The Competition and Markets Authority is the United Kingdom's primary competition and consumer-protection regulator. Since the UK's digital markets competition regime (Digital Markets, Competition and Consumers Act 2024) came into force in January 2025, the CMA has become an active AI-relevant regulator, less through AI safety rules than through regulation of the market position of firms that deploy AI at consumer scale. Its chief executive is Sarah Cardell.
The digital markets regime
The regime lets the CMA designate a firm with strategic market status (SMS) in a digital activity — a designation requiring "substantial and entrenched market power and a position of strategic significance" — and then impose targeted, binding conduct requirements on the designated activity, subject to consultation and proportionality requirements. Designation does not itself imply anticompetitive conduct. Since the regime came into force, the CMA has launched four SMS investigations into Google, Apple, and Microsoft (Source: gov.uk). The instrument differs structurally from EU DMA enforcement: conduct requirements are bespoke and iterative, designed, per Cardell, to "move with the times" as the designated firm's products change.
Google search conduct requirement
Having designated Google with SMS in general search services, the CMA imposed a conduct requirement on June 3, 2026 with three main elements (Source: gov.uk). First, publishers receive "effective tools" to prevent their content being used to power AI features in search, including AI Overviews, without losing regular search placement; the CMA frames this as restoring publisher bargaining power for content deals with Google. Second, added after consultation feedback, publishers can also refuse use of their content for the "fine-tuning" of AI models, extending control across "the full range of AI use-cases of their content." Third, Google must properly attribute publisher content, "using clear links," in AI-generated search results.
Google has nine months to implement, with key controls expected earlier, plus semiannual published compliance reports with supporting data for the first year. The CMA stated that Google's May 2026 announcement of deeper AI integration into search is covered by the requirement, and that "further action in relation to Google's search business" is coming "in the coming weeks" (Source: gov.uk; theverge.com).
The requirement is the first binding regulatory response to the publisher complaint that AI search summaries cannibalize referral traffic while de-indexing is the only escape, the structural problem at the core of AI Content Licensing and adjacent to the US copyright-litigation track (AI Copyright). It creates an opt-out lever, and therefore a negotiating market, rather than a compensation mandate. Ars Technica reported that Google had resisted on the theory that users do not want "lots of sources" (Source: arstechnica.com).
Other AI-relevant activity
The CMA opened an antitrust probe on May 14, 2026 into Microsoft's bundling of Windows, Word, and Teams (see Microsoft), and has an ongoing inquiry into the Microsoft–OpenAI partnership (see AI Antitrust). Its earlier AI foundation-models market reviews (2023–2024) flagged concentration risk across compute, data, and talent; the SMS designations are the binding follow-through.
Relationships
- regulated-by: Google DeepMind ← (SMS designation, June 3 conduct requirement), Microsoft ← (bundling probe; OpenAI partnership inquiry)
- related: AI Antitrust, AI Content Licensing, AI Copyright, Aggregation Theory (the opt-out attacks the aggregator's content-supply default)
- related: CDEI and DSIT (UK) (UK AI-policy institutional landscape), UK AI Safety Institute (AI Security Institute) (the safety-side counterpart regulator-adjacent body)
Sources
3 supporting sources (CMA press release, The Verge, Ars Technica), June 2026. Created by the 2026-06-05 gap scan: the CMA was flagged in the 2026-06-04 lint report as a recurring regulator with no page (Microsoft probe May 14; Google ruling June 3). Foundational ingest candidate: the CMA's full conduct-requirement decision text on the Google SMS case page (gov.uk).