When regulators become a player: antitrust, data law, and AI rules reshaping SaaS

Three bodies matter most globally right now:

• The European Commission, enforcing the DMA and GDPR (General Data Protection Regulation, the EU's 2018 data privacy law).
• The US Federal Trade Commission (FTC) and Department of Justice (DOJ), pursuing antitrust cases under existing US law (there is no US federal equivalent to the DMA as of 2026).
• National data protection authorities, like Ireland's Data Protection Commission (which oversees most US Big Tech due to their EU headquarters location) and Germany's federal and state-level regulators.

Unlike a new competitor entering a market, a regulator can act without building a product, raising capital, or acquiring customers. It just writes a rule, and incumbents must restructure around it. That is a different kind of power, and it changes how incumbents plan.

Case 1: The DMA and gatekeeper obligations

The DMA designates certain large platforms as "gatekeepers" (companies that control access to important digital services for other businesses and consumers) and imposes direct obligations on them. Gatekeepers currently include Alphabet (Google), Amazon, Apple, ByteDance, Meta, and Microsoft, based on the European Commission's designations.

Gatekeeper obligations relevant to SaaS include:

• Interoperability requirements: gatekeepers must let competing services interconnect with their core platforms in specified ways.
• Anti-bundling rules: the Teams unbundling is a direct result of this.
• Data portability: business users must be able to move their data out easily.
• Self-preferencing bans: gatekeepers cannot rank their own services above competitors in search or app stores.

The practical effect for SaaS competitive dynamics: a challenger like Slack no longer competes only on product, it also gets a regulatory tailwind against Microsoft's natural bundling advantage. This is regulation actively reshaping the competitive mapmapUsing software to automate repetitive marketing tasks and campaigns, enabling personalisation at scale across channels like email, web, and social.Voir la définition complète →, not just penalizing bad behavior after the fact.

You can read the DMA's actual gatekeeper obligations at the European Commission's DMA page.

Case 2: GDPR and the rise of European cloud vendors

GDPR, in force since 2018, imposes strict rules on how companies handle personal data of EU residents, including requirements around consent, data minimization, and cross-border data transfers.

The cross-border transfer rules turned out to be a competitive weapon, intentionally or not. Following the *Schrems II* ruling by the EU's Court of Justice in 2020, transferring EU personal data to US cloud providers became legally fraught, because US surveillance law was deemed incompatible with EU privacy protections. This created genuine legal risk for European companies using AWS, Azure, or Google Cloud for regulated data.

The result: a "sovereign cloud" category emerged. Vendors like OVHcloud (France), Deutsche Telekom's cloud services, and Microsoft's and AWS's own EU-localized "sovereign" offerings all market data residency and legal jurisdiction as core features, not side notes. Governments in France and Germany have also pushed public-sector procurement toward EU-based vendors partly for this reason.

This is a second mechanism by which regulation reshapes competition: not by breaking up an incumbent's product, but by making geography and legal jurisdiction into a product feature that didn't matter as much before.

How this changes power dynamics along the value chain

Think about who gains and loses leverage when regulation intervenes:

| Player | Effect of DMA/GDPR-style regulation |

|---|---|

| Large US hyperscalers (AWS, Azure, GCP) | Lose some bundling and data-transfer advantages; must build compliance infrastructure (costly, but also a moatmoatA lasting edge over competitors: a resource, capability or position they cannot easily replicate, letting a firm earn above-average returns over time.Voir la définition complète → against smaller entrants) |

| Challengers (Slack, regional SaaS vendors) | Gain forced access and a more level playing field, at least in the EU |

| European SaaS/cloud vendors | Gain a genuine differentiator (data sovereignty) that didn't previously carry much commercial weight |

| Enterprise customers | Gain leverage, more portability, more vendor choice, lower switching costs |

| Regulators themselves | Become an ongoing variable in competitive strategy, not a one-time event |

Notice the compliance cost detail: building GDPR or DMA compliance infrastructure is expensive. Large incumbents can absorb this cost more easily than small challengers, which means regulation, while aimed at curbing incumbent power, can also raise barriers to entry for the very challengers it's trying to help. This is a genuine tension, not a footnote.

The next frontier: the EU AI Act

The EU AI Act, which entered into force in 2024 with obligations phasing in through 2026 and beyond, classifies AI systems by risk level and imposes obligations accordingly (transparency requirements for general-purpose AI models, stricter rules for "high-risk" uses like hiring or credit scoring).

For SaaS vendors embeddingembeddingAn embedding is a numerical vector that represents data (text, images, or items) in a way that captures meaning, so similar items sit close together in space.Voir la définition complète → AI features (which by 2026 is nearly all of them), this means:

• Documentation and transparency obligations for foundation models used inside products (relevant to vendors like OpenAI, Anthropic, Mistral, and any SaaS company building on top of them).
• Compliance costs that again scale better for large players.
• A possible repeat of the sovereign cloud pattern: European AI vendors (Mistral AI, Aleph Alpha) marketing EU-based, EU-compliant AI as a differentiator against US foundation model providers.

Watch this space closely over 2026 to 2027: it is the DMA/GDPR pattern playing out again, in real time, in a new layer of the stack.

Reading the regulatory chessboard as a strategic skill

For anyone assessing a SaaS company's competitive position, three questions now belong alongside the usual product and market ones:

1. Is this company a "gatekeeper" or does it compete against one? That status alone predicts future obligations or advantages.

2. How exposed is this company's data architecture to GDPR-style transfer risk? This affects EU enterprise sales cycles directly.

3. Is regulation here creating a moat or removing one? Compliance costs cut both ways: they curb incumbent bundling power but also raise the bar for challengers.

A useful public resource for tracking enforcement actions in real time is the European Commission's competition case register, which lists ongoing DMA and antitrust investigations against named companies.

Key Takeaways

• Regulators now actively reshape SaaS competitive structure, not just police it after the fact: Microsoft's Teams unbundling under the DMA is a direct, traceable example of a law changing market sharemarket shareThe percentage of total industry sales your company captures in a given period. It measures competitive position relative to rivals in a defined market.Voir la définition complète → dynamics.
• GDPR's cross-border data transfer rules, especially after the *Schrems II* ruling, created a genuine commercial opening for European "sovereign cloud" vendors like OVHcloud, turning legal jurisdiction into a product feature.
• Regulation redistributes power unevenly: challengers often gain forced access or portability rights, but compliance costs can simultaneously favor large incumbents who can absorb them more easily.
• The EU AI Act is likely to repeat this pattern in the AI layer of SaaS through 2026 and beyond, with transparency and risk-classification rules that create both new costs and new sovereign-AI market opportunities.
• When assessing any SaaS company's competitive position, treat "gatekeeper status," "data transfer exposure," and "compliance cost asymmetry" as core strategic variables, not legal footnotes.