Antitrust moves in years; vendor dependency is set at signing

The week

On October 20, 2020, the U.S. Department of Justice, joined by a group of state attorneys general, sued Google. The suit alleged that the company had unlawfully maintained monopolies in two markets: general search, meaning the everyday search engine people use to look anything up, and search advertising, the paid listings that appear alongside results.

The Justice Department filed in federal court in Washington, D.C. Eleven states joined it from the start: Arkansas, Florida, Georgia, Indiana, Kentucky, Louisiana, Mississippi, Missouri, Montana, South Carolina and Texas. The complaint said Google handled nearly 90 percent of general search queries in the United States, and an even larger share on mobile devices. Google said it would fight the case, arguing that people use its search engine because they choose to.

Every time someone types a question into a phone or a web browser, something has already decided which search engine answers it, and most people never change that setting. The government argued that this unnoticed default was worth a great deal, and that the way Google secured it broke the law.

A central part of the complaint concerned default placement agreements. These are payments to the companies that make phones and web browsers, in return for setting Google as the preset search engine. A default is the option a product chooses for you before you choose anything yourself, like the ringtone on a new phone. Because so few people change it, owning the default can be close to owning the customer.

The complaint described a web of such agreements. Google paid Apple to be the default search engine in Safari. It had revenue-sharing agreements with mobile carriers and phone makers that set Google as the default on Android devices, and licensing terms that required its search app to be preinstalled in prominent positions. The government’s theory was that these arrangements, taken together, denied rivals the scale they needed to improve, so that the default perpetuated itself.

The economics behind that theory matter for any buyer. A search engine improves with use: more queries produce more data about what people click, which improves results, which attracts more queries. A rival locked out of the default positions never gets the volume to catch up. Antitrust lawyers call this a scale effect, and it explains why the government focused on distribution rather than on the quality of Google’s product.

The scale of the case was hard to miss. It was the largest U.S. monopolization case against a technology company since the Microsoft litigation around the turn of the century, when the government challenged how Microsoft used its control of the Windows operating system. Monopolization is the legal claim that a company with dominant market power used unfair conduct to keep it.

That earlier case is instructive about timing. The government sued Microsoft in 1998. The dispute ended in a settlement approved in 2002, after an appeals court had overturned an order to break the company up. Businesses that ran on Windows and Office in 1998 still ran on them long after the settlement. The case changed how Microsoft dealt with computer makers and rivals rather than what its corporate customers paid.

The Google suit also arrived on the heels of a congressional report. On October 6, 2020, the House Judiciary Committee’s antitrust subcommittee had released the majority staff report of its investigation into digital markets. It examined Amazon, Apple, Facebook and Google and recommended changes to antitrust law. Platform power was a live topic in Washington that autumn.

The Google suit did not stand alone for long. Weeks later, in December, the Federal Trade Commission and a coalition of states filed separate suits against Facebook. Within days of those, two more state coalitions sued Google. One, led by Texas, targeted advertising technology. The other, led by Colorado, concerned search and was later combined with the Justice Department’s case for trial. For a few months, the power of the largest technology platforms was the central topic of technology policy, discussed in boardrooms as well as in Washington.

Executives at banks, hospitals and public agencies had a natural question. If the government was taking on the biggest technology companies, would that make life easier for the organizations that buy from them? The honest answer, then and now, is mostly no, for reasons worth understanding.

When a government sues a dominant technology company, buyers are tempted to read it as relief on the way: more competition, better prices, a stronger hand at renewal. For banks, health systems and agencies that reading was mostly wrong in 2020 and is mostly wrong now.

Antitrust addresses the structure of markets over many years. A regulated institution’s concentration risk is more immediate: whether it can keep operating, and switch, if a provider fails or changes terms. Those are different problems on different clocks, and the levers for the second sit with the buyer.

What antitrust can and cannot do for a buyer

Antitrust law exists to protect competition across a whole market. It was never designed to fix the terms of any single customer’s contract, and that difference shapes everything that follows.

