TLDR: The European Union’s Digital Markets Act (DMA) is already applicable to Artificial Intelligence systems embedded within the services of designated tech ‘gatekeepers’ like Google and Meta. The article warns legal and compliance professionals against viewing the potential 2026 formal classification of AI as a grace period. It argues for the urgent need for proactive auditing of AI data pipelines and algorithms now to mitigate the immediate and significant risk of multi-billion euro fines for non-compliance with existing DMA rules.
The European Union’s Digital Markets Act (DMA) is now a reality for tech’s largest players, but a critical component remains in a state of deliberate ambiguity: Artificial Intelligence. While the European Commission has deferred the formal classification of AI as a standalone ‘Core Platform Service’ (CPS) until a potential 2026 review, legal and compliance professionals who interpret this as a grace period are dangerously misreading the landscape. The immediate threat isn’t a future designation; it’s the DMA’s current, active application to AI systems already embedded within the services of designated ‘gatekeepers’. This regulatory gray area creates an urgent need for proactive auditing to mitigate significant, near-term non-compliance penalties, a reality explored in depth by recent analysis of the DMA’s evolving oversight.
Why the 2026 Horizon Is a Deceptive Deadline
For compliance officers and legal counsel, focusing on 2026 is a strategic error. The DMA’s provisions are already in force for designated gatekeepers like Alphabet, Amazon, Apple, ByteDance, Meta, and Microsoft. The critical point is that AI is not a vacuum-sealed technology; it is the engine powering and optimizing existing Core Platform Services, including search engines, social networks, and operating systems. When an AI-driven algorithm within a gatekeeper’s search service favors the gatekeeper’s own products, it directly implicates DMA rules against self-preferencing. Similarly, if an AI-powered virtual assistant on a designated operating system restricts access to third-party services, it is already operating in a regulated space. The question for legal teams is not *if* their company’s AI is subject to the DMA, but *how* its integration into existing CPS triggers current obligations.
The Data Dilemma: Auditing AI’s Input Under Existing Gatekeeper Rules
At the heart of the immediate compliance challenge lies data—the lifeblood of modern AI models. The DMA imposes stringent restrictions on how gatekeepers can combine personal data from different services and use data provided by their business users. Specifically, gatekeepers are prohibited from processing personal data for online advertising or combining it across different core platform services without explicit user consent. They are also banned from using non-public data generated by business users (e.g., merchants on a marketplace) to compete against them. For legal and compliance teams, this raises pressing questions: Where is the data to train your company’s AI models coming from? Have data pipelines been audited to ensure they don’t improperly combine personal data or leverage business user data in violation of current DMA articles? Arguing ignorance of these data flows will not be a viable defense when facing regulatory scrutiny.
Unpacking the Penalty Paradox: The Cost of Inaction Is Already Material
The financial stakes for non-compliance are substantial and designed to command the attention of the C-suite and the board. Violations of the DMA can result in fines of up to 10% of a company’s total worldwide annual turnover, a figure that can escalate to 20% for repeated infringements. Recent enforcement actions underscore that the European Commission is not hesitant to levy significant penalties. This creates a penalty paradox for AI: while the rules may seem ambiguous, the financial consequences of misinterpretation are brutally clear. Legal teams must operate on the assumption that any AI-driven function within a designated CPS is within scope. The cost of a proactive, internal audit is infinitesimal compared to the material risk of a multi-billion euro fine and the subsequent reputational damage. The time to build a DMA compliance framework for integrated AI is not in 2026, but now.
The Path Forward: From Ambiguity to Action
The core takeaway for legal and professional services is that regulatory ambiguity is not a shield but a liability. It demands a higher standard of diligence. Waiting for explicit guidance on AI as a CPS is a gamble against a regulator that has repeatedly demonstrated its willingness to act decisively to shape digital markets. The prudent, and necessary, course of action is to begin auditing all AI and machine learning systems integrated into designated gatekeeper services immediately. Legal and compliance leaders should be closely monitoring the European Commission’s early enforcement actions and workshops, as these will provide the clearest precedents for how existing DMA obligations will be interpreted in the age of AI. The future of AI regulation is being written today, and proactive compliance is the only way to secure a favorable chapter.
Also Read:
