EU Data Act Cloud Switching Procurement FAQ

Start by confirming that the supplier is providing a data processing service to a customer, such as cloud or edge services using configurable, scalable computing resources. The Commission FAQ explains that the Data Act concept covers common IaaS, PaaS, and SaaS delivery models when the service has the Article 2(8) characteristics.

Then ask whether the contract removes the obstacles listed in Article 23: termination after the permitted notice and successful switch, new contracts with another provider, porting exportable data and digital assets, functional equivalence where applicable, and technically feasible unbundling.

Article 25 requires the customer's switching rights and the provider's obligations to be set out clearly in a written contract that the customer can store and reproduce before signing. Exit language found only in a help-center article, commercial slide, or support policy outside the contract pack does not satisfy that contract-content requirement.

The contract should cover at least switching or porting on request, support for the customer's exit strategy, termination mechanics, a maximum notice period, exportable data categories, provider-internal data exemptions, a retrieval period, erasure after retrieval or an agreed later date, and any permitted switching charges.

For switching or porting, Article 25 requires reasonable assistance, due care to maintain business continuity, clear information on known continuity risks, and high security during transfer and retrieval. Ask for named support channels, technical documentation, migration tooling, continuity risk notices, and security controls during the switch.

Article 26 adds a separate information obligation: the provider must give switching and porting procedures, methods, formats, known restrictions, technical limitations, and a reference to an up-to-date online register for data structures, data formats, relevant standards, and open interoperability specifications.

For cloud switching procurement checklist, the Data Act record should identify the source clause, Commission guidance, affected service, decision owner, and the evidence used to approve the supplier's switching terms. Keep the contract pack, supplier redlines, export tests, fee schedule, and online-register snapshot together so the decision can be checked later.

Review the checklist again when the service architecture, supplier documentation, standards references, or renewal timetable changes. A later reviewer should be able to see what was agreed, why it was acceptable, and what would require a fresh review.

Under the Data Act, Article 29 phases out switching charges, including data egress fees, so that from 12 January 2027 providers cannot impose them, and in the interim period any charge must not exceed the provider's costs directly linked to the switching process concerned. Procurement should ask the supplier to confirm which date its contract reflects and how any interim charge is calculated.

A buyer should reject open-ended egress pricing and require the contract to state that switching charges fall away on the statutory date, so the cost of leaving is predictable rather than a lock-in lever.

Under the Data Act, exportable data means input and output data, including metadata, generated or co-generated directly or indirectly by the customer's use of the data processing service. It excludes assets or data protected by the intellectual property rights, or constituting trade secrets, of the provider or third parties. Digital assets are separate elements in digital form that the customer has the right to use independently of the contract with the source provider. Procurement should ask the supplier to define these boundaries in the contract rather than discovering them during a migration.

The checklist should confirm the formats, included metadata, and configuration or schema material needed to make the export usable on the destination service. A raw dump that the customer cannot rebuild from is insufficient.

Under the Data Act, providers of services limited to infrastructural elements must take all reasonable measures in their power to help customers achieve functional equivalence after switching to a service of the same service type. Other providers must make open interfaces available free of charge; where no relevant common specifications or harmonised standards have been published in the central Union standards repository, they must, at the customer's request, export all exportable data in a structured, commonly used, machine-readable format.

Procurement should establish which obligation applies to the service being bought, because expecting functional equivalence from a SaaS provider, or accepting only a raw export from an IaaS provider, both misread the Regulation.

Under the Data Act, the contract must give the customer a retrieval period of at least 30 calendar days starting after the agreed transitional period ends. The provider must fully erase the exportable data and digital assets generated directly by, or relating directly to, the customer after that retrieval period or a later agreed period, provided the switching process has completed successfully. Procurement should make sure the retrieval window and the erasure trigger are both explicit.

A buyer should also confirm how erasure is evidenced, so it can show that the data left the old provider once the migration and any agreed retention period ended.

Article 26 requires the provider to reference an up-to-date register of exportable-data structures, formats, standards, and open interoperability specifications. For non-IaaS services, Article 30 requires free open interfaces and, after the repository trigger and 12-month compliance period, compatibility with referenced common specifications or harmonised standards.

For IaaS, the separate Article 30(1) duty is to take all reasonable measures within the provider's power to help a customer achieve functional equivalence after a same-service-type switch. Procurement should test the correct branch and ask which formats, interfaces, tools, and standards the exit process actually uses.

Article 31 has two different regimes. For a service mainly custom-built for one customer, or developed entirely for one customer, and not offered at broad commercial scale through the provider's catalogue, only Article 23(d), Article 29, and Article 30(1) and (3) do not apply. A non-production version supplied for testing and evaluation for a limited period is outside Chapter VI entirely.

Before contract signature, the provider must identify which Chapter VI obligations do not apply. Procurement should require the factual basis, preserve the remaining duties for a qualifying custom-built service, and negotiate explicit exit protection where a limited test service falls outside Chapter VI.

Article 23 requires providers to remove obstacles that inhibit a customer, where relevant, from using several data processing providers at the same time. It also requires technically feasible unbundling of covered data processing services. Those binding duties do not guarantee that every architecture can be split or that every cost of parallel operation is free.

A phased cutover and overlap plan is a procurement control, not a fixed statutory transition design. Require the supplier to identify dependencies, feasible unbundling points, assistance, security, continuity measures, coexistence charges, and the evidence that will mark each migration stage complete.

Under the Data Act, the core cloud-switching obligations apply from 12 September 2025, and switching charges must be removed by 12 January 2027, so procurement should track which obligations a contract already meets and which depend on a future date. A renewal or new signature is the moment to align the contract with the applicable date.

The team should also set event triggers, such as a change of service architecture or supplier documentation, so the contract is re-checked when the underlying service or the applicable obligation changes.