Monopolization cases are slow by design. The government has to prove market power and conduct that maintains it. Then comes a separate fight over remedies, meaning what the court will actually order, then appeals. The search case was filed in October 2020. A liability ruling came in August 2024 and a remedies decision in September 2025. That is a full technology generation, during which most institutions renewed their major contracts at least once.

Why the two clocks diverge

The litigation clock has fixed stages. After the complaint come discovery, motions and, in this case, a summary judgment ruling in August 2023 that narrowed the claims before trial. The trial ran from September to November 2023. Post-trial briefing and closing arguments followed in 2024, then the liability opinion, a separate remedies trial in 2025, the remedies opinion and a final judgment. Appeals come after all of that. Each stage is there to protect the fairness of the outcome, and none can be skipped.

The procurement clock runs differently. Major technology contracts commonly run for three to five years, and renewal discussions begin well before expiry. A decision to migrate a core system has to be made a year or more before the contract ends, because the migration itself takes that long. A buyer waiting for a court to change the market would have to decide on its next renewal without knowing the outcome, and probably on the one after that as well.

Remedies, when they come, target conduct in a specific market: exclusive deals, default placements, sometimes data access for rivals. They rarely change the terms an individual customer already signed, and they do not lower the cost of moving years of data, integrations and staff skills off a platform. A bank’s dependence on a cloud provider, or a health system’s on its electronic record vendor, is mostly not the kind of dependence antitrust reaches.

Antitrust works like a town deciding, over several years, whether to let more grocery stores open. It may eventually mean more choice for everyone. It does nothing for the household that has already signed a ten-year lease on a house with no kitchen and a single delivery service built into the walls.

Where competition policy does reach buyers

The strongest counter-argument to this article’s claim comes from Europe. Some market regulation does act directly on the terms buyers face. The EU Data Act applies from September 2025. It requires providers of cloud and other data processing services to remove obstacles to switching, and it phases out switching charges, including fees for moving data out, by January 2027. Ahead of it, in 2024, the three largest cloud providers announced that customers leaving their platforms could move data out without the usual egress fees, subject to conditions.

Those are real gains, and buyers should use them. They also show the limits of the market lever. Egress fees are the visible part of switching cost. The larger part is the work of rebuilding integrations, rewriting code that depends on provider-specific services, revalidating controls, retraining staff and running two environments during the transition. No regulation pays for that. A free exit door helps most the institution that has already kept its systems portable enough to walk through it.

Timing matters too. The Data Act was proposed in 2022 and its switching rules apply in stages through 2027. An institution that signed a five-year agreement in 2020 renewed it before any of this took effect. Market rules arrive on a legislative clock, and contracts renew on a commercial one.

What the earlier platform case suggests

The Microsoft litigation is the closest precedent, and its record supports the same reading. The case changed how Microsoft could deal with computer makers and rivals. It did not change the dependence of corporate customers on the operating system and office software at the center of their operations, and the products remained standard in regulated organizations for decades afterward. Competition eventually reshaped the market through the web, mobile devices and cloud services, but that change came from technology shifts more than from the decree.

For a buyer, the practical reading is to treat any antitrust case as background. It may improve options at a future renewal. It will not shorten the time needed to move a core system, and it should not appear in a risk assessment as a mitigation.

How dependency builds up

Vendor concentration is the risk that comes from relying heavily on a small number of suppliers for things the organization cannot live without. Third-party risk management is the discipline of understanding and controlling that risk: knowing who your critical suppliers are, what could go wrong with them, and what you would do about it.

Dependency rarely arrives in one dramatic decision. It builds up in layers. An organization buys a cloud platform, which means renting computing power and storage in a provider’s data centers instead of running its own. It then moves its data there, connects other systems to it, trains staff on its tools and builds new services that use its special features. Each step makes sense on its own. Together they make leaving harder every year.

Technologists call the end state lock-in: the point at which the cost, time and risk of switching are so high that switching is no longer a real option. The provider does not need to behave badly for lock-in to matter. It only needs to raise prices, change a product, suffer a long outage or be acquired, and the customer discovers how little room it has to respond.

