VND-013 Regulatory and Exit Terms in Customer Agreements
Description
The executed agreement with each customer, or the standard terms it incorporates, states the terms on which the customer leaves and any term a regulation makes compulsory for the data the customer entrusts. The exit terms give the notice period for initiating a switch, the transitional period during which the contract stays in force, the retrieval period that starts when the transitional period ends, the point at which the customer's data and digital assets are erased, the basis of any switching charge, an obligation to support the customer's exit strategy including by supplying the information it needs, the exhaustive list of the categories the customer can take with it and of the provider-internal categories excluded from that list with a ground for each and a statement that no exclusion impedes or delays the switch, the customer's election on expiry of the notice period between another provider, its own infrastructure and erasure, a right to extend the transitional period once, notification to the customer when the contract terminates and the grounds and notice periods for termination, among them a subcontracting change the customer objected to, one implemented before the notice period ended without approval and the subcontracting of a service the agreement does not permit. A register records each regulation that imposes contractual terms on data the organisation processes for a customer, the role the organisation holds under it, the terms it requires, the agreements in force subject to it, the date each was last confirmed against the current terms and any date from which a rule reaching an agreement stops permitting a switching charge, and no such charge is raised on or after that date. A statement reachable without an account gives the standard service fees, any early termination charge and any charge for moving data out of the service, says for each whether it applies to a switch away, to use alongside another service or to both, names the services the organisation knows to be complex or costly to move away from and names any switching duty it does not undertake with the ground, and each switching or egress charge invoiced has a retained calculation tying the amount to the costs the organisation incurred that are directly linked to the switch or to the egress. The agreement is available in a storable, reproducible form before signature and the terms flowed to a subcontractor handling the same regulated data are equivalent to those owed to the customer. No term of the agreement conditions termination, a contract with another provider or the retrieval of the customer's data on anything beyond the periods it states.
Rationale
A customer leaving is the moment at which the two parties' interests diverge completely, and it is the moment the library said nothing about: every vendor-domain control speaks from the buying seat. An operational export is not a promise, because the provider can withdraw it. A term of a signed agreement is. The periods are parameters rather than numbers because the numbers are jurisdictional and belong in the profile applicability row, with one exception the register carries: where a rule reaching an agreement fixes a date from which no switching charge may be raised, that date is a field of the register and the charge stops on it. For an agreement reached by Regulation (EU) 2023/2854 that date is 12 January 2027, when Art. 29(1) permits no switching charge at all; until then Art. 29(2) and (3) permit a reduced charge capped at the costs directly linked to the switch, and the retained calculation evidences that cap. The register is also what keeps the regulatory limb honest: a single standard template answers the requirement once, and the reconciliation against the contract system shows it was applied to every agreement that needed it. Boundaries. DAT-023 holds the export capability and is tested by running an export; this control holds what the contract promises and is tested by reading it. DAT-026 holds what happened during a switch that occurred. DAT-027 holds who can reach the retrieval interfaces and on what terms. VND-002 holds the security terms the organisation requires of its own suppliers, the mirror seat, and an assessor cannot satisfy both with one contract because the counterparties differ. VND-011 holds the published responsibility matrix, which either party can read and neither has signed. VND-003 holds the sub-processor register the equivalence clause points at. VND-015 holds the disclosure and the hold on a subcontracting change; only the termination ground that change creates is stated here. BCM-010 holds the exit plans the organisation keeps for services it buys.
Applicability (9 profiles)
A hosted service has customers whose data it holds, so the terms on which a customer leaves and the terms a regulation makes compulsory for that data are commitments of the service rather than internal practice.
Exit and regulatory terms are what a provider owes the customers of a service it sells. An enterprise operating AI systems for its own business is the customer in that relationship, and the terms it reads are covered by VND-002 and VND-004. Where the deployer also supplies a service to external customers it holds the provider seat for that service and reads the row on saas-ai-provider.
Condition: deployment_model in cloud-saas, cloud-single-tenant
A hosted service has customers whose data it holds, so the terms on which a customer leaves and the terms a regulation makes compulsory for that data are commitments of the service rather than internal practice. Conditional since 1.1: the profile lists every deployment model and this row is a commitment of a hosted service, so a provider that publishes weights or runs on infrastructure the customer controls has no hosted service to carry it (ADR-046 amendment, 2026-09-16).
