Switching cloud providers: the Data Act meets the sovereignty package

The legal framework

Status and the texts

The switching rules are in Chapter VI (Articles 23 to 31) of the Data Act, Regulation (EU) 2023/2854 of 13 December 2023. The Data Act entered into force on 11 January 2024 and applies from 12 September 2025 (Article 50). Article 29 on switching charges has its own calendar: reduced charges from 11 January 2024, and no charges at all from 12 January 2027.

On top of that comes a proposal: the Cloud and AI Development Act, COM(2026) 502 of 3 June 2026, procedure 2026/0138(COD). On 13 November 2026 it was awaiting a committee decision in Parliament. It does not apply yet. We describe it in detail in the Cloud and AI Development Act.

Who is caught

The rules bind providers of data processing services. A data processing service is a digital service that gives the customer on-demand network access to a shared pool of configurable, scalable and elastic computing resources (Article 2, point (8)). Recital 81 explains that such services fall into one or more of three delivery models: Infrastructure as a Service (IaaS), Platform as a Service (PaaS) and Software as a Service (SaaS). The beneficiary is the customer: any natural or legal person that contracts with the provider to use the service (Article 2, point (30)). Businesses and public bodies are both customers.

Examples:

• A logistics company runs its warehouse system on a large hyperscaler and wants to move to a European provider. The hyperscaler is the source provider; the European provider is the destination provider.
• A law firm uses a document management SaaS and wants to bring its files back on-premises. That is switching too: the definition includes moving to on-premises ICT infrastructure (Article 2, point (34)).
• A retailer uses two clouds side by side. The rules on parallel use apply (Article 34).

Not fully caught. Services custom-built for one customer and not offered at broad commercial scale escape some duties: functional equivalence, the charges rules and parts of Article 30. Non-production versions offered for testing and evaluation for a limited period escape the chapter altogether (Article 31). The provider must tell the customer before signing which obligations do not apply (Article 31(3)).

The duties, article by article

No obstacles (Article 23). Providers may not impose, and must remove, pre-commercial, commercial, technical, contractual and organisational obstacles that stop customers from:

• terminating the contract after the notice period and a completed switch;
• contracting with a new provider for the same service type;
• porting their exportable data and digital assets, also after a free tier;
• achieving functional equivalence in the new environment; and
• unbundling, where technically feasible, infrastructure services from other services.

These duties fall on the source provider (Article 24).

The written contract (Article 25). The customer's switching rights must be set out in a written contract, made available before signing in a form the customer can store and reproduce. The contract must include at least:

• a right to switch or port without undue delay, and in any event within a transitional period of 30 calendar days after the notice period, during which the provider gives reasonable assistance, keeps the service running with due care, flags known continuity risks and keeps security high (Article 25(2)(a));
• support for the customer's exit strategy, including all relevant information (Article 25(2)(b));
• termination of the contract when the switch is complete, or at the end of the notice period if the customer chooses erasure instead (Article 25(2)(c));
• a maximum notice period of two months to start the switch (Article 25(2)(d));
• an exhaustive list of the data and digital assets that can be ported, at least all exportable data (Article 25(2)(e));
• an exhaustive list of provider-internal data excluded because of trade-secret risk, as long as that does not impede the switch (Article 25(2)(f));
• a retrieval period of at least 30 calendar days after the transitional period (Article 25(2)(g));
• full erasure of the customer's exportable data and digital assets after retrieval, once the switch has succeeded (Article 25(2)(h)); and
• any switching charges allowed by Article 29 (Article 25(2)(i)).

The customer may give notice that it will switch to another provider, move on-premises, or erase its data (Article 25(3)). If 30 days is technically unfeasible, the provider must say so within 14 working days of the request, justify it and propose an alternative period of at most seven months, with continuity of service throughout (Article 25(4)). The customer may extend the transitional period once (Article 25(5)).

"Exportable data" means the input and output data, including metadata, generated or co-generated by the customer's use of the service. Assets protected by the provider's or third parties' IP rights or trade secrets are excluded (Article 2, point (38)).

Information and good faith (Articles 26 and 27). The provider informs the customer of switching procedures, methods, formats and known limitations, and keeps an online register of data structures, formats, standards and open interoperability specifications. All parties, including the destination provider, cooperate in good faith.

Transparency on international access (Article 28). Providers publish the jurisdiction their infrastructure is subject to, and the measures they take against international governmental access to non-personal data that would conflict with Union or national law. Contracts must list those web pages. Article 32 adds the duty to take adequate technical, organisational and legal measures against such access.

