The EU Data Act has applied for a year. Almost nobody uses it.

Over the past months we have talked to a couple of dozen companies about their cloud contracts. In not one of those conversations did the Data Act come up from the other side of the table. Not even where it would have saved money immediately.

That is remarkable, because it is the most effective instrument European companies have ever been handed on this subject — and because it has applied since 12 September 2025.

What is actually in force

Chapter VI of the regulation governs switching between data processing services. Four points from it are usable straight away.

One: exit fees. Providers may charge only the costs actually incurred for a switch, and from 12 January 2027 nothing at all. The data egress charges that used to push an export into five figures are finished.

Two: deadlines. The notice period may not exceed two months. The transition itself gets 30 days, extendable where the switch genuinely cannot go faster.

Three: functional equivalence. For infrastructure services the provider must actively ensure the service runs substantially the same at the new provider. For higher-level services the duty softens to open interfaces and documentation — but even that is more than most contracts offered before.

Four: Article 32. Providers must take all reasonable measures to prevent data held in the EU being handed to third-country authorities where no international agreement supports it. That is the first affirmative European answer to the CLOUD Act, and it sits in a regulation nobody reads as a data protection law.

Why nobody uses it anyway

For a simple reason: rights you are not reminded of do not get exercised. No provider writes to tell you they now have to make leaving easier.

There is also a structural inertia. The Data Act lowers the cost of switching. It does not lower the cost of deciding, and at most companies that is the actual bottleneck. If you have never defined a trigger that would make you switch, you will not switch — even once it got cheaper.

What you can do this week

None of this is a project. It is three emails.

Ask your cloud provider in writing about its switching procedure under Article 25: which data is exported, in what format, within what period, and at what cost. The answer is either usable or it is a finding.

Second, ask about its Article 32 measures. What does the provider concretely do when an order arrives from a third country? Here too, the quality of the answer is the information.

Third, pull a full export from exactly one system. Not because you intend to leave, but because afterwards you will know what actually comes out. That is the difference between an exit clause and an exit capability.

The side effect

We did this with two clients. In both cases the export was incomplete — once the permissions were missing, once the version history. In both cases it became an argument in the next renewal conversation that had not existed before.

The Data Act lowered the price of leaving. Whether you leave is a separate question. That you could changes the negotiation immediately.