You can’t avoid every dependency. You can keep control of the critical ones.
Full independence from technology providers is rarely achievable and seldom worth its price. The practical question is narrower: which dependencies would actually threaten your control, and which decisions keep an exit open? Most of them are made early, in contracts, data models and interfaces, long before anyone notices.
My role: I set the decision framework and steer your providers against it. I do not review code or assess architectures technically. Implementation stays with your team or partners, and legal assessments stay with your counsel.
Six decisions that determine your room to manoeuvre
Know which dependencies are critical
Not every provider matters equally. Start with an inventory: which systems hold critical data or processes, how hard each one is to replace, and where several functions depend on the same provider.
Decide per data class who can compel access
Hosting location alone does not settle the risk. Under the US CLOUD Act, US authorities can require providers subject to US jurisdiction to disclose data in their possession, custody or control, even when it is stored outside the US1. Decide per data class what is acceptable under the Swiss FADP2 and, where you serve EU markets, the GDPR.
Secure the exit before you sign
Lock-in is decided in the contract and the data model, not at the end of the relationship. Agree on data export in open formats, a defined handover period and termination support while your negotiating leverage is highest.
Integrate through open standards, not proprietary connectors
Integrations built on documented interfaces (OpenAPI) and standard identity protocols (OAuth 2.0, OpenID Connect) are easier to move to another provider. Proprietary connectors tie your operations to one vendor.
Own your product data before the EU asks for it
If you sell physical products in the EU, the Ecodesign for Sustainable Products Regulation (ESPR) introduces the Digital Product Passport3. Requirements apply product group by product group as delegated acts are adopted, starting with iron and steel, then textiles, tyres and aluminium. Decide early who owns the data model, and use open identifiers such as GS1 Digital Link4 so partners and authorities can read the data independently of your platform provider. I bring this from my time leading a software provider for digital product passports.
Make your use of AI auditable
Generative and agentic AI need an inventory of where AI is used, a risk classification, and documented data sources and human oversight. Where you place AI systems on the EU market or their output is used in the EU, the EU AI Act applies5. Obligations depend on the risk class and are phased in; in 2026 the EU agreed to postpone the deadlines for high-risk systems6.
Platform decisions that outlast the mandate.
A Digital Baseline Assessment maps your critical provider dependencies, data residency constraints and AI exposure, and shows which trade-offs need a board decision now. Fixed price, two to three weeks, credited against a fractional mandate started within 60 days.
Book an introductory callEvery engagement is led personally by Kevin Lancashire.
Sources
- EDPB & EDPS (2019). Initial legal assessment of the impact of the US CLOUD Act on the EU legal framework for the protection of personal data.
- Federal Office of Justice. Data protection: legal bases (Federal Act on Data Protection, FADP, in force since 1 September 2023).
- Regulation (EU) 2024/1781 (ESPR), in force since 18 July 2024; product groups per the Commission’s first working plan 2025–2030, summarised by Ireland’s Department of Enterprise.
- GS1. GS1 Digital Link standard.
- Regulation (EU) 2024/1689 (AI Act).
- Political agreement on the AI part of the Digital Omnibus, 7 May 2026; summary by Winston Taylor. Check formal adoption before relying on new dates.