EU Opens Android to Rival AI Agents: 2026 DMA Order

On July 16, 2026, the European Commission adopted two binding specification decisions telling Google exactly which parts of Android it must open to competing AI services.¹ The document that came out of it reads less like a regulatory ruling and more like a capability spec for phone-based agents.

In one line: The EU has ordered Google to give third-party AI agents free access to 11 Android features — including wake-word activation, screen automation, background execution, and the on-device Gemini Nano models — which today are either reserved for Gemini outright or open to rivals only on worse terms, with most of it due in Android 18 by August 1, 2027.²

TL;DR

• What happened: The Commission adopted two sets of binding specification measures on July 16, 2026 — one on AI interoperability with Android under Article 6(7) DMA, one on Google Search data sharing under Article 6(11).¹²³
• The core of it: Third-party AI services get access to 11 Android features, grouped into four buckets: invocation, context, actions on apps and the OS, and access to resources.²
• The headline capabilities: always-on hotword detection ("Hey [your assistant]"), screen automation that drives apps in a background virtual window, background execution, and guaranteed equal access to Android's built-in on-device models including Gemini Nano.²
• Deadline: Android 18, and no later than August 1, 2027. Concurrent hotword detection — multiple assistants listening for different wake words — lands later, in Android 19, by August 1, 2028.²
• Not a free-for-all: Five of the 11 features are gated behind an eligibility program Google must publish in draft by February 1, 2027 and finalize by May 1, 2027.²
• Google's position: President of Global Affairs Kent Walker said the decisions "risk undermining vital privacy and security guardrails for millions of Europeans."⁴

What You'll Learn

• What the Commission actually decided on July 16 — and the important thing it did not decide
• All 11 Android features, and what each one unlocks for an agent
• Which five features are gated, and the certification timeline for them
• The real search-data timeline, which most coverage has reported incorrectly
• What this changes if you're building an AI agent that targets phones
• What Google is objecting to, in its own words

What the Commission actually decided

A specification decision under Article 8(2) of the DMA is not a fine and not a finding that a company broke the law. It is the Commission spelling out, in technical detail, what compliance with an existing obligation has to look like.⁵

That distinction matters here. Google was already obligated under Article 6(7) DMA to provide "free and effective interoperability" with Android features. What it did not have was a definition of which features counted.²

The Commission opened these proceedings on January 27, 2026, ran a public consultation on the proposed measures, and adopted the final decision on July 16 — ahead of the statutory six-month deadline of July 27, 2026.²⁵

The stakes attached to it are real. Under Article 30(1)(b) of the DMA, failing to comply with measures specified in an Article 8(2) decision exposes a gatekeeper to fines of up to 10% of total worldwide turnover. A separate provision, Article 30(2), raises the ceiling to 20% for a repeat infringement of an underlying Article 5, 6, or 7 obligation on the same core platform service within eight years.⁶

The Commission's stated reasoning is about distribution. Around 60% of European mobile users are on Android devices, and the Commission's view is that Gemini's deep OS access on that installed base is a structural advantage no rival can match by writing a better model.²

The 11 features, and what each one unlocks

The Commission organized the 11 features into four categories: invocation (how a user summons an agent), context (what the agent can see), actions (what it can do), and resources (what compute it can use).²

Table: The 11 Google Android features covered by the Commission's July 16, 2026 specification decision. Source: European Commission, DMA.100220 Q&A.

Three of these are the ones that change what an agent can architecturally be on a phone.

Screen automation (#7) is the one that most resembles what desktop computer-use agents already do. The Commission's description is specific: the agent imitates user behaviour in a separate virtual window, so it can finish a task in the background while the user does something else.²

Android implements this via Computer Control, currently reserved for Google's own services.² It's the same interaction model as the browser agents from Anthropic, OpenAI, and Google, moved down to the OS layer.

Background execution (#11) is what makes an agent something other than a chat window — without it, an agent can only act while you're looking at it. The Commission notes this is "particularly useful for AI-related apps," which are often designed to work while the user is in another app entirely.²

Third-party apps aren't locked out of background execution today. What changes is that they must get the same access as Google's own apps, under "transparent, objective, precise and non-discriminatory rules."²

System-level on-device models (#9) is the sleeper, and it's a parity fix rather than a door being unlocked. The on-device models that ship with Android — Gemini Nano among them — are already accessible to third parties; what the decision adds is a guarantee of equal access, explicitly including performance.²

That matters more than it sounds. An agent developer gets local inference for summarizing text, proofreading, and speech recognition without shipping their own model weights — and now with a commitment that it won't run slower than it does for Google.

