DMA specification decisions on Google: the access rules the CMA has not written
In short: DMA specification decisions adopted by the European Commission on 16 July 2026 tell Google exactly how to comply with two Digital Markets Act obligations: opening eleven defined Android features to rival AI assistants by 1 August 2027 at the latest, and sharing anonymised Google Search ranking, query, click and view data with competing search engines and AI chatbots on FRAND terms from January 2027. The UK’s parallel regime has not gone this far.
Any AI assistant or rival search engine that needs Android’s back-office plumbing, or Google’s own search data, to compete with Google now has a clearer route in. On 16 July 2026 the European Commission adopted two specification decisions spelling out exactly how Google must open that access: eleven defined Android features for third-party AI providers, most by the next major Android release (Android 18) and by 1 August 2027 at the latest, and anonymised Google Search data for rival search engines and AI chatbots on fair, reasonable and non-discriminatory (FRAND) terms from January 2027. Google has said publicly that it disagrees with both rulings.
Key findings (European Commission specification decisions, 16 July 2026)
- The Commission specified Google’s compliance with two separate Digital Markets Act obligations: Android interoperability for AI services under Article 6(7) DMA (case DMA.100220), and search data sharing under Article 6(11) DMA (case DMA.100209), both under the Article 8(2) specification mechanism. Source: final decision annexes, DMA.100220 and DMA.100209, 16 July 2026.
- The Android decision specifies eleven features across four categories, with most due by the next major Android release (Android 18) and by 1 August 2027 at the latest; one narrow feature (concurrent always-on hotword detection) is deferred to Android 19 and 1 August 2028. Google must begin sharing anonymised search data with eligible rivals from January 2027. Source: final decision annex, DMA.100220, 16 July 2026.
- Eligibility for search data extends to any provider that operates an online search engine in the European Economic Area, expressly including AI chatbots that provide search-engine functionality, subject to a genuine-economic-activity test (two years’ trading, or under two years with over EUR50 million capital, plus at least 50,000 monthly EU users) and sanctions and third-country risk screening. Source: final decision annex, DMA.100209, 16 July 2026.
- The FRAND pricing standard for search data is incremental cost-based, WACC-capped and fixed for a term of five years; SMEs always qualify for strict incremental-cost pricing, while very-large-scale beneficiaries (comparable to the DMA’s own gatekeeper thresholds) may be charged up to Google Search’s own operating margin. Source: final decision annex, DMA.100209, 16 July 2026.
- Google’s chief legal officer said the decisions “risk undermining vital privacy and security guardrails for millions of Europeans”, in a public statement responding to the rulings. Source: Google, The Keyword, 16 July 2026.
- The UK’s Competition and Markets Authority (CMA) designated Google with strategic market status in general search on 10 October 2025 and in mobile platforms (Android, Play, Chrome) on 22 October 2025, but has not yet imposed a conduct requirement addressing third-party access to search data or Android interoperability. Source: CMA, Digital Markets Competition Regime guidance.
| Obligation | What the regulator has decided | Compliance date |
|---|---|---|
| Android AI interoperability (Article 6(7) DMA) | The Commission requires Google to give third-party AI assistants access, on equal terms to Gemini, to eleven defined Android features: voice invocation, on-device app data and proactive suggestions, in-app and system actions, and on-device models. Five features are restricted to providers certified under Google’s Qualified AI Assistant Programme. | Next major Android release (Android 18), by 1 August 2027 at the latest |
| Search data sharing (Article 6(11) DMA) | The Commission requires Google to share anonymised ranking, query, click and view data with eligible rival search engines and AI chatbots operating in the EEA, at FRAND (incremental-cost) pricing, for a minimum five-year retrieval window. | From January 2027 |
| Conduct requirements on Google search (DMCC Act 2024, s.19) | The CMA has imposed Fair Ranking and Data Portability requirements, and a Publisher requirement; a fourth, User Choice, remains outstanding. None addresses third-party data access or Android interoperability. | Fair Ranking: six months from 17 June 2026. Data Portability: three months from 17 June 2026. |
The specification proceedings and their statutory basis
The Commission designated Alphabet as a gatekeeper under the Digital Markets Act (Regulation (EU) 2022/1925) on 5 September 2023 for a number of its services, including Google Android and Google Search. That designation put both services under the DMA’s Article 6 obligations. Article 6(7) requires Google, free of charge, to provide third parties with effective interoperability with hardware and software features controlled by Google Android. Article 6(11) requires Google to grant third-party search engine providers access to anonymised ranking, query, click and view data on FRAND terms.