The switching cost is the total price of leaving: moving data, rebuilding connections to other systems, retraining people, running old and new side by side during the transition, and the risk of something breaking on the way. It is usually lowest before a contract is signed and highest a few years after implementation.

How lock-in builds, year by year

A hypothetical health system shows how ordinary the process is. In year one, it signs with a cloud provider to host a new patient scheduling app. The contract is modest and the team is pleased with the speed. In year two, it moves its data warehouse, the central store of reporting data, to the same provider, because the data is already there and the discount is generous. In year three, its analysts start using the provider’s own reporting and machine learning tools, which only work on that platform. In year four, the security team switches on the provider’s threat monitoring because it is bundled in. By year five, the scheduling app, the reporting that executives see every Monday, the security alerts and dozens of staff skills all rest on one supplier.

No single decision in that story was wrong, and several were sensible and saved money. But nobody ever asked the board whether it was comfortable with that level of dependence, because the question never presented itself as a single choice. When the next renewal arrives, the provider knows how hard it would be for the health system to leave, and so does the health system’s finance team.

Why each step looks rational

Lock-in grows because every step is priced to look sensible. Providers offer committed-spend agreements, where the buyer promises a minimum spend over several years in exchange for a discount. Once that commitment is signed, moving more workloads onto the platform is the way to use the money already promised. Each new workload deepens the dependency and makes the next renewal’s commitment larger.

Bundling works the same way. A security tool or analytics service included in an existing agreement has a marginal cost close to zero, while a separate product needs its own budget, contract and integration. Procurement rules in many organizations favor the option already on contract, which is usually the incumbent’s. Staff incentives reinforce it: teams are rewarded for delivering quickly, and the provider’s own services are the fastest path.

Provider-specific services also tend to be good. A managed database, messaging service or machine learning platform saves real engineering effort. The cost is deferred: the effort saved now is borrowed against the effort needed to leave later. Finance teams rarely record that liability, so it never appears in the business case.

The mechanism is economic rather than sinister. Every party is acting reasonably on the incentives in front of it. The buyer’s only defense is to price the deferred cost explicitly at each step, and decide case by case whether the saving is worth it.

The same arc plays out with electronic health record vendors, core banking providers and the case management platforms that agencies use to run benefits programs. These are systems of record: the authoritative source for who a customer, patient or citizen is and what has happened to them. They tend to be the deepest dependencies of all, because almost every other system connects to them.

Where the costs of dependency land

Dependency is easy to treat as an IT concern. Its consequences land elsewhere.

Cost. A buyer that cannot credibly leave has little bargaining power at renewal, and price increases tend to follow. The cost rarely shows up as one shock. It appears as steady increases across renewals that no single budget review flags as unusual.

Operational risk. When a critical provider has an outage, the customer’s own recovery plans may be irrelevant if they assumed the provider would always be available. Customers cannot open accounts, clinicians cannot see schedules, residents cannot file claims.

Regulators. Supervisors increasingly expect institutions to show that they could survive a provider’s failure and leave in an orderly way, in addition to having chosen a reputable provider.

Strategy. Deep dependence also narrows future choices. A new product, an acquisition or a change in operating model may be limited by what the incumbent platform supports, on the incumbent’s timetable.

Shared exposure. Dependency also has a collective dimension that no single institution controls. When many banks, hospitals or agencies rely on the same provider, an outage at that provider hits them together, and they all compete for the same scarce help at once. The individual institution’s plan should assume that its peers are in the same position, so that alternative suppliers, incident responders and consultants may be fully booked when they are needed most.

When the provider changes, not fails

Exit planning often assumes the trigger will be a provider failure. Recent years have shown that a change in ownership or strategy can be just as disruptive. After Broadcom completed its acquisition of VMware in November 2023, it moved customers to subscription licensing and bundled products, and many customers reported sharply higher costs. Organizations running core workloads on VMware’s virtualization software found that their options depended on how portable those workloads were, and on how much notice and transition time their contracts gave them.

