Write down how you would leave, then carry on using managed services. Those two things are not in conflict, and treating them as if they are is how businesses end up running everything on bare virtual machines to preserve a freedom they will never exercise. The useful exit plan is a one-page document that names where your data lives, how you would get it out, and which three components would need rebuilding. It takes an afternoon and it makes every procurement conversation easier.

What an exit plan is actually for
Most exit plans are written for someone else: an auditor, an insurer, a large customer’s procurement team, or a regulator in financial services. That is a perfectly good reason to have one. But the version that helps you is shorter and more honest, and it answers three questions: if this provider doubled its prices, raised a policy we could not accept, or suffered a multi-day regional outage, what would we actually do?
The answer is rarely to move everything. It is usually to move one thing, accept degraded service on another, and negotiate harder on the rest. Writing that down converts a vague anxiety into a short list of things worth preparing. It also tells you which parts of your architecture are genuinely load-bearing.
If you cannot name, from memory, the three systems that would take longest to rebuild elsewhere, you do not have an exit plan. You have a feeling about vendor lock-in.
What changed: free exits and the January 2027 deadline
Two things changed and both are in your favour. First, the vendors moved. Google Cloud announced in January 2024 that customers migrating their data off Google Cloud entirely could do so with free network data transfer, applying to customers globally. AWS followed in March 2024, waiving data transfer out to the internet for customers moving off AWS, and updated the programme in September 2025 to give eligible customers 90 days to complete the move. Microsoft announced free egress for customers leaving Azure in the same month.
Second, the law moved. The EU Data Act entered into force on 11 January 2024 and became applicable on 12 September 2025. During the transition, providers may charge only costs directly incurred in facilitating a switch; the UK CMA’s own analysis of these programmes records that a full removal of switching charges is required from 12 January 2027. After that date, leaving should cost nothing at the transfer layer.
| Provider | Free exit announced | What it covers | The catch |
|---|---|---|---|
| Google Cloud | January 2024 | Network data transfer out when migrating off Google Cloud entirely, globally | You apply for approval; it is for full exits, not ordinary multi-cloud traffic |
| AWS | March 2024 | Data transfer out to the internet when moving off AWS, from any region | Credits are granted per account after review; eligible customers have 90 days to complete the move |
| Microsoft Azure | March 2024 | Free egress when taking data out of Azure to another provider or on-premises | Same shape: it is a switching programme, not a discount on day-to-day egress |
| All three, from 12 January 2027 | EU Data Act | Switching charges prohibited outright | Parallel use of two providers remains chargeable |
Note the consistent exclusion. None of these programmes makes everyday traffic between two clouds free, which is the pattern most teams actually want. If your plan depends on cheap ongoing transfer rather than a one-off exit, read what egress actually costs before you design around it.
Where the real lock-in lives
Here is the uncomfortable part. Transfer fees were never the thing keeping anyone in place. The real cost of leaving is distributed across things nobody lists on a price page: the identity provider your whole estate authenticates against, the deployment pipeline, the proprietary database features somebody used because they were there, the monitoring dashboards, the compliance evidence tied to one provider’s audit reports, and the fact that your team knows one console and not another.
That concentration is the reason regulators keep returning to this. The UK CMA’s 2025 market investigation found that Amazon and Microsoft hold positions of significant market power, and identified egress fees and interoperability barriers as limits on switching and multi-cloud use. In March 2026 the CMA announced that, following its engagement, both firms had set out material steps on egress fees and interoperability for UK customers, while the CMA opened a strategic market status investigation into Microsoft’s business software ecosystem. Progress on switching is being reviewed rather than concluded.

