On 27 January 2022, the Autorité de la concurrence announced that it had started proceedings ex-officio to issue a market study on competition conditions in the cloud computing sector. The Autorité is today issuing its final opinion, after publishing an interim document in the summer of 2022 and consulting all the stakeholders.
The cloud is one of the technological developments that is central to the digitisation of the economy. It is a source of productivity gains for companies and value creation for the economy.
In this opinion, the Autorité focuses particularly on cloud layers relating to IT infrastructure (IaaS, « Infrastructure-as-a-Service ») and platform services (PaaS, « Platform-as-a-Service ») for business clients. Developments also concern the entire cloud value chain (among which layers relating to software services (SaaS, « Software-as-a-service ») when it is relevant to the competitive analysis. The sector is dominated by three hyperscalers: Amazon Web Services (AWS), Google Cloud and Microsoft Azure, and represent 80% of the spending growth in public cloud infrastructures and applications in France in 2021. Amazon and Microsoft have captured 46 % and 17 % respectively of revenues from IaaS and PaaS services in 2021. Given their financial capacities and their digital ecosystems, these hyperscalers are in a position to hinder competition development.
The Autorité proposes an analysis grid presenting possible relevant markets in the cloud sector and analyzes various practices implemented or likely to be implemented in this sector, which could restrict competition.
Certain risks impact overall competition in the sector for instance, cloud credits or egress fees. Others fit into specific scenarios, with risks for businesses when migrating to the cloud for the first time, when building their IT systems directly from the cloud, and when migrating a cloud service provider to another. The Autorité also examines risks linked to the barriers to expansion for hyperscalers' competitors.
To tackle these risks, the Autorité points out that it has tools to act swiftly and effectively and protect competition on various grounds such as abuse of dominant position law, cartel law, abuse of economic dependence and merger control. The French law on restrictive competition practices can also be an appropriate response to certain situations.
Further, the Autorité identifies market failures likely to be addressed by the regulations under discussion such as the European (« Data Act ») or the French Governement’s draft law to secure and regulate the digital space.
Finally, the Autorité observes that, in the future, several evolutions will potentially have an impact on competition in the sector. Large language models (LLM, such as ChatGPT), edge computing, cloud gaming, cybersecurity issues or the growing importance of its environmental footprint can be mentioned, among others. Competition authorities will have to monitor that established players do not hinder the development of smaller or new players based on these technologies.
The cloud industry and how it works
The cloud is defined as shared services, accessible via the Internet, on demand, paid per use and, by extension, some of the underlying infrastructures (notably data centres). Despite strong growth (with an annual growth in activity volume of 14% by 2025), the adoption of cloud services in France is lagging behind, with SMEs and very small businesses migrating more slowly than in the rest of Europe in recent years.
The sector is dominated by three “hyperscalers”, being Amazon Web Services (AWS), Google Cloud and Microsoft Azure; respectively having revenues of 46 %, 8% and 17 % from infrastructures and public cloud applications in 2021. Given their financial capacity and their digital ecosystems, these hyperscalers are in a position to hinder competition development, in a market affected by a significant number of mergers. In France, the three above-mentioned companies captured 80% of the growth in spending on public cloud infrastructures and applications in 2021.
For these reasons, the Autorité considered that the likelihood of a new operator being able to gain market share rapidly appears limited, excluding companies who are already powerful in other digital markets. This probability could even go lower as companies migrate to the cloud and choose an ecosystem.
In this opinion, the Autorité focused on public and hybrid cloud. The public cloud generally comprises commercial offerings that give business customers direct access to a large number of services. According to the definitions proposed by the National Institute of Standards and Technology, a distinction is made among three main categories of services,that correspond to different shares of responsibility between the cloud service provider and the customer company.
- IaaS (Infrastructure as a Service) is the least outsourced model, in which the supplier provides the user with IT infrastructure, such as servers or storage;
- PaaS (Platform as a Service) is an intermediate model. It provides an environment where customers can benefit from software and tools to develop their applications without having to create or maintain the infrastructure or platform usually associated with the process;
- SaaS (Software as a Service) is the most outsourced model. It gives users direct access to applications, managed entirely by the supplier, from any connected device.
Analysis of relevant markets in the cloud industry
The Autorité proposes an analysis grid presenting possible relevant markets in the cloud sector. Customer requirements for cloud services could be defined as "workloads", which correspond to all the IT resources or business processes meeting a specific customer need or objective. A possible segmentation based on the French trusted cloud label, SecNumCloud, offers could therefore be considered. However, segmentation according to business sector does not, currently, seem relevant.
Further, the Autorité analysed three types of related markets: the market for data centre colocation services, the markets for on-premise software, in which some companies operating in the cloud markets are also active, and the markets for intermediation in consulting and integration of cloud solutions. Leverage effects could play out in the cloud markets, given the dominant position of certain software companies also present in the cloud market.
The competitive risks identified by the Autorité
The Autorité identifies overall competitive risks, highlights scenarios with specific competitive risks and engages in consequences that can arise from company mergers.
Overall competitive risks
The presence of key stakeholders in the market can make negotiating contract clauses difficult for customers, even powerful ones.
Further, it can be difficult for customers to anticipate future cloud costs, given the complexity of the offerings and the lack of pricing clarity.
Two pricing practices, already analyzed in the Autorité’s Opinion 23-A-05 regarding the draft French law to secure and regulate the digital environment are specific to the sector and are being analyzed by the Autorité's.
- Cloud credits
Cloud credits are of real use and added value for many companies, especially startups, who can avoid substantial investments that could hamper their development, but also for cloud providers, who use them to spread and encourage adoption of their technology.
However, the Autorité considers that special attention should be paid to targeted support offers. The high amounts that may be offered (up to 200 000 $ for two years), the vast ecosystem of companies they serve and their validity periods set them apart significantly from the free trials that can traditionally be seen in other industries, and raise doubts about the ability of all cloud providers to offer them profitably.
Given the time-consuming and costly developments required by customers to set up a cloud architecture with a specific provider, and the technical and financial costs associated with migration, there is a risk of lock-in by the major providers. This lock-in could be reinforced by the presence of clauses or practices limiting the options for changing supplier or using several suppliers simultaneously.
- Egress fees
Some cloud service providers, particularly the hyperscalers, bill their clients for their data transfers to another provider, to the company's on-premises infrastructures, or to their final customers.
The investigation has shown that egress fees are potentially disconnected from the costs directly incurred by suppliers regarding data transfers. They are a major concern for the industry, as their pricing structure is proportional to the volume of data transferred, and customers are unable to anticipate their future needs in terms of data traffic and bandwidth usage.
As they are currently structured, these fees could create a risk of customer lock-in on a fast-growing market, by making it more difficult for cloud users to leave their primary provider or to use several providers at once in a multi-cloud environment.
Specific competitive risks
- Specific competitive risks associated with migrating on-premise information systems to the cloud
Migrating customers from on-premise solutions to the cloud is complex and costly. When making a choice for a cloud service provider, customers may rely on their current IT service providers, especially when they are also cloud providers.
The investigation uncovered practices likely to reinforce the disincentives for a customer to use another cloud provider, such as restrictive contractual clauses, tied sales, pricing advantages favouring their products, and technical restrictions. If implemented by an operator in a dominant position, these practices could amount to abusive practices.
Several complaints relating to similar practices are currently being examined by the European Commission.
- Specific competitive risks associated with migrating from one cloud services provider to another
Impediments to migrating to another provider for already cloud-hosted workloads (meaning IT resources meeting a specific need from a company) can undermine the functioning of competition.
Technological barriers to migration can appear at various levels, linked to the specific architecture and solutions used. Indeed, the variety of products and services, especially PaaS services, the interconnection of IT services and the lack of portability of data and applications can lead to significant migration costs.
In addition to the technical obstacles, suppliers can put in place additional technical and commercial barriers, increasing migration costs in order to strengthen their position. This could be the case, for example, of a company deliberately using a specific data format to prevent the portability of a customer's data to another cloud provider.