A provider can also cause an outage without failing in any business sense. On July 19, 2024, a faulty update to CrowdStrike’s endpoint security software crashed Windows computers around the world; Microsoft estimated that about 8.5 million devices were affected. Airlines, hospitals, banks and public services were disrupted at the same moment. The provider remained healthy. Its customers’ shared dependence on one agent, updated automatically, was the risk.

Supervisors had flagged this pattern before either event. In February 2023 the U.S. Treasury published a report on the financial sector’s adoption of cloud services. It pointed to concentration among a few providers, limited transparency to customers about incidents, the difficulty of switching, and the weak negotiating position of smaller institutions. It also noted a shortage of staff skilled in deploying cloud services securely. Between them, its findings touch each of the four kinds of dependency described below.

Four kinds of concentration, four kinds of evidence

Concentration shows up in four distinct forms, and each needs its own evidence.

• Operational dependency. One provider whose outage stops a critical service. Evidence: recovery time objectives, the agreed limit on how long a service may be down, tested against a provider outage as well as against the institution’s own failures.
• Commercial dependency. Renewal terms that worsen because the buyer cannot credibly leave. Evidence: price history across renewals and a current estimate of switching cost.
• Data dependency. Records held in formats or services that are costly to extract. Evidence: a recent test export of a critical dataset, with time and completeness measured.
• Skills dependency. Teams trained on one ecosystem, so switching means retraining as well as migrating. Evidence: an honest count of staff who could run an alternative.

Supervisors focus mainly on the first form. They care increasingly about the others, because those decide whether an exit plan is real. The U.S. banking agencies set out expectations for third-party relationships, including contingency and termination planning, in interagency guidance in 2023. European and UK regimes went further and created direct oversight of critical technology providers to the financial sector. Health care has no single equivalent, though the 2024 attack on a major claims clearinghouse made the operational point in practice: when one shared provider stops, many organizations that depend on it stop with it.

Suppose a regional bank runs its mobile app, fraud monitoring and customer data on one cloud provider, its email and document storage on a productivity suite from a second, and its core banking system, the central ledger that records every account and transaction, with a specialist vendor. The board is told the bank has “three strategic partners.” A closer look shows that the bank cannot open accounts if the core vendor is down, cannot detect fraud if the cloud region fails, and has never tried to export its customer data in a form another system could use. Each of those is a different kind of dependency, and each needs a different plan.

Measuring each dependency

Each form of dependency can be measured with a small number of indicators, and the measures are more persuasive to a board than ratings. For operational dependency, count the critical services that would stop if a given provider failed, and record the recovery time actually achieved in the last test against a provider outage. For commercial dependency, track the price change at each renewal against the original contract and against alternatives quoted at the time, and the share of total technology spend going to each provider.

For data dependency, record how long the last test export of a critical dataset took, what share of records and attachments arrived intact, and whether another system could read the result. For skills dependency, count the people who could operate an alternative platform today, and the training time needed to bring a team up to that level. The numbers will be rough. Even rough numbers show which dependencies are growing and which are under control, and they turn a renewal discussion from adjectives into evidence.

How the rules differ by type of institution

Expectations for managing dependency vary sharply by charter and sector, and it is worth knowing which rules reach whom.

• Banks. The June 2023 interagency guidance from the Federal Reserve, FDIC and OCC covers the life cycle of a third-party relationship, from planning and due diligence through contract negotiation, monitoring and termination. Under the Bank Service Company Act, those agencies can also examine certain technology service providers directly.
• Credit unions. NCUA expects credit unions to manage third-party risk, but it does not have the same authority to examine their technology vendors. It has asked Congress for that authority for years. In practice the credit union carries more of the burden of evidence about its vendors.
• Broker-dealers. FINRA reminded member firms in 2021 that outsourcing a function does not outsource the responsibility for it, and set out expectations for vendor due diligence and supervision.
• Health systems. No single regime covers vendor concentration. HIPAA business associate agreements address privacy and security, not exit. Federal health IT certification rules, however, required certified electronic health record technology to support export of a patient population’s electronic health information by the end of 2023. That gives providers a regulatory basis for data portability.
• Government agencies. Federal agencies buy cloud services through FedRAMP, which Congress put on a statutory footing in December 2022. FedRAMP assesses security, not exit. Data rights, transition assistance and termination terms depend on each contract, and appropriations cycles can make a mid-contract switch hard to fund.

