Your AI agent answers customers, sorts requests, drafts quotes. It has been running for eight months. Then one day the provider raises its rates without notice, or stops answering, or announces a change of technology. You ask for the files. You are told the agent is hosted on their platform, that the prompts are their intellectual property, and that migration will take three months, billed.
This scenario is not rare. It is the direct consequence of a contract signed without a reversibility clause. The good news: reversibility is prepared before signature, in half a day of work. This article describes what you must be able to recover, what European law already guarantees, and the clauses that make the difference.
Key Takeaways
- Recovering an AI agent is not just about code: you need the prompts, the workflows, the knowledge base, access to accounts, the logs and the test sets.
- The European Data Act caps and then removes cloud switching fees, but leaves the provider free to withhold its own intellectual property.
- The GDPR only covers personal data, not models, embeddings or your agent's settings.
- Three clauses are enough to secure an exit: a named delivery format, an enforceable deadline and capped paid assistance.
- A dry-run export before signature beats ten sales promises.
What "recovering your agent" really covers
A production AI agent is an assembly. The language model is only one part, often the cheapest to replace. What costs money is the work accumulated around it: the instructions that encode your business rules, the call chains, the reference documents, the corrections made after months of use.
A serious exit inventory has seven families of assets.
- Code and configurations. The application code, environment variables, tool definitions and model call schemas.
- Prompts and their versions. Not only the current production version: the history, the variants that were tested and the comments explaining why a given wording was kept.
- Automation workflows. If the agent triggers actions in your CRM, billing or email, the corresponding scenarios must be exportable, with their triggers and error-handling rules.
- The knowledge base. Indexed documents, chunking, metadata and, where possible, the vectors, without which everything must be re-indexed.
- Access. API accounts, keys, mailboxes, phone numbers, domains. An agent whose phone number is held by the provider is not reversible, it is confiscated.
- Operating data. Conversation logs, escalated tickets, usage statistics, correction history.
- Quality evidence. The test set, the regression cases, the last evaluation scores. Without them, the new agent will be judged on impression, not measurement.
This list has a practical consequence: ask for it before signing, and have it appended to the contract. A detailed annex beats a general clause promising "the handover of all elements required".
What the law guarantees, and what it does not
Three texts come into play. None is enough on its own, and that is where companies buy false security.
The Data Act, Regulation (EU) 2023/2854, frames switching between providers of data processing services. Article 29 sets a gradual withdrawal of switching charges. The text is explicit: "From 12 January 2027, providers of data processing services shall not impose any switching charges on the customer for the switching process", and until then reduced charges "shall not exceed the costs incurred by the provider of data processing services that are directly linked to the switching process concerned" (Regulation (EU) 2023/2854, article 29). In other words, exit fees can no longer be disguised margin.
The same regulation imposes technical obligations. Article 30 provides that at the customer's request the provider "shall export all exportable data in a structured, commonly used and machine-readable format" (article 30). But paragraph 6 of the same article sets a decisive limit: the provider is not required "to disclose or transfer digital assets that are protected by intellectual property rights or that constitute a trade secret". The framework, the orchestration library, the provider's internal components stay with the provider. You recover your data and your configurations, not their product.
The GDPR provides a right to portability under article 20. The CNIL recalls its scope: people have the right to receive "the personal data concerning them which they have provided to a controller, in a structured, commonly used and machine-readable format" (CNIL, GDPR chapter III). That right concerns individuals, not your company. It does not give you the embeddings, the operating logs or the prompts.
Then comes the most common case in small and mid-sized companies: an agent built to order, hosted on your own infrastructure or on a cloud you pay for. The Data Act does not automatically apply to a development engagement, and no text forces an agency to assign you its code. In that case, everything is decided in the contract. This is the point detailed in our article on who owns an AI agent built for you.
The reversibility clauses to demand
A useful reversibility clause rests on three measurable commitments: a named scope, a precise format, a timetable with consequences. Vague wording such as "the provider will facilitate the transition in a spirit of cooperation" is worth nothing in a dispute.
| Clause | What it must say | What it prevents |
|---|---|---|
| Scope | A named list of deliverables: code, prompts and history, workflows, document base, logs, test set | An argument about what is "necessary" |
| Format | Open formats imposed: JSON, YAML, CSV, SQL, encrypted archive, Git repository | An unusable PDF export |
| Deadline | Handover within 15 working days of the request, including during the notice period | A migration delayed until the end of the contract |
| Access | Transfer of accounts, keys and numbers in the client's name, not a mere copy | An agent that loses its production channel |
| Assistance | A fixed number of support days, at a known price, capped | A six-figure exit invoice |
| Data exit | Proven deletion of client data after migration, with a certificate | Copies left with the former provider |
Two clauses deserve particular attention because they are often missing.