Rather than leave Google to interpret those obligations unaided, the Commission opened two specification proceedings on 27 January 2026, under Article 8(2) DMA, to assist Google in complying and to set out in detail the measures it must implement. This is the DMA’s specification mechanism: where a broad ex ante obligation leaves genuine room for dispute about what compliance requires, the Commission can convert it into a defined technical and contractual build spec, addressed to the individual gatekeeper. The Commission published preliminary findings and draft measures for the search data proceeding on 16 April 2026, and for the Android proceeding on 27 April 2026, before adopting the final decisions on 16 July 2026, ahead of the statutory six-month deadline of 27 July 2026. The proceedings are without prejudice to the Commission’s separate power to find non-compliance and impose fines under the DMA.
What Google now has to build
The Android measures cover four categories of feature: invocation (how a user starts an AI service, including a developer-defined equivalent to the “Hey Google” hotword), context (access to on-device app data and the proactive-suggestion and ambient-sensor functionality that today powers Google’s own Magic Cue and Now Playing features), actions on apps and the operating system (structured integration and agentic screen automation, so a third-party assistant can book a taxi or change a device setting the way Gemini already can), and access to resources (on-device machine-learning models and background execution on equal terms with Google’s own services). The final decision annex for the Android proceeding (case DMA.100220) specifies eleven features across those four categories, narrowed from the thirteen the Commission had floated for consultation in April 2026. Six are open to any qualifying third party; the remaining five, including centralised on-device data access and agentic screen automation, are restricted to providers certified under a new Qualified AI Assistant Programme, for which Google must publish draft certification terms by 1 February 2027 and final terms by 1 May 2027, with applications accepted from that date.
The search data measures are more granular still. Eligibility is not limited to conventional search engines: an AI chatbot that provides search-engine functionality in the EEA can qualify as a beneficiary, provided it also clears a genuine-economic-activity test (two years’ trading, or under two years with over EUR50 million in capital) and sanctions and third-country risk screening, which is the clearest sign yet that the Commission treats AI chat interfaces as substitutes for search while guarding against shell applicants. The anonymisation standard combines technical suppression of identifiers with contractual controls, including a 13-month cap on how long a beneficiary can retain the data, a ban on re-identification attempts, and independent ISAE 3000 assurance before access and annually thereafter. None of this is free: Google charges FRAND, incremental-cost-based pricing, fixed for five years before renegotiation, though a very-large-scale beneficiary comparable in size to a DMA gatekeeper may be charged up to Google Search’s own operating margin, while smaller entrants always qualify for strict incremental-cost pricing. The result is a data-access regime that is generous in scope but far from a free-for-all.
Why the CMA’s parallel regime has not reached the same point
The UK runs a comparable but structurally different regime under Part 1 of the Digital Markets, Competition and Consumers Act 2024 (DMCC Act 2024). The CMA designated Google with strategic market status (SMS) in general search and search advertising on 10 October 2025, and in its mobile platform, Android, on 22 October 2025, in each case nine months before the Commission’s 16 July 2026 decisions. Since then the CMA has imposed three conduct requirements on Google’s search business under section 19 DMCC Act 2024: a Publisher requirement (3 June 2026) letting publishers opt out of AI Overviews and model fine-tuning, a Fair Ranking requirement (17 June 2026) mandating non-discriminatory ranking, and a Data Portability requirement (17 June 2026) that the CMA itself describes as broadly comparable to the end-user data portability obligation at Article 6(9) DMA. A fourth requirement, User Choice, remained outstanding as at the CMA’s most recent published position.
None of the CMA’s conduct requirements so far addresses third-party access to Google’s search data along the lines of Article 6(11), or Android interoperability for AI assistants along the lines of Article 6(7). The closest live UK workstream is the CMA’s mobile-platform steering and NFC consultation, opened 30 June 2026, with the steering conduct requirement consultation closing 28 July 2026 and the NFC call for evidence closing 21 July 2026, and even that addresses payment-wallet access rather than AI interoperability or search data. A UK business that wants the equivalent of the EU’s new data-access rights has no domestic conduct requirement to point to yet.
