The EU Data Act became applicable on 12 September 2025, and its cloud switching provisions are already enforceable. For businesses running on SaaS platforms, that changes the risk profile of many older agreements immediately.
A contract signed three years ago can now contain terms that are commercially outdated, operationally risky, or increasingly difficult to defend once a supplier relationship needs to change.
Switching-initiation notice periods longer than two months
Article 25(2)(d) requires the contract to let a customer initiate switching with a notice period no longer than two months. This is not a generic cap on every termination notice, so scope and the requested switching path must be checked before a clause is flagged.
Even where enforceability is weakening, teams often continue to behave as if the original clause still governs the relationship. That operational assumption can be just as costly as the clause itself.
Switching fees that survive beyond January 2027
Article 29 prohibits switching charges from 12 January 2027. Article 2(36) excludes standard service/subscription fees and early-termination penalties from that definition, so those amounts must not be described as automatically going to zero.
Waiting until the deadline approaches creates unnecessary leverage for the supplier. Visibility now gives procurement teams more room to move.
Transition and retrieval terms that frustrate export
Article 25 requires contractual switching and retrieval terms, including a maximum 30-day mandatory transition period and at least a 30-day retrieval period after it. Separately, Article 30(5) requires exportable data to be available on request during switching in a structured, commonly used, machine-readable format; it is not a universal 30-day-after-termination export deadline.
If the exit plan depends on fast data recovery, vague wording becomes an operational dependency, not a legal footnote.
Broad AI and machine-learning rights over customer data
An increasing number of SaaS agreements include broad language permitting the provider to use customer data for service improvement, analytics, or machine learning. That language deserves scrutiny in any commercially sensitive environment.
Where portability, confidentiality, and data-access expectations are changing, these clauses can create hidden tension between the buyer's operational interests and the supplier's model-development incentives.
Unilateral modification rights with very short notice
Article 13 addresses unfair terms in contracts relating to IoT/connected-product data access — not as a general fairness review for all B2B contracts. Where it applies, terms that let one party rewrite the commercial balance without adequate notice may be non-binding. Clauses that allow changes within 7 or 14 days should be treated with caution.
For smaller buyers in particular, short-notice modification rights turn a contract into a moving target that is difficult to monitor and even harder to budget around.
These are not abstract legal concerns. They are the clause patterns most likely to create avoidable switching friction, renewal cost, or compliance exposure across a live SaaS portfolio.
That is why Custonic focuses on visibility first: surfacing these patterns automatically, quantifying their likely impact, and giving teams a practical sequence for what to review next.