DMA reaches the AI layer: Commission orders Google to open Android to rival assistants and share Search data

On 16 July 2026 the European Commission adopted two binding specification decisions under the Digital Markets Act (Regulation (EU) 2022/1925) that reach, for the first time, into the AI assistant layer of a gatekeeper platform. Alphabet must open eleven system-level Android features, access today reserved for Google's own Gemini, to rival AI assistants by 1 August 2027 at the latest, and must share anonymised Google Search ranking, query, click and view data with competing search engines and AI chatbots on FRAND terms, with the final pricing offer due in January 2027.

What the decisions require

Both decisions close specification proceedings opened on 27 January 2026 and follow public consultations that ran through spring 2026. Executive Vice-President Teresa Ribera framed the measures around "fairness and citizen choice"; Commissioner Henna Virkkunen described the goal as "fair competition in AI assistant markets for Android devices and search engines", according to the Commission announcement. The first decision (Case DMA.100220) specifies Alphabet's duty under Article 6(7) DMA to grant developers "free and effective interoperability with hardware and software features controlled by its operating system, Google Android". The Commission defines eleven features across four capability layers. Invocation: activation through a long-press of the home button or navigation handle, and always-on hotword detection. Context: centralised access to app data stored on-device, context-aware intelligence, and ambient data. Actions: structured on-device integration, screen automation, and system integration. Resources: system-level on-device models, on-device model implementation, and background execution. Interoperability must be free of charge across the Android ecosystem, "equally effective" compared with the access Google grants its own assistant, and each new functionality must reach third parties at the same moment it reaches Gemini, backed by complete documentation and technical assistance.

The second decision (Case DMA.100209) specifies Article 6(11) DMA. Alphabet must license anonymised ranking, query, click and view data generated by end users in free and paid search. The dataset excludes account information, search histories, precise timestamps, very long queries, queries containing rare terms, and paid-result URLs. Anonymisation is engineered into the product: removal of direct identifiers, suppression of rare terms, and a k-anonymity floor of 1,000 users per location, device and language group, with 95% of records sitting in groups above 29,000 users. Pricing follows a cost-based FRAND formula: the incremental costs of preparation, formatting, storage and dissemination, plus a return capped at Alphabet's weighted average cost of capital; an exceptional margin, anchored to Google Search's operating margin, applies exclusively to large-scale operators. Beneficiaries receive access for up to five years, at a latency of at least seven days after the underlying query, with invalid traffic excluded.

Who must act and by when

Alphabet carries the primary compliance burden along a dense calendar. By end August 2026 it must publish the eligibility application form and a beneficiary webpage. September 2026 brings template licence agreements and test data samples; November 2026, the finalised anonymised dataset together with technical documentation on latency and invalid-traffic detection. In January 2027 the final pricing offer must reach the Commission and third-party search engines, opening the access window for rivals and AI chatbots. On the Android side, draft certification terms are due by 1 February 2027 and final terms by 1 May 2027; the eleven features must ship with Android 18 by 1 August 2027, and concurrent always-on hotword detection must follow in Android 19 by 1 August 2028.

Third-party AI assistant providers face gates of their own. For the five most sensitive features, screen automation, structured on-device integration, system integration, centralised data access and context-aware intelligence, Alphabet may apply objective, even-handed eligibility conditions and an independent third-party certification, with assessments capped at four weeks. Search-data beneficiaries must operate a genuine online search service in the EU and demonstrate either 50,000 monthly average users across two consecutive years of activity or, for firms younger than two years, at least €50 million in capital investment. Recipients must process the data inside the EEA or a jurisdiction offering an equivalent level of protection, accept ringfencing and a strict prohibition on re-identification, and submit to a first compliance audit within six months of access, followed by annual audits. Breaches of specification decisions expose a gatekeeper to fines of up to 10% of worldwide turnover, rising to 20% for repeated infringements, under Article 30 DMA; the measures face biennial review and may be reopened under Article 8(9) DMA upon material changes of fact.

The board-level decision

For any company building assistants, agents or search products, the governance action is a compliance-programme milestone with a date attached: charter a DMA access programme in Q3 2026, owned jointly by the General Counsel and the product organisation. Its first deliverable is the eligibility dossier, filed as soon as Alphabet publishes the application form at the end of August 2026; its second is entry into the certification track for the five sensitive Android features once draft terms appear on 1 February 2027. For boards of firms that intend to ingest the shared Search data, the audit trigger is equally specific: ringfencing, the re-identification prohibition, EEA processing and the annual audit cycle belong in the data-governance policy before the first dataset arrives, because the first compliance audit lands within six months of access. Risk committees should log 1 August 2027 as the date the competitive terrain for AI assistants on Android shifts, and should record that assessment in the risk register now: the Commission has demonstrated that the DMA, alongside the AI Act, now governs the AI stack itself.