Lock-in worth accepting, and lock-in that is not
Lock-in is not a binary and it is not always bad. The question is whether the service is doing work you would otherwise have to do. Managed PostgreSQL is a good trade: the wire protocol is standard, your queries are portable, and the provider handles backups and failover. A proprietary serverless database with its own query language is a different proposition, and may still be the right call if it removes an entire class of problem.
Accept the lock-in
Managed services built on open protocols give you most of the benefit and little of the trap.
- Managed PostgreSQL and MySQL: standard wire protocol, portable schema
- Object storage with an S3-compatible API, which several providers implement
- Containers and Kubernetes, which run anywhere
- Standard identity protocols such as OIDC and SAML
- Still a migration project, just a shorter one
Think twice
Services with their own query language, event model or packaging make the exit a rewrite rather than a move.
- Often genuinely removes operational work
- Can be the fastest route to a working product
- No equivalent elsewhere, so leaving means redesigning
- Pricing changes are hard to respond to
- Hiring pool is smaller
The goal is not zero lock-in. It is knowing exactly what you have signed up to.
The five portability choices that cost nothing
These five choices cost nothing extra at the point you make them, and each one shortens a future exit by weeks. That combination is rare enough to be worth acting on.
- Keep your infrastructure definition in code, in a tool that targets more than one provider. You will still rewrite the resource definitions, but the structure, review process and naming survive.
- Choose open database engines where the workload allows it. PostgreSQL and MySQL are available as managed services on every major provider, so the schema and the application code move even when the service does not.
- Containerise the application tier. A container image that runs on one provider’s container service runs on another’s with configuration changes rather than code changes.
- Keep an independent copy of your data. Not a second live region: a restorable export in an open format, somewhere the provider does not control. This also happens to be the backup you want during an outage.
- Write the runbook as you build. Every time you add a stateful service, add a line to the exit plan describing how its data would come out. Two minutes each time beats a week of archaeology later.
Nothing on that list says avoid managed services. The expensive mistake is the opposite one: running your own database, your own queue and your own identity system on virtual machines to stay portable, then spending more on operations than the managed services would have cost. Our guide to service models sets out where that line usually falls.

Writing an exit plan in one page
An exit plan that fits on one page gets read, updated and used. One that runs to forty pages gets filed. Ours has six sections, and we write it in the same session as the architecture review.
| Section | What goes in it | How long it takes |
|---|---|---|
| Data inventory | Every store that holds data you could not recreate, and its format | About an hour, and it is the valuable hour |
| Extraction method | How each store exports, and roughly how long for your volume | 30 minutes |
| Dependency list | Managed services with no equivalent elsewhere, named honestly | 20 minutes |
| Rebuild estimate | Weeks of work for the three hardest components, in a range | 30 minutes, revisited yearly |
| Trigger conditions | What would make us actually do this | 10 minutes, and a useful argument to have |
| Owner and review date | A name and a date, not a team | 1 minute |
Review it once a year, and after any significant architectural change. If you are planning a move right now rather than preparing for a hypothetical one, our piece on choosing a migration path covers the strategies and what each costs to execute, and the provider comparison is the right place to weigh up where you would go.

Eudora Technology writes and reviews these plans remotely for clients worldwide, usually alongside a broader architecture review, and we are happy to say when the honest answer is that your current lock-in is fine. The cloud solutions page covers how we work, and the introduction to cloud technology is the primer behind all of this.
Frequently asked questions
Does the EU Data Act apply to us if we are not in the EU?
It applies to providers offering data processing services to customers in the EU, so a non-EU business with EU operations or EU customers is likely to benefit from it in practice. The large providers have rolled their switching changes out globally rather than running two policies, which is why AWS, Google and Microsoft all describe their free exit programmes as available worldwide.
If exits are free from January 2027, why plan at all?
Because the fee was the smallest part. Free transfer removes a toll booth, not the journey: you still have to rebuild around a different managed database, redo your deployment pipeline, re-evidence your compliance and retrain your team. The plan exists to tell you how many weeks that is, before you need the answer.
Should we run multi-cloud to stay portable?
Rarely, for a small business. Running two providers properly means two sets of identity, two sets of monitoring, two skill sets and ongoing inter-cloud traffic that nobody’s free-exit programme covers. A single provider plus a tested restorable export is cheaper and more resilient in practice than a half-finished second estate.
What should we definitely not build on a proprietary service?
Your source of truth for data you are legally obliged to keep, and anything a customer contract says you must be able to hand back. Those are the places where an awkward export format becomes a legal problem rather than an engineering one. Everything else is a commercial judgement.
How often should the exit plan be reviewed?
Once a year as a minimum, and whenever you adopt a new stateful managed service. The review is short if you have been adding a line each time you build something. If the review takes more than an hour, that is a signal the architecture has drifted further than anyone realised.
If you need an exit plan for an auditor, an insurer or your own peace of mind, we can write one with you in a single session and tell you honestly which risks are worth money. Get in touch with Eudora Technology to talk about your project.
Sources
- Data Act
- Appendix N: Egress fees and free switching programmes
- CMA announces package of actions on business software and cloud services
- Free data transfer out to internet when moving out of AWS
- Eliminating data transfer fees when migrating off Google Cloud
- Free data transfer out to internet when leaving Azure
- Q2 cloud market passes $143 billion



