# When regulators become a player: antitrust, data law, and AI rules reshaping SaaS
In 2023, Microsoft started selling Teams separately from Microsoft 365 in Europe, and eventually worldwide, cutting its price and unbundling a product it had bundled for free since 2017. This was not a strategic pivot. It was a regulatory order. The EU's Digital Markets Act (DMA), a 2022 law that imposes specific obligations on large "gatekeeper" tech platforms, forced Microsoft's hand after a competitor complaint from Slack in 2020 triggered an antitrust investigation.
That single unbundling event moved real market sharemarket shareThe percentage of total industry sales your company captures in a given period. It measures competitive position relative to rivals in a defined market.View full definition →. Rivals like Slack, Zoom, and Google Chat suddenly compete on a more even footing in Europe. This is the core idea of this lesson: regulators are not referees standing outside the SaaS (Software as a Service) market watching for fouls. They are active players who redraw who competes with whom, and on what terms.
In most competitive analysis, you map incumbents, challengers, suppliers, and distributors. In SaaS today, you need a fifth category: regulators, who can unilaterally change market structure.
Three bodies matter most globally right now:
Unlike a new competitor entering a market, a regulator can act without building a product, raising capital, or acquiring customers. It just writes a rule, and incumbents must restructure around it. That is a different kind of power, and it changes how incumbents plan.
The DMA designates certain large platforms as "gatekeepers" (companies that control access to important digital services for other businesses and consumers) and imposes direct obligations on them. Gatekeepers currently include Alphabet (Google), Amazon, Apple, ByteDance, Meta, and Microsoft, based on the European Commission's designations.
Gatekeeper obligations relevant to SaaS include:
The practical effect for SaaS competitive dynamics: a challenger like Slack no longer competes only on product, it also gets a regulatory tailwind against Microsoft's natural bundling advantage. This is regulation actively reshaping the competitive mapmapUsing software to automate repetitive marketing tasks and campaigns, enabling personalisation at scale across channels like email, web, and social.View full definition →, not just penalizing bad behavior after the fact.
You can read the DMA's actual gatekeeper obligations at the European Commission's DMA page.
GDPR, in force since 2018, imposes strict rules on how companies handle personal data of EU residents, including requirements around consent, data minimization, and cross-border data transfers.
The cross-border transfer rules turned out to be a competitive weapon, intentionally or not. Following the *Schrems II* ruling by the EU's Court of Justice in 2020, transferring EU personal data to US cloud providers became legally fraught, because US surveillance law was deemed incompatible with EU privacy protections. This created genuine legal risk for European companies using AWS, Azure, or Google Cloud for regulated data.
The result: a "sovereign cloud" category emerged. Vendors like OVHcloud (France), Deutsche Telekom's cloud services, and Microsoft's and AWS's own EU-localized "sovereign" offerings all market data residency and legal jurisdiction as core features, not side notes. Governments in France and Germany have also pushed public-sector procurement toward EU-based vendors partly for this reason.
This is a second mechanism by which regulation reshapes competition: not by breaking up an incumbent's product, but by making geography and legal jurisdiction into a product feature that didn't matter as much before.
Think about who gains and loses leverage when regulation intervenes:
| Player | Effect of DMA/GDPR-style regulation |
|---|---|
| Large US hyperscalers (AWS, Azure, GCP) | Lose some bundling and data-transfer advantages; must build compliance infrastructure (costly, but also a moatmoatA lasting edge over competitors: a resource, capability or position they cannot easily replicate, letting a firm earn above-average returns over time.View full definition → against smaller entrants) |
| Challengers (Slack, regional SaaS vendors) | Gain forced access and a more level playing field, at least in the EU |
| European SaaS/cloud vendors | Gain a genuine differentiator (data sovereignty) that didn't previously carry much commercial weight |
| Enterprise customers | Gain leverage, more portability, more vendor choice, lower switching costs |
| Regulators themselves | Become an ongoing variable in competitive strategy, not a one-time event |
Notice the compliance cost detail: building GDPR or DMA compliance infrastructure is expensive. Large incumbents can absorb this cost more easily than small challengers, which means regulation, while aimed at curbing incumbent power, can also raise barriers to entry for the very challengers it's trying to help. This is a genuine tension, not a footnote.
The EU AI Act, which entered into force in 2024 with obligations phasing in through 2026 and beyond, classifies AI systems by risk level and imposes obligations accordingly (transparency requirements for general-purpose AI models, stricter rules for "high-risk" uses like hiring or credit scoring).
For SaaS vendors embeddingembeddingAn embedding is a numerical vector that represents data (text, images, or items) in a way that captures meaning, so similar items sit close together in space.View full definition → AI features (which by 2026 is nearly all of them), this means:
Watch this space closely over 2026 to 2027: it is the DMA/GDPR pattern playing out again, in real time, in a new layer of the stack.
Knowledge check
1. What is the core conceptual shift the Microsoft Teams unbundling illustrates for competitive analysis in SaaS?
2. Why does the lesson describe regulatory power as a 'different kind of power' compared to a new competitor entering the market?
3. A US-based SaaS company primarily serving European customers is trying to determine which regulatory body most directly shapes its data privacy obligations. Based on the lesson, which of the following is most likely to have direct oversight?
4. Select ALL correct answers about why regulators are considered a 'fifth force' in SaaS competitive analysis.
Select all the correct answers.
5. Select ALL correct answers describing the regulatory bodies identified in the lesson as currently most influential in shaping global SaaS markets.
Select all the correct answers.
For anyone assessing a SaaS company's competitive position, three questions now belong alongside the usual product and market ones:
1. Is this company a "gatekeeper" or does it compete against one? That status alone predicts future obligations or advantages.
2. How exposed is this company's data architecture to GDPR-style transfer risk? This affects EU enterprise sales cycles directly.
3. Is regulation here creating a moat or removing one? Compliance costs cut both ways: they curb incumbent bundling power but also raise the bar for challengers.
A useful public resource for tracking enforcement actions in real time is the European Commission's competition case register, which lists ongoing DMA and antitrust investigations against named companies.