Cloud computing: the Autorité de la concurrence issues its market study on competition in the cloud sector

The cloud industry and how it works

The cloud is defined as shared services, accessible via the Internet, on demand, paid per use and, by extension, some of the underlying infrastructures (notably data centres). Despite strong growth (with an annual growth in activity volume of 14% by 2025), the adoption of cloud services in France is lagging behind, with SMEs and very small businesses migrating more slowly than in the rest of Europe in recent years.

The sector is dominated by three “hyperscalers”, being Amazon Web Services (AWS), Google Cloud and Microsoft Azure; respectively having revenues of 46 %, 8% and 17 % from infrastructures and public cloud applications in 2021. Given their financial capacity and their digital ecosystems, these hyperscalers are in a position to hinder competition development, in a market affected by a significant number of mergers. In France, the three above-mentioned companies captured 80% of the growth in spending on public cloud infrastructures and applications in 2021.

For these reasons, the Autorité considered that the likelihood of a new operator being able to gain market share rapidly appears limited, excluding companies who are already powerful in other digital markets. This probability could even go lower as companies migrate to the cloud and choose an ecosystem.

In this opinion, the Autorité focused on public and hybrid cloud. The public cloud generally comprises commercial offerings that give business customers direct access to a large number of services.  According to the definitions proposed by the National Institute of Standards and Technology, a distinction is made among three main categories of services,that correspond to different shares of responsibility between the cloud service provider and the customer company.

• IaaS (Infrastructure as a Service) is the least outsourced model, in which the supplier provides the user with IT infrastructure, such as servers or storage;
• PaaS (Platform as a Service) is an intermediate model. It provides an environment where customers can benefit from software and tools to develop their applications without having to create or maintain the infrastructure or platform usually associated with the process;
• SaaS (Software as a Service) is the most outsourced model. It gives users direct access to applications, managed entirely by the supplier, from any connected device.

Analysis of relevant markets in the cloud industry

The Autorité proposes an analysis grid presenting possible relevant markets in the cloud sector. Customer requirements for cloud services could be defined as "workloads", which correspond to all the IT resources or business processes meeting a specific customer need or objective. A possible segmentation based on the French trusted cloud label, SecNumCloud, offers could therefore be considered. However, segmentation according to business sector does not, currently, seem relevant.

Further, the Autorité analysed three types of related markets: the market for data centre colocation services, the markets for on-premise software, in which some companies operating in the cloud markets are also active, and the markets for intermediation in consulting and integration of cloud solutions. Leverage effects could play out in the cloud markets, given the dominant position of certain software companies also present in the cloud market.

The competitive risks identified by the Autorité

The Autorité identifies overall competitive risks, highlights scenarios with specific competitive risks and engages in consequences that can arise from company mergers.

Overall competitive risks

The presence of key stakeholders in the market can make negotiating contract clauses difficult for customers, even powerful ones.

Further, it can be difficult for customers to anticipate future cloud costs, given the complexity of the offerings and the lack of pricing clarity.

Two pricing practices, already analyzed in the Autorité’s Opinion 23-A-05 regarding the draft French law to secure and regulate the digital environment are specific to the sector and are being analyzed by the  Autorité's.

• Cloud credits

Cloud credits are of real use and added value for many companies, especially startups, who can avoid substantial investments that could hamper their development, but also for cloud providers, who use them to spread and encourage adoption of their technology.

However, the Autorité considers that special attention should be paid to targeted support offers. The high amounts that may be offered (up to 200 000 $ for two years), the vast ecosystem of companies they serve and their validity periods set them apart significantly from the free trials that can traditionally be seen in other industries, and raise doubts about the ability of all cloud providers to offer them profitably.

Given the time-consuming and costly developments required by customers to set up a cloud architecture with a specific provider, and the technical and financial costs associated with migration, there is a risk of lock-in by the major providers. This lock-in could be reinforced by the presence of clauses or practices limiting the options for changing supplier or using several suppliers simultaneously.

• Egress fees

Some cloud service providers, particularly the hyperscalers, bill their clients for their data transfers to another provider, to the company's on-premises infrastructures, or to their final customers.

The investigation has shown that egress fees are potentially disconnected from the costs directly incurred by suppliers regarding data transfers. They are a major concern for the industry, as their pricing structure is proportional to the volume of data transferred, and customers are unable to anticipate their future needs in terms of data traffic and bandwidth usage.

As they are currently structured, these fees could create a risk of customer lock-in on a fast-growing market, by making it more difficult for cloud users to leave their primary provider or to use several providers at once in a multi-cloud environment.

Specific competitive risks

• Specific competitive risks associated with migrating on-premise information systems to the cloud

Migrating customers from on-premise solutions to the cloud is complex and costly. When making a choice for a cloud service provider, customers may rely on their current IT service providers, especially when they are also cloud providers.

The investigation uncovered practices likely to reinforce the disincentives for a customer to use another cloud provider, such as restrictive contractual clauses, tied sales, pricing advantages favouring their products, and technical restrictions. If implemented by an operator in a dominant position, these practices could amount to abusive practices.