The variation means a single exit planning template rarely fits. A credit union needs stronger contract rights to compensate for the lack of direct vendor oversight. A health system can lean on the export requirement for clinical data but not for the operational systems around it. An agency has to plan an exit across budget years.

Which levers sit with the buyer

Every lever that matters can be pulled without waiting for a court.

Contract terms. Data return in usable formats, transition assistance at agreed rates, notice periods for material changes, audit rights and clear termination rights are all negotiated at signing, when bargaining power is highest. They are much harder to win at renewal, after implementation has sunk the switching cost. Organizations should check with counsel on what their regulators expect these clauses to cover.

Architecture. Architecture means how systems are designed and connected. Dependency is cheaper to manage when the parts of a system with durable value stay portable. Those parts are data models (how information is organized), identity (how people sign in and what they are allowed to do), integration logic (the connections between systems) and records. Commodity services, the interchangeable basics, can be provider-specific without much risk. Not everything needs to be multi-cloud or multi-vendor, and pursuing that everywhere is expensive. The choice should be made service by service, by criticality.

Who owns exit planning

Exit planning tends to fall between functions. Procurement negotiates the contract, enterprise architecture shapes the design, the business owner runs the service, risk management assesses the provider, and nobody owns the question of how to leave. A workable arrangement names the business owner of each critical service as accountable for its exit plan, with architecture and procurement contributing and risk management challenging the result.

Timing should follow the contract life cycle. Exit terms are set before signing. The exit plan is drafted during implementation, while the team still knows how the service was built. A test is scheduled for each year of the contract. And the plan is refreshed six to twelve months before renewal, so the institution enters the negotiation knowing what leaving would cost. A board or risk committee that receives a short annual report on exit readiness for the top providers will see dependency growing before it becomes a renewal surprise.

A tested exit plan. An exit plan describes how the organization would move a service to another provider, or bring it in-house, if it had to. Many exit plans have never been exercised. A credible plan names the target platform, estimates time and cost, and has been partly tested. Restoring a critical dataset outside the primary provider, or running one key workflow on an alternative for a day, turns assumptions into measurements. Untested plans tend to underestimate effort.

Clauses that matter, and what they cost

Exit terms are worth most when they are specific. A data return clause should state the formats, the scope, including metadata, attachments and audit logs, and the time within which the provider must deliver. A transition assistance clause should commit the provider to keep the service running for a defined period after notice, at rates agreed in advance. Termination rights should cover a change of control at the provider, a material change to the service and persistent failure to meet service levels. Where the buyer can afford it, they should also allow termination for convenience.

Price protection belongs in the same discussion. A cap on renewal increases, or a defined method for setting them, limits the commercial dependency that builds once switching becomes expensive. Notice periods for material changes to products, data locations or subcontractors give the buyer time to react.

These clauses are not free. Providers resist terms that weaken their bargaining position, and they price them in. A smaller institution may be offered a standard contract with little room to negotiate. In that case the effort shifts to architecture and testing, and the risk assessment should record that the contract gives limited protection. Counsel should review whatever is agreed against the expectations of the institution’s regulators.

A modest test can be revealing. Say a state agency that runs unemployment claims on a hosted case management platform decides to check one assumption in its exit plan: that it could extract every open claim, with its history and documents, within two weeks. Its team requests a full export of one month’s claims and tries to load them into a simple test database. The export arrives in a format that needs custom conversion. Some attachments are missing. Linking documents back to claims takes far longer than anyone expected. That is no crisis; producing such findings is what a test is for. The agency now has a measured number to replace a guess, a list of contract points to raise at renewal and a concrete improvement plan to show its auditors.

