The price of leaving a supplier is set on the day you sign, and almost nobody calculates it then. By the time a decision owner wants out, the negotiating position has gone, the data is in a proprietary shape, and the only party who can quote the exit is the party being exited. This is how to put a number on it while you still have a choice.
Exit is priced at signature
Every procurement process compares what it costs to start. Licence fees, implementation, training, the three year total. Very few compare what it costs to stop, even though stopping is the event that decides whether the next procurement is a real contest or a formality.
The asymmetry is structural. At signature you have alternatives, a competitive process and a supplier who wants the deal. At exit you have a live service, a migration your business has not budgeted for, and a supplier whose commercial interest is to make leaving expensive enough that renewing looks sensible. Nothing about that is dishonest. It is simply what happens when a term was never negotiated.
So the useful question during evaluation is what the invoice looks like on the day you tell them you are going.
What the exit bill actually contains
Six things show up, and only the first is widely discussed.
- Data egress. The charge to move your own data out. For the large cloud providers this has largely been waived since 2024. For most software vendors it was never a line item at all, which means it gets invented at exit.
- Extraction and transformation. Getting the data out in a usable shape. A CSV dump of twelve tables is not a migration. The cost lives in schema, referential integrity, attachments, audit history and anything held in a proprietary format.
- Transition assistance. Supplier effort during handover, usually billed at professional services day rates that were never tendered and never benchmarked.
- Dual running. Paying both suppliers while the new service is proven. Often the largest single number, and almost always absent from the business case.
- Re-implementation. Integrations, reports, workflows and training rebuilt on the new platform. The more configuration you invested in, the higher this climbs, which is the uncomfortable arithmetic of a successful implementation.
- Termination charges. Early termination fees, unamortised discounts that claw back, and minimum commitments that survive the decision to leave.
Add them and the total frequently exceeds a year of subscription. That number is the real switching cost, and it is the number a renewal negotiation is conducted against whether or not anyone says so out loud.
What Australian law requires today
Less than most decision owners assume, with one prudential exception that is worth reading closely even if you are not regulated by it.
APRA CPS 230 makes orderly exit an obligation
Prudential Standard CPS 230 commenced on 1 July 2025. Paragraph 56 requires that, for each material arrangement, an APRA-regulated entity must identify and manage risks to ongoing provision, manage step-in and contagion risk, be able to execute its business continuity plan, and ensure it can conduct an orderly exit from the arrangement if needed. Paragraph 48 requires the service provider management policy to cover the approach to entering, monitoring, substituting and exiting agreements with material service providers.
Paragraph 54 then sets the minimum contents of the formal agreement, including ownership and control of data, audit access, liability, notification of the provider’s own material service providers, and termination provisions covering the right to terminate the whole arrangement or parts of it. Existing agreements had until the earlier of 1 July 2026 or their next renewal date to comply. Targeted amendments commencing 1 July 2026 added a narrow exemption from certain contractual requirements for arrangements with bodies such as government agencies, exchanges and payment system operators, where negotiating terms is impractical. The exit obligation itself was not relaxed.
If you are not APRA-regulated, this is still the most specific exit standard available in Australian regulation, and it is free to copy.
Privacy law reaches the last step, which is deletion
Australian Privacy Principle 11.2 requires an entity to take reasonable steps to destroy or de-identify personal information once it is no longer needed for any purpose for which it may be used or disclosed, unless it is required to retain it. After a migration, the copy sitting in the former supplier’s environment is squarely within that duty, and the only practical way to discharge it is a contractual right to certified deletion on a defined clock.
Competition law has identified the problem and not yet fixed it
The ACCC concluded its five year Digital Platform Services Inquiry on 23 June 2025, and impediments to switching and interoperability were among the conduct it named. Treasury consulted on a digital competition regime over the summer of 2024 and 2025. Until something is legislated, an Australian decision owner facing a switching obstacle has contract law and nothing more.
That pattern will look familiar if you read our piece on AI procurement guardrails. A problem is identified at policy level, the legislative remedy is deferred, and the control ends up wherever a decision owner chooses to write it.
Europe already wrote the clause library
The European Union’s Data Act, Regulation 2023/2854, became applicable on 12 September 2025, and its switching chapter does something no Australian instrument does. It specifies the exit terms a cloud contract must contain. Australian decision owners are not covered by it. They can still lift the clause list, because it was drafted by people who had studied exactly how switching gets obstructed.
Article 25 requires the contract to include, among other terms:
- a mandatory maximum transitional period of 30 calendar days, during which the contract stays in force and the provider gives reasonable assistance, maintains business continuity and keeps security intact throughout the transfer
- an obligation on the provider to support the customer’s exit strategy, including by providing all relevant information
- a maximum notice period for starting the switch, which cannot exceed two months
- an exhaustive specification of the categories of data and digital assets that can be ported, and an exhaustive specification of what is excluded as internal to the provider
- a minimum data retrieval period of at least 30 calendar days after the transition ends
- a clause guaranteeing full erasure of exportable data once retrieval closes
Article 29 handles the money. From 11 January 2024 to 12 January 2027 providers may charge reduced switching charges capped at the costs they actually incur. From 12 January 2027 they may impose no switching charges at all. The large cloud providers moved ahead of that deadline and waived egress fees for departing customers during 2024, which is why the egress line has quietly disappeared from hyperscaler exits while remaining wide open everywhere else.
Read that list again as a procurement checklist rather than as European law. Each item is a question a supplier can answer during evaluation, and each answer is worth money at renewal.
