The EU Data Act was talked about mostly as a data-sharing regulation. That is not the part that will land hardest on cloud spend in the next 18 months. The switching regime is. It is a set of legally-binding rules that force cloud providers to make their services interchangeable, in the same spirit the EU brought to phone chargers. Tech press has been calling it "USB-C for the cloud," which is editorial shorthand rather than a Commission phrase, but the direction is right.
If your product runs on cloud, and any of your users or your legal entity sits in the EU, this changes what a good architecture looks like starting now.
What the Data Act actually requires
The EU Data Act (Regulation (EU) 2023/2854) is the follow-up to GDPR. It was published in the OJEU on December 22, 2023, entered into force on January 11, 2024, and became applicable on September 12, 2025. Articles 23 to 31 (the switching-regime chapter) cover any service that stores, processes, or moves data as a resource: IaaS, PaaS, and SaaS are all in scope, regardless of whether the provider is EU-established, as long as the service is offered into the EU.
The switching regime creates four concrete obligations on providers:
- A right to switch. Under Article 23, providers must remove "pre-commercial, commercial, technical, contractual and organisational obstacles" preventing customers from switching or achieving functional equivalence on a new provider.
- A capped switching notice period. Article 25 says the notice period a provider can require "shall not exceed two months," followed by a mandatory maximum transitional period of 30 calendar days to complete the switch (extendable once, up to seven months, in genuinely exceptional cases).
- A phase-out of switching charges. Between January 11, 2024 and January 12, 2027 providers may impose *reduced* switching charges capped at direct costs. From January 12, 2027 onwards, "providers of data processing services shall not impose any switching charges on the customer for the switching process." (Article 29.)
- Functional-equivalence and open-standards duties. Article 30 requires IaaS providers to enable "functional equivalence" — the customer's workload on the new provider must "obtain a materially comparable outcome in response to the same input." For PaaS and SaaS the bar is lower: open interfaces and machine-readable export formats.
Article 25 also spells out contract language that becomes unenforceable: any clause preventing you from switching, any clause bundling non-cloud services with cloud so you cannot exit one without exiting all, any clause forcing you to buy the provider's own migration service. On top of that, Article 13 lists unfair contract terms in B2B data-sharing contracts that are simply not binding, with the burden of proof on the drafter.
One important nuance on the fee ban that most reporting gets wrong: it applies to switching-related egress only. Day-to-day operational egress (serving content to end-users, cross-region replication) is *not* covered and remains billable. The Act closes the exit-fee lock-in, not general bandwidth pricing.
Who this actually hits
Every hyperscaler and every EU-based provider selling into an EU customer, regardless of where the provider is legally established. The Act applies to services *offered* in the EU. AWS US-East is subject to it if the customer is European. Azure Central India is subject to it if the workload is European.
The immediate practical shift, already visible in 2025, was AWS, Azure, and Google Cloud all announcing "free egress on account closure" programs. AWS calls it free data transfer out for customers moving off AWS. Google waived multi-cloud egress fees in the EU and launched its "Data Transfer Essentials" program on September 11, 2025, one day before the switching provisions applied. Azure did the same. All three waivers are exit-only, require case-by-case approval, and exclude services like CloudFront and Direct Connect. That is not generosity. That is a hyperscaler compliance move in front of a regulation that had already been drafted. From January 12, 2027 the friction around those waivers becomes legally indefensible.
The three things that actually change for a CTO
1. Egress fees are no longer a lock-in mechanism, at least not for European workloads.
Egress cost was for years the single biggest reason startups did not exit a hyperscaler even when their bill got ugly. It was cheaper to pay 25% more than to move a petabyte at $0.09 per GB. The Act kills that math for EU customers. When the switching-charge ban is fully in force on January 12, 2027, the ability to move workloads on economic grounds alone gets meaningful.
That does not mean you should move. It means the *option* to move is real, which changes negotiating leverage on renewal.
2. Multi-cloud stops being a tax and starts being a hedge.
The traditional argument against multi-cloud was that it added engineering overhead and did not pay off, because moving workloads was never practical. The Act makes moving practical (contractually). Combined with modern IaC and Kubernetes, it lowers the effort of running the same workload on two providers close enough that a serious CTO should treat it as a real architectural option, not a theoretical one.
The right pattern in 2026 is not to run everything everywhere. It is to design so that any critical workload *could* move within the 30-day window the regulation mandates, without a rewrite. That means Terraform or Pulumi over any provider-specific console workflow. Kubernetes over provider-native compute services where possible. Managed services from a single provider only when the workload does not need portability.