A hosted service has customers whose data it holds, so the terms on which a customer leaves and the terms a regulation makes compulsory for that data are commitments of the service rather than internal practice.
Exit and regulatory terms are what a provider owes the customers of a service it sells. An enterprise operating AI systems for its own business is the customer in that relationship, and the terms it reads are covered by VND-002 and VND-004. Where the deployer also supplies a service to external customers it holds the provider seat for that service and reads the row on saas-ai-provider.
Art. 25 fixes the periods the control states as parameters: a notice period of no more than two months, a mandatory maximum transitional period of 30 calendar days initiated after it and a retrieval period of at least 30 calendar days after that. Art. 29 fixes the charges: reduced switching charges capped at the costs directly linked to the switch from 11 January 2024, and no switching charge at all from 12 January 2027, which is the date the register carries for an agreement this instrument reaches. Art. 34(2) leaves an egress charge for parallel use at cost. Art. 31(3) makes the pre-contract notice of inapplicable obligations a duty in its own right.
The contract terms run both ways under DORA. Art. 28(7) names four circumstances in which a financial customer must be able to terminate, including where its supervisor can no longer effectively supervise it because of the arrangement, and Art. 30(2)(h) requires termination rights and minimum notice periods set against the expectations of competent and resolution authorities. RTS 2025/532 Art. 6 adds three grounds turning on an unapproved subcontracting change, which the control states in full. VND-002 keeps the buying seat.
164.314(a)(1) and 164.314(a)(2)(i)(A) put the compliance undertaking in the executed business associate agreement, which is the first artefact a United States healthcare customer asks a vendor for. A published responsibility matrix states the same commitment and is not the contract the rule asks for. The register keeps the set current once the required terms change, and the equivalence of the terms flowed to a subcontractor is the 164.314(a)(2)(i)(B) duty VND-003 holds, read from the upward-facing side.
A hosted service has customers whose data it holds, so the terms on which a customer leaves and the terms a regulation makes compulsory for that data are commitments of the service rather than internal practice.
Framework Mappings (26)
| DORA-Art.28.7 | Termination grounds in contractual arrangements | partial |
| DORA-Art.30.2.h | Termination rights and minimum notice periods | partial |
| DORA-RTS-2025/532-Art.6 | Termination for unauthorised subcontracting changes | full |
| EU-DA-Art.23.a | Contract Termination on Completion of Switching | full |
| EU-DA-Art.23.b | Freedom to Contract with a Different Provider | full |
| EU-DA-Art.23.e | Unbundling of Infrastructure Services | partial |
| EU-DA-Art.25.1 | Written Switching Contract Available Before Signing | full |
| EU-DA-Art.25.2 | Minimum Content of the Switching Contract | full |
| EU-DA-Art.25.2.a | Thirty-Day Maximum Transitional Period | partial |
| EU-DA-Art.25.2.b | Support for the Customer Exit Strategy | full |
| EU-DA-Art.25.2.c | Contract Termination Trigger and Notification | full |
| EU-DA-Art.25.2.d | Maximum Notice Period of Two Months | partial |
| EU-DA-Art.25.2.f | Exempted Provider-Internal Data Categories | full |
| EU-DA-Art.25.2.i | Switching Charges Clause | full |
| EU-DA-Art.25.3 | Customer Election on Expiry of the Notice Period | full |
| EU-DA-Art.25.5 | Customer Right to Extend the Transitional Period | full |
| EU-DA-Art.29.1 | Abolition of Switching Charges from 12 January 2027 | full |
| EU-DA-Art.29.2 | Reduced Switching Charges in the Transitional Window | partial |
| EU-DA-Art.29.3 | Reduced Charges Capped at Directly Linked Costs | full |
| EU-DA-Art.29.4 | Pre-Contract Information on Fees and Charges | full |
| EU-DA-Art.29.5 | Information on Complex or Costly Switching | full |
| EU-DA-Art.29.6 | Public Availability of Charge Information | full |
| EU-DA-Art.31.3 | Pre-Contract Notice of Inapplicable Obligations | full |
| EU-DA-Art.34.2 | Egress Charges for In-Parallel Use | full |
| HIPAA-164.314.a.1 | Business Associate Contracts or Other Arrangements | full |
| HIPAA-164.314.a.2.i.A | Business Associate Contract Compliance Term | full |
Evidence (3)
Executed customer agreement, or the standard terms it incorporates, carrying the exit terms and any term a regulation makes compulsory for the data the customer entrusts.
