If You Can't Leave, You're Not Sovereign
Every sovereignty conversation eventually reaches the same question, and it's the one that actually matters: if you had to leave your provider next quarter (because of a price hike, a breach, a legal order, or a geopolitical shock), could you? And could you prove it?
Part of the pillar series Sovereignty You Can Actually Operate.
There's a comforting version of digital sovereignty that's really just shopping: pick a provider with the right flag on it, sign, and feel sovereign. But sovereignty isn't a logo. It's a capacity: specifically, the capacity to decide, which includes the capacity to walk away. A provider you cannot leave has sovereignty over you, whatever colour its badge is.
This is the companion to our technical piece on building portability into the architecture. Here, the strategic case: why the exit is the real test, why so few organizations can pass it, and what changes in 2027 that you should be preparing for now.
Almost nobody can actually leave
Start with how unprepared most organizations are. Vendor lock-in is now a top-tier worry (a February 2026 survey found 94% of IT leaders concerned about it, nearly half "very concerned" (Parallels)), and around 70% rank it among their top three cloud risks (Flexera 2025). Worry, though, is not readiness. Under DORA, financial entities must now hold a documented, tested exit strategy for every ICT service supporting a critical function, and most simply don't have the tested artifact yet. The mandate exists; the rehearsed exit largely doesn't.
That gap is the vulnerability. An exit plan you've never tested is not a control: it's a hope with a cover page.
The levers that keep you in
Lock-in isn't one thing; it's a set of levers, and knowing them is how you disarm them.
| Lever | How it holds you |
|---|---|
| Egress fees | Cheap to put data in, expensive to take it out: a deliberate exit tax |
| Proprietary managed services | Build on a provider's unique APIs and your app won't run anywhere else |
| Embedding data gravity | AI vectors only work in the model that made them; switching means re-embedding everything |
| Consolidation & licensing | A vendor you chose years ago gets acquired, and the terms change under you |
The egress lever is the most concrete. Hyperscaler egress runs around $0.09/GB in Europe, roughly $900 to move 10 TB, every month you're migrating (AWS EC2 pricing; Azure bandwidth pricing). That's not a cost; it's a disincentive, engineered. Tellingly, European providers have moved the other way: OVHcloud dropped all object-storage egress fees in December 2025, and Scaleway charges nothing, turning "free to leave" into a competitive feature (SoftwareSeni).
The consolidation lever is the sneakiest, because it happens after you've committed. When Broadcom acquired VMware, European cloud providers reported price increases of 800% to 1,500%, perpetual licenses were withdrawn, and multi-year subscriptions became mandatory, prompting the industry association CISPE to file an antitrust complaint and take the Commission to court (CISPE / ECCO, 2025). The customers who "chose" VMware a decade earlier had sovereignty over neither its price nor their exit. Lock-in deepens through M&A and licensing, not just market share.
What "leaving" actually costs: three real exits
The good news, visible in organizations that have actually done it: leaving is feasible, and often pays for itself. The numbers are worth having.
| Exit | Driver | Result |
|---|---|---|
| France Health Data Hub → European cloud | CLOUD Act exposure of health data | ~18-month migration, selected against 350+ criteria (Le Monde Informatique) |
| Schleswig-Holstein → open source | Cost + sovereignty | >€15M/yr saved for a ~€9M one-time spend: payback under a year, ~30,000 staff (heise) |
| 37signals → repatriation | Cost | ~$2M/yr compute savings; ended a ~$1.5M/yr storage bill; >$10M projected over five years (The Register) |
Note the detail in the 37signals case: to let them delete their account cleanly, the hyperscaler waived roughly $250,000 in egress fees. The exit tax is negotiable, but only leverage, or the law, makes it so.
What changes in 2027, and why to prepare now
Which brings us to the law. The EU Data Act has set a hard date that reshapes the economics of leaving: switching rules have applied since 12 September 2025 (providers may charge only the direct costs of switching), and from 12 January 2027 all switching and egress charges are prohibited outright (Data Act, Art. 29).
