The European Commission has unconditionally approved Google’s proposed acquisition of Wiz under the EU Merger Regulation, concluding that the transaction raises no competition concerns in the European Economic Area (EEA).
Following an in-depth investigation, the Commission found that the acquisition would not significantly impede effective competition in any of the markets examined. The case primarily concerns the fast-growing cloud security sector, which is closely linked to the market for cloud infrastructure services.
Market Context and Parties’ Activities
Google, through its Google Cloud Platform (GCP), is active in cloud infrastructure and offers cloud security services, mainly to its own cloud customers and, to a limited extent, to users of rival cloud providers. Wiz operates a cloud-native application protection platform, enabling customers—particularly large enterprises—to secure applications across multiple cloud environments through a single, integrated security solution.
The transaction is set against a backdrop of intense competition in cloud infrastructure markets, where Google faces strong rivals, notably Amazon Web Services (AWS) and Microsoft Azure. The Commission noted that multi-cloud strategies are increasingly important for customers seeking to diversify workloads and enhance resilience, and that cloud security solutions play a key role in enabling such strategies.
Findings of the Commission’s Investigation
As part of its assessment, the Commission gathered extensive feedback from customers and competing suppliers of cloud security and cloud infrastructure services. This market investigation focused on all material aspects of the transaction, including potential foreclosure risks, data access concerns, and the impact on customer choice.
The Commission concluded that customers would continue to have access to several credible alternative providers of cloud security solutions. In particular, even if Google were to bundle Wiz’s services with its own offerings, or if Wiz’s platform were hypothetically limited in its compatibility with non-Google clouds, customers would still be able to switch to competing solutions.
The Commission also examined whether the acquisition could give Google access to commercially sensitive data relating to rival cloud service providers that integrate with Wiz’s platform. The investigation confirmed that the data accessible to Google post-transaction would not be commercially sensitive and is generally available to other security software providers operating in the market.
Conclusion and Procedural Background
On the basis of these findings, the Commission determined that the acquisition does not raise competition concerns in the EEA and approved the transaction unconditionally.
Although the transaction did not meet the EU Merger Regulation’s turnover thresholds, it was reviewed following a referral request by Google under Article 4(5) of the Regulation. The transaction was capable of review under the national competition laws of at least three Member States—Cyprus, Ireland, and Sweden. No Member State opposed the referral, and the Commission accepted jurisdiction in July 2025. The transaction was formally notified on 6 January 2026.