All articles

Journal

The exit plan nobody writes

EU law bans cloud exit fees from January 2027. It says nothing about your service provider, your repositories, your secrets or your domain name. Here is what an exit plan contains when you actually want to be able to leave.

Date
Reading
9 min read
Topics
reversibilitymanaged-servicessovereigntycontracts

In January 2026, Broadcom unilaterally closed the partner programme through which thousands of resellers distributed VMware, then restricted end customers' right to bring their own licences. The European providers who had built their virtualisation offering on it had, at that moment, nowhere to go: the software is "technically complex to replace", with switching "disruptive to the business, and time-consuming". The phrase is attributed to the European Commission by the ECCO observatory, which quotes it in its fourth report of September 2026.

A word on who measures what, because it changes how you read the rest. ECCO brings together CISPE members — the association of European cloud infrastructure providers, meaning Broadcom's licensees and competitors — with user organisations, Cigref among them, as observers. It has filed a competition complaint against Broadcom with the Commission and is calling for interim measures. Its figures are self-reported and produced by an interested party. Under that caveat: its members report renewal increases of "ten times or more" against pre-acquisition VMware pricing, and a further 15% rise for those readmitted into the successor partner programme.

The most-quoted figure, for its part, was never adjudicated. AT&T put the rise in its support bill at roughly 1,050% in the complaint it filed on 29 August 2024; after the court signalled it would grant the injunction sought, the parties settled in December 2024 on undisclosed terms. That is an allegation, not a ruling. On the Commission's side, a request for information went to Broadcom and VMware on 26 February 2026 and the complaint is under assessment: as of 27 October 2026, no formal proceedings have been opened and no statement of objections has been issued. This is the paragraph in this article that can change from one week to the next.

None of those companies had made a technical mistake. VMware was an excellent product. They had simply built ten years of operations on a component whose exit cost had grown larger than any price increase, and the vendor knew it better than they did.

Reversibility is the ability to leave. Everyone mentions it in tenders; almost nobody tests it. This article describes what a working exit plan contains, and why recent law does not excuse you from writing it.

What the law has done for you

Credit where due: in two years the framework has moved a lot, and in the right direction.

The EU Data Act has applied to cloud services since 12 September 2025. Its Article 50 provides no transitional arrangement for this chapter, so contracts signed before that date are covered too. Article 25 requires in every contract a switching notice period of at most two months, a transitional period of thirty calendar days — extendable up to seven months where the provider invokes technical unfeasibility, with reasons, within fourteen working days — a data retrieval window of at least thirty calendar days after transition, and an exhaustive list of the categories of exportable data and digital assets. Article 29 caps exit charges at the costs actually incurred until 12 January 2027, and bans them thereafter. Article 30 requires functional equivalence for IaaS and open interfaces for everything else.

Two limits to read before celebrating. The ban covers switching charges: it touches neither the ordinary price of the service consumed during the transition, nor early termination penalties on a fixed-term commitment, which remain lawful. A three-year contract left after one year is still paid for.

In France, the SREN law of 21 May 2024 had moved first: transfer fees limited to cost, cloud credits capped at one year, an interoperability obligation. On 25 September 2025 Arcep adopted a recommendation on interoperability and portability — a harmonised information grid, APIs described in OpenAPI, twelve months' notice before an update that breaks backward compatibility — then, on 2 July 2026, guidelines setting out which costs a provider may still charge before January 2027. And the amount is now settled: the order of 17 November 2025, made under Article 27 of the SREN law and published in the Journal officiel on 30 November, sets the maximum charge for data transfer fees on switching at zero euros. It has applied since 1 December 2025 and runs until 12 January 2027, when the Data Act prohibition takes over. France thus moved thirteen months ahead of the European ban.

This framework is solid. It has a blind spot: it regulates the cloud provider. Not your development contractor, not your managed-services provider, not the agency that has held the registrar account since 2017. And that, in our experience, is where most of the exit cost sits.

What the law has asked for all along, and nobody does

ANSSI's IT hygiene guide devotes its rule 3 to controlling the risks of outsourced operations. It calls for "a list of precise requirements to be imposed on the provider: contract reversibility, the performance of audits, backup and return of data in a standardised open format, keeping the security level up to date over time", commitments to be formalised in a security assurance plan set out in the tender.

The SecNumCloud 3.2 standard is more precise still. Its requirement 19.1 h) mandates a reversibility clause letting the customer retrieve all of their data, including data the service produced from theirs. Point i) requires the technical arrangements to be written into the service agreement: files in formats "documented and usable outside the service", or interfaces "following a documented and usable schema". And requirement 19.4 a) closes the loop, with secure erasure of all customer data at the end of the contract, on twenty-one calendar days' formal notice.

One change shifts the balance of power: since the order of 12 August 2026, published in the Journal officiel on the 14th and in force the following day, that standard is no longer merely a voluntary qualification. The French state, its agencies and certain public interest groupings must entrust their most sensitive data to an ANSSI-qualified service, and the service agreement must carry the mandatory clauses the text lists, reversibility first among them. If you sell to the public sector within that perimeter, the clause has stopped being negotiable. For every other buyer it remains what it was: good practice nobody imposes.

Those sentences appear in most contracts we read. What is missing is the annex that says concretely what, and the appointment at which someone checks that it works.

The plan, item by item

Here are the eight items we check when asked to audit a system's reversibility. The order is the order of pain observed.

1. Repository ownership. Is the code in an organisation the client owns, or in the provider's, with the client as a guest? The difference is invisible day to day; it shows on the day of the break-up. Code must live with the client from the first commit, the provider being a contributor.

2. Infrastructure as code, in the client's account. A cluster created by hand from the provider's account is not reversible; it is rebuildable, which is neither the same thing nor the same price. Terraform, Helm, manifests: versioned, in the client's repository, applied to their cloud account.

3. Secrets. API keys, certificates, database passwords, CI tokens. Who holds them, where, and can the client rotate them alone? A secret only the provider knows is an unwritten dependency clause.

4. The domain name and DNS. The most often forgotten and the most expensive item: the domain registered in the agency's name, the DNS zone at a third party whose login nobody has. The domain registrant must be the client, full stop.

5. The CI/CD chain. Are the pipelines in the repository, or in a tool of the provider's? Whose runners do they run on?

6. The data, in an open format, with the export tested. A backup that has never been restored is not a backup; an export that has never been re-imported elsewhere is not reversibility. Tested means: re-imported into a clean instance, by someone else, on a date you can name. The format must be documented and readable without the original software: SQL, CSV, JSON, not a proprietary dump.

7. Operations documentation. How to deploy, how to restore, where the alerts are, what to do at 3 a.m. Written for someone who has never seen the system.

8. The access list, and the revocation procedure. Who has access to what, and how everything is revoked within an hour.

The annual drill

An exit plan that is never tested is worth a backup that is never restored. Our recommendation, and we apply it to our own engagements: once a year, half a day in which someone who is not the provider tries to rebuild a complete environment from the repositories, the secrets and the documentation, without asking them a single question. Whatever blocks is the real exit cost. Note it, fix it, repeat next year. On a containerised platform the drill starts with the provider's add-ons, which are what actually ties a cluster down.

We write this as a provider, and we sell reversibility audits, which is a reason to read the above with suspicion. We also know what it implies: every item above is a place where we could make a client captive, and where we choose not to. That choice is not altruism. A client who can leave and stays is a reference; a client who cannot leave is a dispute waiting to happen.

One thing an exit plan does not give you. It lowers the cost of leaving; it does not create the place to go. VMware's customers were not short of reversibility clauses, they were short of an equivalent product within migration reach — and the Commission, in the sentence quoted at the top, says exactly that. So the question to put to a supplier is not only "how do I leave?", but "who, today, does what you do?". If the answer is nobody, the exit plan is a damage-limitation document, and it should be budgeted as one.

Sources

Ready to take your technology back?

Tell us where you are stuck. A real person reads every message and answers within 48 working hours, with a concrete first step.

Talk to us