The Competition and Markets Authority (CMA) has given Google nine months (March 2027) to implement new requirements that will allow publishers to control how their content is used in AI-powered search features. While the immediate focus is Google’s AI Overviews, the UK’s intervention reaches far beyond search results and into one of the most contested areas of AI regulation: who controls the information that powers generative systems.
The measures will allow publishers to opt out of certain AI-powered search uses while continuing to appear in traditional search results. They also introduce new transparency and attribution obligations designed to give content creators greater visibility and influence over how their material is used. In addition, publishers will be given greater control over whether their content can be used to support AI-powered search features and AI model development.
For legal teams, compliance officers and businesses developing AI-powered services, the ruling offers an early indication of how regulators may approach content governance as AI becomes more deeply embedded in everyday products.
What the CMA Has Done
The Competition and Markets Authority (CMA) has introduced new conduct requirements for Google’s search services following the company’s designation with Strategic Market Status under the UK’s digital markets regime. The measures are intended to address concerns about Google’s position in the search market while giving publishers greater influence over how their content is used in AI-powered search products.
At the centre of the changes is a new ability for publishers to prevent their content from being used in features such as AI Overviews while continuing to appear in traditional search results. The CMA said the measures are designed to strengthen publishers’ bargaining position and provide greater control over the use of their content. The regulator has also required Google to provide clear attribution and linking when publisher content appears in AI-generated search responses.
The decision reflects growing concern among regulators about the relationship between AI-powered search tools and the publishers whose content helps power them. It also signals a willingness to intervene before disputes become entrenched, rather than relying solely on traditional competition investigations after potential harm has occurred.
How Google’s New Controls Will Work
Google has said it is testing new tools that will allow publishers to decide whether their content can be used within AI-powered search features such as AI Overviews. Publishers that choose to opt out will continue to appear in traditional search results but will no longer receive traffic generated through those AI experiences.
The company has also indicated that it plans to increase the number of links included within AI-generated responses and provide additional reporting tools to help publishers understand how their content performs across its AI products.
Those changes are intended to address a growing concern among publishers that AI-generated answers reduce the need for users to visit original websites. While Google maintains that AI search features can help users discover information more efficiently, many publishers argue that declining click-through rates threaten advertising revenues, subscriptions and audience growth.
Whether the new controls strike an acceptable balance remains to be seen. For publishers, the key issue is not simply visibility but influence over how their content is used within AI-powered services and whether they have sufficient leverage when negotiating with dominant platforms.
The Legal Framework
The CMA’s intervention stems from the UK’s new digital markets regime, which gives the regulator greater powers over companies designated with Strategic Market Status. The framework is designed to address competition concerns before they become entrenched, rather than relying solely on lengthy investigations after potential harm has already occurred.
That approach marks a notable shift in regulatory strategy. Instead of focusing exclusively on market share, search rankings or advertising practices, regulators are increasingly examining how dominant digital platforms operate in practice and how their decisions affect businesses that depend on them.
In Google’s case, the focus extends beyond traditional search competition and into the use of publisher content within AI-powered products such as AI Overviews. The CMA’s requirements reflect growing concern about whether publishers have meaningful control over how their content is used and whether platforms can provide sufficient transparency around those decisions.
For businesses developing AI-powered services, the broader significance is that regulators are beginning to look more closely at the systems, processes and controls that sit behind AI-generated outputs. Questions about content sourcing, attribution, permissions and accountability are becoming part of the regulatory conversation alongside more traditional competition concerns.
Why Regulators Are Focusing on AI Content Use
The debate extends beyond Google’s search products.
Publishers and news organisations have increasingly argued that AI-generated answers reduce the need for users to visit original websites. Lower referral traffic can affect advertising revenue, subscriptions, audience growth and commercial sustainability.
From a competition perspective, regulators are examining whether content creators have meaningful control over how their work is incorporated into AI-generated experiences.
The concern is not simply whether content is used. It is whether publishers operating within an ecosystem dominated by a small number of technology platforms have realistic bargaining power when decisions are made about that use.
The CMA’s intervention is designed to address that imbalance by giving publishers more options and greater leverage over participation in AI-powered search features.
Beyond Search Results: The Growing Debate Over AI Training Data
While much of the public discussion has focused on AI Overviews, the underlying issue reaches much further.