The terms worth negotiating
Price the transition at signature
Put transition assistance day rates in the contract at the same time as everything else, capped and indexed. A rate agreed while you are still choosing is a different number from a rate quoted once you have chosen. If a supplier will only give a rate card at exit, that is your answer about how the exit will go.
Define the export by naming the format
“You can export your data at any time” is not a term. Name the formats, the schema documentation, whether attachments and audit history are included, whether historical versions come across, and how the export handles records that reference each other. Agree a sample export during implementation, so the format is proven while the relationship is good.
Fix the four dates at signature
Borrow the Data Act shape: a notice period capped in months, a transition window measured in days with the service still running, a retrieval window after that, then certified deletion. Four dates, all fixed at signature. Without them, every step becomes a negotiation you are conducting from the weaker side. Contract negotiation support is most useful at exactly this point, before signature.
Kill the survival clauses you did not notice
Minimum commitments, ramped discounts that claw back on early termination, and auto-renewal windows that quietly precede your decision date. Read them together with the renewal mechanics covered in our piece on running a renewal as a procurement event. A ninety day auto-renewal notice and a ninety day exit notice are the same trap wearing different labels. To see where the exit bill sits in the full cost of a contract, use our five-year total cost of ownership model.
Get deletion in writing, with evidence
Certified deletion within a named period, extended explicitly to backups, subprocessors and any analytics copies, with a written certificate you can hand to a regulator or an auditor. APP 11.2 is your obligation, and it does not transfer to the supplier merely because the data sits on their disks.
Name who is entitled to help you leave
Some agreements bar the incumbent from working with a named competitor, or limit assistance to your own staff. Require cooperation with a third party of your choosing, including the incoming supplier, under confidentiality. Otherwise the migration is staffed by people whose employer would prefer it went badly.
Test the clause before you rely on it
An exit clause that has never been exercised is a theory. Two cheap tests convert it into evidence.
Run a sample export during implementation, while the supplier is motivated and the project has budget. Load it somewhere neutral and see what survives. This is the single highest value hour in the whole exercise, and it usually finds something: attachments arriving as opaque identifiers, audit trails omitted, custom fields flattened into one column.
Then hold a short exit tabletop, once, with the people who would actually run it. Assume a decision to leave next quarter and walk the four dates, the export format, the dual running cost and the deletion evidence. An hour of that in year one is worth more than any clause review in year three, because it tells you which parts of the plan are real.
Both tests also produce exactly the artefacts a regulator asks for. CPS 230 expects an entity to be able to conduct an orderly exit. A dated sample export and a tabletop record are how you show that rather than assert it.
How CYBORIUM helps
CYBORIUM is an independent technology advisory. We do not charge decision owners a fee and we do not resell software, so we have no interest in which supplier you pick or how long you stay. We put the exit questions into the evaluation itself, because that is the only point in the relationship when a supplier has a reason to answer them.
Related guidance: APRA CPS 230 due diligence, vendor and supplier risk management, backup and recovery procurement, and managing procurement risk in IT and cybersecurity.
Frequently asked questions
What is transition-out in a technology contract?
Transition-out is the defined period during which an outgoing supplier keeps the service running while handing it over, supplies your data in an agreed format, and assists your incoming supplier. Exit is the decision. Transition-out is the mechanism that makes the decision executable.
Are cloud egress fees still charged in Australia?
The major cloud providers waived transfer-out charges for customers leaving during 2024, under competitive and regulatory pressure that originated in Europe, and Australian customers benefit from those global policies. Software vendors below that tier are a different matter, and most contracts say nothing at all about the cost of getting your data out.
Does the EU Data Act apply to an Australian business?
Generally it applies to services offered in the European Union, so an Australian decision owner contracting locally cannot rely on it. Its value here is as drafting. If your supplier already meets Article 25 for its European customers, asking for the same terms costs them very little and costs you nothing to ask.
What does CPS 230 require about exiting a supplier?
Paragraph 56 requires an APRA-regulated entity to ensure it can conduct an orderly exit from each material arrangement if needed, and paragraph 48 requires the service provider management policy to cover substituting and exiting agreements. The standard does not prescribe clause wording, which leaves the decision owner to define what orderly means in the contract.
When should exit terms be negotiated?
During the evaluation, before a preferred supplier is named. Once a decision is announced internally, the commercial position changes and exit terms become the first thing traded away for a discount that looks better on the business case.
How much should we budget for exit?
Rather than a rule of thumb, price the six components above for the specific service, with dual running as its own line. For a configured enterprise platform the realistic total often lands beyond a year of subscription, which is the figure that should sit next to the renewal quote when the time comes. CYBORIUM's five-year total cost of ownership calculator lets you enter that exit figure next to subscription, uplift and staff costs to see the real total against the quoted price.
Official sources and update status
- Prudential Standard CPS 230 Operational Risk Management, APRA, commenced 1 July 2025
- Final targeted amendments to CPS 230, APRA, commencing 1 July 2026
- Regulation (EU) 2023/2854 (Data Act), Articles 25 and 29 on switching
- Data Act overview, European Commission
- APP 11 guidelines on security and destruction of personal information, OAIC
- Digital Platform Services Inquiry, ACCC, concluded 23 June 2025
Information status: reviewed against publicly available Commonwealth and European sources on 16 September 2026. Regulatory positions change, and this is general information rather than legal advice.
Signing or renewing a major platform and want the exit priced before you commit? Talk to CYBORIUM.
Last updated:
