Spain's competition authority published a 126-page market study on 16 September 2026 concluding that the country's infrastructure and platform cloud market is highly concentrated, that 2.3% of sampled business customers moved their main provider between 2022 and 2024, and that around 5% ran workloads with more than one supplier.

In Short

Spain's competition watchdog looked at who sells cloud computing in the country and found that a very small group of companies takes most of the money, while customers almost never move between them. That matters because nearly every advertising, measurement and analytics tool a marketer touches runs on top of one of those providers, so their pricing and their exit costs quietly set the floor for everyone else's costs. The watchdog is not fining anyone: it is asking Brussels to consider bringing cloud under the EU's platform rulebook, and asking Spanish public buyers to stop writing tenders that tie them to a single supplier.

What the CNMC measured

The Comisión Nacional de los Mercados y la Competencia registered the work as expediente E/CNMC/001/23 and approved it on 21 July 2026, releasing the full document set on 16 September 2026. The package runs to a 126-page English report, a 134-page Spanish original, a press release in both languages, a question-and-answer note, an infographic and two spreadsheet annexes carrying the underlying figures for twelve charts and five tables.

Scope matters here. The analysis covers Infrastructure as a Service and Platform as a Service in the public cloud and excludes Software as a Service entirely. According to the study, the two lower layers are aimed at technology professionals building and running IT solutions, converge on a small pool of common suppliers, and behave differently from the fragmented software market sitting above them.

Method was a mix of compulsory information requests to the main providers, a public consultation, and more than 20 meetings with operators across the value chain alongside meetings with national and international administrations. Figures on company adoption come from the Spanish statistics institute INE and from Eurostat. Public procurement figures come from the Public Sector Procurement Platform.

A market that doubled in three years

Combined IaaS and PaaS revenue in Spain stood at around EUR 1,900 million in 2024, according to the CNMC, split roughly EUR 1,100 million to infrastructure and EUR 800 million to platform services. That is 58% and 42% respectively, a mix close to the European Union average and markedly different from the global picture, where the study puts infrastructure at about 75% of revenue.

Indexed to 2021, total revenue reached 218.5 in Spain by 2024. The equivalent figures were 222.0 globally and 226.7 across the European Union, so Spanish growth tracked the wider market without outpacing it. Within Spain the two layers diverged sharply: infrastructure reached 197.2 on the same index while platform services reached 286.1.

Scale still lags. The study cites the UK Competition and Markets Authority putting combined British IaaS and PaaS revenue at GBP 10,500 million in the same year. Measured against nominal gross domestic product, the Spanish market represents 0.12% of its economy against 0.38% in the United Kingdom.

Forward capacity is the sharper number. Taking 2024 as 100, operators told the CNMC they expect Spanish data centre capacity in megawatts to reach 204.7 in 2025, 326.3 in 2026, 543.3 in 2027, 994.1 in 2028, 2,161.6 in 2029 and 3,726.0 in 2030. The study attaches a caveat that data centre growth is also driven by uses other than cloud provision. Even so, a thirty-seven-fold projection over six years describes an infrastructure build-out with few precedents in the country, and it arrives in the same period that Amazon raised its planned Spanish investment to EUR 33.7 billion, centred on the AWS Europe (Spain) Region in Aragón and running through 2035.

Where the share sits, and a discrepancy in the annexes

The CNMC publishes market shares in banded ranges rather than point estimates. In the combined IaaS and PaaS view, Microsoft and AWS each sit in the 20-30% band for 2022, 2023 and 2024, with Google in the 10-20% band and Oracle and IBM each below 5%. Operators outside the top five hold 30-40%. The three largest together account for 50-70% of revenue in 2024.

Infrastructure is the tighter layer. The study puts the two leaders at a combined 60-70% and the top three at 65-80% in 2024, with that concentration rising across the series. Platform services are more evenly spread, with providers outside the top five falling from the 50-60% band to 40-50% between 2022 and 2024, which is itself a concentration signal moving in the same direction.

Here the published materials do not agree with each other. In the spreadsheet annexes, in both the English and Spanish versions, the infrastructure table lists Microsoft first at 30-40% across all three years, with AWS moving from 20-30% to 30-40% in 2024. The report body reverses those two rows: AWS holds 30-40% throughout while Microsoft climbs into that band only in 2024. The platform table carries the same kind of swap, with the annexes placing AWS in the 10-20% band and Google in the 5-10% band, and the report placing Google in the higher band and AWS in the lower one.