Example: Executed master services agreement with Northbank Insurance, signed 14 April 2026, incorporating standard terms v7.2 and the healthcare data addendum of 2 February 2026.
Test: Request the customer agreement in force for a sample drawn from the register. Verify: (1) a notice period for initiating a switch is stated as a maximum and no minimum term, renewal window or termination charge runs past it, (2) a transitional period is stated as a maximum and the agreement says the contract remains in force during it, (3) a retrieval period is stated as a minimum and starts at the end of the transitional period rather than at termination, (4) the erasure commitment covers the customer's data and its digital assets and is tied to the expiry of the retrieval period, (5) the portable categories are exhaustive, the excluded provider-internal categories each carry a ground and the agreement says no exclusion impedes or delays the switch, (6) the customer can elect on expiry of the notice period between another provider, its own infrastructure and erasure, and can extend the transitional period once, (7) termination grounds and notice periods are stated, among them a subcontracting change objected to, one implemented before the notice period ended without approval and the subcontracting of a service the agreement does not permit, (8) where the register names a regulation reaching this agreement, each term that regulation requires appears in the executed instrument rather than in a page either party can change on its own, (9) the version in force was obtainable in a storable form before the signature date on the executed copy.
Register of the regulations that impose contractual terms on data the organisation processes for customers, with the agreements each reaches, the confirmation dates and any date from which a switching charge may no longer be raised.
Example: Customer terms register extract customer-terms-register-2026-06.csv, generated 30 June 2026, covering four regulations and 212 agreements in force.
Test: Verify: (1) the register names each regulation that imposes contractual terms on the organisation's processing for a customer and the role the organisation holds under each, (2) the terms each regulation requires are listed rather than referenced as an instrument in general, (3) every agreement in force subject to a listed regulation appears against it and the count reconciles to the customer contract system for the data categories in scope, (4) each entry names the subcontractor agreements carrying the equivalent flowed-down terms, (5) each agreement carries the date it was last confirmed against the current terms and no confirmation is older than the interval the register states, (6) where the required terms changed in the period, every affected agreement shows an amendment or a recorded decision that none was needed, (7) where a rule reaching an agreement fixes a date from which no switching charge may be raised, the register carries that date, and for an agreement reached by Regulation (EU) 2023/2854 that date is 12 January 2027, (8) no invoice in the period raised a switching charge on an agreement on or after the date the register carries for it.
Published charge statement as reachable without an account, with the retained calculation behind every switching or egress charge invoiced in the period.
Example: Pricing and switching charges page captured 30 June 2026, with cost workings for invoices INV-2026-0418 and INV-2026-0533.
Test: Retrieve the charge statement without authenticating and take every invoice in the period carrying a switching or egress charge. Verify: (1) the statement gives the standard service fees, any early termination charge and any charge for moving data out of the service, (2) each is classified as applying to a switch away, to use alongside another service or to both, (3) the statement names the services the organisation knows to be complex or costly to move away from, (4) where a switching duty is not undertaken for a service, the statement names the duty and the ground, (5) every invoiced switching or egress charge has a retained calculation tying the amount to costs incurred that are directly linked to that switch or egress rather than to a catalogue rate, (6) the statement was current at the date of each invoice sampled, (7) the statement was reachable without an account, a login wall or a request to sales.
Questions (3)
Is there a register of the customer agreements in force and the terms each is required to carry?
The register is about terms the organisation accepts from a customer, not terms it imposes on a supplier; those are in the vendor contract control. Answer yes only where the register exists and lists the agreements, not merely the regulations.
Which of the following does the customer agreement state?
Count only what the executed agreement or the terms it incorporates say. A commitment made in product documentation, a support article or a trust centre page is not a term of the agreement. Options follow the order a switching schedule is normally drafted in, not an order of importance.
How is the agreement set kept current when the terms a regulation requires change?
Options run strongest to weakest. Answer on what happened the last time a required term changed, not on what the contract management procedure says would happen.