Structured on-device integration (#6) also comes with a concrete list attached: Google must expose Gmail, Calendar, Drive, Docs, Maps, YouTube, Messages, and Phone through OS-level integration channels.²

The five gated features

Access is not automatic for everything. The Commission allows Google to impose "objective and non-discriminatory eligibility conditions" on five features it considers sensitive:²

1. Screen automation
2. Structured on-device integration
3. System integration
4. Centralised access to apps' data stored on the device
5. Context-aware intelligence

Certification is performed by Google together with independent third parties, and the Commission was explicit that no commercial requirements may be attached — this is a security and privacy gate, not a licensing one.²

The certification calendar runs ahead of the feature deadline. Google must publish draft terms for consultation by February 1, 2027, publish final terms by May 1, 2027, and begin accepting applications on that same date. Each application must be assessed within four weeks.²

A set of general obligations applies across all 11 features, gated or not: interoperability must be free of charge, must work across the whole Android ecosystem including other manufacturers' devices, must not require extra user friction, and — notably — cannot be conditioned on the AI provider holding a default role on the device.²

Google also has to hand over complete documentation, let developers test the interoperability solutions including via beta, and provide technical assistance. Any new functionality added to a covered feature must reach third parties at the same time it reaches Google's own services.²

The search-data timeline most coverage got wrong

The second decision, under Article 6(11) DMA, covers Google Search data sharing — and it's where reporting has drifted from the source.

Multiple outlets have written that Google must begin sharing search data with rivals in January 2027. The Commission's own timeline says something different: by January 2027 — six months after adoption — Alphabet must finalise the pricing offer and communicate it to the Commission and to third-party search engines.³

The actual milestones are earlier and more granular:³

Table: Google Search data-sharing implementation milestones. Source: European Commission, DMA.100209 Q&A.

The reason this decision exists at all is blunt in the Commission's telling: Alphabet's initial compliance proposal was removing between 90% and 100% of unique search queries from the shared dataset, and excluded AI chatbots with search functions from eligibility entirely.³ The Commission says this produced "no meaningful uptake by potential beneficiaries."³

The fix explicitly brings AI chatbots offering search functionality into scope as eligible recipients.³ To qualify, a service needs at least 50,000 monthly average users in the EU over the past year, plus either two consecutive years of operation in the EU or founding within the last two years and more than €50 million in capital investment.³

Anonymisation is handled with k-anonymity at a floor of 1,000 users sharing the same location, device type, and query language — with the Commission noting 95% of users will sit in groups of at least 29,000.³ Data is shared with a minimum seven-day latency, for up to five years per beneficiary.³

Usage is fenced: recipients may improve query understanding, ranking and retrieval, and indexing — but may not train general-purpose AI models on it, use it for consumer profiling or advertising, or systematically replicate Google's results.³

What this changes if you build agents

The practical shift is that the mobile agent surface stops being a Google-only product decision and becomes a documented, testable interface with a compliance deadline behind it.

Plan for a certification track, not just an SDK. If your agent needs screen automation or app-data access — and most useful agents will — you're in the gated five. Draft terms land February 2027, applications open May 2027. That's a procurement and security-review workstream, not an afternoon of integration.

The permission surface is genuinely large. Ambient microphone and camera streams, on-device app data, screen contents, and the ability to act in apps while the screen is off is a substantial blast radius. This is precisely the territory covered by the zero-trust framing security teams are now applying to agents — and the Commission's answer is user consent plus the eligibility gate, not architectural restriction.

Geography is a real constraint. These measures are EU obligations. Nothing here compels Google to ship the same access in the US or elsewhere, and the decision covers Android only.

Apple's iOS carries its own Article 6(7) interoperability obligations, but the Commission specified those in two separate decisions adopted on March 19, 2025 — covering connected physical devices and the process for requesting interoperability.⁷ Neither is an AI-services equivalent of what Google just received.

Watch the tooling layer converge. An agent that can call OS-level app functions on Android and MCP servers over the network is dealing with two different tool-invocation surfaces. The MCP spec finalizing on July 28 governs the second; this decision governs the first.

What Google is objecting to

Kent Walker, President of Global Affairs at Google & Alphabet, published Google's response the same day.⁴

"Today's decisions risk undermining vital privacy and security guardrails for millions of Europeans. We have repeatedly offered solutions to safeguard users while satisfying the DMA's goals, but these rulings discount extensive evidence of user harm."⁴

His specific objection on Android is about who does the vetting. Walker's argument is that AI assistants already access Android capabilities safely today "with phone makers playing a key role in vetting them," and that the ruling "threatens device security by granting external apps sensitive and powerful device permissions without these safeguards."⁴

On search data, Walker wrote that "Europeans' private searches would be exposed to unfamiliar companies, without adequate anonymisation of the data and without user knowledge or consent."⁴

Google has not, as of July 21, 2026, announced an appeal of either decision. Specification decisions are challengeable before the EU General Court in the same way as other Commission decisions, and obligations remain live during any challenge.⁵

The Commission says it will monitor implementation over the coming two years, with Google required to report regularly on design, development, and release progress.²

Bottom Line

The interesting thing about this decision isn't the competition politics. It's that a competition regulator has ended up publishing what is arguably the clearest public breakdown yet of what an AI agent actually needs from a phone.

Invocation, context, actions, resources — that four-part split is a reasonable architecture diagram for a mobile agent, and it now has legal force and a date attached. Whether Gemini's rivals can build something worth summoning is a separate question, and not one the Commission set out to answer for them.

The deadline that actually matters for builders is not August 2027. It's February 2027, when the terms for the five gated features go out for consultation — because that's the document that will determine who gets to ship a real agent on Android and who ships a chat window.