EU Data Act: Switching Duties for Cloud Portfolios

02.08.2026

5 min read

12 September 2025 marks the start date for the core obligations of the EU Data Act: cloud and edge providers must contractually and operationally ensure switching and interoperability. For CIOs and CDOs in the DACH region, the exit question shifts from negotiation margin to the compliance core of the provider portfolio.

Key Takeaways

Applicability: The core obligations of Regulation (EU) 2023/2854 took effect on 12 September 2025; switching charges will be fully eliminated from 12 January 2027.
Deadlines: Contracts must include a switching right with a maximum notice period of two months and a transition phase of no more than 30 calendar days; data retrieval must be possible for at least 30 days thereafter.
Scope: The regulation covers data processing services broadly across IaaS, PaaS and SaaS, as well as non-EU providers serving EU customers-not just hyperscalers.

Chapter VI turns switching into a minimum standard

Regulation (EU) 2023/2854, published in the Official Journal on 22 December 2023, addresses providers of cloud and edge services in Chapter VI. According to the European Commission’s digital-strategy.ec.europa.eu update dated 15 December 2025, this chapter sets minimum standards for interoperability and switching between data processing services. The legal act thus establishes a hard framework for exit, portability and provider changes-not merely an optional best practice.

What is switching under the Data Act? Switching refers to moving from one data processing service to another or back to an in-house data centre. The Data Act obliges providers to enable and technically support this transition. Fees for switching will be phased out.

Controlling a provider portfolio hinges on the definition of “service.” Analysis by Alston & Bird LLP (16 September 2025) shows the scope of data processing services is intentionally broad, covering Infrastructure as a Service (IaaS), Platform as a Service (PaaS) and Software as a Service (SaaS). According to the recitals, Storage- and Database-as-a-Service may also fall under the legal definition if the conditions are met. The rules therefore target a wide range of data processing services. Large hyperscalers alone is not enough.

The switching rules have extraterritorial effect. Providers based outside the EU are covered by Alston & Bird’s analysis as soon as they serve EU customers. For DACH organisations, this means global contracts and US or Asian suppliers must be included in compliance reviews once the service is delivered within the EU.

Contracts must govern exit, deadlines and data retrieval

Chapter VI delves deeply into contract design. After reproducing the regulation on eu-data-act.com (Art. 25 para. 2), the contract must provide for a switching right: the notice or announcement period may not exceed two months, followed by a transition period of no more than 30 calendar days. During this phase, the provider is obliged to provide technical and organisational support for the switch.

If the 30-day transition period is technically unfeasible, a narrowly defined exception applies. Under Art. 25 para. 4, the provider must justify this within 14 working days and may set an alternative transition period of no more than seven months. Service continuity remains due during this period. This is relevant for CIOs because complex migrations often take longer, but the exception is subject to justification and time limits.

The contract must also cover further exit components: exit support, final lists of portable data and digital assets, at least 30 calendar days of data retrieval after the transition phase and complete deletion after the retrieval period expires (Art. 25 para. 2 lit. b, e, g, h). Without these clauses, the legally required exit architecture is missing, regardless of how robust the technical roadmap may be in-house.

Functional equivalence, exportable data and multi-cloud

Functional equivalence is framed in the Data Act as an IaaS obligation for the source provider: with a shared feature basis, comparable results should be achievable for identical inputs (Art. 30 para. 1, 2, 5 as per eu-data-act.com). PaaS and SaaS are subject to different portability and interoperability obligations; the precise measurability of functional equivalence is still little refined by case law in practice and should be treated as an IaaS priority in your portfolio.

Exportable data, according to McCann FitzGerald LLP (17 September 2025), includes input and output data plus metadata generated by the customer’s use. Excluded are, among other things, IP-protected assets and the provider’s trade secrets as well as security-critical integrity data of the service. The portability boundary therefore runs along exportable data and digital assets of the customer, not along a full mirroring of the provider’s platform.