The same principle applies to outages. A bank that has only ever rehearsed the loss of its own data center has not tested the scenario supervisors now ask about most: what happens when a provider many institutions share goes down at once. Running that scenario on paper first, with the business leaders who would make the real decisions, is cheap and usually reveals gaps in communication as well as technology.

Portability without multi-cloud

Keeping the durable parts portable does not require running everything on two providers. A few disciplines go a long way. Data should be kept, or regularly exported, in open formats the institution can read without the provider’s tools. Identity should be controlled by the institution, so that staff accounts and access rights do not live only inside one vendor’s product. Infrastructure should be defined in code, so it can be rebuilt elsewhere with known effort. Integrations should run through interfaces the institution documents and owns.

Each discipline has a cost. Open formats can mean giving up a convenient proprietary feature. Owning identity means running or buying a separate identity service. Infrastructure as code takes engineering skill. The case for paying those costs is strongest for systems of record and weakest for commodity services, which is why the choice should be made service by service.

Portability claims deserve the same scrutiny as exit plans. A vendor’s statement that data can be exported in a standard format is a starting point. The useful evidence is a completed export, loaded into another tool, with the gaps written down. An architecture review that asks, for each new design, which components would have to be rewritten to move the service elsewhere keeps the question alive between tests. Recording the answer alongside the design decision costs a few minutes and gives the next renewal team a head start.

The default trap inside your own organization

Default placement, the heart of the search case, has a parallel inside the enterprise. Many institutions made their most consequential platform choices by default: the identity service bundled with the productivity suite, the analytics tool included with the cloud agreement, the security add-on enabled at renewal. Defaults are convenient. They also accumulate into dependencies nobody chose. A yearly review of which bundled defaults now support critical services costs little and is usually revealing.

Consider a county finance office that moved to a productivity suite for email five years ago. The suite came with a sign-in service, which the county then used for its payroll portal. It came with a file-sharing tool, which became the place where procurement records live. It came with a forms feature, which now handles permit applications from residents. Nobody ever held a meeting to decide that permits would depend on the email vendor. It happened one sensible shortcut at a time.

Procurement teams can also use competition where it exists. In most categories regulated buyers depend on, credible alternatives exist at initial purchase. That bargaining power fades after implementation. The effort is better spent on portability and exit terms during selection than on discounts that deepen the lock-in.

The case for the bundle

Bundles have a serious defense. An integrated suite from one provider has fewer seams between products, and seams are where security gaps and outages often appear. A smaller institution may lack the staff to integrate and monitor several best-of-breed tools, and a single well-run platform may leave it safer than a patchwork it cannot manage. Consolidation can also reduce the number of vendors whose risk must be assessed.

Those advantages are real, and many institutions should take them. The argument here is about choosing the bundle knowingly. That means recording the decision and the dependency it creates, keeping data and identity portable even inside the bundle, and testing the exit for the services that matter most. A bundle chosen on purpose, with its exit priced, is a sound decision. A bundle accumulated by default is a risk nobody approved.

Scale and dependency arrive together

Large platforms often offer better security and resilience than an institution could build alone, and that point deserves weight. Avoiding big providers would often make an organization less safe. The benefits of scale and the risks of dependency arrive together, and only the buyer can manage the second.

Institutions that manage it well keep a short, current list of critical providers, with each of the four kinds of dependency assessed separately. They agree contract terms on data return, transition help and termination before signing, and have counsel review them. They test at least one element of each critical exit plan every year and report the results in hours and dollars rather than adjectives. And they decide, service by service, what must stay portable and what can be provider-specific.

A board view of dependency

A board does not need the technical detail to oversee dependency, but it does need a consistent view. One page per year can cover it. The page lists the handful of providers whose failure would stop a critical service, with the four dependency measures for each. It shows the date and result of the last exit test, the main contract protections in place and their renewal dates, and any change in a provider’s ownership, strategy or pricing during the year.

