Your Exit Clause Is Not an Exit Plan

Last week was when the clock started, when you decided. This week is the one document where you describe your own dependencies to a supervisor, and what the fields in it give away.

Most firms have exit clauses. Article 30 requires them in contracts covering critical or important functions, so they exist, they were reviewed by someone competent, and they're filed.

A clause grants a right. Whether you can exercise that right is an architectural question, and the two have almost nothing to do with each other.

This is the part supervisors go at directly. A right to exit that nobody could actually perform is precisely what gets probed, because Article 28 asks you to assess concentration risk and be able to exit without undue disruption. Not to have permission to exit. To be able to.

And here's the uncomfortable bit. You describe your own position on this, in writing, once a year.

The Register of Information has fields for it. Under the implementing regulation, you report substitutability, difficulty of reintegration, and whether a credible alternative provider exists. Those sit alongside fields recording whether the service supports a critical function and what your recovery objectives are.

Fill those in honestly for a hyperscaler underneath your core platform, and the combination reads in one direction: low substitutability, hard to bring back in-house, no serious alternative, critical function, tight RTO. The exit-plan flag further down the form does very little to soften that. Anyone reading it sees a concentration and resilience problem first, and a documentation question somewhere after.

Somebody will ask how long it would take you to leave, and what it would cost. Most firms can answer the first question with a number that came from nowhere.

From: "Our contract gives us the right to exit."
To: "Here's the single thing that would stop us, and what removing it would cost."