Who this affects, and when
Google carries the direct compliance burden: rebuilding Android’s interoperability layer, standing up the search-data-sharing infrastructure, and submitting to independent audit, all against fixed deadlines and with a public objection already on record. Third-party AI assistant developers and rival search engines are the immediate beneficiaries, but access is conditional, not automatic: an AI provider seeking the five restricted Android features must certify under Google’s Qualified AI Assistant Programme, and a search engine or AI chatbot seeking search data must be established and operating in the EEA, pass the genuine-economic-activity and risk-screening tests, submit to independent audit, and pay FRAND pricing rather than access the data for free. For UK-facing businesses building on Android or on search-adjacent AI products, the practical question is jurisdictional: the DMA’s rights attach to EEA-facing services, so a UK-only product does not benefit from either decision directly, and the domestic route through the CMA’s SMS regime has not yet produced an equivalent right. Businesses assessing market entry in this area, or advising a target with EU platform exposure in due diligence, can start with our regulatory perimeter and market entry page.
The compliance calendar is now fixed on the EU side: search data access from January 2027, Android interoperability from the next major Android release and by 1 August 2027 at the latest. Google’s public disagreement, aired through its own corporate blog rather than through a legal challenge announced so far, is an indication that an appeal to the General Court is a live possibility; a specification decision under the DMA is challengeable in the same way as any other Commission decision, and non-compliance in the meantime carries fines of up to 10% of Alphabet’s worldwide annual turnover.
Viewpoint
The specification decisions show what the DMA’s ex ante model is designed to do: convert a broad, contestable obligation into a detailed, auditable build spec within a fixed statutory clock, whether or not the gatekeeper agrees with the outcome. That the Commission met its own 27 July 2026 deadline with eleven days to spare, on two separate and technically dense proceedings, is itself notable discipline. The CMA’s SMS regime, which designated Google in the same two services nine months earlier, has so far produced conduct requirements addressing ranking, publisher terms and end-user data portability, but nothing addressing third-party access to Google’s own data or interoperability with Android. That is not a criticism of the UK regime’s design, which allows the CMA to move issue by issue rather than adopting a single specification decision covering an entire obligation; it is a difference in sequencing, and nothing in the CMA’s published work programme points to it closing quickly. In our experience advising on parallel EU and UK platform regimes, the harder operational question is rarely the substantive standard, which the Commission has now specified in some detail, but the independent audit and eligibility-vetting process a gatekeeper controls and can use to slow access even where the rules are settled. The CMA’s outstanding User Choice conduct requirement and its mobile-platform steering consultation, closing 28 July 2026, are the clearest indication of whether the UK intends to follow the EU toward mandated data access, or continue with a narrower ranking-and-portability approach.
Frequently asked questions
What is a DMA specification decision?
A specification decision is how the European Commission converts a broad Digital Markets Act obligation on a designated gatekeeper into a detailed, binding set of measures. The Commission opens a proceeding, publishes preliminary findings and draft measures for consultation, then adopts a final decision within six months of opening. Google’s two July 2026 decisions followed this route in full.
When must Google open Android to rival AI assistants?
From the next major Android release, Android 18, and by 1 August 2027 at the latest (one narrow feature is deferred to Android 19, by 1 August 2028). The obligation covers eleven features across invocation, on-device context, in-app and system actions, and on-device model access, on terms equally effective to those Google gives its own Gemini assistant; five of the eleven are restricted to providers certified under Google’s Qualified AI Assistant Programme.
Who can access Google’s search data under the new rules?
Any provider that operates an online search engine in the European Economic Area, including an AI chatbot that provides search-engine functionality, provided it clears a genuine-economic-activity test, sanctions and risk screening, and Google’s independent-audit process, and pays FRAND, incremental-cost-based pricing.
Does the UK have an equivalent rule to Article 6(11) DMA?
Not yet. The CMA designated Google with strategic market status in search and mobile platforms in October 2025 and has since imposed Fair Ranking, Publisher and Data Portability conduct requirements under the DMCC Act 2024, but none addresses third-party access to Google’s search data or Android interoperability for AI services.
Is Google appealing the decisions?
Google has publicly objected, saying the decisions risk undermining privacy and security safeguards, but had not confirmed a General Court challenge at the time of writing. A specification decision is challengeable in the same way as any other Commission decision under the DMA.
If you are assessing market entry, platform access rights, or DMA and DMCC Act exposure on a transaction, contact Rob Bratby at Bratby Law.