Across multiple jurisdictions, policymakers, publishers and technology companies are debating how content should be used not only in AI-generated summaries but also in the development and improvement of AI systems themselves.
Questions surrounding consent, attribution, licensing and compensation continue to emerge as AI capabilities expand.
For legal departments and compliance teams, the lesson is that content governance is becoming a strategic issue rather than a technical one. Decisions about data sourcing, content permissions and attribution may increasingly attract scrutiny from regulators, commercial partners and rights holders.
Compliance Obligations and Internal Oversight Requirements
The CMA’s action highlights a broader shift in regulatory thinking around AI-powered products. Regulators are becoming less interested in what AI systems can do and more interested in how they do it. That includes how external content is sourced, whether content owners have meaningful choices over its use, and whether businesses can explain the decisions that sit behind AI-generated outputs.
For companies developing AI-powered services, this means looking beyond technical performance and examining the controls that support the product. Businesses may increasingly need to demonstrate how content permissions are managed, how attribution requirements are applied, how publisher preferences are recorded, and who is responsible for oversight when concerns arise.
For many organisations, the challenge is no longer building AI capabilities. It is showing that appropriate processes, accountability structures and record-keeping mechanisms exist around the use of third-party content throughout the lifecycle of an AI product.
Realistic Internal Failure Scenario
Imagine a company launches an AI-powered search or knowledge platform that relies on information from news publishers, industry websites and other third-party sources. The product gains traction quickly because it can summarise information and deliver answers directly to users.
As the platform grows, questions begin to emerge about how that content is being sourced, whether publishers have any meaningful control over its use, and how attribution decisions are being made. The company discovers that content permissions are handled inconsistently across different systems, publisher preferences are not centrally recorded, and there is no clear process for responding to complaints from content owners.
What began as a product issue quickly becomes a legal, operational and commercial problem. Publishers challenge the use of their content, regulators seek information about internal controls, and product teams are forced to redesign features while the service is already live. Management attention shifts from growth and innovation to remediation, governance reviews and stakeholder concerns.
The lesson is not that businesses should avoid AI-powered products. It is that controls around content sourcing, permissions, attribution and accountability are often far easier and less expensive to build before a product scales than after regulators, publishers or customers begin asking difficult questions.
Where the Risks Sit for Businesses
The risks emerging from this area extend beyond traditional competition enforcement. As regulators take a closer look at how AI-powered products use and display third-party content, businesses may face operational, commercial and governance challenges that are difficult to address after products have already launched.
Regulatory Risk
The most immediate risk is regulatory intervention. Competition authorities may require businesses to introduce new controls, modify existing products or demonstrate how content-owner preferences are managed in practice. In some cases, the cost of implementing those changes after deployment can be significantly higher than building them into products from the outset.
Commercial Risk
Many AI-powered services depend on access to external content. If publishers gain greater control over how their material is used, businesses may need to renegotiate commercial arrangements, adapt product functionality or identify alternative content sources. Changes in publisher participation could directly affect the quality, coverage or usefulness of AI-generated outputs.
Reputational Risk
Questions about content use, attribution and transparency can quickly become public issues. Businesses that cannot clearly explain how external content is sourced or used may face criticism from publishers, customers, regulators and investors, particularly as awareness of AI governance issues continues to grow.
Board and Leadership Risk
Senior leadership teams are increasingly expected to understand how AI systems operate and where the associated risks sit. As regulatory expectations develop, boards may face greater scrutiny over oversight arrangements, accountability structures and the adequacy of internal controls governing AI-powered products.
Financial and Operational Consequences
The financial consequences can extend well beyond regulatory scrutiny. Businesses may face product redesign costs, increased compliance spending, legal and advisory fees, additional reporting obligations and delays to product deployment. Commercial disputes with content providers can add further complexity.
For larger platforms, remediation costs can quickly exceed the investment that would have been required to build stronger controls during development.
Where Regulators Appear to Be Heading
Several themes are beginning to emerge from AI-related investigations, consultations and policy initiatives around the world.
First, regulators want users to understand where information comes from and whether AI has played a role in producing or presenting it.
Second, content creators are receiving greater attention. Authorities are showing more interest in whether publishers and rights holders have meaningful control over how their material is used by AI-powered services.