Switching charges (Article 29). From 11 January 2024 to 12 January 2027, providers may charge reduced switching charges, no higher than the costs directly linked to the switch. From 12 January 2027, no switching charges at all. Switching charges include data egress charges, but not standard service fees or early termination penalties (Article 2, point (36)). Before signing, providers must inform customers of standard fees, early termination penalties and reduced switching charges, and flag services where switching is highly complex or costly.

Technical aspects (Article 30). Infrastructure providers must take all reasonable measures to help the customer reach functional equivalence at the destination. Other providers must offer open interfaces free of charge. They must also become compatible with common specifications or harmonised standards within 12 months of their publication in the Union repository. Until then, they export all exportable data in a structured, commonly used and machine-readable format on request. Providers need not develop new technologies or disclose assets protected by IP or trade secrets (Article 30(6)).

Parallel use (Article 34). For multi-cloud use, the main switching duties apply by analogy. Providers may pass on data egress costs, but not more than the costs incurred.

Where the sovereignty proposal comes in

The proposed Cloud and AI Development Act would let public buyers buy only cloud services recognised at a Union assurance level (Article 30 of the proposal). If a public body's risk assessment calls for another service, it would have to migrate within a transition period of at most 12 months (Article 29(6) of the proposal). Public bodies would also have to consider a multi-vendor or multi-cloud strategy (Article 29(9)). The proposal's explanatory memorandum calls the Data Act an enabler of these rules: the right to leave is what makes a sovereignty requirement workable. For providers that sell to the public sector, a loss of recognition could become a common trigger for exit.

In practice

For providers. Check your standard terms against Article 25 line by line. The most common gaps: no stated maximum notice period, no exhaustive list of exportable data, retrieval periods under 30 days, and minimum-term clauses that block termination after a switch. Publish the Article 28 information and link it in the contract. Plan the end of egress-based switching charges on 12 January 2027, and make sure that early termination penalties are real penalties, not disguised switching charges.

For customers. Before you sign, ask for the exit section. Test whether the list of exportable data includes your metadata and configurations, and whether the provider claims trade-secret exclusions that would hollow out the switch. Plan your exit: data formats, who does what, and how long you need. Use your right to extend the transitional period once if the migration is complex.

A worked example: a mid-sized manufacturer gives notice on 1 March to move its ERP platform to another provider. The notice period ends on 1 May at the latest. The provider then has 30 days to complete the transition, unless it explained within 14 working days why that is unfeasible and proposed up to seven months. After the transition, the manufacturer has at least 30 days to retrieve remaining data. Then the provider erases it. If the switch happens after 12 January 2027, the provider may not charge for it.

Contract checklist

1. Maximum notice period stated, two months or less.
2. Transitional period of 30 days, with assistance, continuity and security duties.
3. Exhaustive list of exportable data and of any trade-secret exclusions.
4. Retrieval period of at least 30 days, then full erasure, confirmed in writing.
5. Charges: none after 12 January 2027; before then, at cost and disclosed.
6. Links to the provider's Article 28 jurisdiction and access-protection pages.
7. For public customers: a clause on what happens if a sovereignty recognition is lost, if the proposal is adopted.

Frequently asked questions

Does the Data Act let us leave a fixed-term cloud contract early?

The Data Act regulates the switching process and removes obstacles to it. It distinguishes switching charges from early termination penalties, and providers must disclose such penalties before signing (Article 29(4)). Whether a penalty is payable depends on your contract and on whether it is fair under the general rules.

Are SaaS products covered, or only infrastructure?

Every data processing service as defined in Article 2, point (8), is covered. The technical rules differ: Article 30(1) is for infrastructure services, the rest of Article 30 for other services.

Can the provider refuse to hand over its own software or models?

Yes. Assets protected by the provider's IP rights or trade secrets are not exportable data, and Article 30(6) says providers need not disclose them. The provider must list excluded data categories in the contract.

Does the 12-month migration rule already apply to public bodies?

No. It is in the proposed Cloud and AI Development Act, which had not been adopted on 13 November 2026.

How this connects

Switching terms belong in every cloud and SaaS contract. Read more in SaaS agreements and in our overview of the EU Data Act. Our commercial contracts and transactions team reviews and negotiates these terms. We test contracts against Article 25 with the clause library and risk review, draft exit schedules with Document Studio, our proprietary document analysis and development system, and track notice and retrieval periods in the rights and obligations register.

Cited provisions: Regulation (EU) 2023/2854, Articles 2 (points (8), (30), (34), (36) and (38)), 23 to 32, 34 and 50; proposal COM(2026) 502, Articles 29 and 30.

Key dates:

• 11 January 2024: Data Act in force; reduced switching charges allowed from this date
• 12 September 2025: Data Act applies
• 12 January 2027: no more switching charges

Related reading: the Cloud and AI Development Act, the EU Data Act, SaaS agreements and Interoperable Europe.