EU says preliminary results of its probe into software used by EU institutions raises “serious concerns” over Microsoft's compliance with data protection rules
Context & Ripple Effects
This preliminary finding caps an inquiry opened in April after a Dutch audit found hidden telemetry in Microsoft products used across EU institutions violated GDPR rules — the EU's own probe into Microsoft products deployed inside its institutions was launched precisely because the buyer couldn't verify what its vendor was collecting.
First-order effects
- Microsoft now faces formal pressure to change how its software handles data inside EU institutions, with the probe's serious-concerns language putting remediation — disabling telemetry, altering contracts — ahead of any fine.
Second-order effects
- The finding gives EU bodies leverage to demand compliance-by-design terms in renewals, pushing procurement toward vendors that can guarantee where institutional data goes — and years later the EDPS would conclude the Commission's own Microsoft 365 use breached privacy rules, showing remediation pressure persisted.
Third-order effects
- If the pattern holds, EU institutions treating data protection as a procurement gate rather than a legal afterthought points toward sovereign-cloud requirements reshaping which suppliers can sell to European government at all — a dynamic visible in the EU's later willingness to threaten fines up to 1% of global turnover under the DSA over risk disclosures on generative AI tools.
The trend: European public-sector buyers are converting data protection findings into structural procurement requirements, forcing US hyperscale software vendors to offer sovereign-compliant configurations or cede institutional accounts.