Third, competition regulators appear less willing to accept opaque decision-making. Platform operators may increasingly be asked to explain how content is sourced, displayed, summarised and attributed.
Finally, there is growing interest in preventative controls. Rather than waiting for disputes to arise, regulators are encouraging businesses to build transparency, accountability and content-management safeguards into products from the start.
What Organisations Should Be Reviewing Now
For many businesses, the most immediate question is whether AI products rely on third-party content and, if so, what controls exist around that use. Legal teams should identify where external content is being incorporated into AI-powered products and review whether existing licensing agreements explicitly address AI-generated summaries, search responses, content extraction, or model-improvement activities. They should also assess whether contractual rights align with the way content is currently being used.
Compliance teams may wish to examine whether existing AI governance programmes adequately address attribution requirements, publisher preferences, content-owner complaints, and regulatory reporting obligations. As regulators place greater emphasis on transparency, organisations should be able to demonstrate how content-related decisions are made, documented, and reviewed.
Product and engineering teams should evaluate whether publisher restrictions can be recorded, updated, and applied consistently across all relevant systems. This includes testing attribution mechanisms, ensuring content controls function as intended, and maintaining audit logs that show when content-use restrictions were applied, modified, or overridden.
At board level, attention should be focused on accountability and oversight. Directors may wish to confirm which executive is responsible for AI content governance, whether reporting lines are clear, and whether management is regularly assessing regulatory developments, third-party content dependencies, and emerging legal risks.
While the CMA’s action is directed at Google, the underlying questions are relevant to any organisation developing AI-powered products. Businesses that can clearly demonstrate how content is sourced, attributed, governed, and monitored are likely to be better positioned if similar regulatory expectations emerge in other markets.
Key Takeaways for Business and Legal Leaders
The CMA’s action is not simply about AI Overviews or declining publisher traffic. It reflects a broader regulatory effort to give content creators greater control over how their material is used within AI-powered products and services.
For businesses, the key question is no longer whether AI can access, summarise or surface third-party information. Regulators are becoming more interested in how those decisions are made, whether content owners have meaningful choices, and whether platforms can demonstrate clear processes around attribution, permissions and accountability.
Companies developing AI-powered products should view this as an early warning sign of where regulatory expectations may be heading. Businesses that rely on external content may need stronger controls around content sourcing, rights management, attribution and internal oversight, particularly as regulators begin examining the operational decisions that sit behind AI-generated outputs.
Perhaps the clearest takeaway is that AI governance is becoming a business-risk issue rather than simply a technology issue. Organisations that build transparency, accountability and content-management controls into products from the outset are likely to be better positioned as regulatory scrutiny continues to expand.
Why This Matters Beyond Google
The CMA’s intervention may prove significant not because it affects Google alone, but because it provides an early indication of how regulators may approach AI-powered products that rely on third-party content.
Many businesses are focused on the capabilities AI can deliver. Regulators, however, are increasingly asking different questions: Where did the information come from? Were content owners given meaningful choices? Can the company explain how content is sourced, attributed and governed?
Those questions are unlikely to remain confined to search engines. Any organisation developing AI-powered tools that summarise, surface or rely on external content may eventually face similar scrutiny.
Businesses that address those issues early are likely to be in a stronger position if regulatory expectations continue to expand. Those that do not may find themselves facing product redesigns, compliance costs, commercial disputes and increased oversight after systems are already in use.
This is no longer just a debate about AI innovation. It is becoming a question of how organisations manage content rights, accountability and risk as AI becomes embedded in everyday products and services.
What Happens Next
Google is testing new publisher controls while implementing the CMA’s requirements, which are designed to address both current and future developments in its search products.
The immediate focus will be whether publishers make use of the new opt-out mechanisms and whether those controls give them meaningful influence over how their content is used within AI-powered services. Regulators will also be watching closely to see whether the changes improve transparency and attribution without undermining the functionality of AI search features.
Beyond Google, the decision is likely to be studied by policymakers, publishers and technology companies in other jurisdictions facing similar questions about AI-generated content and platform accountability.
For businesses, the practical lesson is not to wait for new regulations before reviewing content governance practices. Organisations that understand where third-party content is used, how permissions are managed and who is responsible for oversight will be better prepared if similar requirements emerge elsewhere.