Vendor lock-in
In shortLock-in is not a property of a product. It is a number: what leaving would cost you.
At a glance
- Unit of measure
- Switching cost in working hours, not in euros of licence fee
- Four layers
- Data format, processes, in-house knowledge, contract
- Most common error
- Believing open source alone prevents lock-in — it solves format, not processes and knowledge
- Most expensive layer
- Processes and knowledge; they appear on no invoice and surface only when you try to leave
- Legal lever
- EU Data Act, Chapter VI: limited switching charges, capped notice periods, a duty on the provider to assist
- When to measure
- Once a year for the three to five most important systems — before the next price round, not after
Lock-in is usually described as a property of a product: this format is proprietary, that provider ties its customers in. A different view is more useful. Lock-in is a number — what a switch would cost you if you had to start tomorrow.
Almost nobody knows that number. The provider usually knows it better than the customer, and that is exactly what its negotiating position rests on at the next price round.
The four layers
Format. Is your data in a documented, machine-readable form, and does an export include attachments, relations and history? This layer can be checked by exporting once and opening the file.
Processes. Workflows built on the product's quirks — approvals, automations, templates, interfaces. They are rarely documented and appear in a migration project as surprises.
Knowledge. Training, certifications, a service partner who knows precisely this one product. This layer produces resistance that has no technical basis and works anyway.
Contract. Term, notice period, exit charges, no obligation to hand data back. The only layer you can settle before signing — and the only one where the law now helps you.
What the Data Act changed
Since September 2025, Chapter VI of the EU Data Act applies to data processing services: switching charges may only cover costs actually incurred and disappear entirely from January 2027, notice periods are capped, and providers must assist with a switch rather than wait it out.
That has made the contractual layer considerably weaker. The other three layers the law left untouched — and in practice they account for the larger share of the cost.
How to establish the number
Take the system you have had longest. Estimate four items: data migration including verification, rebuilding automations, training, parallel running. Verify at least one item against a small part of the system rather than estimating everything.
The result is your negotiating position, and it is the starting point of every Exit strategy. Anyone who calculates it only after a price announcement calculates under pressure — and then regularly decides against switching, regardless of whether the alternative is better.
The most common error in thinking
Trying to avoid lock-in entirely. Every decision creates dependence; that is the price of a tool that fits the company. The question is not whether dependence arises, but whether it is known, quantified and proportionate to the benefit.
Common questions
- Is open source automatically free of lock-in?
- No. Open source solves the format question and secures continued operation, but processes, extensions and in-house knowledge bind just as much. A heavily customised open application can be more expensive to leave than a subscription product with a clean export.
- How do I calculate switching cost?
- In four items: data migration including verification, rebuilding automations, training, and parallel running. Estimate each and verify at least one against a small part of the system. That makes the number solid enough to negotiate with.
- What helps before the contract is signed?
- Three sentences in the contract: a documented export you can trigger yourself at any time, including attachments and relations; a fixed deadline for handover after termination; and a duty to announce changes of sub-processors.
- And if the contract has been running for years?
- Then set up your own recurring export — the only step that works without the provider. Everything else belongs in the next renewal, together with a reference to the Data Act.