EU orders Google to give rival AI apps equal Android access
The European Commission issued binding rules this week requiring Google to open Android's deepest system controls to competing AI assistants on equal terms with Gemini. The order, published under Digital Markets Act Article 6(7), is not a choice screen or a preference menu. It mandates OS-level infrastructure access, and it sets a compliance clock running toward a July 2027 deadline for EU users to see the results.
Google pushed back the same day. "Today's decisions risk undermining essential privacy and security safeguards for millions of Europeans," the company said in a blog post, adding that the required permissions are being opened at a moment when the EU's own cybersecurity agency warns that "security fundamentals matter more than ever in the age of AI."
The Commission's position is that AI assistant access at the operating-system level is platform infrastructure, not a product decision Google makes alone. Whether that position delivers anything in practice comes down to one unresolved question: whether the certification model built into the order is workable enough for rivals to enter and strict enough to address real security risks.
Why the EU Google Android AI app access order goes beyond app distribution
The structural problem the Commission is trying to solve starts with how Gemini sits inside Android. Gemini ships preloaded on every Google-certified Android phone and can activate in response to the "Hey Google" wake word even when the screen is off, Ars Technica reported this week. No rival assistant can do that through an app download.
The Commission put it directly: third-party AI assistants are limited in how they can offer their services, making them less attractive to the roughly 60% of EU users on Android devices, according to Ars Technica, citing the Commission's press release. An assistant that requires a user to unlock their phone and tap an icon before it can respond is structurally weaker than one that's already listening. That gap cannot be closed through distribution alone.
The Commission's stated goal, heise reported this week, is to prevent Gemini from becoming the dominant AI platform on Android before the market hardens. This is a forward-looking concern, not a response to an established monopoly. ChatGPT reportedly held roughly 70% of EU AI chatbot usage as of April 2026, according to ICLE's analysis published two months earlier. In October 2025, Gemini recorded approximately 813 million monthly desktop sessions against 369 million on mobile, a desktop-to-mobile ratio exceeding two-to-one, ICLE noted. Gemini is not winning the AI race. The Commission's concern is that OS-level bundling, compounded over time, is precisely how platform monopolies have formed before the race was over.
What the Commission actually requires
The order covers four categories of access. The first two are relatively direct. The second two are where the mandate gets technically aggressive.
Activation. Competing assistants must be able to detect custom wake words through the phone's digital signal processor, including in battery-saver mode with the screen off, and must be triggerable via hardware buttons on the same terms as Gemini's "Hey Google" capability, heise reported this week. ICLE's analysis of the Commission's annex confirms the requirement extends to third-party-controlled second-stage wake-word validation, per ICLE.
Context and screen access. Third-party assistants must be able to capture screen content and app context, just as Gemini can today, heise reported. ICLE's reading of the annex goes further: continuous background access to core ambient sensors including the microphone, camera, speakers, accelerometer, and GPS, with consent flows and data quality equivalent to Google's own services, per ICLE.
Cross-app control. Rival assistants must be able to perform agentic, multi-step functions just as Gemini does, the Commission explained in a Q&A document cited by heise. Per ICLE's annex analysis, this includes controlling other applications through screen automation, simulating user inputs, and executing multi-step transactions in a virtual background window, ICLE noted. Practically, that means ordering food or booking a ride through a voice command, one of the examples the Commission cited, per heise.
On-device compute. This is the most contested category. According to ICLE's reading of the annex, the mandate extends to AI Core, Gemini Nano, and the underlying NPU, GPU, and RAM resources, meaning users could grant a third-party assistant the same preferential hardware access currently reserved for Google's own services, ICLE noted. The Commission's published materials describe the general requirement to share hardware resources and local models; ICLE's annex analysis identifies the specific components.
Taken together, ICLE characterized the package as creating "an attack surface qualitatively different from anything Article 6(7) has previously been used to open," contrasting it with the Apple iOS specification decisions from early 2025, which covered comparatively bounded connectivity functions such as NFC, Bluetooth pairing, and notification forwarding, per ICLE.
The assistants best placed to use this access are those with existing EU user bases and engineering capacity to pursue certification. ChatGPT and Claude are the most obvious candidates. Claude had captured substantial enterprise demand by early 2026, with an estimated $14 billion annualized revenue run-rate and adoption by eight of the Fortune 10, ICLE noted. European-built or OEM alternatives are also possible entrants.
The security fight: Google's objections and the Commission's answer
Google's argument is not purely strategic. The specific permissions at issue, always-on microphone access, persistent screen reading, continuous cross-app automation, are the same capabilities that make a compromised or malicious app dangerous. The company stated this week that the ruling "threatens device security by granting external apps sensitive and powerful device permissions without these safeguards," and pointed to the EU's own cybersecurity agency warning that security fundamentals grow more important, not less, as AI expands.
The Commission's answer is a supervised admission model, not open access. GDPR and the Cyber Resilience Act apply to all third-party providers. Users must grant explicit consent for sensitive permissions. Google may impose objective, non-discriminatory access conditions tied to data protection and security standards, heise reported this week. What it cannot do is layer commercial requirements on top of those conditions or apply restrictions that don't apply equally to Gemini.
The structural tension sits in how restrictions must be justified. The annex requires any integrity measure to be backed by "objective and verifiable evidence showing the existence and magnitude of the integrity risk," with proof of the measure's effectiveness and the possibility of independent verification not exclusively within Google's control, according to ICLE's analysis. ICLE argued this standard could prevent Google from blocking emerging threats before they have materialized into documented harm. Whether a certification review can catch a bad actor in four weeks is a real operational question, not a rhetorical one.
The Commission and Google are not arguing about whether security matters. They are arguing about who decides what constitutes sufficient evidence of a threat, and whether that decision can be made fast enough to matter.
The compliance timeline: key dates for EU users on Android
The ruling sets a structured sequence. Google must publish draft certification program terms for Commission and third-party review by February 1, 2027. Final terms are due May 1, 2027, at which point Google must begin accepting applications. Each review must be completed within four weeks of submission, heise reported.
Android must be updated to support the required AI integrations by July 2027, per Ars Technica and heise. MacObserver reported a software requirement deadline of August 2027, likely reflecting a separate milestone in the same rollout. Heise noted the adjustments are likely to arrive with the Android 18 update, though that timing has not been formally confirmed.
A parallel DMA order requires Google to begin sharing search data with competing search and AI providers by January 2027, Ars Technica reported. That is a separate proceeding.
The certification terms Google drafts by February 2027 are the real test. The ruling establishes that AI assistant access is infrastructure subject to interoperability requirements. The terms will determine which assistants can actually enter the Android system, on what conditions, and at what cost. The Commission retains the ability to review and amend those terms. That exchange, not the order itself, is where the policy either becomes functional or settles into a compliance dispute that outlasts the Android 18 release window.
Comments
Be the first, drop a comment!