- Specific competitive risks linked to barriers to expansion for hyperscalers' competitors
The sector is also marked by technical barriers to interoperability. These affect all competitors, but they have a greater effect on smaller providers, given the attractiveness of cloud ecosystems when it comes to choosing a first provider. These obstacles are illustrated in the opinion by practical examples, such as the technical implications of interoperability with regard to the Amazon S3 object storage service (IaaS). Interoperability with PaaS services is even more complex. For example, changing the PaaS database service requires rewriting the part of the application code that uses that service.
The Autorité has also identified several competitive risks associated with a supplier's presence in several related digital markets, linked to certain business and tariff practices, as well as risks linked to the conditions set by providers for access to and operation of these cloud marketplaces. The possibility of obstacles deliberately being put in place to hinder interoperability cannot be ruled out.
- Company mergers
Competitive risks identified by the Autorité could be reinforced by an aggressive acquisition policy from companies already present in the cloud sector in order to reinforce their position in an identified cloud market or a related market.
The hearings conducted by the Autorité revealed a trend towards mergers in the cloud sector, particularly in the French market. While the Autorité recognises that acquisitions can enable a provider to improve its offering, close the gap with well-established competitors or expand into new segments, it points out that certain mergers can have negative effects on competition (reduction in the number of players, potential bundling or tied selling, higher prices, impact on innovation, etc.). The Autorité also observed that currently, while the hyperscalers have all made acquisitions in recent years, this type of acquisition is much rarer on the part of European operators. The entry into force of the DMA should enable competition authorities, and in particular the European Commission, to monitor more closely these acquisitions, which currently escape merger control as the acquired companies often have a turnover below the notification thresholds.
The Autorité is also concerned about the creation of joint ventures, which bring together major players in the cloud sector who together propose offers specially designed to cover new market segments. However, these entities may group together companies that already enjoy significant competitive advantages, de facto limiting the ability of other, less powerful players to compete with them. The European Commission just cleared the creation of the common company Bleu, co-company from Capgemini and Orange founded on the Microsoft Azure techonologies.
Lastly, the Autorité notes the existence of technological partnerships between hyperscalers and major software providers (for instance agreements between AWS and Salesforce, or Microsoft and Oracle). However, stronger partnerships between cloud service providers or between cloud service providers and software companies, integrators, or specific interoperability agreements between certain cloud and SaaS players, could raise issues with regard to antitrust law, whether they are horizontal or vertical agreements.
The use of regulation
The existence of failures in the market can justify recourse to regulation. While technical solutions exist to facilitate supplier switching or the use of multi-cloud, hyperscalers are not necessarily incentivized to develop high-performance solutions that could erode their market share. The failure of joint initiatives to develop common standards, for example, attests to the lack of will on the part of hyperscalers.
To remedy this situation, the regulatory authorities have taken action, as demonstrated by the adoption of the DMA, the Data Act and the draft law mentioned above. The Autorité made a number of recommendations in this respect in its Opinion 23-A-05 of 20 April 2023.
The Autorité believed the Data Act is likely to positively modify the competitive functioning of the sector. Given the conclusion of the trialogue on 27 June 2023, it does not seem relevant to make proposals to improve the current text. However, as the Commission is due to carry out an evaluation exercise in three years, the Autorité considers that it may be appropriate to monitor several issues:
- distinguishing the regime applicable to egress fees from other migration costs,
- carrying out an impact study on cloud credits and
- specifying measures to promote portability and interoperability
The tools available to the Autorité de la concurrence
Competition law is a particularly useful tool to preserve and stimulate competition in the digital economy. It is sufficiently flexible and comprehensive as evidenced in cases involving big digital players, its capacity to grasp new practices and adapt well-established solutions to new services. To meet the challenges posed by the cloud, one could consider, alongside the classic competition law tools of abuse of dominant position, combating illegal cartels, merger control and abuse of economic dependence, other legal tools from Book IV of the French Commercial Code (Code de commerce), such as restrictive practices, which can be implemented by the General Directorate for Competition Policy, Consumer Affairs and Fraud Control (DGCCRF).
Though it is not legally possible for the Autorité to investigate these questions in the current opinion, the General Rapporteur announces that his competition units will carry out a preliminary examination of the elements gathered in order to estimate whether it is necessary to open one (or more) litigation investigation(s).