AI Governance Institute logo
AI Governance Institute

Intelligence for Compliance and GRC Teams

← News
Enforcement2026-07-22

EU Binding DMA Measures Force Google to Open Android AI Access and Share Search Data by July 2027, Reshaping Enterprise AI Procurement Risk

What happened

The European Commission has issued final binding specification measures under the Digital Markets Act requiring Google to open Android's system-level access to competing AI platforms on equivalent terms to those currently granted to Gemini, and to make search data available to rival search providers for a reasonable fee. Full details are reported in the Ars Technica account of the Commission's decision. The measures set two distinct compliance deadlines: search data sharing obligations take effect by January 2027, while Android AI interoperability must be in place by July 2027. Critically, the Commission has ruled that AI chatbots are to be treated as search services for data-sharing purposes, meaning the data-sharing and anonymization obligations extend to AI assistant products, not only to traditional search engines. A multilayered anonymization approach is mandated for all shared data, imposing specific technical and process requirements on any party accessing or receiving that data.

Why it matters

  • ·Enterprise procurement teams that have standardized on Gemini as the default AI assistant on managed Android device fleets must now assess an expanded field of competing AI assistants that will have equivalent system-level access - each representing a new third-party AI vendor that requires risk assessment, contract review, and shadow AI controls under frameworks such as the EU AI Act.
  • ·The Commission's classification of AI chatbots as search services for data-sharing purposes creates a precedent that regulators in other jurisdictions may follow, meaning that AI assistant products handling search-adjacent queries could face data access, sharing, and anonymization obligations beyond what current privacy and AI governance programs anticipate.
  • ·Enterprises building AI products that consume Google search data, or that operate AI assistants in EU markets, face direct operational obligations: they must evaluate whether their data intake processes, anonymization controls, and vendor agreements are compatible with the multilayered anonymization standard and the January 2027 data-sharing deadline.

Governance controls affected

PRC-001Third-Party AI Risk AssessmentPRC-002AI Vendor Contract RequirementsDGC-002PII Handling in AI PipelinesDGC-003Data Minimization and DeletionCMP-001Multi-Jurisdiction AI Regulatory Compliance Mapping

What to do now

  • ☐Audit all managed Android device policies to identify where Gemini is currently deployed as a default AI assistant, and map the governance implications of new competing AI assistants gaining equivalent system-level access after July 2027.
  • ☐Update third-party AI vendor due diligence templates to include questions about DMA compliance status, multilayered anonymization capabilities, and data-sharing obligations for any AI assistant or search-adjacent AI product operating in the EU.
  • ☐Review vendor contracts for AI products that ingest Google search data or operate as AI assistants in EU markets, and identify whether data processing agreements reflect the Commission's anonymization requirements ahead of the January 2027 deadline.
  • ☐Assess shadow AI risk exposure by inventorying which AI assistants employees may begin adopting on Android as interoperability opens the platform, and extend acceptable use policy enforcement to cover newly accessible assistants.
  • ☐Brief legal and compliance leadership on the Commission's classification of AI chatbots as search services, and evaluate whether that classification affects regulatory obligations for any AI assistant products the organization deploys or procures.

What to watch next

Compliance teams should monitor whether the Commission issues further technical specifications on the multilayered anonymization standard ahead of the January 2027 data-sharing deadline, as the technical detail of that standard will directly affect data governance program updates. Google's formal response and any appeal proceedings could shift the implementation timeline, so tracking enforcement milestones through the first half of 2027 is warranted. Teams should also watch for other jurisdictions - particularly the UK and US - citing the Commission's chatbot-as-search-service classification as a basis for extending data-sharing or interoperability obligations to AI assistant products under their own regulatory frameworks, which would materially expand the multi-jurisdiction compliance mapping work required under [CMP-001].

Stay ahead of stories like this

Get every EU AI governance development like this one, plus the rest of the week's developments. Every Thursday.

Powered by Buttondown.

Related Coverage

Enforcement2026-07-29

Italy's Garante Fines Character.AI Operator €158,000 for Data Protection and Age-Control Failures, Signaling Broader EU Enforcement Risk for Consumer AI Platforms

Italy's data protection authority, the Garante, fined Character Technologies, the U.S.-based operator of the generative AI platform Character.AI, €158,000 for violations of data protection rules. The enforcement action centers on failures related to age verification, lawful basis for processing, and user data controls on a consumer-facing AI service. The decision is one of the first EU data protection enforcement actions to target a generative AI platform directly.

Corporate Policy2026-07-27

Claude Shared Chats Indexed by Google, Exposing Health Records and Children's Data in Employee-Generated AI Content

An undetermined number of Claude shared chats and Artifacts became publicly searchable on Google, with some conversations containing health records, private company documents, and children's personal information. Anthropic stated the exposure resulted from users choosing to share links rather than from a platform misconfiguration. The incident creates immediate compliance exposure for organizations whose employees use Claude for work involving sensitive or regulated data.

Research2026-08-04

Meta's Deceptive Minor-Persona Red Teaming Exposes a Governance Gap in Adversarial Testing Programs

WIRED reported that Meta, through contractor Covalen, directed hundreds of workers to create fake accounts with under-18 birthdates and send rival chatbots thousands of prompts involving suicide, self-harm, eating disorders, and sexual content from the perspective of minors in crisis. The project raises serious questions about consent, the ethics of synthetic-persona construction, and the absence of governance frameworks for outbound adversarial testing against third-party AI systems. Enterprise compliance teams that rely on contractors for red teaming or competitive AI benchmarking face heightened scrutiny over how they authorize and oversee such activities.