The report's own prose sides with the report's tables. It describes the two leading infrastructure providers as AWS and Microsoft ahead of a third that would be Google, and it names the closest platform competitors in the order Microsoft, Google and AWS. The banded values are identical in both documents; only the provider labels move. Readers working from the spreadsheet alone would draw a different conclusion about which company led Spanish infrastructure cloud in 2022 and 2023 than readers working from the report.

Sales channels are less contested. In 2024, bilateral negotiations and tenders accounted for 56.3% of the main providers' Spanish revenue, resellers for 23.3%, self-service web purchase for 9.1%, marketplaces for 3.0% and other routes for 8.3%. Negotiated deals, in other words, carry the bulk of the money, which is the context in which the study's later findings on discounts and contractual terms belong.

Demand: adoption below the EU average

The Spanish business and public administration customer base grew about 25% between 2022 and 2024, indexed at 125.1 by the end of the period, with platform services at 128.9 and infrastructure at 122.2. Revenue grew faster than customers, so average revenue per customer rose 28.1% over the same window, split 20.3% for infrastructure and 42.7% for platform services. Growth, in short, came as much from existing accounts spending more as from new accounts arriving.

Penetration remains uneven. INE data puts 44.3% of Spanish companies buying paid cloud services in 2025. Below 40% of small companies do so, against 60.7% of medium-sized companies and 81.1% of large ones. Eurostat, using a slightly different basis, puts Spain at 41.7% against a European Union mean of 52.7%, which places it twenty-second among the twenty-eight European countries charted. Finland leads at 79.2%, Italy follows at 75.6%, Germany sits at 53.9%, and Bulgaria trails at 17.8%.

Sector patterns follow the same duality. Information and communication technology firms are the heaviest users at 76.5%, followed by other services at 48.7%, industry at 40.4% and construction at 35.4%. The gap between large firms and smaller ones is widest in construction, where large companies reach 89.6% against 33.3% for small ones.

What companies actually buy is skewed toward productivity rather than compute. Among Spanish firms already using cloud services in 2025, 87.0% purchase file storage, 82.8% office software and 75.6% email. Security applications reach 68.9%, finance and accounting software 57.4% and database hosting 54.3%. ERP sits at 46.4% and CRM at 41.4%. Raw computing power reaches 32.9% and application development platforms 30.8%, the two lowest entries on the list.

Switching at 2.3%, multi-cloud at 5%

The mobility analysis is the part of the study most likely to be cited elsewhere. The CNMC followed a method similar to the UK CMA's, requesting data on business customers whose annual spend with a given provider exceeded EUR 10,000 in any of 2022, 2023 or 2024. The resulting sample covers roughly 70% of the main providers' Spanish revenue.

For multi-cloud, adoption is defined as concurrent spending with two or more providers in the same year, with a cut-off to separate structural deployment from incidental spend. Under the baseline threshold of 5% of total cloud spend going to an alternative provider, 5.36% of sampled customers qualified in 2024, up from 4.64% in 2022. Those customers accounted for 21.3% of sampled revenue. A stricter 15% threshold drops the figure to 3.58% of customers and 16.7% of revenue. A conservative 1% threshold lifts it to 6.99% of customers and 34.6% of revenue.

For switching, the CNMC counted customers whose spend with one provider fell by at least 50% between 2022 and 2024 while spend with an alternative provider rose by at least half the amount removed. Business customers meeting both tests came to 2.3% of the sample. The study labels that a maximum value, noting that a project ending with one supplier and a new project starting with another would be counted even where no data or workload moved between platforms. A sensitivity check found 16% of customers met the spending-drop condition without meeting the spending-rise condition, and the study attributes most of that residual 13.7 percentage points to reversion to on-premises infrastructure, completed projects or businesses ceasing activity rather than to unobserved migrations.

Comparison with the United Kingdom is instructive on method as much as on outcome. The CMA found 7.5% of customers using multiple providers, absorbing 40% of main-provider revenue, and less than 1% switching annually. The CMA worked from a GBP 1,000 spending threshold, giving broader coverage, but applied a stricter multi-cloud cut-off. On switching the direction reverses: the CMA required an 85% fall at origin and a 60% recovery at destination, where the CNMC relaxed both to 50%.

Egress fees, credits and commitment discounts

Three commercial mechanisms receive dedicated treatment. Cloud credits are grouped into evaluation programmes, targeted support programmes aimed at groups such as start-ups, and migration programmes designed to offset one-off transfer costs, plus discretionary credits granted inside bilateral negotiations. Minimum commitment discounts split between resource-based commitments and committed-spend agreements. The study's concern is not the instruments themselves but their calibration: commitments large enough to absorb a substantial share of a customer's IT budget leave alternative suppliers unable to offer savings big enough to compensate for the discount a customer would forfeit at the incumbent.

Egress fees get the most detailed cost breakdown. The CNMC lists the network cost categories operators cite, including IP transit, cross-connects, backbone and metro fibre, network maintenance, equipment depreciation and security. It then lists a second set of costs operators acknowledge are not exclusively attributable to data transfer, including data centre space, power, cooling, rents and property taxes, internal infrastructure, and overheads such as business and marketing expenses, support, and professional services. According to the study, some stakeholders consider that certain providers may be folding costs of the second kind into egress pricing.

The regulatory clock here is fixed. Article 29 of the Data Act bars cloud providers from imposing egress fees on customers for the switching process from 12 January 2027, with a transitional regime in the meantime limiting charges to costs directly related to switching. Exceptions remain for tailor-made services and for multi-cloud contexts, where fees may pass through costs actually incurred without exceeding them. The CNMC flags the multi-cloud carve-out as potentially ambiguous, warning that the wording could leave room for the same cost-allocation problem to persist in precisely the configuration that is already rare. Germany's enforcement structure for the regulation went live at the Bundesnetzagentur earlier in 2026, with the switching provisions reaching the infrastructure that advertising technology runs on.

Contract terms round out the section. The study identifies clauses submitting Spanish customers to foreign law or foreign courts, symmetrical liability caps set at the same amount for parties of very different size, and customer notice periods for unilateral termination running from 30 to 90 days.

Public procurement and the framework agreement problem

Public buyers form a distinct part of the analysis. The CNMC reviewed completed procurement processes worth more than EUR 1.5 million between 2021 and 2025, linked to the CPV codes covering software and information systems packages and computer services.

Within that sample, 78.9% of contracted value was classified as supply contracts and 21.1% as mixed contracts. By procedure, framework agreements accounted for 42.5% of value, open procedures 34.2%, negotiated procedures without prior publication 14.1% and dynamic purchasing systems 9.2%. On award criteria, 66.8% of contract value combined formula-scored criteria with criteria resting on a value judgement, 23.9% used a price-only formula, 7.7% used formulas covering price and other factors, and 1.6% combined a price-only formula with a value judgement.

Two operational details sit underneath those percentages. Most tenders required a guarantee of 5% of the contract amount, and some tender titles and technical specifications referred explicitly to named providers or software solutions. The CNMC also notes that successful bidders are in most cases consulting firms, integrators or temporary joint ventures, which means the formal contract winner frequently is not the cloud provider actually running the workload. That gap obscures the underlying architecture, the real consumption and the exit terms.

Eighteen recommendations

The study groups eighteen numbered recommendations under four headings. The first keeps competition enforcement as the primary instrument, calling for thorough merger scrutiny, enhanced conduct supervision combined with binding remedies and greater use of interim measures, and consideration of new tools including a market investigation instrument and a possible future enforcement tool specific to digital markets.

The second asks that applying the Digital Markets Act to cloud services be considered alongside competition policy, and that the two be coordinated rather than duplicated. That recommendation lands while the European Commission is already mid-process: three market investigations opened on 18 November 2025, two examining whether AWS and Microsoft Azure meet the gatekeeper test despite falling short of the quantitative thresholds, and a third examining whether existing obligations reach cloud practices at all. The designation investigations run to a twelve-month deadline with a six-month compliance window afterwards; the Article 19 investigation runs to eighteen months and can conclude with a proposal to amend the regulation.

The third heading addresses regulation itself, and it cuts in an unusual direction for a competition authority. The CNMC recommends considering a Data Act reform exempting operators without systemic importance from certain obligations, warning that uniform switching duties fall harder on smaller providers that cannot spread legal and engineering costs across a large customer base. It asks for proportionate application of security, sovereignty, data localisation and certification requirements, and for promotion of interoperability through open-source solutions such as container orchestration platforms, with the caveat that open standards must not themselves become a barrier.

