On April 28, 2026, the EU said the DMA stays intact while cloud and AI become audit priorities for gatekeepers. Technical breakdown. Read now.
What stayed the same, and what moved into the audit queue
On April 28, 2026, the EU made two points at once: the Digital Markets Act itself remains the governing framework, and enforcement attention is shifting toward how designated gatekeepers run cloud infrastructure and AI systems. That split matters. The legal duties—open access where required, non-discrimination between own services and rivals, data-use limits, and interoperability obligations—do not get rewritten by a new priority list. What changes is where auditors look first, how deep they dig into technical controls, and which product surfaces must produce evidence on demand.
For engineering and compliance teams, “audit priority” means cloud control planes, model hosting paths, ranking and recommendation services, and identity/data-sharing APIs stop being treated as side documentation. They become primary evidence sets. If your stack sits behind a gatekeeper designation—or depends on one—you should assume reviewers will ask not only for policy text, but for logs, configuration history, access paths, and decision trails that prove the policy is enforced in production.
- Map every cloud and AI surface that touches ranking, bundling, defaults, or third-party access.
- Document where first-party services get different data, latency, or feature flags than rivals.
- Retain configuration and access logs long enough to reconstruct who changed what and when.
- Define a single owner for audit responses so legal, security, and platform teams do not produce conflicting answers under time pressure.
Cloud audits: control planes, tenancy, and parity
Cloud scrutiny under a gatekeeper lens is less about marketing claims and more about whether the platform treats equivalent workloads equivalently. Auditors typically want to see tenancy isolation, fair access to APIs and capacity, transparent pricing and metering interfaces where those affect competition, and clear separation between the operator’s own products and those of dependents. Practical proof lives in IAM policies, network isolation designs, service quotas, feature-flag systems, and the pipelines that promote configuration changes.
Build an internal “parity checklist” before an external request arrives. For each managed service: who can call it, under what auth model, with what rate limits, and with what observability. If your own teams use privileged paths—internal APIs, better telemetry, earlier feature rollout—those paths need either a lawful justification or a plan to expose comparable capability to third parties. Treat privileged shortcuts as audit findings waiting to happen, not as temporary engineering conveniences.
AI audits: data use, model access, and ranking effects
AI systems raise DMA-shaped questions even when the model is not a product on its own. Training and fine-tuning data provenance, whether platform data from business users feeds competing features, how model outputs influence discovery and defaults, and whether third parties can integrate or switch without artificial friction all sit inside the same compliance perimeter. An audit-ready AI stack records data sources and consent/contract boundaries, separates training pipelines from operational inference where required, and keeps versioned records of models, prompts/policies that govern them, and deployment environments.
Ranking and recommendation layers deserve special care. If an AI system affects which apps, cloud regions, tools, or content appear first, treat that as a competitive surface. Capture the inputs used, the business rules layered on top of the model, and any first-party boosts. Engineers should be able to explain, in plain terms, why two similar third-party services receive different outcomes—and show the configuration that produced those outcomes—not rely on opaque model behavior as an explanation.
How to prepare without waiting for a formal notice
Preparation is mostly systems work. Create a living inventory of cloud services and AI endpoints tied to designated platform roles. Automate export of access logs, change history, and data-flow diagrams so evidence collection is hours of work, not weeks of archaeology. Run internal red-team reviews that ask the same questions an auditor would: Can a rival get the same API surface? Can a business user refuse secondary use of their data? Can a dependent migrate without hostage features?
Finally, align product roadmaps with enforcement reality. The DMA framework stays intact; cloud and AI simply moved up the inspection list. Teams that treat compliance as a documentation project will struggle. Teams that encode fair access, data boundaries, and explainable ranking into the control plane will handle audits as routine operational work—and reduce the chance that a technical shortcut becomes a regulatory finding.