The great opening: the EU forces Google to open Android to third-party IA assistants and share data under the DMA

The European Commission has for the first time, and in a demanding way, armored the interoperability of artificial intelligence assistants on Android: Google must open to third parties the same access that its assistant Gemini already has to camera, microphone, content on screen, keyword activation with blocked screen and the ability to control other applications by imitating touches and writing. The obligation appears in two binding decisions under the Digital Markets Act (DMA), one on the capabilities of the operating system (with a deadline in the next big version, Android 18, or as a last resort on August 1, 2027) and another on the provision of anonymous search and click data to competitors and chatbots that do searches.

These measures do not fine Google but technically define what it has to implement: the DMA already left intact the Commission's power to open non-compliance procedures with economic sanctions if the specifications are not respected. The scope is significant The text forces Google to create a Qualified AI Assistant Programme and to accept certificates from third parties - Trusted Certification Authorities - without cost and without being able to revoke them arbitrarily, although the Commission is monitoring that the criteria are reasonable and non-discriminatory. That door may seem like a compromise: it gives Google room to manage certification and, at the same time, submits its rules to external supervision. The regime, in practice, defines how third-party assistants can perform sensitive actions such as reading and writing emails, managing calendars, controlling maps or interacting with messaging and calls: functions that have traditionally been under the strict control of manufacturers and Google itself. The Commission has also opened up the possibility that very invasive functions of the system - such as continuous access to microphone, camera, location, system audio and screen content - are available for end-user applications under the same consent conditions as are currently used by own services. That means that several attendees could hear or see at the same time and, in theory, run commands with blocked screen, a measure whose calendar places the coexistence of assistants always active for Android 19, with a deadline of August 1, 2028. The movement seeks to open competition in an area where an assistant's ability to access the device context offers strategic advantage over cloud-hosted models. However, it introduces real security and privacy risks. Recent history shows that the content of notifications or other input channels can be used for prompt injection attacks or to scale privileges without explicit malicious applications on the device, as evidenced by the incident published by SafeBreach with the Gemini agent on Android Utilities. The Commission has tried to mitigate this with certification requirements that require model integrity, supply chain control and accidental data leakage measures but the burden of designing and running these tests will be largely on Google and the certifiers it accepts. The second major change forces Google to share anonymous search data, with a three-pass method that abolishes direct identifiers, eliminates consultations with rare or sensitive terms and gathers metadata to large population sizes (minimum threshold of 1,000 per group, with the majority reaching 29,000). The beneficiaries must comply with strict contractual conditions and demonstrate scale (50,000 users per month on average of the year) and judicial reliability. It is a commitment to market transparency and to giving data to competitors, but leaves the initial selection and risk assessment to Google. with very short time-limits for eligibility and delivery. What does this mean for users, companies and regulators? For users it should result in more choice of more powerful assistants, but the promise will only be real if the certification process is reliable, transparent and audible. The user experience will require clearer and more reversible consent interfaces: the decision provides that users may omit the certification by service and device by express consent, without hiding that option in developer modes. Without robust consent UX and minimum default controls, permit expansion can quickly become accidental exposure. For application developers and service providers, the calendar is demanding. Companies must prepare for two fronts: to adapt their apps to block sensitive views against control by other attendees and to review how they expose context (screen, notifications, multimedia content) thinking about which automated tools can read and act on them. They should also work with manufacturers and manage possible incompatibilities between apps that want to preserve context segments against automated control. The decision allows Google to implement technical mechanisms to make an app or a sensitive view out of automation, but does not force them to be built; that leaves room for industrial negotiation in the months before Android 18. In security and research it is key to maintain external scrutiny. Commission requires independent audits before data access and on an annual basis and gives appeal and notification windows that seek to avoid arbitrary revocation. Even so, Google's management of the acceptance of certifiers poses a potential conflict of interest: European regulators and the cybersecurity community should require full transparency on criteria, audit results and incidents, and promote the participation of truly independent and technically resourced certifiers. Practical recommendations: users should review and restrict attendance permits and activate courier and notification protections; companies developing assistants or apps of the Android ecosystem should plan certifications, audits and hardening against entry handling and context escape; security officials in organizations should include user-by-agent scenarios in their penetration tests and review contracts and data control clauses before accepting integrations. Regulators and policy makers should press for the publication of certification criteria, the opening of clear appeals processes and the creation of public metrics to measure whether openness improves competition without eroding security. The decision changes the balance between competence and technical integrity. Forced opening can boost innovation, but it will only work if certification and governance of access to sensors and context are more robust, independent and transparent than the frameworks that have existed so far.. Both the design of the Qualified AI Assistant Programme and the way in which audits and user rights are carried out will be the battlefield where it will be decided whether Europe will achieve a more competitive and secure ecosystem of attendees or whether, on the contrary, the attack surface is growing without security rights. To deepen the legal framework and security risks associated with the IA boom, the Digital Markets Act text in EUR-Lex and ENISA's work on artificial intelligence security, which provide technical context and recommendations on resilience to advanced models, can be consulted: DMA Regulation (EUR-Lex) and ENISA - European Union Agency for Cybersecurity.