The value of that page lies in the trend. A provider whose share of spend keeps rising, whose last export test was slow and whose contract renews next year deserves attention now, while there is still time to negotiate or prepare. Read across several years, the page shows whether the institution is choosing its dependencies or drifting into them.

The usual errors run the other way. Some institutions wait for regulation or competition to improve terms later instead of negotiating them now. Some accept a deeper bundle for a lower price, raising switching cost in exchange for a short-term saving. Some write exit plans for an examiner that nobody has tried to follow. And some spread every service across several providers, at great cost, instead of protecting the parts that matter most.

A court can change how a dominant firm behaves in its markets. It cannot tell a credit union, a hospital or a state agency how long it would take to move its core records.

How hard it would be to walk away

• Which three providers would stop a critical service if they failed tomorrow, and how long could we keep operating without each one?
• When did we last export a critical dataset from a provider, and how long did it take and how complete was it?
• What do our contracts say about getting our data back, help with transition and our right to leave?
• Which services did we adopt simply because they came bundled with something else, and do any of them now support critical work?
• If a supervisor or auditor asked to see our exit plan for our most important provider, what evidence could we show that it works?

With hindsight

The search case reached a liability ruling in August 2024, when a federal judge found that Google had unlawfully maintained a monopoly in general search. The remedies decision in September 2025 stopped well short of a breakup. It declined to order a sale of the Chrome browser, barred exclusive distribution arrangements and required some sharing of data with rivals. A separate federal case on advertising technology produced a ruling against Google in April 2025.

The detail of the search remedies is telling. Google remained free to pay for placement, but it could not make those payments conditional on keeping its products as defaults for longer than one year. The data it had to share included parts of its search index and user-interaction data, and it also had to offer search and search ad syndication to qualified competitors. The court entered final judgment in December 2025, and appeals, including a cross-appeal by the plaintiffs, were under way in 2026. More than five years after filing, the case was still not final.

The advertising technology case, which the Justice Department filed in January 2023, moved faster, with a trial in September 2024 and a liability ruling in the Eastern District of Virginia in April 2025.

Those were significant outcomes in competition law. They took close to five years from filing to remedy, and they addressed how a dominant company deals with device makers, browsers and rivals. They were never designed to touch the contracts of an ordinary corporate or public-sector customer.

The rulings did not change the day-to-day position of a bank or health system buying cloud, productivity or analytics services. Supervisory attention to concentration did change, through third-party risk guidance in the U.S. and dedicated regimes for critical providers in Europe and the UK. The practical pressure on regulated buyers came from examiners asking whether exit plans were real, rather than from the courtroom. The outages of 2024 gave those questions a concrete reference point.

Europe and the UK moved further. The EU’s Digital Operational Resilience Act applied from January 2025 and created direct oversight of information and communication technology providers designated as critical to the EU financial sector. The UK’s regime for critical third parties to the financial sector took effect the same month. Both make some large technology providers answerable to financial supervisors, which no U.S. antitrust case did. The EU Data Act’s switching rules began applying in September 2025, and the 2024 decisions by the largest cloud providers to waive data egress fees for departing customers lowered one visible cost of leaving.

Shared-provider outages kept making the operational case. The 2024 attack on Change Healthcare disrupted claims and payments for providers across the country for weeks. The faulty CrowdStrike update in July 2024 hit organizations in every sector on the same day. Neither event had anything to do with market power, and both showed what concentrated dependence looks like when something goes wrong.

What lasts is a point about timing and ownership. The moment of greatest bargaining power is before signature, and it does not come back. The best evidence that an organization could leave a provider is an actual test, however small. And the decisions that create dependency are often the unexamined defaults no one remembers making.

The 2020 suit is a useful reminder that market structure is a policy question, while dependency is a management one that each institution owns. Governments can reshape markets over a decade. Only the buyer can decide, this year, how hard it would be to walk away.