The exit test: could your critical systems move in under a year?

The PrompX BriefingN° 0627 October 2026On the table in FrankfurtThe exit test: could your critical systems move in under a year? Europe is rewriting the rules on where data and workloads may live. The question for the board is simpler, and more uncomfortable: if you had to leave your provider, how long would it take? By the PrompX Editors · 5 min read On 5 October, the Dutch Tax and Customs Administration abandoned its plan to move its 47,500 staff to Microsoft 365. About 5,000 had already moved. The concerns behind the decision, raised by the Dutch Advisory Council on ICT Assessment, were not price or features. They were security, lock-in and the absence of an exit strategy. Five days earlier, a networking incident at Microsoft Azure disrupted network gateways in at least thirty-three regions, among them Germany West Central in Frankfurt, North Europe, West Europe, France Central, UK South and Switzerland North. In September, AWS told customers that some resources hosted only in its Bahrain region, damaged in wartime in March and April, could not be restored. None of this is a reason to abandon the cloud. Together it is a reason to put a question on the board agenda that most boards have never asked: where do our critical systems run, and could we move them if we had to? The figures 36% of large organisations would need more than twelve months to leave a critical technology provider. One in ten says it has no viable alternative at all.Capgemini Research Institute: 1,300 executives at organisations with revenue above US$1bn, 8 September 2026 59% say full digital sovereignty is not a realistic goal. Just under half would still pay a premium for sovereignty, averaging 23%.Capgemini Research Institute, same survey, 8 September 2026 16.3 GW BloombergNEF expects EU data-centre IT capacity to reach 16.3 GW in 2030, up from 9.1 GW at the end of 2026 but well short of the 27.4 GW that tripling implies. Ongoing constraints push Ireland and the Netherlands out of the five largest markets in Europe, the Middle East and Africa by 2035.BloombergNEF, EMEA data-centre outlook, 25 September 2026 30% of Ireland’s electricity could be used by data centres by 2035, and up to 17% of the Netherlands’, against a typical 2.5% in large European markets last year.Moody’s projections, as reported by The Register, 13 October 2026 What is changing, and what is not Sovereignty is becoming a purchasing standard. The proposed Cloud and AI Development Act sets four sovereignty levels for public procurement, from data processed and stored in the EU (Level 1) to full control of the software supply chain and no interference from a non-EU country (Level 4). It also aims to at least triple Europe’s data-centre capacity within five to seven years. Parliament formally referred it to committee in September; the lead committees expect to present a joint draft report on 1 December and to vote in mid-March. The cost is already contested. A study funded by CCIA Europe, whose members include Amazon, Google and Meta, puts it at €115 billion over a decade, six times the Commission’s upper estimate of €18 billion. Whatever the final text, public buyers will adopt these levels first. Regulated industries and their suppliers will meet them next. Leaving is about to get cheaper. Only on paper. From 12 January 2027, the EU Data Act removes switching charges entirely, including fees for moving data out. The commercial barrier to leaving falls in eleven weeks. The technical and organisational barriers do not: the skills, the integrations, the years of configuration that only one provider understands. Capacity is a power question. Building in Europe means building where the grid allows. The Commission has proposed an energy rating for data centres above 500 kW, with the first labels expected in 2027. Europe’s own champions are moving: the Schwarz Group, owner of Lidl, plans a €5.6 billion, 240-megawatt data centre near Rostock by 2033. Sovereign is not the same as resilient. A sovereignty label tells you whose law applies. It does not tell you what happens when a region fails. On 20 October, a power outage at a third-party facility in Google Cloud’s London region left customers of Lloyds, HSBC and Revolut without key services for hours, and the European Banking Authority asked Google for details. Four days later, AWS ran its European Sovereign Cloud for several hours without its global network, operated only by EU residents, and says service was not interrupted. It is a model worth copying: independence you have rehearsed is worth more than independence you have been promised. The question is no longer which cloud. It is which tier, and whether you can leave.Three moves for the next ninety days Tier your systems. Sort workloads by the consequence of losing them, or of a foreign authority reaching them. Agree which tier must meet which sovereignty level, and stop debating sovereignty in the abstract. Rehearse one exit. Take your most critical system and walk through leaving its provider: where it would go, how long it would take, what would break. Find out whether you are among the 36% before a regulator or a crisis asks. Renegotiate before January. Use renewals between now and 12 January to secure portability, exit assistance and usable data formats in writing. The law removes the fees. Only the contract removes the friction. For your next leadership meeting Which of our systems could we not run for a week if one provider or region failed? If a regulator asked tomorrow for our exit plan for our main cloud provider, what would we hand over? Where are we paying for sovereignty, and does it buy resilience or only reassurance? Now, two minutes. Below this briefing are five statements. Answer them for your organisation as it is today, and see where you stand. Sources Tweede Kamer, Letter from the State Secretary for Finance on the future of the tax administration, 5 October 2026; The Register, Dutch tax office drops Microsoft 365 migration, 7 October 2026. The Register, Azure maintenance incident disrupts hybrid connections, 1 October 2026; Microsoft, Azure post-incident review 7Q30-010, 30 September 2026. The Register, AWS unable to restore some Middle East resources, 16 September 2026. Capgemini Research Institute, Digital sovereignty survey, 8 September 2026. BloombergNEF, EMEA data-centre outlook: five things to know, 25 September 2026. The Register, Moody’s on European data-centre electricity demand, 13 October 2026. European Commission, Cloud and AI Development Act; European Parliament, procedure file 2026/0138(COD); MLex, EU lawmakers to present report on the Cloud and AI Development Act in December, 7 October 2026; techUK, Dispatch from Brussels, 9 October 2026. CCIA Europe, Study on the cost of the Cloud and AI Development Act, carried out by ECIPE, 13 October 2026; CCIA, member list. European Commission, Data Act explained. European Commission, EU rating system for data centres, 21 September 2026. CIO.de, Schwarz Group data centre near Rostock, 27 August 2026. The Register, Google Cloud blames a power event for its London outage, 20 October 2026; Reuters (via The Star), Europe’s financial regulators query Google over cloud outage, 21 October 2026; AWS, European Sovereign Cloud: demonstrating independent operation, 28 September 2026; Dutch IT Channel, AWS demonstrates the operational independence of its European Sovereign Cloud, 26 October 2026. The PrompX Editors

Where does your organisation stand?

Where should your critical systems run?

More briefings

Only one company in eight consistently weighs what AI returns against what it costs

Europe postponed its high-risk AI rules. It did not postpone the rest.

Most companies cannot trace an AI decision back to its data. Can yours?

What each euro of AI must buy in 2027