Who can switch the service off: Microsoft shareholders and the single-supplier direct award

If you have closed a direct award justified by the absence of competition for technical reasons, you have already put the awkward part on the record: there is no second supplier to call. For as long as the service holds up, that sentence is a procurement formality. It becomes a problem the day the decision to continue is not yours. On 9 September 2026, at the SEC, fifty-six shareholders asked Microsoft to measure how well its controls work over the use customers make of its cloud and artificial intelligence.

The document filed on 9 September

The form is a PX14A6G, a Notice of Exempt Solicitation: it is filed when someone campaigns on a shareholder proposal without soliciting proxies, under Rule 14a-6(g). Registrant: Microsoft Corporation; filer: Investor Advocates for Social Justice.

The proposal was re-filed on 1 July 2026 by lead proponents Religious of the Sacred Heart of Mary Charitable Trust and the Sisters of the Sacred Heart of Mary with another 54 co-filers: fifty-six shareholders holding more than 300 million dollars in Microsoft stock, against 59 the year before. It asks for a report on the effectiveness of the company’s human rights due diligence “in preventing, identifying, and addressing customer misuse of Microsoft artificial intelligence” and of its cloud products and services.

The precedent sits in a company filing: in the Form 8-K of 8 December 2025 Microsoft records its 5 December annual meeting and the item “Shareholder Proposal: Report on Human Rights Due Diligence”, not approved, with 26.34% in favour — 1,336,945,255 shares out of 6,321,402,487 voted. A quarter of the voting capital is asking for that control. The filing is a fact; the arguments it contains belong to the proponents.

What Microsoft says

The company’s position is set out in its own document of 4 June 2026, “Summary of 2025 External Investigation and Follow Up”. The investigation entrusted to Covington & Burling found evidence supporting elements of the journalistic account — including consumption of Azure storage in the Netherlands by the Israeli Ministry of Defence — and neither Microsoft nor its advisers accessed customer content: the work was done on the company’s own business data. The document confirms the decision, communicated on 25 September 2025, to “cease and disable specified IMOD subscriptions and services”.

Two passages matter more than the case itself. The first: the customer was given “an opportunity to provide further information showing that their use of the disabled services was consistent with our terms of service”. The right of reply was exercised, but because it was granted. The second, reported by third parties inside the document itself: “IMOD apparently planned to transfer the data at issue to a competing cloud platform”. That is the only answer available to a shut-off: go elsewhere.

Microsoft then lists five areas of work — among them pre-contract review of national security-related engagements — and states the purpose: “predictability for our customers”. It is the company writing that predictability is what is at stake for the buyer. The contractual perimeter already exists: the Acceptable Use Policy and the Enterprise AI Services Code of Conduct require human oversight and access controls. We reconstructed the facts in March.

The Italian piece: “dal solo operatore economico”

On 5 August 2026 the European official journal (S 149/2026) published TED notice 541133-2026. Buyer: ATS della Città Metropolitana di Milano, the Milan metropolitan health authority, a body governed by public law. Subject: twelve months of “MICROSOFT UNIFIED ENTERPRISE SUPPORT” technical support. Procedure: negotiated without prior publication, under article 76(2)(b) of legislative decree 36/2023. Standard justification: absence of competition for technical reasons. And in plain words: “tale servizio può essere garantito dal solo operatore economico Microsoft S.r.l. […] perché non risultano esistere sul mercato operatori partner Microsoft autorizzati” (that service can be provided only by the economic operator Microsoft S.r.l. […] because no authorised Microsoft partner operators appear to exist on the market).

The notice is voluntary and doubles as a market survey: the buyer deliberately opens itself to challenge, which is what the rule wants. Directive 2014/24/EU, the legal basis cited in the notice, sets the limit in article 32(2)(b): “The exceptions set out in points (ii) and (iii) shall only apply when no reasonable alternative or substitute exists and the absence of competition is not the result of an artificial narrowing down of the parameters of the procurement”.

This is not an isolated case: between 8 and 18 September 2026 TED recorded twenty-three Italian notices of the same kind. But the act certifies the absence of alternatives; it does not create one. The very sentence that makes the award lawful describes, word for word, your continuity risk.

Three lines to put in before you sign

Suspension. Who may suspend which service, for which uses, with what notice, and what right of reply is guaranteed to you in writing — not granted afterwards.

Exit. For financial entities this is already an obligation: regulation (EU) 2022/2554 (DORA), article 28(8), provides that “for ICT services supporting critical or important functions, financial entities shall put in place exit strategies”, and article 30(3)(f) requires a mandatory transition period in the contract so that migration is possible. For NIS2 entities, article 24 of legislative decree 138/2024 covers supply chain security. Everyone else should still write the plan: an audit has already asked for one elsewhere.

Proof of use. If the criterion by which you are judged is the use you make of the technology, you must be able to document it: recorded human oversight, access controls, declared purposes. That is what the acceptable use policy already asks, and almost nobody treats it as an evidentiary duty.

Why a closed system

The data cannot leave: when a third party checks how you use a service, it relies — the company says so — on its own commercial data and on press reporting, because it does not access your content; you are assessed on circumstantial evidence. Continuity here has a precise shape, the disabling of specific subscriptions, and a single answer, migration: which is not available to a buyer that has declared in a public act that it has no alternatives. You must be able to say what is inside: without the model and the weights inside your own perimeter, the human oversight the policy requires remains a statement. Volume and cost: support renews every twelve months at the price of the one operator you named yourself. The value stays inside: data schemas, procedures and models tuned on your own corpus are years of work, and should not live where somebody else can disable them. The right way round is the opposite: processing stays inside the perimeter, on open-weight models running on machines we staff.

The two axes, applied to this case

Complying. The control we put into service is a living register of critical services: which suspension clause governs each one, what transition period is agreed, which exit plan has been tested and when — with the dated trail to show an inspector, in the terms of article 28 of DORA and article 24 of legislative decree 138/2024.

Deciding. The same architecture holds contracts, procurement acts, application inventories and access logs together in a single operating model, on which AI agents carry out decisions with a human operator in command — for large enterprises, public administration, healthcare and defence. On-premise, or in a dedicated cloud with data centres in Italy staffed by us, always under shared management.

Could you say, for the three services you depend on most, who can suspend them and how long it would take you to restart elsewhere? Half an hour with one of our engineers is enough to begin.

What we do not know

We do not know how Microsoft’s 2026 annual meeting will vote, nor when it will be convened: the proxy statement has not been filed and the board’s position is not public. We do not know what the contracts contain: the TED notice gives the subject, the procedure and the justification, not the text. The assessments of the company’s internal reviews belong to the proponents, not to an authority. The count of notices holds for that window and above the European thresholds.