How do you manage AI vendor lock-in? Five strategies for UK organisations: multi-provider, self-hosting, open-weight models, contract terms and exit plans.
Link copied
Picture a technology team three years ago. It puts its entire AI stack on a single provider. The decision is quick and sensible: one contract, one integration, one invoice. Today the same provider raises its prices, and the team asks a question for the first time: if we moved to another provider, how long would it take and what would we lose?
If nobody can answer, the organisation already has a lock-in problem.
AI vendor lock-in is the point at which an organisation's AI stack depends so heavily on one provider that the cost of switching becomes prohibitive. The risk runs from price rises to regulatory change to a provider changing its own product strategy. This piece sets out five ways to measure and manage that risk.
A single provider brings speed and focus. Gartner made the same observation in November 2025: organisations that want to use generative AI at scale often choose a single vendor for speed and simplicity. Gartner also warned that this deep dependency can affect technical agility and future negotiating power on pricing, terms and service levels.
The risk is the gradual loss of the option to move. Economists call this option value. Once the option has gone, so has the leverage on price, service quality and the product roadmap.
Gartner's recommendation is to prioritise open standards, open APIs and modular architecture in the AI stack, and to make interoperability a standard part of generative AI pilots. The same analysis made two predictions:
Both point the same way. The architecture decision you take today sets your flexibility three years from now.
The Competition and Markets Authority's cloud services market investigation gives a UK picture of how hard switching can be. In its final decision of 31 July 2025, the CMA reported that UK customers spent £10.5 billion on cloud services in 2024, and that fewer than 1% of customers switch provider each year. It found that egress fees reduce customers' ability and incentive to switch or to use more than one cloud, particularly for smaller customers and those with large volumes of stored data.
AI workloads sit on the same infrastructure. The CMA noted that cloud services underpin AI model development and deployment.
The picture has started to move. On 31 March 2026 the CMA announced a package of actions: AWS extended its free-egress switching window from 90 to 180 days, and Microsoft committed to amend UK contracts to allow free switching. On 14 May 2026 the CMA opened a strategic market status investigation into Microsoft's business software ecosystem, including licensing practices it had found to reduce competition in cloud services. A decision is due in February 2027.
For organisations that also buy from EU-based providers, the EU Data Act has applied since 12 September 2025 and removes switching charges, including data egress charges, entirely from 12 January 2027.
Government guidance is realistic about the limits. The Government Digital Service's guidance on managing technical lock-in in the cloud states that "it's impossible to avoid technical lock-in completely", and that an exit strategy should balance the impact of changing provider against the benefit of staying.
Sending personal data to an AI provider outside the UK is a restricted transfer under UK GDPR. Since 5 February 2026, the Data (Use and Access) Act 2025 has framed the test for transfers around whether the standard of protection is "not materially lower" than in the UK. The ICO's guidance describes the transfer risk assessment in the same terms.
The main tools are:
Check which of these applies to each AI provider you use, and bring the legal team into supplier selection from day one. (Position as of September 2026.)
All five share one aim: staying in a position where you can leave if you need to. You don't need all five at once; the decision matrix below shows where to start.
One model in production, more than one in development. Let your operational AI agent run on a single model for speed. In your development and evaluation environment, keep testing at least two different providers.
You don't need to use Anthropic, OpenAI, Google, Meta and Mistral all at once. Keeping at least two providers' APIs live and tested is enough.
A practical starting rule: don't give your entire production load to one provider. Running a small share on a parallel provider is the most concrete proof that switching is possible.
Some data should stay inside your own environment. Legal, health, financial and critical infrastructure data come first on that list, and every restricted transfer of personal data adds the obligations described above.
Open-weight model families such as Llama, Mistral and Qwen can now run on an organisation's own servers. The approach I see most often in practice is hybrid: general work runs on a cloud model, and work involving sensitive data runs on an in-house model.
An open-weight model is a model you can hold your own copy of. When you fine-tune a model like Llama or Mistral for your domain, the resulting weights are yours. If the provider changes its price, closes the product or tightens its licence, you can carry on with your own version.
Read open-model licences one by one. Some allow commercial use freely; others attach conditions. Meta's Llama licence, for example, requires companies with more than 700 million monthly active users to request a separate licence. Review the terms with your legal team.
For a smaller business, the equivalent is running a small open model on a local server with retrieval over your own documents (RAG). Planning by company size is covered in our AI roadmap for SMEs.
AI providers' standard contracts are mostly written around the provider's needs. Four terms deserve negotiation:
Where personal data goes to a provider outside the UK, add the transfer mechanism (IDTA, Addendum or data bridge) to the list.
No provider relationship lasts forever. Planning the exit at the point of entry is a sign of maturity. Exit architecture has five parts:
For regulated financial firms, exit planning is already a supervisory expectation. The PRA's supervisory statement SS2/21 on outsourcing and third-party risk management includes a chapter on business continuity and exit plans.
None of these parts works fully until the data side is ready. I covered the state the data needs to be in, in my piece on data governance.
| Profile | Priority 1 | Priority 2 | Priority 3 |
|---|---|---|---|
SME at pilot stage | Contract safeguards | Multi-provider (in testing) | Exit architecture |
Mid-sized firm scaling up | Multi-provider | Open-weight hybrid | Contract safeguards |
Regulated large organisation | Self-hosting option | Multi-provider | Exit architecture |
Organisation running critical operations | All five together | All five together | All five together |
To track which strategy is paying off, use the cost and risk measures in our AI ROI metrics.
This short talk of mine looks at growth marketing in the technology sector:
Growth Marketing in Technology | Yuce Zerey (YouTube)
List your current AI suppliers and build a four-column table: annual spend, contract end date, whether there is an exit clause, and whether an alternative is being tested. That table is your organisation's AI dependency map. Ask technology and legal to look at it together tomorrow.
It is the point at which an organisation's AI stack depends so heavily on one provider that the cost of switching becomes prohibitive. The risk shows up with price rises, regulatory change or a provider changing its product strategy.
In the short term it adds testing and integration costs. In return it gives negotiating leverage on price and a way to switch during an outage. To keep the cost down, use the second provider only in testing and evaluation at first.
Sending personal data to a provider outside the UK is a restricted transfer under UK GDPR. Since 5 February 2026 the test is whether protection is "not materially lower" than in the UK. The usual tools are the IDTA, the UK Addendum to the EU standard contractual clauses, or the UK-US data bridge for certified US organisations. Work through the details with your legal team.
The CMA found in July 2025 that egress fees reduce customers' ability to switch or use more than one cloud. In March 2026 AWS extended its free-egress switching window to 180 days and Microsoft committed to free switching in UK contracts. Check the current terms in your own contract.
For specific tasks they can come close. Open models fine-tuned for a domain can work well for customer service and internal document search. On general reasoning and complex agent work, closed models are often ahead. Measuring with your own test set is the most reliable method.
Put all your AI suppliers in one table: annual spend, contract end date, exit clause and whether an alternative is being tested. The table shows where the risk is concentrated.
After Dinner Speakers
Contents
