The European Commission has unconditionally approved Google’s proposed acquisition of Wiz under the EU Merger Regulation, saying the deal raises no competition concerns in the European Economic Area (EEA). The approval allows Google to move ahead with its plan to buy Wiz, a cloud security company, in a transaction valued at $32 billion.
EU regulators said the review focused on the fast-growing cloud security industry, where both companies are active, and its link to cloud infrastructure, where Google competes with other major providers. Google offers cloud infrastructure through Google Cloud Platform and also provides cloud security services to its cloud users and, to a limited extent, to users of other cloud infrastructure providers.
Wiz, which is headquartered in the United States, offers what it calls a cloud-native application protection platform. The platform is designed to give cloud customers a single security product to help protect applications against cybersecurity threats across different cloud environments, including multi-cloud setups.
Why the EU cleared the deal
The Commission said it collected extensive feedback from customers and rival suppliers of cloud security and cloud infrastructure services to test how the deal could affect competition. One concern was whether Google could bundle Wiz’s multi-cloud security platform with Google’s existing products in a way that could reduce choice for customers.
EU officials said the market investigation found there are several credible competitors customers could switch to if bundling became an issue. Regulators also examined another scenario: whether Wiz’s platform might stop working well with cloud services other than Google’s after the acquisition. The Commission said customers would still have credible alternatives, and it did not find competition concerns on the markets it examined in the EEA.
The Commission also looked at whether Google would gain access to commercially sensitive data about competing cloud service providers through Wiz’s integrations. It said its market investigation confirmed the data Google would obtain is not commercially sensitive and can generally be accessed by other security software companies as well.
Teresa Ribera, the Commission’s Executive Vice-President for Clean, Just and Competitive Transition, said Google sits behind Amazon and Microsoft in cloud infrastructure market shares, and the Commission’s assessment found customers would continue to have alternatives and the ability to switch providers.
A Phase I decision under a referral
The EU decision followed what the Commission described as a Phase I review, the standard first-stage process used for most merger notifications. The Commission said it generally has 25 working days from notification to either clear a transaction in Phase I or open an in-depth Phase II investigation.
In this case, the Commission said the proposed transaction did not meet the EU Merger Regulation’s usual turnover thresholds. However, it took up the review after receiving a referral request from Google under Article 4(5) of the Merger Regulation.
According to the Commission, the deal was capable of being reviewed under the national competition laws of at least three member states—Cyprus, Ireland, and Sweden. The Commission said it transmitted Google’s request to all member states on July 4, 2025, and none disagreed with the referral. It accepted the referral on July 29, 2025, and said the transaction was notified to the Commission on January 6, 2026.
Advocacy pressure and Google’s message
While the Commission cleared the deal, the EU decision came amid political and civil-society pressure highlighted by Calcalist. The report said European advocacy organizations urged the Commission not to approve the transaction at the preliminary stage and pushed for a deeper review.
Calcalist reported that groups including Rebalance Now, the Open Markets Institute, the Balanced Economy Project, SOMO, and Article 19 filed a joint submission. The submission warned the acquisition could entrench Google’s power in two areas they described as increasingly critical digital infrastructure: cloud computing and cybersecurity.
The groups’ central concern, as described by Calcalist, focused on Wiz’s independence as a stand-alone company that acts as a neutral layer monitoring security across rival cloud providers. They argued that once Wiz is owned by Google, that neutrality could weaken, including through what they called “soft degradation,” such as slower feature parity for competing platforms or shifts in engineering priorities that could steer customers toward Google Cloud.
Google, for its part, has presented the acquisition as a way to strengthen security across cloud computing at a time of rising cyber threats, according to Calcalist.
What comes next
The Commission said it cleared the transaction unconditionally after finding no competition concerns in the EEA. The case will be listed in the Commission’s public case register under case number M.11964.
The deal has also cleared U.S. review steps mentioned by Calcalist, which reported that the U.S. Department of Justice ended its antitrust review and that an “early termination” of the mandatory review period was recorded on October 24 on the Federal Trade Commission’s website.
