By imposing restrictions on the portability of VMware licenses, Broadcom risks creating regional and sectoral “mini-monopolies.”
Such is the view of CISPE, the association representing European cloud providers. It voices this in the fourth report of its “competition observatory.”
The first three had been published in February, May and October 2025. In this interval, the list of grievances against the American group had gradually grown longer.
After VCSP, BYOL: one fewer fallback option
One year later, there is still news. CISPE highlights two actions in particular. On one side, the sudden closure of the VCSP program. It was January 26, 2026. Partners learned that after March 31, they would no longer be able to sign new customer contracts or renewals. Not that it could have been foreseen: Broadcom had already heavily revamped the program in autumn 2025. With, among other effects, the requirement for cloud providers to choose between reseller and service-provider roles. As for those who would no longer be part of the program, they could not host VMware solutions – only resell licenses.
According to CISPE, suppliers invited to join the new partner program saw their license fees rise by 15%. In the background, notably, the end of the model that allowed the use of additional cores and then paying retroactively. The association laments more broadly the loss of access to a product that “has no immediate substitute” and which, beyond its resale, has become the backbone of an entire ecosystem of cloud services.
The other element CISPE highlights concerns the bring your own license (BYOL). “Severe restrictions” have applied since May 2026, it says. Until then, end customers could deploy their licenses on-site in the cloud of their choice, as long as it was on dedicated infrastructure provided and operated by the CSP. This form of contingency plan for cloud providers excluded from the partner program is no longer. The end-customer choice is now limited to the platforms Broadcom has certified. Hence the reference to the risk of “mini-monopolies.”
The professional secrecy delays antitrust proceedings
The February 2025 report attributed to Broadcom “dilatory tactics” used in its litigation – notably with Orange and Thales in France – to delay substantive decisions.
CISPE still denounces these methods, but now in the context of the antitrust proceedings opened by the European Commission. There is not yet a formal investigation. We are at the information request stage… for eight months now. Broadcom has indeed blocked this request. It has turned to the EU Tribunal to have it annulled. At the heart of the debate is the professional secrecy applied to communications with lawyers in the context of legal advisory services.
In the United States there exists what is commonly translated as the “client-attorney privilege,” guaranteeing total protection for these communications. Broadcom invoked it to challenge an unlawful request from the European Commission. The courts, however, rejected its challenge in early August. Brussels, however, made a concession, agreeing not to seek the full production of exchanges with external lawyers.
CISPE says it fears a precedent that other tech companies could exploit. It also notes that, conversely, Broadcom seeks to force it to disclose information that falls under trade secrets.
The compliance reporting, equated to a kill switch
From report to report, another topic has grown in importance: sovereignty. CISPE reiterates that Broadcom is engaging in “misleading” communications on sovereignty. The association relies on a framework it published in spring 2026: the Sovereign and Resilient Cloud Framework.
The initiative clearly borrows from Gaia-X’s Level 3, but differentiates itself with a dual approach of “sovereign” and “resilient.” It is a response to the Cloud Sovereignty Framework that the European Commission has been pushing. CISPE regrets in particular the possibility Brussels gives to compute a “sovereignty score,” potentially weighted by objective (strategic sovereignty, technological, operational, etc.). In its view, you cannot be “75% sovereign”: you are sovereign or you are not.
VCF does not meet the criteria of the Sovereign and Resilient Cloud Framework, not least because it is a proprietary stack emanating from a vendor exposed to the CLOUD Act and to export restrictions decreed by Washington. But there is another reason: it keeps unilateral control as the sole source of patches, updates and maintenance. CISPE adds an element it has already highlighted in the past: the reporting mechanism for VCF’s compliance. It likens it to a kill switch in the sense that non-compliance can result in degradation or blockage of the control plan (see Broadcom documentation).
