched test of the incumbent and one alternative, using the same source material and a short set of real cases. Fourth, ask the supplier for a demonstrable export path and price the work of moving that one workflow. Finally, take the resulting scorecard to the licence renewal or budget review.

Be precise about the regulatory story when briefing colleagues. The CMA has proposed strategic market status for Microsoft's business software ecosystem, invited views and identified possible areas for future intervention. It has not ordered a company to unbundle Copilot, declared Microsoft guilty of misconduct, or guaranteed that a competitor will gain equal access tomorrow. The consultation on the proposed decision is open until 13 November 2026 according to the CMA case page. Buyers and competitors with relevant evidence can contribute, but their own procurement work should not wait for that process.

For UK businesses, the lesson is neither to abandon the familiar suite nor to trust it by default. Make assistants compete on the workflow that matters, including security and exit. A sensible decision can be a single supplier. The point is that it should be a decision you can explain with evidence, repeat next year and reverse if the facts change. That is how regulatory news becomes a practical purchasing discipline rather than another headline that briefly unsettles a board and changes nothing.

Frequently Asked Questions

Has the CMA found Microsoft guilty of wrongdoing?

No. It has proposed a strategic market status designation and is consulting before a final decision. The proposal does not itself establish wrongdoing.

Does this mean we should stop using Copilot?

No. Test Copilot against your own workflow and a credible alternative. If it wins on quality, security, cost and exit terms, keep it.

When is the CMA decision expected?

The CMA case page indicates a final decision by the February 2027 statutory deadline, following consultation.

What does strategic market status mean?

It is a UK digital markets designation that can enable targeted interventions, subject to separate legal tests. It does not automatically impose a specific remedy.

Are cloud switching fees now gone?

The CMA reports removal of data transfer fees for customers changing cloud providers by AWS and Microsoft, but terms and other migration costs still need checking for your contract and workload.

How many AI tools should a small firm compare?

Usually two for a first decision: the incumbent and one serious alternative, assessed on ten matched real tasks.

What should an AI exit drill include?

Export prompts, configuration, source metadata and evaluations, then reproduce one workflow elsewhere and record the hours and gaps.

Does the DWP cloud policy apply to private companies?

No. It governs DWP and its relevant suppliers. Private buyers can still use its questions about embedded AI, data use and portability as procurement prompts.