The text forces Google to create a Qualified AI Assistant Programme and to accept certificates from third parties - Trusted Certification Authorities - without cost and without being able to revoke them arbitrarily, although the Commission is monitoring that the criteria are reasonable and non-discriminatory. That door may seem like a compromise: it gives Google room to manage certification and, at the same time, submits its rules to external supervision. The regime, in practice, defines how third-party assistants can perform sensitive actions such as reading and writing emails, managing calendars, controlling maps or interacting with messaging and calls: functions that have traditionally been under the strict control of manufacturers and Google itself.

The Commission has also opened up the possibility that very invasive functions of the system - such as continuous access to microphone, camera, location, system audio and screen content - are available for end-user applications under the same consent conditions as are currently used by own services. That means that several attendees could hear or see at the same time and, in theory, run commands with blocked screen, a measure whose calendar places the coexistence of assistants always active for Android 19, with a deadline of August 1, 2028.

The movement seeks to open competition in an area where an assistant's ability to access the device context offers strategic advantage over cloud-hosted models. However, it introduces real security and privacy risks. Recent history shows that the content of notifications or other input channels can be used for prompt injection attacks or to scale privileges without explicit malicious applications on the device, as evidenced by the incident published by SafeBreach with the Gemini agent on Android Utilities. The Commission has tried to mitigate this with certification requirements that require model integrity, supply chain control and accidental data leakage measures but the burden of designing and running these tests will be largely on Google and the certifiers it accepts.

The second major change forces Google to share anonymous search data, with a three-pass method that abolishes direct identifiers, eliminates consultations with rare or sensitive terms and gathers metadata to large population sizes (minimum threshold of 1,000 per group, with the majority reaching 29,000). The beneficiaries must comply with strict contractual conditions and demonstrate scale (50,000 users per month on average of the year) and judicial reliability. It is a commitment to market transparency and to giving data to competitors, but leaves the initial selection and risk assessment to Google. with very short time-limits for eligibility and delivery.

What does this mean for users, companies and regulators? For users it should result in more choice of more powerful assistants, but the promise will only be real if the certification process is reliable, transparent and audible. The user experience will require clearer and more reversible consent interfaces: the decision provides that users may omit the certification by service and device by express consent, without hiding that option in developer modes. Without robust consent UX and minimum default controls, permit expansion can quickly become accidental exposure.

For application developers and service providers, the calendar is demanding. Companies must prepare for two fronts: to adapt their apps to block sensitive views against control by other attendees and to review how they expose context (screen, notifications, multimedia content) thinking about which automated tools can read and act on them. They should also work with manufacturers and manage possible incompatibilities between apps that want to preserve context segments against automated control. The decision allows Google to implement technical mechanisms to make an app or a sensitive view out of automation, but does not force them to be built; that leaves room for industrial negotiation in the months before Android 18.

In security and research it is key to maintain external scrutiny. Commission requires independent audits before data access and on an annual basis and gives appeal and notification windows that seek to avoid arbitrary revocation. Even so, Google's management of the acceptance of certifiers poses a potential conflict of interest: European regulators and the cybersecurity community should require full transparency on criteria, audit results and incidents, and promote the participation of truly independent and technically resourced certifiers.

Practical recommendations: users should review and restrict attendance permits and activate courier and notification protections; companies developing assistants or apps of the Android ecosystem should plan certifications, audits and hardening against entry handling and context escape; security officials in organizations should include user-by-agent scenarios in their penetration tests and review contracts and data control clauses before accepting integrations. Regulators and policy makers should press for the publication of certification criteria, the opening of clear appeals processes and the creation of public metrics to measure whether openness improves competition without eroding security.

The decision changes the balance between competence and technical integrity. Forced opening can boost innovation, but it will only work if certification and governance of access to sensors and context are more robust, independent and transparent than the frameworks that have existed so far.. Both the design of the Qualified AI Assistant Programme and the way in which audits and user rights are carried out will be the battlefield where it will be decided whether Europe will achieve a more competitive and secure ecosystem of attendees or whether, on the contrary, the attack surface is growing without security rights.

To deepen the legal framework and security risks associated with the IA boom, the Digital Markets Act text in EUR-Lex and ENISA's work on artificial intelligence security, which provide technical context and recommendations on resilience to advanced models, can be consulted: DMA Regulation (EUR-Lex) and ENISA - European Union Agency for Cybersecurity.