Broadcom appears firmly in the crosshairs of European antitrust watchdogs, with European Union (EU) officials reportedly grilling cloud providers impacted by sweeping licensing changes.

Bloomberg reports that European cloud firms are being subject to questions from antitrust officials on the importance of VMware offerings and to what extent they could be easily replaced. Cloud service providers are also reportedly being asked for any new certification arrangements they might deem “unfair.”

Should the commission eventually decide to escalate the matter, it could launch a formal investigation or intervene more quickly with the option of imposing so-called “interim measures” – temporary orders that can only be implemented in the event officials find immediate risk of serious and irreparable damage to competition. These include ordering companies to pause at-issue practices for a short time.

Such measures, though, are rarely used, and in the event they ever are, legal challenges can be brought by the affected company, further slowing the process. Companies found to breach EU antitrust laws can be hit by fines of up to 10% of their global annual revenue, though such instances are few and far between.

Since its $61 billion takeover of VMware closed in late November 2023, Broadcom has instigated sweeping changes, many of which have caused consternation among some customers.

Ripping up perpetual license offerings to create subscription-based mass bundles resulted in customers purchasing subscriptions to services they don’t need just to access the ones they do.

Broadcom has also shuttered the Advantage Partner Program for VMware Cloud Service Providers (VCSP), replacing it with an invite-only system. The White Label model, which allowed smaller cloud service providers to work through Pinnacle or Premier partners, was also retired. And just last week, Broadcom pulled the plug on a software kit that allowed rivals to migrate virtual machines away from VMware.

Customer consternation has seen a considerable number of VMware users jump ship, much to the delight of Nutanix, Red Hat, and even some hyperscalers.

Broadcom, though, has consistently been defiant, maintaining an uncompromising stance amid VMware related-legal spats with disgruntled ex’s like Tesco, Siemens, and more recently, T-Mobile US.

CEO Hock Tan previously proudly proclaimed that more than 90% of VMware’s 10,000 largest customers have signed up for the vendor’s Cloud Foundation (VCF) platform. At the company’s recent Explore event in Las Vegas, chief product officer Paul Turner tried to paint the private cloud offering as a means to better manage surging token costs.

That hasn’t stopped Broadcom from being painted as public enemy No. 1 by the Cloud Infrastructure Service Providers in Europe (CISPE). The group took issue with the shuttering of VCSP, filing a complaint with the European Commission’s Directorate-General for Competition alleging that it would force many European communication service providers to exit the market.

Broadcom also recently lost out in a fight with EU antitrust regulators over access to documents it contended were covered by American legal professional privilege. The EU General Court sided with the bloc’s regulators, however, finding that “it is for the commission to decide whether a particular item of information is necessary to enable it to bring to light an infringement of the EU competition rules.”

Manufacturers selling products with digital elements in the EU must now report actively exploited vulnerabilities to cybersecurity authorities under the Cyber Resilience Act’s mandatory reporting rules.

The reporting duties set out in Article 14 of the CRA became applicable today. Subject to the regulation’s exemptions, they apply to manufacturers of products with digital elements made available in the EU, regardless of where those manufacturers are based.

Manufacturers must submit an early warning within 24 hours of becoming aware of an actively exploited vulnerability, followed by a more detailed notification within 72 hours.

The same deadlines apply to severe incidents affecting the security of products with digital elements.

The only difference in timing is related to the final report. Manufacturers must provide a final report on an actively exploited vulnerability within 14 days of making a corrective or mitigating measure available. For serious incidents, the final report is due one month after the first report.

Darren Anstee, CTO for security at Netscout, said the reporting deadlines introduce much-needed urgency in working toward global cyber resilience.

“The 24-hour window in which an initial warning must be reported creates a level of urgency, with subsequent deadlines ensuring that the gathering and release of additional information is prompt,” he said.

“Better, more rapid sharing of information helps organisations put defences and mitigating controls in place when they know there is heightened risk.”

EU and non-EU manufacturers must file these reports through ENISA’s Single Reporting Platform (SRP).

Notifications are addressed to the coordinating computer security incident response team (CSIRT) determined under the CRA. For an EU manufacturer, this is generally the CSIRT for the member state where it has its main establishment; separate rules determine the coordinator for manufacturers based outside the bloc.

Manufacturers must also inform affected users, where appropriate, about actively exploited vulnerabilities or severe incidents. The CRA states that users must be informed of available corrections or mitigations without undue delay.

Generally, failures under the CRA are punishable by varying tiers of fines, the most serious of which can reach €15 million ($17.4 million) or 2.5 percent of the offender’s annual turnover, whichever is higher.

The reporting duties that took effect today are classified as core responsibilities under the act, meaning failures to comply with them could lead to the maximum fines being issued.

They are the latest step in the EU’s plan to drip-feed tighter security regulations on companies operating in the bloc.

Most remaining CRA provisions become applicable on December 11, 2027, at which time manufacturers will also be required to embed security by design and default. That means no default passwords and security updates are no longer optional.

Products covered by the CRA will also have to undergo the applicable conformity assessment before being placed on the EU market and bearing a CE mark.

The European Commission is collecting information on how US technology giant Oracle licenses its software for cloud use.

A person familiar with the matter told Reuters EU antitrust regulators were seeking information from third parties about Oracle’s licensing practices.

However, the information-gathering exercise does not mean the company is formally under investigation. Regulators could use the evidence to build a case, or decide to take no further action if they find no wrongdoing.

The Commission has taken a similar approach towards German software company SAP, which agreed concessions in July to address concerns over its licensing practices.

The Commission has been cautious about confirming the details of its work on Oracle. A spokesperson said the regulator would continue to monitor potential anti-competitive practices and abusive conduct in the cloud sector, but stressed that there was currently no formal investigation into any company.

Oracle has faced complaints about its licensing and software audit practices for years, including from European customers.

Such disputes have generally been resolved through commercial agreements rather than antitrust proceedings.

Cloud computing has changed the nature of those concerns. Licensing conditions that make it significantly more expensive to run Oracle software on a rival cloud could influence a customer’s choice of vendor.

Similarly, contracts that are difficult to terminate could make it harder for businesses to switch providers.

Broadcom has lost a round in what’s shaping up to be one of the more consequential antitrust fights in European tech regulation. The EU General Court dismissed the company’s request to suspend an information demand from the European Commission, specifically one that seeks documents related to Broadcom’s US legal advisers.

The ruling effectively tells Broadcom that EU regulators can, in fact, ask for those papers. And that trying to challenge such requests could, in the court’s words, weaken enforcement efforts in EU competition law.

The European Commission is ending an antitrust investigation into SAP after the company made numerous concessions worldwide regarding maintenance and support services for on-premises versions of its ERP solution. The Commission began its investigation in September 2025, concerned that SAP forces customers to buy its services for longer, and for more licenses, than they need.

In accepting SAP’s commitments, the Commission makes them binding on the company. SAP could still face fines if it fails to make good on its concessions over the next ten years. SAP’s promises include: