The EU Data Act Just Turned Course-Evaluation Vendor Lock-In Into a Compliance Question

Bottom line up front: Since 12 September 2025, the EU Data Act (Regulation (EU) 2023/2854) has given European universities a new legal lever over their software suppliers. Cloud and SaaS providers must now remove the obstacles that stop a customer moving to a competitor, let that customer port their data in a structured, commonly used, machine-readable format, and — from 12 January 2027 — do it without charging switching fees (European Commission timeline, via Alston & Bird). For anyone who has ever tried to leave a course-evaluation platform and discovered that a decade of student feedback is trapped in a proprietary schema behind an export paywall, that is a bigger deal than the phrase "cloud switching regulation" makes it sound.

Course-evaluation data is not a trivial dataset. It is the institution's longitudinal record of teaching quality — the evidence base cited in accreditation self-studies, promotion cases, and quality-assurance audits. If you cannot get it out cleanly, you cannot leave your vendor, and a supplier that knows you cannot leave has very little reason to improve, lower its price, or fix the things you complain about. The Data Act reframes that from an annoyance your procurement team grumbles about into a compliance-relevant obligation your supplier owes you.

What the Data Act actually says about switching

Chapter VI of the Data Act (Articles 23 to 31) targets "data processing services" — the cloud and SaaS category that most modern course-evaluation platforms sit in. The core obligations are concrete (Garrigues; Deloitte Legal):

• Remove the obstacles to switching. Providers must withdraw pre-commercial, commercial, technical, contractual and organisational barriers that prevent a customer from terminating and moving to another provider or to on-premise infrastructure.
• A defined exit process. Contracts must specify a maximum notice period for switching (no longer than two months) and a transition period during which the provider keeps helping you migrate.
• Port your data and "digital assets." The provider must enable you to export the exportable data you put in and generated, plus relevant metadata, in a structured, commonly used and machine-readable format.
• Phase out switching charges. Since September 2025 switching charges must only reflect the actual costs incurred; from 12 January 2027 they are prohibited entirely.
• Publish what you can export. Providers must make information about available data formats and interoperability arrangements available, so a buyer can see, before signing, how hard leaving will be.

Two honest caveats. First, the strongest "functional equivalence" duty — the obligation to make the new environment work like the old one — bites hardest on infrastructure (IaaS) services; for application-layer SaaS the duty is narrower, centred on exporting your data and digital assets rather than replicating the software itself (Greenberg Traurig). Second, the Act governs the mechanics of leaving, not whether a competitor exists to receive you. But for course evaluation, the mechanics are exactly where universities get stuck.

Why course evaluation is a textbook lock-in case

Ask a quality-assurance office what happens if they want to change evaluation platform, and you will hear a familiar list: the historical results export as flattened PDFs or image-only reports, not structured records; the question bank and its response scales come out in a format only the incumbent can read; the open-text comments — the richest data you hold — arrive as an undifferentiated dump with no link back to the module, cohort, or question that produced them. The switching cost is not the licence fee. It is the quiet realisation that leaving means abandoning your own history.

That is precisely the friction the Data Act now treats as a defect the supplier must remove. A university can reasonably read the regulation as saying: your evaluation vendor owes you a clean, structured, machine-readable export of every response, every scale, and every comment — mapped to the questions and cohorts that produced them — on request, and soon without a fee. This sits alongside, not instead of, the data-protection questions you already ask. We have written before about where your evaluation data physically lives under Schrems II and the security duties NIS2 adds on top of GDPR; the Data Act adds a third axis — not is my data safe or is my data in Europe, but can I take my data and leave.

What procurement should now demand

The Data Act turns three things from "nice to have" into questions with a legal answer behind them. If you are writing an evaluation-software tender, put them in it explicitly:

1. A documented, self-service export of structured data — responses, scales, metadata and open text — in a commonly used machine-readable format (CSV, JSON, or an equivalent), not a locked PDF. Ask to see a sample export file during evaluation.
2. A written exit clause stating the maximum notice period, the transition-support period, and the assets returned. If your incumbent contract predates September 2025, it may already be non-compliant.
3. Published data formats and interoperability arrangements, so you can assess switchability before you sign — the Act requires providers to make this available.

