Assessing Cloud Portability Before You Sign: A Buyer Guide

Portability is not a property of a cloud provider. It is a property of your workloads, your contract and your team on the day you try to leave. This guide gives you a grid to assess all three before you sign, whether you are choosing a first provider or renewing a large one.

It names no providers and ranks none. The questions are the same whichever logo is on the proposal.

The regulatory backdrop, briefly

If your provider and your use fall within the EU Data Act (Regulation (EU) 2023/2854), switching rights are part of the picture. According to the European Commission, the Act has applied since 12 September 2025, and switching charges, including data egress charges, are to be fully removed from 12 January 2027, after a transitional period during which providers may still charge costs. Article 29 of the text provides that from 12 January 2027 providers shall not impose any switching charges, and that reduced switching charges are allowed from 11 January 2024 to 12 January 2027.

The text also sets contract content. Under Article 25, the customer must be able to start switching within a maximum notice period of two months, and the switch must take place without undue delay and within a mandatory maximum transitional period of 30 calendar days, with the service maintained. Article 30 requires, for infrastructure services, all reasonable measures to facilitate functional equivalence, and an export of all exportable data in a structured, commonly used and machine-readable format where no common specification exists.

Two limits. First, none of this removes the other costs of leaving: rewriting code, retraining people, running two platforms in parallel. Second, amendments are under discussion. A July 2026 legal analysis of the Digital Omnibus describes proposals for transitional relief on some contracts concluded on or before 12 September 2025 and for an express permission of proportionate early termination penalties in fixed-term contracts. They are proposals, and the Council text was still under negotiation in that analysis. Ask your counsel for the position on the day you sign.

The grid below is useful with or without the regulation. It asks what the regulation cannot guarantee for you.

1. Workload portability

Decide. For each workload, classify it: portable by design, portable with work, or tied to the provider. Do this before choosing services, not after.

Ask yourself, workload by workload.

• Does it run in containers or on standard virtual machines, or does it depend on provider-specific runtimes?
• Which managed services does it call, and does an equivalent with a compatible interface exist elsewhere?
• Is the infrastructure described in code that you own, in a tool that is not tied to one provider, or was it built by clicking in a console?
• Is configuration separate from code, or are provider identifiers embedded in the application?

Warning signs.

• Nobody can list the managed services in production.
• Infrastructure that exists only in the console and cannot be rebuilt from scripts.
• A design document that says "uses the provider's native services wherever possible" as a principle, with no list of exceptions.

Get priced. A migration estimate per workload class, in days, from the team that runs it. Treat an estimate of "unknown" as a risk and size it.

2. Data portability

Decide. Which datasets must be exportable, in which formats, and in what time.

Ask the vendor.

• In which formats can each data service export, and does the export include schema, configuration, permissions and metadata, or only the rows?
• Are there limits on export speed, volume or concurrency?
• Is any of your data held in a format that only the provider's software can read?
• What does the provider consider "exportable data" under the switching rules, and which of your data does it exclude?
• How will deletion after exit be done and evidenced?

Warning signs.

• Export described as a support request rather than a documented feature.
• Backups that can only be restored to the same provider.
• Different answers from sales and technical staff.

Get priced. The cost of exporting your full data set, today and after the switching-charge changes, with the provider stating the assumptions in writing. Also a test: perform a real export of a representative data set before signing.

3. Contract terms

Decide. Which clauses are non-negotiable and which you will trade.

Ask the vendor.

• What is the notice period to begin switching, and the maximum time to complete it, and where is that written in the contract?
• What happens to a spend commitment if you migrate part of the workload, or all of it?
• Are early termination penalties defined, and how are they calculated?
• Can you run in parallel with another provider during migration without being charged for it, and is that stated in the contract?
• How are price increases notified, and do you have an exit right when they happen?
• Which law and which courts govern disputes, and where is the data processed and stored?

Warning signs.

• Commitments that continue to be billed after you have left.
• Rights described in the sales material but absent from the contract text.
• Terms incorporated by reference to a web page the provider may update.

Get priced. The worst-case exit bill: unused commitment, penalties and fees under the contract as written. Ask the provider to confirm the calculation.

4. Skills and operating model

Decide. How much of your operating knowledge may be provider-specific, and who holds it.

Ask yourself.

• Could a competent engineer who has never used this provider run your platform with your documentation?
• Are runbooks written in terms of your systems or the provider's console steps?
• Which certifications or specialist roles does your team depend on, and what is the turnover risk?
• Do you have monitoring and logging outside the provider's own tools?

Warning signs.

• One or two people who understand how everything is wired.
• Observability and security tooling that exists only inside the provider.
• Identity and access management that cannot be exported or reproduced.

Get priced. Retraining and parallel-run staffing for the migration period, and the cost of documenting what currently lives in people's heads.

5. Security and identity

Decide. Where the control points sit: identity, keys, logs.

Ask the vendor.

• Can you manage encryption keys outside the provider, and what happens to access when you do?
• Can identity be federated with a system you control, and does it survive a change of provider?
• Can logs and audit trails be exported continuously, in a documented format, to a store you own?

Warning signs.

• Keys that cannot leave the provider's key service.
• Audit history available only inside the provider console.
• Security configuration that cannot be expressed as code.

Get priced. Key management and log storage outside the provider, as ongoing costs.

6. Concentration and fallback

Decide. Which services are critical enough to need a second option, and what that option is.

Ask yourself and the vendor.

• If this provider suffered a long outage or a dispute over terms, which of your services would stop, and for how long can the business tolerate it?
• Is there a documented fallback for the most critical services, even a degraded one, on another provider or on your own hardware?
• Does your backup strategy include a copy that the provider cannot delete or lock, held under separate credentials?
• Can the provider suspend your account, and under what conditions and notice?

Warning signs.

• A disaster recovery plan that stays inside the same provider and the same account.
• Backups and production sharing one set of administrative credentials.
• Suspension rights written broadly, with no notice or appeal.

Get priced. The cost of a minimum viable fallback for the critical services, and of the independent backup copy.

7. A portability test you can run

Pick one workload and one dataset of moderate size. Before signing, or within the first ninety days, rebuild it from scripts in a second environment, restore its data there, and run its tests. Record how long it took, what broke, and who knew how to fix it.

You do not need to move it. You need to learn what moving would cost. The result tells you more than any questionnaire, and it gives you facts to negotiate with.

Putting the grid to use

Score nothing. Write a one-page summary with three headings: what we can leave in a month, what would take a year, and what we cannot leave without rebuilding. Attach the worst-case exit bill and the list of unanswered vendor questions.

If the third heading is long, the contract should say so too, in the price you pay and the term you accept. If it is short, you have bought flexibility, and you should still run the test again next year.