UK Cloud Costs 2026: CMA Rules, Egress Fees and Lock-In

The short answer

UK cloud bills are not falling because of regulation, but the levers you can pull have changed. On 31 March 2026 the Competition and Markets Authority (CMA) accepted voluntary commitments from Amazon Web Services and Microsoft to cut egress fees and improve interoperability, declined to open strategic market status (SMS) investigations into their cloud businesses, and instead opened an SMS investigation into Microsoft's wider business software ecosystem, which began on 14 May 2026 and includes cloud licensing. For a UK business, the practical consequence is that exit costs and multi-cloud friction are now negotiable in a way they were not two years ago, while licensing remains the single biggest unresolved cost risk until the CMA decides on designation by February 2027.

Stratgik is a technology firm, not a law firm. What follows is commercial and architectural guidance for buyers; competition law advice, and any contract drafting, should come from your legal advisers.

What the CMA actually found about UK cloud costs

The CMA's cloud services market investigation ran from October 2023 and published its final decision report on 31 July 2025. Three findings matter if you are signing or renewing a cloud agreement.

First, the market is concentrated. The combined UK infrastructure-as-a-service and platform-as-a-service market was worth around £10.5 billion in 2024, having grown at roughly 29% a year since 2020. AWS and Microsoft each held a 30–40% share of IaaS, with Google at 5–10%.

Second, egress fees — the charge for moving your own data out to the internet — were found to be a commercial barrier that reduces both the ability and the incentive to switch or run workloads across more than one provider. The report was explicit that the burden falls hardest on smaller customers, for whom transfer charges are a higher proportion of total spend.

Third, and most consequentially, the CMA concluded that Microsoft's software licensing practices weaken the competitive constraints on Microsoft and so reduce competition in cloud services. By contrast, committed spend agreements — the discount-for-commitment deals most mid-market and enterprise buyers sign — were found to be widespread but not, in their current form, causing competitive harm, because rivals can profitably compete against them.

That last point is often misread. It does not mean committed spend deals are good value. It means the regulator will not intervene in them, so the discipline has to come from your own procurement.

What changed on 31 March 2026

The CMA's own inquiry group had recommended SMS investigations into AWS and Microsoft for cloud. The CMA Board did not follow that recommendation. Instead it announced a package of actions built on voluntary steps by both firms, covering reductions to egress fees and a set of interoperability measures: direct data-centre interconnection products, including to Google Cloud; a clear application process for interoperability tooling; standards for AI agents connecting to their cloud products; better cross-cloud application management; and extension of multi-cloud standards developed for the EU into the UK.

The CMA described its approach as flexible and pragmatic, and set a six-month progress review — due around late 2026 — at which it will take evidence from UK customers and competitors on whether switching and multi-homing have genuinely become easier. Critics, including competition-focused non-profits, have argued that voluntary commitments tend to be general and hard to enforce after a three-year investigation.

The buyer's takeaway is unglamorous but useful: the six-month review is an open door. If egress charges or interoperability blockers are costing you money, that is evidence the regulator has said it wants.

Separately: the Microsoft SMS investigation

On 14 May 2026 the CMA launched an SMS investigation into Microsoft's business software ecosystem. In scope are productivity software, PC and server operating systems, database management systems and security software — and, carried over from the cloud investigation, Microsoft's use of software licensing where it was found to reduce competition in cloud services.

The statutory timetable is nine months, so a decision on designation is expected by February 2027. If Microsoft is designated, the CMA can impose conduct requirements or pro-competition interventions. Nothing is decided yet, and it would be wrong to plan on a specific outcome.

What this does mean is that any Microsoft agreement you sign in 2026 with a three- or five-year term will run through a period in which the licensing rules underneath it could change. That is an argument for shorter terms, or for a contractual mechanism to revisit pricing if licensing terms change materially — a point worth raising with your legal advisers before signature.

The actual numbers: what moving data out costs today

Published list prices are the baseline, not the price you will pay. Both major providers charge in US dollars, and both already waive charges for the first 100 GB per month.

Sources: Microsoft Azure data transfer pricing and published AWS data transfer rates. Microsoft notes that actual pricing varies with the agreement you hold, which is also true of AWS. Treat the table as an order of magnitude for modelling, then check your own rate card.

The exit waiver is the part most teams miss. AWS offers free data transfer out when moving off AWS, but it is not automatic: you must contact support, have the request approved at account level, and since 30 September 2025 complete the move within 90 days unless you notify support that you need longer. Microsoft operates an equivalent process for customers leaving Azure. In both cases the waiver covers a genuine exit, not ongoing multi-cloud traffic — which is precisely the gap the CMA's 2026 commitments are meant to narrow.

If you also operate in the EU, note the contrast. Under Article 29 of the EU Data Act, switching charges must be fully withdrawn from 12 January 2027, with only cost-based reduced charges permitted in the interim. The UK has no equivalent statutory ban; it has commitments and a review. Where a provider extends EU-derived standards to the UK, as the 2026 package contemplates, UK customers may benefit indirectly.