The fourth heading covers public procurement: market research and preliminary consultations before tendering, a template for cloud tender specifications, preference for open procedures and dynamic purchasing systems over framework agreements, technological neutrality in specifications, interoperability and reversibility clauses written in from the outset, total lifecycle costing that includes migration and exit rather than ex ante price alone, division into lots, workable requirements for smaller bidders, avoidance of vague or disproportionate sovereignty criteria, and better-resourced contracting authorities.

The press release summarises the diagnosis in a single line, stating that "Leader cloud service providers hold a combined market share of 60-70%". The report's conclusion frames the stake more broadly, describing cloud services as "an essential lever for digitalisation, productivity and competition".

Why this matters for marketers

The connection between a Spanish competition study and a media plan is not obvious, and it runs through cost structure rather than through policy.

Advertising technology is a cloud workload. AWS has become the predominant infrastructure layer for the sector, hosting supply-side platforms, demand-side platforms and measurement vendors alongside Amazon's own advertising business. Data collaboration runs on the same foundations, with clean rooms such as Amazon Marketing Cloud built directly on provider infrastructure. When the CNMC writes that data transfer charges may include data centre, overhead and marketing costs unrelated to moving bytes, it is describing a line item that appears, indirectly, in what an advertiser pays a vendor.

That line item is already visible in programmatic engineering decisions. Bedrock Platform moved its bidder inside Index Exchange's own data centres specifically because per-request egress, latency and serialisation costs forced it to throttle inbound bid requests, capping how much of the market it could evaluate. Bigabid moved high-frequency bid traffic to a private network charging per transaction rather than per gigabyte, freeing budget that had been consumed by plumbing. Those are commercial responses to exactly the cost structure the CNMC dissects.

The 2.3% switching figure carries a second implication. If vendors almost never change infrastructure provider, then a pricing change, a capacity constraint or a regional outage at one of three companies propagates through the advertising supply chain without any meaningful diversification to absorb it. The study's finding that multi-cloud customers are disproportionately large firms with bigger technology budgets suggests the smaller independent vendors in ad tech are the least insulated.

Regulatory timing compounds the point. The egress fee prohibition arrives on 12 January 2027, the DMA designation decisions are due within their own window, and the European Commission has separately proposed the Cloud and AI Development Act and the Digital Omnibus simplification package, the latter having already produced a contested removal of the automated consent signal from the Council's position in June 2026. Sovereignty requirements, which the CNMC warns can restrict competition when applied generically, are the same requirements that produced the AWS European Sovereign Cloud and its connectivity partnerships across European data centres.

Javier Ramirez Iglesias, an international legal executive and former HP vice-president for legal affairs, framed the wider pattern in a LinkedIn post following the publication, writing that "Competition in the cloud is rapidly becoming one of the major competition policy issues" of the digital economy. He listed the UK CMA and Ofcom, France's Autorité de la concurrence, the Dutch ACM and Japan's JFTC as authorities that have examined the same market, with the Commission going further through its DMA investigations. Spain's contribution to that body of work is a set of national estimates where previously there were mostly global ones, and a public procurement dataset that few other authorities have assembled.

Timeline

Summary

Who: The Comisión Nacional de los Mercados y la Competencia, Spain's national competition and markets authority, with data supplied under compulsory information requests by the main cloud providers operating in Spain, including Microsoft, AWS, Google, Oracle and IBM, plus statistics from INE, Eurostat and the Public Sector Procurement Platform.

What: A market study registered as E/CNMC/001/23, covering infrastructure and platform cloud services, concluding that the Spanish market is highly and increasingly concentrated, that switching reached 2.3% of sampled business customers and multi-cloud around 5%, and issuing eighteen recommendations across competition enforcement, DMA application, proportionate digital regulation and public procurement design.

When: Approved on 21 July 2026 and published with its full document set on 16 September 2026. Underlying market data covers 2021 to 2024, adoption data covers 2025, procurement data covers 2021 to 2025, and capacity projections run to 2030.

Where: Spain, with comparisons to the European Union average, the United Kingdom, and prior work by authorities in the Netherlands, Japan, France, the United States, Australia and at the OECD.

Why: Cloud infrastructure now sits beneath most digital services, advertising technology included, and the authority argues that entrenching concentration at an early stage of adoption would raise costs and limit choice across the wider economy. With the Data Act egress prohibition due in January 2027 and DMA designation decisions pending, the study is a national input into a decision being taken at European level.