The Governance Body With Teeth -- The EU's Two Binding DMA Decisions Force Google to Share Search Data From

1) What the EU actually ordered, and why it has teeth

The Digital Markets Act labels Google a "gatekeeper" -- a platform so dominant that normal competition law moves too slowly to matter, so the DMA lets Brussels issue binding technical requirements instead of waiting years for a court case. On July 16 it used that power twice. First: Google must give rival AI assistants the same access to 11 Android features that it reserves for Gemini, including letting a user summon a competitor with a voice command the way "Hey Google" works today -- changes required to reach users by July 2027. Second: starting January 2027, Google must share anonymised search data with competing search engines and AI chatbots, the raw material it has used to make its own answers better than anyone else's. Miss either deadline and the fine is up to 10 percent of Google's global annual revenue -- not a slap, a number that shows up in guidance to shareholders. That's the difference from Monday's story about the WAIC governance charter: 29 nations signing a document with no enforcement clause is a statement of intent. A gatekeeper decision under the DMA is a standing legal obligation with a fine attached from day one. Both are "AI governance" in the headlines; only one of them changes what Google is allowed to ship.

2) Why Android's assistant slot specifically -- and who benefits

The Android default-assistant slot is the same kind of chokepoint that made Google's default-search deal with Apple worth tens of billions of dollars a year: whoever sits in that slot gets picked by users who never open a settings menu. Reserving OS-level hooks -- screen reading, voice activation, app-launch permissions -- for Gemini alone meant a rival assistant installed from the Play Store was structurally second-class no matter how good its model was. Opening those 11 hooks doesn't hand Perplexity or ChatGPT a better model; it removes the platform-level handicap that made the model

It also lands one day after this series covered Nubia's NaviX Ultra -- a phone whose entire pitch is an OS-level agent that operates every app on the user's behalf. Once rival assistants get the same OS access Google reserves for its own, the interesting question stops being "which chatbot is smartest" and becomes "which agent gets the OS-level permissions to actually act" -- and after July 2027, that's no longer Google's decision alone to make on Android.

3) The rivals' other agreement: a shared scale for jailbreak danger

The same four companies squaring off over Android access -- Google, Microsoft, Amazon, plus Anthropic -- spent the same stretch of July agreeing on something together: the Cyber Jailbreak Severity (CJS) framework, published by Anthropic on July 2. It's a five-tier scale, CJS-0 (informational) through CJS-4 (critical), scored on four axes -- how much capability a jailbreak actually unlocks beyond what an attacker already had, how many distinct offensive tasks it works on, how easy it is to turn into a working attack, and how easily a threat actor would find it on their own. The tiers are exponential, not linear: each level is meant to represent several times more real-world risk than the one below it, not just

Before CJS, there was no shared vocabulary for "how bad is this jailbreak" -- so every new technique escalated on its own, sometimes all the way to emergency export controls, because nobody had an agreed triage step in between. That's not a hypothetical: it's the same dynamic that pulled Anthropic's own Fable 5 and Mythos 5 offline earlier this year until the Commerce Department lifted the controls in July. A shared severity scale is the industry's bet that most future jailbreak findings can be triaged instead of treated as a crisis by default -- self-regulation adopted because it's in every lab's interest, with no regulator required to make it stick.