Vendor lock-in: the five forms nobody invoices

Since January 11, 2024, Google Cloud has offered free outbound data transfer to customers migrating elsewhere; AWS followed on March 5, 2024, explicitly citing the EU Data Act. That same Data Act, applicable since September 12, 2025, caps switching charges at the provider's direct costs, before banning them on January 12, 2027. The invoiced cost of leaving is heading to zero — sometimes as credits granted on request, within a 90-day migration window: a process rather than a button, but heading to zero.

And yet, the UK Competition and Markets Authority (CMA) found on July 31, 2025 that fewer than 1% of cloud customers switch providers each year. If leaving costs almost nothing and almost nobody leaves, the lock is not on the invoice: it sits in the five dependencies above, which no contract stipulates. This thesis is falsifiable — the grid at the end lets you test it on your own systems.

European law has dismantled the contractual lock: a maximum two-month termination notice, a 30-day transition, then at least 30 days to retrieve your data (Data Act, art. 25). In France, the SREN law of May 21, 2024 limits free cloud credits to one year and caps transfer fees, under ARCEP supervision. Yet each text carries its own limit.

The pattern is constant: the law covers what is contractual and measurable — data, fees, timelines — and stops where the provider's intellectual property begins. Self-regulation had not done better: the SWIPO codes of conduct (December 2019) were found to have "a number of significant shortcomings" by an assessment commissioned by the European Commission in February 2022. The binding regulation followed.

These dependencies appear neither in the contract nor in the budget. They build up silently, precisely because the system works well.

The ISO/IEC 19941:2017 standard clarifies the first form: reading an export (syntactic portability) is not understanding what it contains (semantic portability). Data Act article 30 §6 shields conventions: the provider's intellectual property does not have to be disclosed.

The "relationship" form reveals itself at the worst moment. After Broadcom's acquisition of VMware, the CISPE association — European cloud providers, an interested party in the matter — reported on March 19, 2024 license terminations on a few weeks' notice and price increases of up to twelve times, among members deriving over 75% of their revenue from those technologies. No clause had been breached: the relationship had changed hands.

Financial regulators do not require a reversibility clause, but a capability. DORA mandates exit strategies that are "sufficiently tested and reviewed periodically" for any critical ICT service; as early as 2019, the European Banking Authority required "a documented exit strategy" for any critical outsourcing.

The counter-example proves the rule. In October 2024, 37signals (the maker of Basecamp) documented a costed cloud exit: annual bill cut from $3.2M to $1.3M, about $700,000 of hardware, more than ten million dollars of projected savings over five years — possible only because an internal team knew how to bring things back in-house. Documenting decisions and keeping that knowledge with the client is the principle at the heart of how we build.

What doing nothing costs — The legal exit standard: two months' notice, a 30-day transition, 30 days to retrieve your data (Data Act, art. 25). Discovering your dependencies at notice time means resolving them within that window, from a position of weakness.

Ten questions, two per dimension. Score 0 (no, or nobody knows), 1 (partially), 2 (yes, verified within the last twelve months). Total out of 20.

Reading the results: 16-20, you are replaceable — a position of strength in every negotiation. 10-15, address the zero-scored lines first. Below 10, your vendor probably knows your situation better than you do. Repeat the exercise every year, before renewals — the full approach is described in our method.

Being replaceable is not always desirable. On a peripheral tool, scoring replaceability costs more than it returns. Some dependencies are rational choices: the CMA did not find committed-spend discounts anticompetitive — concentrating your purchasing can be the right decision, made knowingly. And full reversibility has a cost: abstracting away every proprietary convention means giving up part of the value that justified the tool. The goal is not 20 everywhere, but knowing where you stand on the systems that carry your revenue.