The DMA’s Interoperability Duty and AI-Powered Features

Article 6(7) is the provision that decides whether a third-party application can use the same on-device model, the same notification surface or the same assistant hook that the platform owner uses. It is also the provision where the gap between the words and an implementation is widest, which is why it is the one the Commission has had to specify.

What Article 6(7) says

The Digital Markets Act, Regulation (EU) 2022/1925, requires a designated gatekeeper to allow providers of services and providers of hardware, free of charge, effective interoperability with, and access for the purposes of interoperability to, the same hardware and software features that are accessed or controlled via the operating system or virtual assistant listed in the designation decision, and which are available to services or hardware provided by the gatekeeper itself. The gatekeeper may take strictly necessary and proportionate measures to ensure that interoperability does not compromise the integrity of the operating system, virtual assistant, hardware or software features, provided those measures are duly justified. The operative text is at EUR-Lex.

There are two obligations in that sentence, not one, and they fail differently. “Effective interoperability” is about outcome: the third-party service has to actually work with the feature. “Access for the purposes of interoperability” is about means: the interfaces, documentation and technical enablement needed to get there. A gatekeeper that publishes an API but withholds the entitlement that makes it usable has satisfied neither. A gatekeeper that grants access on terms nobody can meet has satisfied the second and not the first.

The benchmark is internal parity. The duty is scoped to features available to the gatekeeper’s own services and hardware, which makes the compliance question empirical rather than normative: what can your own first-party app do that a third party cannot. A capability the gatekeeper does not use itself is outside the duty.

Why AI features are the hard case

Three properties of AI features make parity harder to assess than it is for, say, a Bluetooth pairing flow.

• The feature is often a model, not an interface. If the first-party photo app calls an on-device vision model through a private framework, the “software feature” is the model and its runtime. Parity means a third party can call the same model with comparable latency and comparable quality — not that it can call a smaller public model that nominally does the same thing.
• Quality is a continuum. Rate limits, quantisation, context length and thermal budgets are all levers that degrade a third-party integration without denying it. Effective interoperability is the word that reaches those levers; access alone does not.
• Data is entangled with capability. An assistant hook that lets a third-party app be invoked is worth little if the app cannot receive the same context the first-party app receives. But handing over that context may itself be constrained by the GDPR, which the DMA does not displace — Article 8(1) requires compliance with both, and the interaction with controllership analysis is unresolved in this exact configuration.

The security proviso is not a veto

The integrity carve-out is the most-cited and most-overread part of the provision. Its structure imposes three separate requirements on the gatekeeper, all of which must hold: the measure must be strictly necessary, it must be proportionate, and it must be duly justified. Strict necessity means no less restrictive measure would achieve the same protection. Proportionality means the restriction is weighed against the interoperability the Regulation is trying to produce. Due justification means the reasoning is articulated and reviewable, which in practice means written and given to the Commission.

The consequence is that a general assertion — opening this interface would create a security risk — is not a defence. Nor is the observation that a third party is less trustworthy than the gatekeeper: the duty exists precisely to stop the gatekeeper being the judge of who is trustworthy enough to reach its own users. What the proviso does support is a specific, technically argued restriction, such as requiring an attestation, sandboxing an entitlement, or rate-limiting a capability that can be abused, with reasoning that shows why the safer alternative was rejected.

Privacy is sometimes offered in the same breath as security. It sits less comfortably in the proviso, which speaks to integrity of the system rather than to data protection, and the answer to a genuine GDPR obstacle is usually a lawful-basis and controllership design rather than a refusal to interoperate.

How the duty gets made concrete

Article 6 obligations are self-executing in principle: a gatekeeper is supposed to comply from the compliance date without waiting to be told how. In practice Article 8(2) lets the Commission adopt a specification decision setting out the measures a particular gatekeeper must implement to comply with a particular obligation, following a regulatory dialogue in which the gatekeeper can propose its own.

The Commission has used that power in respect of Article 6(7) — in March 2025 it adopted specification decisions addressed to Apple concerning iOS interoperability with connected devices and the process by which developers request interoperability. That is the model for how this obligation becomes concrete: a general duty, a dispute about what it requires, and a decision that names features and deadlines. Anyone reasoning about AI features should expect the same shape rather than expecting the text alone to answer the question. The current state of every case is on the Commission’s DMA case register.

What a third-party developer can ask for

If you build a service that competes with, or plugs into, a designated operating system’s AI features, the practical sequence is unglamorous and it works. Identify the specific feature and evidence that the gatekeeper’s own service uses it — parity is the test, so the evidence is comparative. Use the gatekeeper’s published interoperability request process, because a documented refusal is worth far more than an undocumented one. If refused, get the justification in writing and test it against strict necessity and proportionality rather than against reasonableness. And complain to the Commission: the DMA is publicly enforced, with no private enforcement route of its own, so the Commission is the addressee, though national courts may hear damages claims founded on a breach.