Where UK cloud money is actually lost

Egress is visible and annoying, but for most UK organisations it is not the largest line of waste. Flexera's 2026 State of the Cloud research puts estimated wasted IaaS and PaaS spend at 29%, and software waste at 25%, with 85% of respondents naming cloud cost management as their top challenge. Regulation does not touch any of that.

In our experience across UK engagements, the recurring causes are consistent: environments provisioned for a launch and never resized; non-production running outside working hours; commitments bought on last year's architecture; storage tiers left at default; and licensing entitlements nobody has reconciled against actual deployment. None of these require a provider change to fix, which is why a cloud cost review should always precede a migration business case.

A practical checklist for the next 90 days

• Quantify your exit position. Calculate the data volume you would need to move per workload, price it at list, then record whether a waiver would apply. An exit cost you cannot state is a lock-in you cannot negotiate.
• Pull your rate card, not the public price list. Confirm the egress, storage and commitment rates actually in your agreement, and when each expires.
• Separate waste from lock-in. Run a right-sizing and scheduling pass before any multi-cloud or migration decision. A 20% reduction in run-rate changes the maths on every commitment you are considering.
• Reconcile licences against deployment. Especially for Microsoft estates, check entitlements versus what is actually running, and whether bring-your-own-licence terms affect where you can host.
• Shorten or protect long terms. With a licensing decision due by February 2027, take legal advice on term length and on any mechanism to revisit pricing if licensing terms change.
• Design the exit at build time. Keep data in portable formats, keep infrastructure as code, and avoid proprietary services for anything on the critical path unless the benefit is explicit and documented.
• Document interoperability blockers. Where a provider's tooling or licensing prevents a multi-cloud setup you want, write it down with costs. That record is useful in renewal negotiations and in the CMA's review process.
• Check data protection implications before moving anything. Changing provider or region changes your transfer and processor position under UK GDPR; confirm it before, not after.

How this should change a build or buy decision

Lock-in risk is a cost, and it belongs in the model rather than in a risk register nobody prices. A managed platform that is 30% cheaper to run but would cost six figures and four months to leave is not obviously the cheaper option over five years. Equally, refusing all managed services to stay portable usually means paying engineers to rebuild what you could have rented.

The workable position is to be deliberate: accept deep lock-in where the service is genuinely differentiated and the workload is stable, and insist on portability where the workload is core, long-lived or likely to move. Our build vs buy tool is a reasonable starting point for framing that trade-off, and a short structured review through a technology decision sprint is usually cheaper than discovering the answer during a migration.

For organisations without a dedicated platform team, the cost discipline matters more than the provider choice. Continuous right-sizing, commitment management and licence reconciliation are operational habits, not projects, which is why they tend to sit with a managed technology arrangement rather than being revisited annually.

Frequently asked questions

Did the CMA ban cloud egress fees in the UK?

No. The CMA accepted voluntary commitments from AWS and Microsoft on 31 March 2026 to reduce egress fees and improve interoperability. There is no UK statutory ban. That contrasts with the EU, where Article 29 of the EU Data Act requires switching charges to be withdrawn entirely from 12 January 2027.

Can I get my data out of AWS or Azure for free?

For a genuine full exit, usually yes, but only on application. AWS requires you to contact support and have the request approved at account level, and since 30 September 2025 expects the move to complete within 90 days unless you notify support otherwise. Microsoft runs an equivalent process for Azure. Neither waiver covers routine multi-cloud traffic.

Will the Microsoft SMS investigation change my licensing costs?

It might, but nothing is decided. The investigation began on 14 May 2026 with a nine-month statutory timetable, so a decision on designation is expected by February 2027. Only if Microsoft is designated can the CMA impose conduct requirements. Plan for the possibility of change rather than for a specific outcome, and take legal advice on contract terms that span that period.

Is multi-cloud now the cheaper option for UK businesses?

Rarely on run cost alone. Running two platforms adds tooling, skills and operational overhead, and most organisations do not recover that through discounting. The stronger arguments for multi-cloud are resilience, specific capability, and negotiating position. The 2026 interoperability commitments lower the friction; they do not make duplication free.

What should we fix first if our cloud bill is too high?

Waste, before architecture or provider. Industry research puts wasted IaaS and PaaS spend at around 29%, and in most UK estates the quickest wins are right-sizing, switching off non-production out of hours, correcting storage tiers and reconciling licences. Only once the run-rate is clean does a migration or multi-cloud business case mean anything.

Does changing cloud provider or region affect UK GDPR compliance?

Yes, potentially. Moving data changes your processor arrangements and may introduce or remove international transfers, which affects your documentation, transfer mechanisms and records of processing. Treat it as a compliance change, not just an infrastructure one, and confirm the position before the migration rather than after.

If you are reviewing a cloud agreement, a renewal or a migration business case in the UK this year, the sequence that works is: clean the run-rate, price your exit, then negotiate — and check the data protection position before anything moves. Our UK practice page sets out how we work with UK teams on these decisions, and our UK GDPR compliance page covers the data protection side of a provider or region change. Stratgik is a technology firm, not a law firm; for legal obligations and contract terms, work with your legal advisers.