What your cloud provider knows about your dependency

One figure deserves far wider circulation than it gets.

Fewer than 1% of customers switch cloud provider each year. This is not a consultancy estimate. It is the finding of the UK competition authority, the Competition and Markets Authority, at the end of a twenty-two month market investigation closed on 31 July 2025.

In other words, out of a hundred organisations that are contractually free to leave, fewer than one does.

There are two ways to read that. Either customers are satisfied. Or they cannot leave. The CMA came down on one side: it identified commercial, technical and contractual barriers, and recommended opening investigations into Microsoft and Amazon.

What we are actually talking about

A word first on the cloud itself, because we use it without always defining it.

Your software and your data used to live on machines you owned, in a room you held the key to. With the cloud, they live on another company's machines, in data centres spread around the world, and you pay a subscription to reach them over the internet. You no longer buy hardware, you rent capacity.

The benefit is real. You scale up on a busy day without buying anything, scale down the next, and someone else handles the failures. So is the trade-off: part of your business runs on someone else's premises.

The word dependency covers everything, so let us be precise.

You are dependent when leaving costs more than staying, even once staying has become the worse option. Satisfaction does not come into it. Everything turns on the exit price.

That price has three components.

What you pay to get your data back. These are called egress fees. You pay to move information that belongs to you out of your provider's systems. The more you store, the more it costs.

What has to be rebuilt. Your teams have learned tools specific to one provider. Your applications use its interfaces. At a competitor, you rewrite, retest, retrain. The CMA notes that skills transfer poorly from one provider to another.

What you do not see. Software licences whose price changes depending on where you run them. The CMA found that Microsoft's licensing terms make Windows Server, SQL Server and its office suite more expensive to run on Amazon and Google.

Concentration gives the order of magnitude. In the second quarter of 2026, Amazon held 28% of the global cloud infrastructure services market, Microsoft 20% and Google 15%, according to Synergy Research Group. In Europe, the three together held 70% of the market in 2024, while European providers accounted for 15%, down from 29% in 2017.

What changes on 12 January 2027

The European Data Act has applied since 12 September 2025. Its Chapter VI deals specifically with switching provider.

It sets a date. From 12 January 2027, a provider of data processing services may not impose any switching charge on a departing customer. Until then, it may charge reduced fees, capped at the costs it actually bears for the switch.

The text goes further than price alone.

Two points that matter. Standard service fees and early termination penalties remain lawful, they are not covered by the ban. And the law only removes the commercial obstacle. It does not rewrite your applications.

The Swiss gap

Here precision matters, because this is the point many boards miss.

The Data Act applies to providers of data processing services regardless of where they are established, as soon as they serve customers in the Union. The test is the customer, not the provider's headquarters.

A Swiss company serving customers in the Union therefore falls within scope, as a provider. But a Swiss company buying cloud for its own Swiss workloads is not a customer in the Union. It gets neither the capped notice period, nor the transition period, nor the removal of egress fees.

And there is no Swiss equivalent. The Federal Council adopted a report on Switzerland's digital sovereignty on 26 November 2025, announcing an interdepartmental working group, promotion of open source and trusted infrastructure. It does not announce market regulation.

The only binding lever is sectoral. FINMA requires banks and insurers, through its 2018/3 circular on outsourcing, to carry out risk analysis, secure audit rights and hold an exit strategy. Its 2023/1 circular on operational risks and resilience, in force since 1 January 2024, strengthens those requirements and places responsibility at board level. If you are neither a bank nor an insurer, your only protection is your contract.

The Confederation is learning this itself. In June 2021 it awarded public cloud framework contracts to Amazon, IBM, Microsoft, Oracle and Alibaba, worth 110 million francs, running to the end of August 2026. The Swiss Government Cloud, with a commitment credit of 246.9 million for a programme totalling 319.4 million, only plans migration of existing applications from 2027. In the meantime, the framework contracts have been extended to 2031. An appeal lodged against that extension in October 2025 was withdrawn at the end of November. And the Swiss Federal Audit Office, in a report dated 8 December 2025, considers that the economic value of the programme for the Confederation as a whole has not yet been demonstrated.

A state that decides to take back control needs seven years. That is a useful order of magnitude to hold in mind before calling a dependency reversible.

What the provider knows and you do not

Here is the reversal I want to put on the table.

Your provider knows your dependency better than you do. It sees your volumes, your peaks, the services you use, your growth rate, the share of your business running through its proprietary interfaces. It has a fair idea of what leaving would cost you.

