The future becomes human when it retains a way out. A community can adopt a useful platform, automate a service, or test promising infrastructure without surrendering its ability to decide forever. An exit is not a decorative button or a hidden clause. It is the practical ability to stop, migrate, recover information, maintain essential functions, and repair consequences without imposing a disproportionate cost on the people who depend on the system.

Initial convenience can conceal a dependency that becomes visible only when someone tries to leave. A low price loses its meaning if data cannot be exported intelligibly; a school application ceases to be convenient if the school cannot preserve pupils' work; a municipal sensor no longer serves the common interest if only its supplier knows how to interpret it. Dependency does not always arise from bad intent. It also grows from closed formats, concentrated knowledge, long contracts, inseparable identities, and processes that have never rehearsed the day after.

A well-designed exit protects three values. It preserves dignity because nobody must accept new conditions merely to retain a personal history or reach a basic service. It strengthens security because an organisation can isolate a defective component without paralysing everything. It enables reparation because records, responsibilities, and resources remain available to correct harm. The professional question is not only whether innovation works today, but whether the community will retain room for action when needs, suppliers, or evidence change.

An exit is a capability, not a promise#

An exit plan starts by identifying what must keep working. The list commonly includes access to records, communication with affected people, payments, verified copies, credentials, support, and legal duties. It then distinguishes what depends on the supplier, what the community controls, and which knowledge resides in only one person. This map exposes dependencies before they become emergencies. It also supports realistic timescales and names the person with authority to activate a transition.

An exit plan starts by identifying what must keep working. The list commonly includes access to records, communication with affected people, payments, verified copies, credentials, support, and legal duties.

Data portability is necessary but insufficient. A file may be downloadable yet useless because it lacks structure, relationships, metadata, or documentation. A material exit requires machine-readable formats, field definitions, change history, and an import test in an alternative environment. Where personal information is involved, transfer must respect minimisation, confidentiality, and retention periods. The aim is not to copy everything without judgment, but to preserve what continuity, rights, and accountability require.

Operational portability matters as well. The community needs procedures, inventories, configurations, and human capabilities that do not vanish with a licence. A deputy must be able to restore a copy; a different team must understand the main decisions; users must know which channel will function during the change. If transition depends on the goodwill of the party losing the contract, the exit remains fragile.

The ending is designed before the pilot begins#

A responsible trial defines closure before starting. It specifies duration, scope, success criteria, harm signals, and stopping conditions. It states what will happen to data if the trial does not continue, how people will be informed, and who will pay for migration. This work prevents effort already invested from becoming the principal reason to retain a mediocre solution. Sunk cost does not demonstrate public value.

The contract must translate that intention into verifiable duties: transition assistance, delivery times, documented formats, certified deletion of copies that no longer have a purpose, and temporary availability of critical functions. It should also clarify ownership of configurations, created materials, and audit records. Penalties can help, but they do not replace a prepared alternative. Real protection appears when the organisation retains tested copies, trained staff, and decision-making power.

The exit deserves its own budget. Migration requires hours, support, communication, validation, and sometimes a period in which systems coexist. If every resource goes to launch, leaving becomes politically uncomfortable even when technically possible. Reserved capacity does not express distrust. It recognises that a pilot creates knowledge and that the knowledge may support a change of direction.

Case 1: a school recovers its memory#

A school adopts one platform for assignments, messages, and assessment. Speed improves over two academic years, and families become accustomed to a single application. The supplier then changes its terms: some accessibility functions move to a more expensive tier, and old accounts will lose files when the contract ends. The leadership discovers that the export gathers separate documents but does not preserve comments, rubrics, or links between submissions and grades.

The school avoids presenting the problem as a simple purchasing decision. It forms a group of teachers, administrators, pupils, and families to define which memory must be preserved and which data should be deleted. It keeps non-digital channels open, freezes new functions, and tests an import with one volunteer year group. The test reveals truncated names and shifted dates. Those failures are corrected before the remaining records move, without turning pupils into involuntary technicians.

The transition preserves necessary academic evidence, gives every student an intelligible copy of their work, and documents exceptions. The supplier certifies subsequent deletion under the contract. The school adds an annual portability review and requires every future platform to pass a sample restoration. The exit does not erase the value the tool once provided. It prevents that value from becoming captivity and preserves the educational relationship above the application.

Case 2: a cooperative is not halted by an outage#

A food cooperative centralises orders, routes, and invoicing in a cloud service. The system reduces mistakes, but a regional incident blocks access for a morning. Vehicles are ready and products are perishable, while only two people remember how routes were organised before automation. A nightly copy exists, although nobody has established whether it opens without the supplier's tools.

The cooperative activates a limited procedure: it protects the cold chain, prioritises sensitive deliveries, and records every change manually for later reconciliation. It does not attempt to reproduce every function. When staff restore a sample, they learn that the copy contains data but not allocation rules or permissions. The incident therefore becomes evidence of an operational dependency, not merely a technical outage.

After service returns, the board distributes knowledge, exports rules in a documented format, and agrees a degraded mode that is rehearsed every quarter. A second administrative account is protected and accessible through an emergency procedure. The contract gains transition assistance and access to records. The cooperative measures recovery time, preserved orders, and later discrepancies. The exit operates as everyday security: it allows activity to reduce in an orderly way, sustains essentials, and supports a return without losing traceability.

