Workflow automation lock-in: what you can export, what you rebuild

An AI vendor due diligence checklist for legal teams, published here on 11 July, closes on exit and data return: when the contract ends, how does your data come back, and in what format. Since 12 September 2025 that question has been too small.

The EU Data Act, Regulation (EU) 2023/2854, has applied since that date to providers of data processing services, a class its recital 81 reads as covering IaaS, PaaS and SaaS alike. Article 25 puts the exit in the contract: a notice period capped at two months, a transitional period capped at 30 calendar days, and where that is technically unfeasible a justified notice within 14 working days naming an alternative period that cannot exceed seven months, at least 30 further days to retrieve, and an exhaustive specification of every category of data and digital asset that can be ported. Switching charges fall away on 12 January 2027 (Article 29). These duties bind providers serving customers in the Union (Article 1(3)(f)); elsewhere the same terms are things you negotiate, not rights you hold.

Then the limit, which is the real subject. Functional equivalence, re-establishing a minimum level of functionality after the move, is something only infrastructure providers have to take reasonable measures to facilitate, and even then only for features both services offer (Article 30(1), recital 86). A workflow platform owes open interfaces and, while interoperability standards for its service type remain unpublished, an export of exportable data on request in a structured, commonly used, machine-readable format (Article 30(2) and (5)). Exportable data stops where the provider's intellectual property and trade secrets begin (Article 2(38)), and a digital asset travels only where you may use it independently of the contract you are leaving (Article 2(32)). Workflow definitions, prompt and policy assets, evaluation sets, connector mappings and run history are a different asset class from your documents. The Commission's non-binding Data Act FAQs, version 1.4 of 22 January 2026, say it at question 58b: no source provider is responsible for helping you rebuild your service in the destination environment.

So rehearse the exit once, on one live workflow, while the platform is not yet load bearing. Take the export the contract promises, stand the workflow up elsewhere with the vendor's help withdrawn, and log what you had to rebuild by hand. That log, not the demo, is what the scale decision needs. Ask for the Article 25(2)(e) specification before signature. Then read Article 31: a platform whose majority of main features was custom-built for your needs, or whose components were all developed for you, and which is not offered at broad commercial scale, falls outside some of these duties, the end of switching charges among them.

Published 27 July 2026

Next: An AI vendor due diligence checklist for legal teams →