Most organisations do not have that figure. They know their monthly bill. They do not know their exit price.

That asymmetry is the real subject. It is not fixed by suspicion, it is fixed by internal work, the kind of economic intelligence you turn on yourself: knowing what a third party knows about you.

Two recent facts show the question is not theoretical.

On 18 November 2025, the European Supervisory Authorities designated nineteen critical third-party ICT service providers placed under direct oversight under the DORA regulation. Amazon, Microsoft, Google, IBM, Oracle, SAP and Deutsche Telekom are among them. One of the criteria applied is the substitutability of the provider.

And at a hearing before a French Senate inquiry committee on 10 June 2025, the head of public and legal affairs at Microsoft France stated under oath that he could not guarantee French citizens' data would never be transmitted to US authorities without explicit French authorisation. The public sector technical director specified that since January 2025, European customer data contractually no longer leaves the Union. Both statements are accurate. They simply say that the contractual commitment and the legal constraint do not fully overlap.

Five clauses to check in the contract you already have

No need to open a project here. Half a day of careful reading is enough.

The notice period. How long between your decision to leave and the switch actually starting? If the contract does not say, the provider will.

Migration assistance. Is it owed, or billed separately? On a system of any size the difference runs into hundreds of thousands of francs.

The retention period after termination. How many days to retrieve your data, and in what format? An export in a proprietary format is not retrieval.

Access to logs. The European AI Act will require the deployer of a high-risk system to keep automatically generated logs for at least six months, for those under its control. Those obligations were pushed back to 2 December 2027 by Regulation 2026/1744, in force since 27 July 2026. In a cloud deployment those logs usually sit with the provider. If your contract runs to 2029 and does not provide access, the obligation will be impossible to meet on the day it applies.

The register of formats. Does the provider maintain an up-to-date list of data structures and export formats? The Data Act requires it for customers in the Union. Nothing stops you requiring it by contract in Switzerland.

Three decisions that are already yours

Have your exit price costed. An estimate to within three months is enough. Until it exists, your committee is deciding without knowing the order of magnitude of what it is committing to.

Decide where dependency is acceptable. Nobody controls their entire technical chain, and that is not the goal. The useful exercise is to write down where dependency remains bearable and where it stops being so: your clients' data, the continuity of your production, your ability to change without rebuilding everything.

Write the clauses into the next renegotiation. That is the only moment you have leverage. Renewal deadlines are prepared six months ahead, not six weeks.

A deadline that will pass unnoticed

12 January 2027 is a public date, known, dated, and it creates no apparent urgency. It will pass. Many organisations will then discover that a right existed and that they never used it, for want of measuring what was in it for them.

One question remains, and it is rarely asked. Who, in your organisation, knows the exit price of your main cloud contract?

If nobody can answer, the subject is not waiting for technical skill. It is waiting to be recognised as a decision.

Sources

• Competition and Markets Authority, cloud services market investigation, final decision of 31 July 2025 (share of customers switching, UK market shares, barriers identified, licensing practices)
• Competition and Markets Authority, decision of 31 March 2026 not to open strategic market status investigations and to accept voluntary commitments from Amazon and Microsoft, with a six-month review
• Competition and Markets Authority, opening on 14 May 2026 of an investigation into Microsoft's enterprise software ecosystem, decision expected by February 2027
• Regulation (EU) 2023/2854 on data, Chapter VI, Articles 23, 25, 26, 29, 30, 31 and 32, and Article 50 for the application timetable
• Regulation (EU) 2024/1689 on artificial intelligence, Article 26 on deployer obligations, including log retention, and Regulation (EU) 2026/1744 of 24 July 2026 postponing to 2 December 2027 the obligations applying to Annex III high-risk systems
• Synergy Research Group, releases of 30 July 2026 (global market shares, second quarter 2026) and 24 July 2025 (European market shares)
• European Supervisory Authorities, designation of the first nineteen critical third-party providers under the DORA regulation, 18 November 2025
• Federal Council, report on Switzerland's digital sovereignty, 26 November 2025
• Federal Council, dispatch on the Swiss Government Cloud, May 2024, and Swiss Federal Audit Office report of 8 December 2025
• Federal Chancellery, public cloud framework contracts awarded in June 2021 and extension announced in September 2025
• FINMA, circular 2018/3 on outsourcing and circular 2023/1 on operational risks and resilience
• French Senate, inquiry committee, hearing of Microsoft France representatives, 10 June 2025