On 19 October 2026 the Netherlands' Authority for Consumers and Markets (ACM) published guidance on the cloud-switching chapters of the EU Data Act. Its message is that switching cloud providers must be fast, easy and free. The ACM also notes that the three largest cloud providers serve 75% of the market. The guidance is open for market consultation, so the text may still change.
The strongest case for the ACM's approach
The case for intervention is real. When three firms hold three-quarters of a market, the cost of leaving is part of the product's price. Egress fees, proprietary APIs and services that only work inside one ecosystem all raise that cost. A customer who cannot leave cannot negotiate, and it cannot credibly threaten to move workloads to a smaller European rival. Those smaller providers are the ones whose entry would discipline prices.
The Data Act makes this a legal question and not only a competition one. Regulation (EU) 2023/2854 applies from 12 September 2025. Under Article 29, switching charges must be abolished by 12 January 2027. The ACM can enforce the Act in the Netherlands because the Dutch implementing act took effect on 21 November 2025. Its jurisdiction covers cloud providers headquartered in the Netherlands.
What the guidance actually requires
Four duties stand out, based on the ACM's announcement and press coverage of the draft:
- A hard end date for fees. Providers may charge only costs directly tied to the switch until 12 January 2027. After that, switching fees must end. Reporting on the draft adds that data-transfer charges for parallel use can continue, but only at actual cost.
- Free APIs and interoperability standards. Customers must be able to run several services side by side with data flowing between them.
- Functional equivalence for IaaS. The ACM requires functional equivalence after a switch for infrastructure services. Press coverage of the draft describes this as a duty to take all reasonable and feasible measures toward a materially comparable outcome. It covers only features both the old and new service offer.
- Protection against unlawful non-EU government access. Providers must protect non-personal data against unlawful access or transfer by non-EU governments.
Where the fee ban is strongest
The fee ban is the best-justified part. It is a clear, measurable rule that prices a barrier at zero. It does not tell engineers how to build anything. A provider can comply with a spreadsheet change and a billing update. It also leaves room for innovation: providers can still compete on performance, price and reliability, and they cannot compete on the cost of leaving.
The guidance also stays close to cost. Until January 2027, providers can recover costs directly tied to switching. Parallel use can carry real data-transfer costs, and the draft lets providers recover them at actual cost. That distinction between a cost and a toll is what a proportionate rule should draw.
Where the risk lies
The interoperability and equivalence duties are harder. A rule that says services must work together is simple to write and expensive to implement. The risk is that compliance cost falls hardest on the providers regulators most want to help. A hyperscaler can fund a standards team. A European regional cloud with a few dozen engineers may struggle to maintain free APIs, track evolving standards and certify equivalence for every feature. If the duty is read broadly, it could entrench the three largest providers by raising the fixed cost of competing.
The IaaS functional-equivalence standard is the clearest test. Limiting the duty to features that both services actually offer is sensible. It would be a mistake to turn it into a requirement that a destination replicate capabilities it never advertised. That would amount to product design by regulator. The ACM should keep the "reasonable and feasible" qualifier prominent in the final text. It should also say what evidence of a good-faith effort looks like, so a small provider knows when it has complied.
The sovereignty provision needs similar care. Protecting non-personal data from unlawful non-EU government access is a legitimate goal. But "unlawful" does the work in that sentence. If national regulators read it differently, providers face a patchwork of risk analyses across the single market. That is the opposite of the harmonisation the Data Act promised. Customers do not benefit if a provider answers uncertainty by withholding services or by pushing legal risk into contracts.
What good implementation looks like
Three practical tests would keep the guidance on the pro-competition side of the line.
- Measure outcomes. Track the share of customers that switch or adopt multi-cloud setups after January 2027. Also track whether smaller European providers gain share. If concentration stays at 75% after fees fall to zero, the problem lies elsewhere, such as committed-spend discounts or technical lock-in, and the remedy should follow the evidence.
- Coordinate across regulators. Other national authorities are writing their own guidance. Divergent readings of the same Article will cost more than any single obligation.
- Protect the consultation. The ACM has asked market participants to respond to the draft. Smaller providers and customers should respond, because the large firms certainly will.
The bottom line
The fee ban is a proportionate fix for a real market failure, and it comes with a date providers have known about since the Data Act was adopted. The interoperability and sovereignty duties deserve the same discipline. A regulator that pairs a strict end to switching fees with workable, evidence-based technical duties will do more for competition than one that tries to engineer the cloud market. The ACM has the first half right. The final text will show whether it gets the second.