EU finalizes DMA LLM cloud portability rules; 12‑month clock starts

Who, what, when, where, why: On 24 June 2026 the European Commission adopted a final decision extending Digital Markets Act (DMA) obligations to large cloud providers’ hosted large language model (LLM) services. The decision compels designated gatekeeper cloud platforms to implement standardized APIs, packaging formats and metadata exchanges to enable enterprises to port models, fine‑tunes, prompts and associated governance artifacts. The Commission set a 12‑month compliance window: affected gatekeepers must meet the rules by 24 June 2027 or face DMA fines up to 10% of global turnover (20% for repeat non‑compliance).

Why this matters now

The move turns a consultation paper from April 2026 into enforceable obligations. Regulators frame the change as reducing vendor lock‑in for enterprise AI applications — from automated document processing and customer‑service bots to in‑ERP composable intelligence — while preserving auditability and governance. For procurement, engineering and compliance teams this is a hard deadline with financial penalties; for ecosystem vendors it opens new product and service opportunities if the technical rules are widely implemented.

What the final interoperability rules require

The Commission’s final technical annex refines the April draft and references existing industry standards to reduce bespoke work by vendors. The interoperability package centers on three practical capabilities:

• Model and artifact portability: Gatekeepers must support packaging LLM artifacts in OCI‑compatible images and common interchange formats such as ONNX for compatible models, plus standardized manifests for fine‑tuning checkpoints, prompt libraries and tokenizers so customers can move artifacts without re‑engineering CI/CD pipelines.
• Authentication and billing bridges: Implementations must support federated authentication (OAuth 2.1 / OpenID Connect flows) and a billing‑translation API that allows subscription continuity or metered crediting during migration, with defined reconciliation semantics for common pricing models (per‑token, per‑compute‑hour, per‑inference).
• Provenance and metadata exchange: A machine‑readable minimum metadata set is mandatory: model identifiers, versioning, provenance (W3C PROV compatible), documented safety constraints, known limitations and a high‑level training data lineage to the extent permitted by law. The spec requires cryptographic signing of exported artifacts for auditability.

The final text is pragmatic: instead of inventing new serialization formats, it leans on ONNX, OCI image layout and W3C provenance models while adding DMA‑specific metadata fields and API contracts that gatekeepers must expose.

Security and IP protections — the compromise

Gatekeepers secured explicit carve‑outs to protect trade secrets and prevent unauthorized exfiltration. The rules require:

• Support for hardware‑backed key attestation (TPM / SE / SGX‑style enclaves) and encrypted model artifacts so providers can enforce usage controls on confidential commercial models during transit and at rest.
• Policy enforcement hooks so providers can retain platform safety filters and usage policy layers as opt‑in services; the portability interfaces must not circumvent safety controls required by the host provider for hosted inference.

Those provisions aim to balance portability with IP protection and security — a central industry concern during consultations.

Who’s affected and the immediate impact

The DMA applies to designated "gatekeepers"; in practice the final decision names major hyperscalers whose managed LLM services are embedded in enterprise stacks — notably Amazon Web Services, Microsoft Azure and Google Cloud Platform. Affected customers include large enterprise buyers, ISVs building AI extensions for ERPs and CRMs, and regulated firms whose auditors require persistent governance trails.

Practical impacts for buyers and vendors:

• Procurement teams should immediately add DMA portability and metadata export clauses to new contracts; Service Level Agreements (SLAs) must clarify who bears migration and reconciliation costs.
• Engineering teams should prototype exportable artifacts now to identify runtime incompatibilities: tokenizer differences, inference optimizations, hardware accelerator dependencies and safety‑filter integrations are the most common friction points.
• Governance and observability vendors must update agents and telemetry schemas to carry the DMA metadata and signed audit bundles alongside model artifacts.

Industry reaction and pilots

Responses have been mixed but constructive. The Commission’s spokesperson called the adoption "a practical step to strengthen competition and protect enterprise choice." Major cloud providers issued statements saying they welcome clarity but will provide implementation timelines and transition tooling; Microsoft announced an "OpenModelBridge" preview for Azure customers in June 2026, and Hugging Face and several European banks published a joint pilot plan to test migrations between Azure and AWS in July 2026.

Open‑source and governance players were broadly positive. Hugging Face said the decision "lowers switching friction for enterprise models and invites interoperable tooling," while smaller model vendors welcomed clearer hooks into hyperscaler platforms. Some platform operators reiterated concerns about preserving IP and maintaining integrated performance features.

Evidence and market trends

Adoption momentum is already visible. Multiple enterprise pilots in June–July 2026 show that basic portability (model export/import and manifest translation) works for stateless transformer models but breaks where platform‑specific accelerators or proprietary safety layers are involved. Early migration tests reported by enterprise pilots show conversion costs ranging from a few hours for simple models to several person‑weeks for tightly integrated systems (tokenizers, pre/post‑processing and proprietary inference optimizations).

What vendors and teams should do now

1. Start contract updates. Add clauses for portability exports, metadata delivery, billing reconciliation and a migration support SLA. Legal and procurement should require signed artifact bundles with clear custody transfer terms.
2. Run a sandbox migration. Export one production model, its tokenizer and governance metadata to an alternative cloud in a controlled environment to map integration gaps and estimate costs.
3. Revise CI/CD and observability. Ensure build pipelines can produce OCI images or ONNX bundles and that monitoring agents collect and carry DMA metadata into your governance stack.
4. Design for layered value. If your product relies on vendor‑specific accelerations or safety tooling, document those dependencies and offer customers migration options or managed portability services.

What to watch next

• Compliance enforcement: the EU Commission will begin targeted audits after 24 June 2027; expect early investigations if major gatekeepers miss the deadline.
• Standards alignment: watch working groups (W3C, Linux Foundation AI, and industry consortia) for reference implementations and test suites that will drive interoperability baselines.
• Commercial responses: some vendors may offer "DMA‑compliance" migration services or certified model packaging to reduce customer migration costs.

Will this eliminate vendor lock‑in?

Not overnight. Interoperability lowers switching costs for many use cases, but platform‑specific performance features, proprietary safety tooling and commercial agreements will remain switching friction. Expect a gradual unbundling where standard‑friendly workloads move first.

Frequently asked questions

Who exactly must comply with the DMA LLM portability rules?

The final decision applies to cloud providers designated as DMA "gatekeepers" in the Commission’s ruling. In practice that includes major hyperscalers offering managed LLM services — for example, Amazon Web Services, Microsoft Azure and Google Cloud Platform — and any other platforms the Commission designates as gatekeepers at EU level.

What is the compliance deadline?

The Commission set a 12‑month calendar from the adoption date: because the decision was adopted on 24 June 2026, gatekeepers must implement the required interoperability interfaces and metadata exports by 24 June 2027.

Will my regulated company’s confidential models be at risk?

The rules include explicit safeguards for IP and security: hardware‑backed attestation, encrypted artifact formats and policy hooks are mandatory. Nonetheless, legal and technical teams should validate migration workflows in a sandbox and require contractual protections for confidentiality during export/import operations.

How should product teams prioritize work?

Prioritize: (1) contract and procurement updates; (2) an end‑to‑end export/import pilot of a live model; (3) updates to CI/CD and observability to carry the required DMA metadata. These steps reduce surprises during full migrations and provide evidence of compliance readiness.

What will regulators audit?

Audits will cover whether gatekeepers expose the required APIs, deliver the mandated metadata, and preserve auditability and provenance. Expect requests for signed artifact bundles and migration logs as part of any investigation.