Updated 17 October 2026. A service can be local and still be difficult to leave. Exit is therefore a useful sovereignty question: what can the organisation take with it, and what has to be rebuilt?

Rehearse the exit before relying on it

Identify the assets the workflow depends on. These may include documents, metadata, access rules, prompts, evaluation cases and integration configuration. The exact list depends on the product. An export of raw files may leave important context behind.

An illustrative migration test can move a small, non-sensitive sample into a replacement environment. Check whether the permissions and workflow meaning survive, not merely whether the download completes. A folder full of files is not necessarily a functioning service.

Look for dependencies that are costly to replace. A proprietary tool format, identity integration or approval mechanism may matter more than the model itself. Record the replacement work honestly rather than describing portability as a binary feature.

Contract terms and technical capability should agree. A right to retrieve data is more useful when the service can produce an intelligible export within the agreed conditions. Legal review and a practical rehearsal answer different parts of the question.

Rehearse the exit before relying on it: review map
Question Evidence or action
Assets Data, context and configuration
Portability Usable export and preserved meaning
Replacement Dependencies and rebuilding work
Illustrative decision aid. Adapt it to the actual system and context.

The practical next step

Run a small exit exercise while the relationship is healthy. Discovering the missing pieces during a dispute is an unnecessarily dramatic way to learn about your architecture.

Keep the resulting decision, its owner and unresolved questions in a short decision record. For claims about agent behaviour, connect the decision to evaluation evidence rather than relying on a successful demonstration alone.

Further primary reading: NIST AI Risk Management Framework. The review map and product recommendations above are my analysis, not a certification or a legal assessment of a particular deployment.