Vendor lock-in means you can no longer switch provider without it becoming expensive, slow or risky. Nobody chooses it on purpose. The dependency grows with every interface, every export format and every "we'll sort that out later".
In the Bitkom Cloud Report 2026, 59 per cent of the companies surveyed name lock-in effects as a barrier to switching provider. With AI, the topic is only just arriving: many companies are choosing their AI vendor right now. So the best time to think about the exit is before you get in.
- Vendor lock-in means you can no longer switch provider without major effort, because your data, interfaces, know-how or contracts depend on it.
- Since September 2025 the EU Data Act has given cloud customers rights when switching, and from 12 January 2027 providers may no longer charge switching fees for it.
- What helps most, though, is an exit test before you sign: request the export, time it, check the content, count the gaps.
What is vendor lock-in?
People speak of vendor lock-in when switching costs so much that it is practically off the table. The cost is rarely just money. It's weeks of migration, systems that need changing and know-how that has to be rebuilt.
The risk is lopsided. Getting in is planned, budgeted and celebrated. Getting out often happens unplanned, under time pressure and with whoever is left. If you only check what a switch costs at that point, you negotiate the renewal with no leverage.
In shortLock-in builds up quietly; the exit is rarely planned.
The four kinds of lock-in
"Can we export our data?" is a weak question, because it tests only one of four dependencies. Each needs its own answer:
- Data. Your content sits in a format no other system reads, or the export leaves out the parts that matter. Often the easiest to solve.
- Integrations. Ten internal systems call the vendor's interface. Each connection is small; together they are the migration. Usually the biggest hidden cost.
- Know-how. Your team knows the system: processes, conventions, workarounds for known quirks. None of it is in any inventory.
- Contract. Long terms, discounts in exchange for commitment, notice windows once a year. Not technical, but often the tightest limit.
Most companies have never put a figure on these four items. That's why many experience lock-in as an insurmountable barrier rather than a calculable effort. It's often smaller than feared, sometimes much bigger. Either way, you want to know before you sign.
In shortData, integrations, know-how, contract, each dependency needs its own answer.
Lock-in in AI: what really counts
With AI that works on your documents, some parts are easy to replace. The search index with its embeddings is built from your documents and can be recalculated. Migrating it is rarely worth it. The language model can be swapped too, if the platform allows different models.
Four other things matter:
- The source documents and their connection to the repositories they come from.
- The permission model, meaning who may see which content.
- The history: conversations, feedback and the audit log you need as evidence.
- What only exists in the tool: assistants, instructions, templates, curated answers.
A vendor who offers to export the index but not the audit log has answered the easy question. Ask specifically about these four points.
In shortIndex and model are replaceable; documents, permissions, history and curated content count.
What the EU Data Act sets for cloud switching
Chapter VI of the EU Data Act has applied since 12 September 2025. It gives customers of cloud services rights when switching to another provider or to their own servers. The graphic above shows the process.
The key rules from Article 25 and Article 29:
- Notice period: at most two months until the switch starts.
- Transition: at most 30 days, in exceptional cases up to seven months; the service keeps running meanwhile.
- Data retrieval: then at least 30 days to collect the data, followed by full deletion.
- Switching charges: until 11 January 2027 only reduced and capped at cost; from 12 January 2027 none at all.
The contract must also list which data can be exported. That helps with data. Against lock-in through integrations, know-how and contract terms, the law helps only to a limited extent. Chapter VI doesn't apply to software you run on your own servers; there, the export is your own responsibility.
In shortTwo months' notice, 30 days' transition, no switching charges from 2027, for cloud services.
The exit test: one afternoon
The most revealing test in a vendor selection takes one afternoon. Do it during the trial, while you can still negotiate:
- Request the exportthrough the documented route; a support ticket is already a finding
- Time itwith your real data volume, not the demo set
- Open the contentnot just the file list: can another system read it?
- Count the gapspermissions, versions, comments, audit log, metadata
- Clarify the afterhow long the vendor keeps data and how it proves deletion
Then write down four numbers: how long the export took, what share of the content arrived complete, how many internal systems would need changing and how many person-days the migration costs, with a name next to it. Those four numbers are your real switching cost.
In shortRequest the export, time it, open the content, count the gaps, clarify deletion.
Questions for your AI vendor, including us
Ask every vendor these questions before you sign:
- In what format do we export documents, permissions, history and audit log, and has anyone on our side tested it?
- How long would a full switch take, in days?
- Can we change the language model without changing the platform?
- What happens if the vendor changes its terms or is acquired?
- Could we run the same software on our own servers?
With RAGSuite, RAGSuite Engine and the self-hosted version are the same platform. The core is available as the Community Edition under the Apache 2.0 open-source licence, you choose the language model per project, and in Enterprise you export the full audit log. To stay honest: your own servers don't solve every lock-in. Integrations and know-how remain. But you decide for yourself when to switch.
An open standard helps with AI tools too: with the Model Context Protocol (MCP) they are not tied to one vendor. RAGSuite has an MCP server and an MCP client in the Community Edition.
This is general information, not legal advice. Have your legal team review contracts.
In shortAsk every vendor about the exit, us included.
Check your dependencies with the free data sovereignty check, or go through the exit test with Jürgen.
Frequently asked questions
What does vendor lock-in mean?
Vendor lock-in describes a dependency on a provider that makes switching expensive, slow or risky. It builds up through data formats, interfaces to other systems, the team's know-how and contract terms. In the Bitkom Cloud Report 2026, 59 per cent of companies name lock-in effects as a barrier to switching provider.
What does the EU Data Act set for switching cloud provider?
Since September 2025, rules include a notice period of at most two months, a transition of at most 30 days and at least 30 days to retrieve data. Switching charges are only allowed in reduced form until 11 January 2027 and not at all from 12 January 2027. The contract must list exportable data.
How do you avoid vendor lock-in with AI?
Test the exit before you sign: request the export, time it, open the content and count what's missing. Look for open formats, a replaceable language model and short contract terms. The most freedom comes from a platform you can also run on your own servers if needed.
Which data should you be able to export from an AI vendor?
What matters are the source documents, the permission model, the history with feedback and audit log, and anything that only exists in the tool, such as assistants and instructions. The search index with its embeddings can be recalculated from the documents and usually doesn't need migrating.
Does self-hosting protect against vendor lock-in?
Partly. On your own servers the data is already with you, and nobody can switch the service off. Dependencies through data formats, integrations and your team's know-how remain, though. The difference: you decide yourself when and how fast to switch, without a vendor's deadlines setting the pace.
Sources
- Bitkom: Cloud Report 2026, Studienbericht: lock-in, switching, method
- Bitkom: Presseinformation Cloud Report 2026 (17.06.2026): overview
- EU Data Act, Reg. (EU) 2023/2854: Kapitel VI, Art. 23–31
- Data Act Art. 25 (dejure.org): switching deadlines
- Data Act Art. 29 (dejure.org): switching charges
Jürgen advises companies on introducing AI on their own infrastructure and leads RAGSuite at NITSAN. He writes about sovereignty, strategy and costs.