On July 17, 2026, France's Autorité de la concurrence published a 3,700-page investigation into the AI agent market. They built their own AI agents and ran 550 test queries. Their finding: OpenAI, Google, and Anthropic together control more than 84% of the global AI agent market. The specific risk they named — 'platformisation' — is that whichever companies control the AI agent layer will control which websites, products, and services get discovered. DrafterDaily explains what the report found, what the proposed remedies mean, and what enterprise AI buyers should watch.
On July 17, 2026, France's Autorité de la concurrence published Opinion No. 26-A-05 — a 3,700-page report on the competitive landscape of the AI agent market. To investigate, the authority did something unusual: they built their own AI agents and ran 550 structured shopping queries, logging exactly which websites each agent visited and cited. The result was a precise map of market concentration that no industry survey or self-reported data could have produced.
The headline finding: OpenAI, Google, and Anthropic together control more than 84% of the global AI agent market. The three companies sit at the foundation of virtually every AI agent product — whether through direct consumer products like ChatGPT and Gemini, or through the underlying models and APIs that power third-party agents built by enterprises and startups worldwide.
The Autorité de la concurrence's investigation was methodologically distinctive. Rather than relying on company filings or third-party market research, French regulators built functional AI agents and used them to conduct real shopping queries across e-commerce, travel, and services categories. For each query, they logged which providers' models generated the agent's response, which websites the agent visited, and which were cited or recommended in the output. The investigation covered 8 months and produced a 3,700-page opinion.
The Autorité de la concurrence's concern is not simply that three companies have large market shares. The specific risk the opinion names is 'platformisation' — the process by which AI agents become the dominant interface layer through which users discover products, services, and information.
In a world where a user asks an AI agent 'book me a hotel in Paris' or 'find me the best protein powder' instead of typing into a search engine, the agent — not the user — decides which hotels and supplement brands get considered. The companies that control those agents control discovery in a way that is more powerful than search ranking because agents synthesize and recommend rather than list. A website that doesn't appear in an AI agent's recommendations doesn't just rank lower — it may not exist in that user's consideration set at all.
This is what the report means by a 'monopoly in waiting': the concentration is already high, but the economic stakes will grow dramatically as AI agents become the primary interface for consumer discovery and transactions.
The Autorité de la concurrence proposed intervention on three fronts. First, data access for smaller AI providers: regulators want to mandate that dominant players make training data, fine-tuning datasets, and usage data available to competitors on non-discriminatory terms. Second, interoperability standards: mandatory technical standards that allow AI agents from different providers to communicate and exchange tasks without proprietary lock-in. Third, regulation of default AI placement — which AI agent comes pre-installed on which device, operating system, or browser. The report treats default placement as the AI-era equivalent of the browser wars and recommends applying 'choice screen' logic similar to the EU's Digital Markets Act on browser defaults.
For enterprises currently building AI-powered workflows on a single provider's APIs, the report is a useful risk assessment. The 84% concentration figure is not a reason to avoid OpenAI, Google, or Anthropic — these are the strongest providers for most use cases. But the report's analysis of lock-in risk is accurate: vendor agreements that don't include data portability clauses, that require exclusive deployment of a specific model, or that don't allow switching providers without re-engineering the integration are meaningful business risks if interoperability mandates eventually change market structure.
The Autorité de la concurrence's opinion is advisory, not binding, and applies to French and EU markets rather than the US directly. But EU competition authority opinions in tech have historically been early signals of regulatory trajectory. Enterprise AI buyers should track whether the CLARITY Act and any US AI governance framework picks up the interoperability argument.
What the French report adds to the AI governance conversation is specificity. It is not a general warning about AI market concentration — it is a measured account of which companies control which chokepoints, produced by people who actually built the tools to measure it. The 84% figure will be disputed and refined. The underlying dynamic it describes — AI agents as the new discovery layer, controlled by a handful of providers — is not going to be disputed for long.
That is the finding of France's Autorité de la concurrence from its July 17, 2026 opinion, based on a methodology the authority designed specifically to measure this: they built their own AI agents and ran 550 structured queries, logging exactly which providers' models powered each response. The 84% figure reflects market activity — model usage in AI agent pipelines — rather than revenue or user counts. The actual concentration at the foundational model layer is even higher.
Plain-English analysis of what AI regulation and market structure actually mean for your business.
Claude Fable 5.1 costs exactly what Fable 5 cost per token. The 25-to-45% saving Anthropic advertises comes from one repriced line item — cached input, now billed at 2.5% of list instead of 10%. That is a discount you only collect if you keep the agent running.
Anthropic was not breached. The malware was already on the customer's machine, and it took a session cookie rather than a password — which is why two-factor authentication did nothing and why server-side revocation is the only lever the vendor has.
OpenAI's incident report on the Hugging Face breach leads on a security failure. The remarkable part is a verbatim chain-of-thought in which a model identifies its action as unauthorised and proceeds anyway — and an escape route that was a package manager, not a superintelligence.