Switching means more than a complete provider change. According to Alston & Bird, the regime also covers multi-cloud, parallel operation and on-premises migration. For digital leaders, this shifts the focus: exit capability becomes a portfolio option alongside dual-vendor setups and gradual decoupling, not merely an emergency plan for a full exit.

Switching charges end in 2027, lock-in via term remains

The Data Act clearly distinguishes between switching charges and other costs. Under Art. 29, switching fees-including data egress for the switch-will be completely abolished from 12 January 2027. Until then, only cost-covering switching fees are permitted. Organisations switching before 2027 may still face cost-based exit positions; from the deadline, this lever is removed for providers.

Early-termination penalties and regular service fees remain permissible. They are distinct from switching charges. Economic lock-in via contract terms and upfront investments is therefore not abolished. Boards should therefore read budget and sourcing decisions in parallel: cheaper exit fees do not replace an assessment of minimum terms, advance payments and depreciation risks.

The European Commission has published non-binding model contract terms or standard contractual clauses for cloud contracts, including provisions on switching and exit. Maples Group reports (17 April 2026) on the draft dated 19 November 2025. These clauses serve as a reference and negotiation anchor; they do not automatically create a right. They can accelerate contract work but do not replace a review of the specific service model or the mapping of statutory deadlines in your own framework agreement.

Oversight, Sanctions, and Real-World Tensions

For violations of the switching rules, the respective member state will determine the sanctions. While the regulation demands effective, proportionate, and dissuasive measures, it does not, according to Alston & Bird, set uniform EU-wide fine levels for Chapter VI. In the German implementation discussion, a draft status names the Federal Network Agency as the competent authority; fines of up to 4 percent of global annual turnover or €5 million are under discussion (Latham & Watkins LLP, 19 August 2025, draft status as of publication date).

Practical limits remain. Latham & Watkins points out that strict deadlines and portability obligations clash with real-world multi-system landscapes. The pro-competitive effects are therefore not guaranteed: rights on paper can fail due to integration debt, data models, and dependencies between services. For the executive level, this results in a governance mandate: contract compliance, technical exit readiness, and sourcing strategy must be managed in tandem.

Among the sources reviewed, questions remain-including the applicability of Chapter VI to legacy contracts predating 12 September 2025; Greenberg Traurig flagged this as contested in September 2025. The classification of individual SaaS or AI-as-a-Service products under the legal definition is similarly case-specific. Both issues belong in legal and procurement audits but are not suitable for blanket portfolio assumptions.

Frequently Asked Questions

When do the switching obligations under the Data Act come into effect?

The core obligations of Regulation (EU) 2023/2854 have applied since 12 September 2025. The regulation was published in the Official Journal on 22 December 2023. Switching charges will be fully abolished from 12 January 2027; until then, only cost-covering switching fees are permitted.

What deadlines must cloud contracts provide for switching?

A maximum of two months’ notice period, followed by a transition phase of no more than 30 calendar days. If this is technically unfeasible, the provider must justify it within 14 working days and may set an alternative transition period of up to seven months; service continuity must still be ensured. After the transition phase, at least 30 calendar days must be allowed for data retrieval.

Do these rules apply only to hyperscalers in the EU?

No. The term “data processing services” broadly covers IaaS, PaaS and SaaS, as well as storage and database-as-a-service where the legal definition applies. Providers outside the EU are also covered if they serve customers in the EU.

Are early-termination penalties banned under the Data Act?

No. Early-termination penalties and regular service fees remain permissible and are distinct from switching charges. Economic lock-in through contract durations and upfront investments is therefore not abolished.

Who sanctions violations and how high can fines be?

Member states set sanctions; the regulation requires effective, proportionate and dissuasive measures, without fixing EU-wide fine levels for Chapter VI. In German draft discussions, the Federal Network Agency is mentioned; fines of up to 4 percent of global annual turnover or €5 million are under discussion.