The Act also caps notice and transition periods and mandates that providers let you export data in a "structured, commonly used, machine-readable format." The financial moat around the exit is being drained by regulation. But the Data Act removes the fee, not the effort: the proprietary APIs, the un-portable embeddings, the untested failover are still yours to solve. The organizations that prepare portability now will simply walk through the door that opens in 2027; the rest will discover the door was never the hard part.
Sovereignty you can prove
The through-line of this whole series is that sovereignty has to be demonstrable, not asserted, and nowhere is that clearer than exit. The truest sovereignty metric is a question you can answer with a test, not a testimonial: can we leave, and have we proven it?
This is why we built the Soveryne Cloud Foundation with an open-source core you can inspect and portability as a default rather than a premium: no proprietary trap, keys in your jurisdiction, and operational knowledge transferred to your team so that "sovereign" never quietly becomes "dependent on us." And it's why Command treats exit and continuity as first-class, evidenced controls: the tested exit strategy DORA now expects, kept current rather than filed and forgotten. We'd rather earn your stay than trap it. That's what it means to build for the door.
FAQ
What's the best test of digital sovereignty? Whether you can actually leave your provider (on your own terms, on your own timeline) and prove it with a tested exit. If leaving is impossible or ruinous, you don't control the relationship; the provider does.
When do cloud egress fees end in the EU? From 12 January 2027, the EU Data Act prohibits all switching charges, including data egress fees. During the transition since September 2025, providers may only charge the direct costs of switching.
Why is vendor lock-in getting worse? Beyond ordinary data gravity, lock-in now deepens through proprietary managed services, non-portable AI embeddings, and, critically, post-acquisition licensing changes, as the Broadcom/VMware price increases of 800–1,500% showed.
How do you build a cloud exit strategy? Use open formats and standards, avoid proprietary service coupling, keep your keys and embeddings under your control, contract for data-return and reversibility, and, above all, test the migration, the way you'd test disaster recovery.
A provider you can't leave isn't a sovereign choice; it's a dependency with better branding. See a foundation built for the door, open-core, portable, keys in your jurisdiction: explore the Soveryne Cloud Foundation and Command.
Sources
- Parallels, cloud vendor lock-in survey (2026): https://www.parallels.com/newsroom/news/press-releases/20260217-cloud-survey/
- Flexera, 2025 State of the Cloud: https://www.flexera.com/blog/finops/the-latest-cloud-computing-trends-flexera-2025-state-of-the-cloud-report/
- EU Data Act, Article 29 (switching/egress charges): https://www.eu-data-act.com/Data_Act_Article_29.html
- DORA, Article 28 (exit strategies): https://www.digital-operational-resilience-act.com/Article_28.html
- CISPE / ECCO on Broadcom-VMware: https://www.theregister.com/2025/10/28/cispe_ecco_broadcom/
- France Health Data Hub migration: https://www.lemondeinformatique.fr/actualites/lire-scaleway-devient-l-hebergeur-du-health-data-hub-99998.html
- Schleswig-Holstein open-source migration: https://www.heise.de/en/news/Goodbye-Microsoft-Schleswig-Holstein-relies-on-Open-Source-and-saves-millions-11105459.html
- 37signals cloud repatriation: https://www.theregister.com/2025/05/09/37signals_cloud_repatriation_storage_savings/
- EU cloud provider egress comparison: https://www.softwareseni.com/eu-native-cloud-providers-compared-hetzner-ovhcloud-scaleway-and-t-systems/
Seven posts of problem. This one is all solution. Here is what a European organization can actually do in the next year to reduce its dependence on foreign technology, without a rip-and-replace, without autarky, and without waiting for Brussels to build the alternatives.
Read the next part
In the companion post we argued the real sovereignty test is whether you can leave. This is the engineer's answer to the obvious follow-up: how do you build a system so that leaving is a rehearsed operation instead of a hostage negotiation, including leaving us?
Read the companion piece