3. European providers become a first-class option, not a fallback.
Providers like Hetzner (DE), OVHcloud (FR), Scaleway (FR), IONOS (DE), STACKIT (DE), UpCloud (FI), and Leaseweb (NL) were previously in the "yes, but" category for anything beyond a side project. Cheaper per GB, but you lose managed services, ecosystem, and vendor confidence.
That calculus is now different. If your workload runs on Kubernetes with a Postgres or MongoDB you manage, the practical difference between running it on AWS EKS versus Hetzner K3s versus Scaleway Kapsule is smaller than it used to be. The new switching rights only work if there is somewhere else to switch *to*. For EU workloads, the EU providers are now that somewhere.
What we actually recommend
We build production infrastructure on all three tiers: hyperscalers, European providers, and specialty GPU clouds. Here is what we tell clients to do about the new regime today.
For workloads live on AWS, Azure, or GCP
Do not migrate reactively. Do this instead:
- Document your exit plan. Under Article 26 you are entitled to complete provider information about what data, artifacts, and configuration exist in the service, and under Article 27 the provider must act in good faith through the switch. Get the information, store it, and treat it as compliance documentation. National authorities (Germany's BNetzA has been most vocal) can request evidence that the switching path actually works.
- Push back on renewal terms. Any contract clause that limits your switching rights beyond what the Act allows is void. Your legal team should be reading vendor contracts against the new switching rights.
- Move IaC ownership to your side. If your infrastructure is defined by clicking around a console, you do not have a real exit path regardless of what the law says. Terraform your infrastructure now.
For workloads about to be provisioned in 2026
Design for portability from day one, even if you never use it. Concretely:
- Kubernetes over provider-native compute where the workload allows. K8s is the closest thing to the "USB-C" of workload placement.
- Object storage via S3 API (works with AWS S3, MinIO, Wasabi, Cloudflare R2, Scaleway Object Storage) rather than a provider-specific SDK.
- PostgreSQL over provider-native databases unless you have a documented reason otherwise.
- CloudNativePG or an equivalent operator so your database is portable to any conformant K8s cluster.
For workloads with EU data-residency requirements
The Act does not solve data-residency by itself, but combined with the EU Cybersecurity Certification Scheme for Cloud Services (EUCS) and PDPL, it is the moment to seriously reconsider a European provider. Our clients running healthcare or finance workloads in the EU are increasingly asking us to spec Hetzner or OVH for the compute tier, with hyperscaler managed services (Bedrock, Vertex AI) only where the EU alternatives are not yet mature.
The 2027 deadline is the real one
The rollout runs in phases. September 12, 2025 was when the switching provisions kicked in with reduced charges permitted. January 12, 2027 is when the switching-charge phase-out completes and the full economics land. Everything provider marketing is doing in 2026 is aimed at customer retention before that date. The AWS, Azure, and GCP "free egress for migration" programs, the surge of managed database offerings on EU providers, the new interoperability partnerships. None of it is coincidence.
Note also that on September 12, 2027, the unfair-terms rules extend to contracts signed *before* September 12, 2025, meaning legacy enterprise agreements are not grandfathered indefinitely.
Enforcement will be uneven. There is no pan-EU authority under the Act; each Member State appoints its own competent authority. Germany designated BNetzA as sole authority. The Netherlands has ACM plus the DPA where personal data intersects. Belgium and Ireland are still finalising their designations as of early 2026. Penalties are set nationally and must be "effective, proportionate, and dissuasive" — no GDPR-style harmonised cap. As of mid-2026, no major enforcement action has been reported publicly, but the fee-ban deadline is likely to change that.
If your infrastructure was designed on the assumption that switching cost 6 to 12 months of engineering time, that assumption is being deprecated by law over the next 18 months. The teams that update their architecture ahead of 2027 will get real negotiating power on renewal. The ones that wait will find their position quietly weaker as the deadline passes.
What we help with
We run production infrastructure on all four tiers you see on our CloudOps service page: hyperscalers, European providers, AI/GPU-native clouds, and specialty regional providers. EU Data Act conformance and multi-cloud portability engineering are covered under our standard engagement patterns.
If you have an EU-facing product on a single cloud today and want a technical read on what the new switching rules change for your architecture specifically, book a free 30-minute CloudOps audit.