The first concerns subcontracting. If your provider relies on a third-party orchestration tool, reversibility also depends on that third party. Demand the list of subcontractors and a commitment that changing them does not affect your exit rights. Article 28 of the GDPR already requires that prior authorisation, but it says nothing about the export format.
The second concerns exit in case of failure. A provider going into liquidation will not hand anything over willingly. Plan an escrow mechanism: a copy of the code and configuration held by a third party, releasable on presentation of a formal notice that went unanswered. It is the only real protection against the sudden disappearance of a supplier.
Our guide to the questions to ask before signing with an AI agency covers the other points to negotiate, in particular ownership of deliverables and reversibility of training data.
Test the exit before signing
An untested reversibility contract is a hypothesis. The most reliable method is to request a real exercise during the sales phase, before any signature.
Ask the provider to deliver, on a demonstration environment, a complete archive of its agent: code, prompts, configurations, document base export and test file. Then check three things.
- Completeness. Does the archive allow the agent to be rebuilt elsewhere, or is a proprietary dependency missing?
- Readability. Are the prompts exported in clear text, or as screenshots? Are the workflows in a format you can re-import?
- Reproducibility. Can an outside developer run the agent locally from the archive alone, without access to the original platform?
A provider confident in its work will accept the exercise and bill a few days for it. A refusal, or a partial demonstration, is information in itself. It signals that the exit will be expensive.
The test also applies to an agent already in production. Once a year, request a full export and store it in your own infrastructure. That copy is your only insurance against an imposed price increase. For an agent processing customer data, the exercise overlaps with security obligations: a copy outside your control is data whose retention period you no longer control.
A thirty-day exit plan
Once the decision to change provider is made, improvisation is costly. A simple sequence avoids blind spots.
Days 1 to 5: freeze and document. Identify every contact point between the agent and your systems: APIs, webhooks, shared accounts, email addresses. Record the volume of conversations handled and the cases where the agent escalates to a human. This snapshot will be the reference for judging the new agent.
Days 6 to 15: obtain the assets. Send a written request repeating the contract annex, with a deadline and the precise clause references. This is where the quality of the signed clause is measured. If the export arrives incomplete, the follow-up must be factual: list the missing items one by one.
Days 16 to 25: rebuild and compare. The new agent runs in parallel, on the same test set. Compare answers on the hard cases: ambiguous requests, complaints, missing information. A lower success rate on those cases matters more than a gap on simple questions.
Days 26 to 30: switch and close. Move traffic in stages, then request the deletion certificate and the return of accounts. Keep the old setup switched off but intact for a month, long enough to detect forgotten uses.
This timetable assumes the decision is taken with enough notice. If the provider is in difficulty, the timeline compresses and escrow becomes the only recourse. That is why the exit clause is negotiated at the start, while you still have a choice.
FAQ
What happens if my provider refuses to hand over the prompts?
Unless the contract says otherwise, prompts written by the provider may be considered its intellectual property, and the Data Act does not force it to assign them. The answer is contractual: have the prompts and their history listed as deliverables, with a named export format. Failing that, you can demand a perpetual licence to use and modify them, which allows operations to continue without holding the source file.
Does the Data Act apply to a custom-built AI agent?
Not automatically. The regulation targets data processing services delivered remotely, of the cloud or SaaS type. A specific development delivered on the client's premises falls under ordinary contract law. If your agent runs on the provider's platform, the question deserves a precise answer, because the scope depends on the nature of the service provided.
How much does an unprepared AI agent migration cost?
No honest figure is possible, situations vary too much. What can be measured is the structure of the cost: rebuilding prompts, re-indexing the document base, rewriting integrations, a period of dual operation, and lost business if the service stops. The exit fees charged by the provider are only one line among others, often the smallest.
Can I recover past conversations to train my new agent?
That depends on two things: what the contract says about ownership of logs, and the legal basis for the processing. Conversations contain personal data from your customers. You may keep them if you have a legal basis to do so, but reusing them for a new tool requires checking the stated purpose and the information given to individuals. A prior audit avoids building a new asset on an irregular processing operation.
Should I change provider just to get a better price?
Not necessarily. The reversibility clause also works as a negotiation lever at a constant price. A provider that knows you can leave in three weeks does not charge the same as one that knows you are captive. In our experience of AI projects in small and mid-sized companies, renegotiation often succeeds without migration, once the balance of power is clear.
Conclusion
Reversibility is not a technical topic reserved for large companies. It is a contract clause, an inventory and a test. Three documents, half a day of negotiation, and you stop depending on a supplier's goodwill.
If you need to arbitrate an existing contract, NexeAI offers an advisory audit that reviews exit clauses, ownership of deliverables and export formats. For an upcoming project, our AI agents for small and mid-sized companies build reversibility in from the design stage: delivered code, up-to-date documentation, reproducible environments. You can also browse our other articles on AI in business to prepare the discussion.
To talk it through, contact us: a thirty-minute conversation is often enough to spot the clause you are missing.