If you are already unhappy with an incumbent, the Data Act is leverage: a supplier that has historically treated a full data export as a paid professional-services engagement now has a shrinking legal basis for doing so. It is worth pairing this with our migration guide, which walks through the operational side of actually moving.

"But isn't this just a procurement issue dressed up as law?"

The strongest objection is that none of this is new: good procurement always insisted on data portability, and a well-written contract already secured an export clause. That is fair — the Data Act does not invent portability, it makes it a default entitlement rather than something you had to negotiate for and often lost. The difference matters most for the universities with the least bargaining power: a single faculty renewing a modest licence has never had the leverage to extract a functional-equivalence clause from a large vendor. Now the floor is set by regulation, not by how good your procurement lawyer is.

A second objection: enforcement is uncertain, and Member States are still designating competent authorities. True. The Data Act is not going to trigger a wave of litigation over course-evaluation exports. But regulatory obligations shape supplier behaviour long before anyone sues — they change what a vendor can defensibly refuse, and what an auditor can reasonably expect. The value here is not the threat of a fine; it is that "we cannot export that" stops being an acceptable answer.

The limits — what the Data Act does not do

Be precise about the claim. The Data Act does not guarantee that a competitor's platform can ingest your export cleanly; semantic mapping between two different question models is still work. It does not resolve who is the controller of the data, or your GDPR obligations when you move special-category free-text comments — that remains your responsibility, and may still require a data-protection impact assessment. And it does not force your incumbent to have built a good export in the first place; it obliges them to provide one, which for some legacy platforms means real engineering they have deferred for years. Portability as a right is not the same as portability as a lived experience — but the right is the precondition for the experience.

How Koji approaches this

We think the honest response to a portability regulation is to make leaving easy, not to comply grudgingly. Koji for Education stores evaluation responses — scale answers, structured question types, and open-text comments — as structured records tied to the module, cohort, and question that produced them, and exposes full structured export (not image-only PDFs) so an institution can take its complete history at any time. Our position is that a vendor should earn renewal by being better next year, not by making the exit painful; the Data Act simply codifies what we already believed a supplier owes a university.

Koji is the AI-native platform for acting on student feedback — AI-moderated conversational interviews that probe beyond a Likert number, automatic thematic analysis of open text, and programme-level reporting — built for EU data handling from the ground up. The same AI interview engine also powers koji.so for teams doing general user and customer research. If your current evaluation contract treats your own data as the vendor's asset, the Data Act is a good reason to revisit it — and a good moment to see what a portability-first platform looks like.

The Data Act will not make anyone switch platforms. What it does is remove the excuse that you cannot. For a sector whose entire quality story depends on longitudinal evidence, that changes the balance of power with every supplier you have.

Frequently asked questions

When did the EU Data Act cloud-switching rules take effect?

The switching obligations in Chapter VI of the Data Act (Regulation (EU) 2023/2854) became applicable on 12 September 2025. Switching charges must be reduced to actual costs from that date and are prohibited entirely from 12 January 2027.

Does the Data Act apply to course-evaluation software?

Yes, where the platform is a cloud or SaaS "data processing service", which most modern evaluation platforms are. The provider must let the customer export their data in a structured, commonly used, machine-readable format and remove obstacles to switching to another provider.

What should a university put in an evaluation-software tender because of the Data Act?

Three things: a documented self-service export of structured responses, scales, metadata and open text (not locked PDFs); a written exit clause specifying notice and transition-support periods; and published information on available data formats and interoperability, so switchability can be assessed before signing.

Does the Data Act guarantee a competitor can import my data?

No. It obliges your provider to give you a clean, structured, machine-readable export, but semantic mapping between two different question models is still work. Portability as a right is the precondition for a smooth migration, not a guarantee of one.

Does the Data Act replace my GDPR obligations?

No. Data protection is a separate axis. Moving special-category free-text comments may still require a data-protection impact assessment, and you remain responsible as controller. The Data Act governs your right to switch and port; GDPR governs how the personal data is handled.