Several complaints relating to similar practices are currently being examined by the European Commission.

• Specific competitive risks associated with migrating from one cloud services provider to another

Impediments to migrating to another provider for already cloud-hosted workloads (meaning IT resources meeting a specific need from a company) can undermine the functioning of competition.

Technological barriers to migration can appear at various levels, linked to the specific architecture and solutions used. Indeed, the variety of products and services, especially PaaS services, the interconnection of IT services and the lack of portability of data and applications can lead to significant migration costs.

In addition to the technical obstacles, suppliers can put in place additional technical and commercial barriers, increasing migration costs in order to strengthen their position. This could be the case, for example, of a company deliberately using a specific data format to prevent the portability of a customer's data to another cloud provider.

• Specific competitive risks linked to barriers to expansion for hyperscalers' competitors

The sector is also marked by technical barriers to interoperability. These affect all competitors, but they have a greater effect on smaller providers, given the attractiveness of cloud ecosystems when it comes to choosing a first provider. These obstacles are illustrated in the opinion by practical examples, such as the technical implications of interoperability with regard to the Amazon S3 object storage service (IaaS). Interoperability with PaaS services is even more complex. For example, changing the PaaS database service requires rewriting the part of the application code that uses that service.

The Autorité has also identified several competitive risks associated with a supplier's presence in several related digital markets, linked to certain business and tariff practices, as well as risks linked to the conditions set by providers for access to and operation of these cloud marketplaces. The possibility of obstacles deliberately being put in place to hinder interoperability cannot be ruled out.

• Company mergers

Competitive risks identified by the Autorité could be reinforced by an aggressive acquisition policy from companies already present in the cloud sector in order to reinforce their position in an identified cloud market or a related market.

The hearings conducted by the Autorité revealed a trend towards mergers in the cloud sector, particularly in the French market. While the Autorité recognises that acquisitions can enable a provider to improve its offering, close the gap with well-established competitors or expand into new segments, it points out that certain mergers can have negative effects on competition (reduction in the number of players, potential bundling or tied selling, higher prices, impact on innovation, etc.). The Autorité also observed that currently, while the hyperscalers have all made acquisitions in recent years, this type of acquisition is much rarer on the part of European operators. The entry into force of the DMA should enable competition authorities, and in particular the European Commission, to monitor more closely these acquisitions, which currently escape merger control as the acquired companies often have a turnover below the notification thresholds.

The Autorité is also concerned about the creation of joint ventures, which bring together major players in the cloud sector who together propose offers specially designed to cover new market segments. However, these entities may group together companies that already enjoy significant competitive advantages, de facto limiting the ability of other, less powerful players to compete with them. The European Commission just cleared the creation of the common company Bleu, co-company from Capgemini and Orange founded on the Microsoft Azure techonologies.

Lastly, the Autorité notes the existence of technological partnerships between hyperscalers and major software providers (for instance agreements between AWS and Salesforce, or Microsoft and Oracle). However, stronger partnerships between cloud service providers or between cloud service providers and software companies, integrators, or specific interoperability agreements between certain cloud and SaaS players, could raise issues with regard to antitrust law, whether they are horizontal or vertical agreements.

Response tools

The use of regulation

The existence of failures in the market can justify recourse to regulation. While technical solutions exist to facilitate supplier switching or the use of multi-cloud, hyperscalers are not necessarily incentivized to develop high-performance solutions that could erode their market share.  The failure of joint initiatives to develop common standards, for example, attests to the lack of will on the part of hyperscalers.

To remedy this situation, the regulatory authorities have taken action, as demonstrated by the adoption of the DMA, the Data Act and the draft law mentioned above. The Autorité made a number of recommendations in this respect in its Opinion 23-A-05 of 20 April 2023.

The Autorité believed the Data Act is likely to positively modify the competitive functioning of the sector. Given the conclusion of the trialogue on 27 June 2023, it does not seem relevant to make proposals to improve the current text. However, as the Commission is due to carry out an evaluation exercise in three years, the Autorité considers that it may be appropriate to monitor several issues:

• distinguishing the regime applicable to egress fees from other migration costs,

• carrying out an impact study on cloud credits and

• specifying measures to promote portability and interoperability

The tools available to the Autorité de la concurrence

Competition law is a particularly useful tool to preserve and stimulate competition in the digital economy. It is sufficiently flexible and comprehensive as evidenced in cases involving big digital players, its capacity to grasp new practices and adapt well-established solutions to new services. To meet the challenges posed by the cloud, one could consider, alongside the classic competition law tools of abuse of dominant position, combating illegal cartels, merger control and abuse of economic dependence, other legal tools from Book IV of  the French Commercial Code (Code de commerce), such as restrictive practices, which can be implemented by the General Directorate for Competition Policy, Consumer Affairs and Fraud Control (DGCCRF).

Though it is not legally possible for the Autorité to investigate these questions in the current opinion, the General Rapporteur announces that his competition units will carry out a preliminary examination of the elements gathered in order to estimate whether it is necessary to open one (or more) litigation investigation(s).