The barrier was never the egress bill. The schema was.
The EU Data Act retires the egress bill in January 2027, and it does not retire the reason workloads stay where they are.
What the EU Data Act actually requires
The Data Act is Regulation (EU) 2023/2854, published in the Official Journal on 22 December 2023 and applicable since 12 September 2025.
Chapter VI covers switching between data processing services, and it is the part of the regulation that lands on engineers rather than lawyers.
Providers of Platform and Software as a Service must expose open interfaces and export customer data in a commonly used and machine readable format at minimum. Providers of Infrastructure as a Service must deliver materially comparable outcomes for the same input across the features two services share, which the Commission describes as functional equivalence. Every provider has to remove the obstacles a customer meets when moving.
From 12 January 2027 the switching charges, including data egress, are removed entirely.
The transitional window that lets providers charge for switching costs closes on the same date, so treat the date as a plan rather than a promise. The charge disappears; the obligation to have an exit that works does not.
The date is also easy to misread. Providers were already required to make interfaces and exports available, and 2027 only removes the fee, which means the compliance work for a customer starts with the next renewal rather than with the deadline.
The lock in nobody billed for
The regulation removes the price of leaving, which leaves the engineering question underneath it: can your data and the applications around it be rebuilt on another provider at all?
That question stays invisible while egress costs money, because the invoice looks like the constraint and nobody pushes on the harder one. Teams can draw their architecture on a whiteboard and cannot produce an export.
The common mistake is reading the cloud chapter as a data access right. Access is the easy half, and portability includes the identity model, the queue settings and the integrations that make a workload useful, none of which appear on an invoice.
Lock in is usually an architecture decision made early and never revisited, which is a harder conversation now that moving is a dated obligation instead of a negotiation.
Where the regulation reaches further
The same law gives users of connected products access to the raw data those products generate, free of charge, while inferred or derived data stays out of scope and none of it may be used to build a competing product.
There is one limit worth knowing, because it surprises teams who read the regulation as global portability by default: a data holder is not obliged to share data with third parties established outside the EU.
Another chapter bans contractual terms imposed without negotiation where they unfairly limit liability or remedies, so a cloud agreement that no technical person has ever read is now worth reading.
Vendors will change their paperwork before they change their platforms, so the first visible trace of this regulation inside most stacks will be an annex in a contract rather than a new export button.
Enforcement sits with national authorities, and Member States must appoint a data coordinator as the single point of contact, while Chapter VIII points to an EU repository that will carry standards and specifications for cloud interoperability.
The Commission has published frequently asked questions about the Data Act and opened a legal helpdesk, which is the cheapest place to test a specific clause before a renewal deadline does it for you.
Brussels keeps turning data and resilience rules into dated engineering work, and the Cyber Resilience Act and its reporting clock belongs in the same plan.
Three checks to run before January 2027
1. Inventory data by exportability, not by owner. For every service, list the input and output data your team generates and record whether it leaves through an open interface in a machine readable format. That list is the obligation your provider carries and the first artifact a migration asks for.
2. Prove functional equivalence on one real workload. Take a workload that will not hurt if it breaks, run the same input against a second provider, and compare the output for the features both services claim to share. A gap found now is a backlog item, and a gap found during a migration is the reason the migration stalls.
3. Put exit terms into the next contract review. Read the switching, export and termination clauses against the minimum content requirements, using the Commission's draft model contractual terms and standard contractual clauses for cloud contracts as the benchmark you hold vendors to.
The obligations land on the providers, and the consequences land on whoever has to answer a migration plan in a meeting. That is usually a platform team with no authority over the contract that made the choice.
None of this is exotic work. It is the ordinary cloud fundamentals of interfaces, formats and configuration that travels, which is also why the skill is easy to test and hard to fake.
Give the work a named owner and a date, because an export nobody has run is a diagram, and the difference between the two shows up on the worst possible day.
If the team needs a starting point, the cloud and infrastructure courses cover the parts that decide whether a workload is portable in the first place.
The assumption that expired
The old assumption was that lock in is a commercial risk you negotiate at renewal. The new reality is that it is a set of interfaces and formats you either exercise or lose.
Free egress does not move a workload. It only removes the last reason to postpone finding out whether you could move it.
If your main provider made egress free tomorrow, which workload would you move first, and what would you discover you cannot export?
Images: the Berlaymont building by MPorciusCato, the Altenwerder container terminal by Wolfgang Meinhart, and a container ship loading, each CC BY-SA 3.0, via Wikimedia Commons.