Digital Infrastructure Fragility Indices

1. Introduction

Digital Infrastructure Fragility Indices are analytical frameworks used to measure how vulnerable critical digital infrastructure is to failure, disruption, concentration, cyberattack, technological dependency, interoperability breakdown, supply-chain shocks, or loss of essential inputs.

A fragility index can be applied to infrastructure such as:

• cloud-computing systems;
• telecommunications networks;
• internet exchange infrastructure;
• data centres;
• payment and financial networks;
• digital identity systems;
• undersea cables;
• semiconductor and hardware supply chains;
• artificial-intelligence compute infrastructure;
• digital public infrastructure; and
• critical software and API ecosystems.

The concept is particularly important in competition law, because infrastructure may become fragile not merely because it is technically unreliable, but because a small number of undertakings control indispensable components. A highly concentrated digital infrastructure can create a single point of failure and simultaneously create market power.

2. Meaning of Digital Infrastructure Fragility

Digital infrastructure fragility refers to the susceptibility of a digital ecosystem to systemic disruption arising from internal weaknesses or external shocks.

A system may be fragile because:

1. one company controls an essential service;
2. alternative suppliers are unavailable;
3. switching costs are extremely high;
4. interoperability is restricted;
5. data cannot easily be migrated;
6. technical standards are controlled by incumbents;
7. infrastructure components are geographically concentrated;
8. cybersecurity vulnerabilities are interconnected;
9. supply chains depend on a small number of manufacturers; or
10. access can be withdrawn through contractual or technological mechanisms.

Thus, fragility is broader than ordinary cybersecurity risk.

Basic formula

A simplified fragility index could be expressed as:

FI=C+D+S+I+R−AFI = C + D + S + I + R - A

Where:

• C = concentration risk;
• D = dependency risk;
• S = supply-chain risk;
• I = interoperability risk;
• R = recovery/resilience weakness; and
• A = availability of alternatives.

A higher score indicates greater structural fragility.

3. Main Components of a Fragility Index

A. Infrastructure concentration

The first component measures whether essential infrastructure is controlled by a small number of firms.

Relevant indicators include:

• market share;
• HHI;
• number of viable suppliers;
• infrastructure ownership;
• capacity concentration; and
• geographic concentration.

A cloud market dominated by two or three providers, for example, may have a greater systemic fragility than a market with numerous interchangeable providers.

B. Dependency concentration

Dependency measures how difficult it is for users or downstream businesses to operate without a particular infrastructure provider.

Examples include:

• dependence on a single cloud provider;
• dependence on a single payment network;
• dependence on a particular authentication provider;
• dependence on proprietary APIs;
• dependence on a particular operating system; and
• dependence on a particular AI accelerator.

The important question is not merely:

"Is the infrastructure widely used?"

but:

"Can users realistically operate without it?"

4. Switching and Portability Fragility

Digital infrastructure becomes fragile when switching is technically possible but economically or operationally unrealistic.

Indicators include:

• data-transfer costs;
• egress charges;
• migration time;
• proprietary formats;
• incompatible APIs;
• loss of functionality;
• retraining requirements;
• contractual termination barriers; and
• dependence on proprietary tools.

This creates a distinction between nominal substitutability and effective substitutability.

A competitor may technically exist, while the customer remains practically locked into the incumbent.

5. Interoperability Fragility

Interoperability is particularly important because digital infrastructure often consists of interconnected layers.

For example:

Device → operating system → identity layer → API → cloud → payment infrastructure → data storage

Failure or exclusion at one layer can propagate through the entire ecosystem.

An interoperability fragility index therefore examines:

• open standards;
• API accessibility;
• protocol compatibility;
• data portability;
• authentication compatibility;
• cross-platform functionality; and
• technical barriers to interoperability.

6. Supply-Chain Fragility

Digital infrastructure depends on complex global supply chains.

A fragility assessment can examine dependence upon:

• semiconductor manufacturers;
• GPU suppliers;
• networking equipment;
• telecommunications components;
• undersea cables;
• data-centre equipment;
• specialised software;
• energy systems; and
• rare or strategically important materials.

A market may therefore be competitive at the consumer-facing level while remaining fragile upstream.

7. Cybersecurity Fragility

Cybersecurity risk is another major component.

Indicators may include:

• common vulnerabilities;
• concentration of authentication services;
• common software dependencies;
• centralised identity systems;
• concentration of DNS infrastructure;
• shared cloud dependencies;
• ransomware exposure;
• recovery capability; and
• incident propagation potential.

The relevant competition-law issue arises where an undertaking can exploit its infrastructural position to impose restrictive conditions or exclude competing providers.

8. Geographic Fragility

Digital infrastructure may also be geographically concentrated.

Examples include:

• data centres located in one region;
• internet cables passing through a narrow corridor;
• telecommunications infrastructure concentrated in particular areas;
• cloud capacity dependent on a limited number of facilities; and
• critical network equipment supplied from a restricted geographic base.

Geographic redundancy is therefore an important component of resilience.

9. Economic Fragility

Economic fragility concerns whether infrastructure can survive changes in:

• prices;
• demand;
• financing;
• energy costs;
• regulatory requirements;
• interest rates;
• supply interruptions; and
• market exits.

A system with only one economically viable supplier may be particularly vulnerable if that supplier fails.

10. Governance Fragility

Digital infrastructure increasingly performs quasi-public functions.

Examples include:

• digital identity;
• payment infrastructure;
• public-sector cloud;
• health-data platforms;
• government authentication;
• digital taxation systems; and
• critical communications.

Governance fragility arises where the infrastructure operator obtains substantial control over access to essential social or economic functions.

This raises questions of:

• accountability;
• transparency;
• due process;
• access;
• neutrality;
• discrimination; and
• abuse of infrastructural power.

11. Competition-Law Significance

Digital Infrastructure Fragility Indices can be particularly useful in competition investigations.

Traditional competition analysis tends to focus on:

• prices;
• output;
• market shares;
• consumer welfare;
• quality; and
• innovation.

Fragility analysis adds another dimension:

How resilient is the competitive structure itself?

A highly concentrated infrastructure market can produce:

Concentration → Dependency → Lock-in → Reduced contestability → Greater exclusionary power → Systemic fragility

This makes fragility relevant to:

• abuse of dominance;
• essential facilities;
• refusal to supply;
• discriminatory access;
• interoperability restrictions;
• tying and bundling;
• self-preferencing;
• exclusionary contracts;
• mergers;
• vertical foreclosure; and
• digital-platform regulation.

12. Six Important Case Laws

1. United Brands v Commission — C-27/76

The European Court of Justice established important principles concerning dominance and dependence.

The case concerned the conduct of United Brands in relation to distributors and customers.

Relevance

The case demonstrates that dominance is not determined solely by market share. The broader question is whether an undertaking enjoys a position enabling it to behave to a significant extent independently of competitors, customers and consumers.

For a digital infrastructure fragility index, this supports examining:

• customer dependency;
• alternative suppliers;
• switching possibilities;
• network structure; and
• economic independence.

It therefore provides a conceptual foundation for measuring dependency fragility.

2. Commercial Solvents v Commission — Joined Cases 6/73 and 7/73

This case concerned refusal to supply an essential input to downstream competitors.

The Court recognised that an undertaking possessing a dominant position in an upstream market could infringe competition law by restricting supplies to downstream competitors.

Relevance to digital infrastructure

The principle is highly relevant where a dominant infrastructure provider controls an indispensable input.

Examples could include:

• cloud infrastructure;
• network access;
• authentication services;
• technical interfaces; or
• critical data infrastructure.

A fragility index could therefore measure whether control over an upstream infrastructure layer creates downstream exclusionary power.

3. Bronner v Mediaprint — C-7/97

The Court established stringent conditions for applying the essential-facilities/refusal-to-deal doctrine.

The relevant facility must, among other things, be indispensable and not realistically duplicable.

Relevance

This case is particularly important for digital infrastructure fragility.

An infrastructure index can ask:

1. Is the infrastructure indispensable?
2. Can competitors reproduce it?
3. Is duplication economically feasible?
4. Is access necessary for effective competition?
5. Does refusal eliminate effective competition?

Thus, the indispensability score can form an important part of a digital fragility assessment.

4. IMS Health v Commission — Joined Cases C-418/01 P and C-7/97

The Court dealt with access to an infrastructure protected by intellectual-property rights.

The case is important for determining when refusal to license or provide access to an indispensable resource can constitute abuse of dominance.

Relevance

Digital infrastructure frequently combines:

• intellectual property;
• data;
• software;
• proprietary protocols;
• databases; and
• technical standards.

Consequently, a fragility index can examine whether intellectual-property control creates a non-replicable infrastructure bottleneck.

5. Microsoft Corp. v Commission — T-201/04

The General Court upheld major findings concerning Microsoft's conduct involving interoperability information and tying.

The case is particularly significant for digital markets because interoperability information could be important for competing products.

Relevance to fragility indices

The case supports measuring:

• interoperability dependence;
• access to technical information;
• compatibility barriers;
• tying;
• ecosystem dependence; and
• foreclosure risks.

A digital infrastructure system becomes more fragile when competing products cannot communicate effectively with the dominant infrastructure layer.

6. Slovak Telekom v Commission — Joined Cases C-152/19 P and C-165/19 P

The Court considered access to telecommunications infrastructure and the circumstances in which a refusal or restrictive access arrangement may constitute abusive conduct.

Relevance

Telecommunications infrastructure illustrates the relationship between:

physical infrastructure + network effects + access dependency + competition

A fragility index can therefore evaluate whether downstream competitors depend upon infrastructure that cannot reasonably be replicated.

13. Additional Relevant Case Laws

Several other authorities strengthen the analysis.

Oscar Bronner principles

The case remains central to assessing whether infrastructure is genuinely indispensable rather than merely advantageous.

Google Shopping — Case T-612/17

The General Court examined Google's conduct concerning comparison-shopping services and the relationship between dominance, platform architecture and self-preferencing.

Its importance for infrastructure fragility lies in the possibility that control of a central digital gateway can distort access for competing services.

Google Android — Case T-604/18

The case concerned Google's Android ecosystem and contractual restrictions involving mobile-device manufacturers.

It illustrates how control of one digital layer can extend power into adjacent markets.

Aéroports de Paris v Commission — C-82/01 P

The case illustrates the broader principle that an undertaking operating infrastructure can also engage in economic activities and thereby be subject to competition-law constraints.

14. Fragility Index and Merger Control

The concept is particularly useful in merger analysis.

Suppose:

Cloud Provider A acquires Cloud Provider B.

Traditional analysis might consider:

• market shares;
• prices;
• efficiencies;
• innovation;
• customer benefits.

A fragility analysis additionally asks:

• Does the merger eliminate redundancy?
• Does it increase single-provider dependency?
• Does it reduce alternative infrastructure?
• Does it increase systemic failure risk?
• Does it increase control over data?
• Does it increase switching barriers?
• Does it reduce interoperability?

Therefore:

Merger Risk=Market Concentration+Infrastructure Dependency+Systemic FragilityMerger\ Risk = Market\ Concentration + Infrastructure\ Dependency + Systemic\ Fragility 

15. Fragility and Essential Facilities

The essential-facilities doctrine provides a particularly useful analytical bridge.

A digital infrastructure may become an essential facility where:

1. it is indispensable;
2. duplication is impracticable;
3. access is necessary for competition;
4. refusal substantially eliminates competition; and
5. access can technically or economically be provided.

Examples could include:

• critical telecommunications networks;
• payment infrastructure;
• identity authentication;
• cloud infrastructure;
• interoperability interfaces; and
• certain data-access infrastructures.

However, high fragility does not automatically mean an essential facility exists. The legal tests must still be satisfied.

16. Possible Digital Infrastructure Fragility Index

A competition authority could develop a 100-point model:

Illustrative interpretation

0–20: Low fragility
21–40: Moderate fragility
41–60: Significant fragility
61–80: High fragility
81–100: Systemic fragility

These thresholds would be analytical rather than automatically legal.

17. Competition vs Resilience

An important issue is that competition and resilience are related but not identical.

Competition can improve resilience by producing:

• multiple suppliers;
• alternative technologies;
• lower switching barriers;
• redundant infrastructure;
• innovation; and
• competitive pressure.

But competition can sometimes also produce duplication costs.

For example, requiring every infrastructure provider to maintain completely independent infrastructure could increase costs substantially.

Therefore regulators should seek:

contestable and redundant infrastructure without economically wasteful duplication.

18. Digital Infrastructure Fragility and Section 19a GWB

Under German competition law, Section 19a GWB provides a particularly significant framework for addressing undertakings of paramount significance across markets.

Digital infrastructure fragility can be relevant when a large digital undertaking simultaneously controls:

• platforms;
• data;
• cloud infrastructure;
• operating systems;
• advertising systems;
• identity services; and
• other digital ecosystems.

The combination can produce a structural advantage extending beyond one conventional relevant market.

A fragility assessment can therefore complement traditional dominance analysis by examining cross-market infrastructural dependency.

19. Relationship With Data Portability

Data portability can substantially reduce fragility.

Where users can easily:

• export data;
• transfer data;
• reconstruct their systems;
• move workloads; and
• connect to competing services,

dependency is reduced.

Conversely:

No portability + proprietary formats + high migration costs = high lock-in fragility.

Thus, data portability is not merely a privacy issue. It can also function as a competition and resilience mechanism.

20. Regulatory Uses

Digital Infrastructure Fragility Indices could be used by authorities for:

Ex ante regulation

Identifying infrastructure that requires:

• interoperability;
• access obligations;
• portability;
• redundancy;
• operational separation; or
• resilience requirements.

Merger review

Detecting transactions that create systemic infrastructure dependency.

Abuse-of-dominance investigations

Identifying exclusionary conduct affecting critical infrastructure.

Market investigations

Determining whether a market has become structurally dependent upon one provider.

Public procurement

Preventing governments from becoming irreversibly dependent upon a single technology supplier.

21. Key Legal Issues

The use of fragility indices raises several legal questions:

A. Can fragility itself constitute market power?

Not necessarily. Fragility is evidence relevant to market power and systemic importance, but it does not automatically establish dominance.

B. Can a low-fragility competitor defeat a dominance finding?

Potentially, if the competitor provides a genuine and economically viable alternative.

C. Can infrastructure fragility justify access obligations?

Potentially, but legal requirements such as indispensability and elimination of effective competition remain important.

D. Can fragility justify merger intervention?

Yes, where increased infrastructure concentration creates significant competitive harm or systemic dependency, subject to the applicable merger-control test.

E. Is cybersecurity relevant to competition law?

Increasingly, yes, particularly where security architecture affects quality, access, interoperability, innovation or competitive conditions.

22. Core Legal Principle

The central proposition can be stated as follows:

Digital infrastructure should not be assessed solely by asking who has the largest market share; regulators should also examine how many independent technological pathways remain available when the dominant infrastructure fails or restricts access.

This changes the focus from static market power to structural resilience and contestability.

23. Conclusion

Digital Infrastructure Fragility Indices provide a useful framework for analysing the relationship between digital concentration, dependency, resilience and competition.

The most important dimensions are:

1. infrastructure concentration;
2. dependency;
3. switching costs;
4. interoperability;
5. data portability;
6. supply-chain concentration;
7. cybersecurity;
8. geographic redundancy;
9. recovery capability; and
10. availability of alternative infrastructure.

The principles emerging from United Brands, Commercial Solvents, Bronner, IMS Health, Microsoft and Slovak Telekom demonstrate why control over indispensable infrastructure can acquire competition-law significance.