Case 3: a municipality changes sensors without losing purpose#

A municipality installs sensors to adjust lighting and maintenance in several squares. The dashboard is clear, but raw readings are stored in a proprietary format. Two years later, an audit finds that some mobility patterns are classified incorrectly and that the supplier cannot adequately explain a model update. The council could renew by inertia because changing appears more costly than continuing.

The public team returns to the purpose: improving places without monitoring individual journeys. It suspends the highest-impact automated decisions, publishes known limitations, and combines field observation with aggregated data. Municipal technicians, neighbourhood associations, and accessibility specialists define the minimum set that must be retained. A pilot export shows that part of the history lacks units and algorithm versions, preventing valid comparisons between periods.

The municipality negotiates documentation, keeps only useful data, and temporarily commissions an open gateway for comparing suppliers. Associations take part in evaluation, but responsibility remains with the administration. The new specification requires interoperability, change logs, and orderly device removal. The final decision is more than a change of brand: it recovers public capacity to understand the system, question inferences, and decide whether any function should disappear.

Leaving without abandoning anyone#

Transitions distribute costs unevenly. People with time, connectivity, and skills commonly adapt first; those who need accessibility, translation, or assistance can lose service during the change. The plan must therefore identify affected groups, offer equivalent channels, and fund support. An alternative is not real if it requires a new device, unexpected journeys, or knowledge that was not previously necessary.

Communication should arrive before the change and explain dates, reasons, required actions, continuity, and sources of help. Confirmed facts should be distinguished from pending matters. Generic messages create rumours and can push people towards unsafe choices, such as downloading sensitive information onto shared equipment. A public update schedule and an accountable contact allow questions to be corrected quickly.

An exit cannot transfer all work to the community either. Consulting affected people improves criteria, but it does not turn them into unpaid support or universal representatives. Their participation requires accessibility, time, feedback and, where appropriate, payment. The institution retains its duty to implement, protect, and repair.

Four institutional references for a verifiable exit#

European Union. The Data Act, Regulation (EU) 2023/2854, establishes obligations concerning switching between data-processing services and interoperability. Its approach shows that the ability to change supplier is not merely a commercial decision. Obstacles must be removed, functional continuity must be facilitated, and responsibilities must be clear.

European Commission. Institutional information about the Interoperable Europe Act places interoperability at the heart of connected public services. The relevant lesson for a community is that different systems must be able to cooperate under known rules and assessments. A sustainable exit is prepared through architecture, governance, and shared learning, not through an improvised export.

National Institute of Standards and Technology. NIST SP 800-34 Rev. 1 on contingency planning organises impact analysis, recovery strategies, testing, and maintenance. Although intended for information systems, it offers transferable discipline: identify essential functions, define priorities, rehearse responsibilities, and demonstrate that restoration works before a crisis.

Organisation for Economic Co-operation and Development. Its Recommendation on Digital Government Strategies connects technology decisions with openness, participation, coordination, and institutional capabilities. Public technology should strengthen collective value and retain accountability. That framework prevents dependence on a tool from being mistaken for mature digital transformation.

Testing whether the door opens#

An exit is evaluated through exercises, not declarations. An organisation can select a sample, export it, verify integrity, import it into an alternative environment, and compare results. It should also simulate unavailability, staff turnover, and contact with users. Discovered failures are recorded with an owner and correction date. Repeating the exercise confirms whether the capability survives changes of team and supplier.

Useful measures combine recovery time, percentage of interpretable data, essential functions maintained, accessibility incidents, transition cost, and complaints repaired. A favourable average may conceal a group that loses access. Short accounts and differences between channels help explain the mechanism of harm. The goal is not a frictionless migration, but friction that is visible, proportionate, and correctable.

Attention should also be paid to what remains behind. Some data must be preserved, some can be anonymised, and some must be deleted. Keeping everything as a precaution increases risk and prolongs dependencies. A retention table with a reason, owner, and date allows responsible closure. Certified deletion is as much a part of exit as export.

Governing reversibility#

Authority to pause or leave must be named before conflict. A project sponsor may have incentives to defend it, so review needs plural membership and independent access to evidence. Stopping conditions should include harm to rights, repeated failures, unmet objectives, and loss of supervisory capacity. A proportionate pause does not prejudge the outcome; it creates room for investigation without expanding consequences.

When a pilot closes, the decision offers more options than continuation or cancellation. Scope can be reduced, the supplier changed, functions separated, an alternative channel retained, or only the component concentrating risk removed. Every option should identify costs, affected people, repair tasks, and outstanding evidence. Recording reasons preserves institutional memory and prevents the next team from reproducing the same dependency.

A shared future does not require every tool to be preserved. It requires collective capacity to choose to be preserved. When the door has been tested, data travel with meaning, essential functions survive, and nobody is abandoned in transition, innovation ceases to be an irreversible spectacle. It becomes a human practice: able to begin cautiously, learn from limits, stop in time, repair what happened, and continue in a different way.