Strategy · 18 January 2026 · Updated 19 April 2026

Vendor lock-in on AI platforms: the SME perspective

AI platforms are consolidating. What Swiss SMEs should watch for in tool selection, contract design and exit strategies - with DSG pointers on data portability.

Author

ai-edu Team

AI Training Experts

As of April 2026. The AI-vendor landscape is consolidating fast. Concrete product names in this post age quickly - the question “how do I protect myself against one-sided dependency?” stays relevant.

Over the last 24 months in the AI market, a pattern is playing out that is familiar from cloud and SaaS: the large platforms integrate features that were previously delivered by third-party vendors. For Swiss SMEs this shifts the procurement and risk logic. Anyone building a tool stack today must think not just about today’s features, but also about the conditions under which they could leave it in 24 months.

What “vendor lock-in” actually means in the AI context

Vendor lock-in does not mean “we are using a tool”. It means: “we cannot leave the tool again without losing processes, data or competencies.” Four dimensions shape lock-in in the AI space:

Data lock-in - conversation histories, custom GPTs, knowledge bases, vector embeddings stored in vendor-specific formats.
Workflow lock-in - automated processes that rely on vendor-specific APIs, plugins or connectors.
Skill lock-in - the team has internalised prompt strategies, model idiosyncrasies and workarounds for precisely this system.
Compliance lock-in - DPA, data-flow maps, EDÖB documentation and DSG policy are tailored to the current vendor.

The deeper the integration, the higher the cost of switching. Nobody switches voluntarily - but vendor failures, price hikes or compliance changes can force a switch.

Four current consolidation examples

The following four moves from 2025/2026 illustrate the pattern:

Anthropic Claude integrates features for knowledge work (Claude Cowork and subsequent releases) - file operations, workflow automation, research. Capabilities for which several specialised SaaS offerings previously competed. Use cases therefore migrate into the platform.

OpenAI expands Apps and Custom GPTs - GPTs, the Agent Builder and the Operator browser module absorb functions that were previously covered by external bots, RPA tools or browser extensions.

Microsoft 365 Copilot Stack expands - Copilot Studio, connectors, agents, M365 Chat in Teams. Integrates workflows that used to live in Power Automate, separate chatbots or third-party plugins.

Google Agentspace and Gemini Enterprise - Workspace integration, a dedicated agent marketplace, Vertex AI hooks. The counterpart to the Microsoft strategy, with Workspace as the foundation.

The pattern is clear: four large platforms that increasingly offer full meals rather than components. For SMEs this means: simpler procurement, higher lock-in risk.

What Swiss SMEs can actually lose along the way

Three concrete losses that we see regularly in our advisory work:

Negotiation leverage. When 80% of internal workflows run on a single platform, the vendor has strong negotiating power in price reviews. The M365 model has shown this for years.

Data sovereignty. Platforms decide on training defaults, hosting regions and data-flow transparency. A shift from friendly terms to tough terms can happen at any time.

Innovation perspective. Anyone who only knows one model no longer sees the strengths and weaknesses of the others. That erodes the team’s tool-selection competence.

DSG and data portability for AI tools

The revised Swiss DSG creates three concrete levers that SMEs can use when switching vendors:

Right of access and data release (Art. 25 DSG). Personal data that an AI vendor processes on behalf of the company must, on request, be handed over in a structured format. This covers conversation histories and stored customer information.

Commissioned processing with return/deletion obligation (Art. 9 DSG). The DPA with the AI vendor should explicitly specify that at contract end, all processed data are returned or deleted - including training embeddings.

Duty to inform when switching (Art. 19 DSG). If the company changes AI vendor, data subjects must be informed about the new data processing - an update to the privacy notice is part of the switch project.

Covered in depth in the DSG guide.

Three lock-in avoidance strategies

Strategy 1: two strategic vendors per workflow category

Rather than putting all the tools of one area on a single vendor, maintain two strategic options. Example text generation: ChatGPT Team plus Claude Pro. Not because both are needed simultaneously, but because the team knows both and switching would not be a shock.

Realistic: a maximum of two all-round vendors. More fragments the team, fewer creates lock-in.

Strategy 2: data and prompts in your own repository

Keep important conversations, prompt templates and custom-GPT specifications outside the platform - in Notion, Confluence, Git or Markdown files. That way the value stays with the company even if the platform changes.

Strategy 3: prefer API access, minimise UI-vendor binding

Anyone who wires important workflows via API (Claude API, OpenAI API, Azure OpenAI) stays more portable than with UI comfort features. Switching between API models is usually a configuration change; switching between UI platforms is a re-training exercise.

Exit strategy for SMEs with existing AI contracts

Anyone who has already invested can still reduce lock-in after the fact:

Review contracts. Which clauses on data return, notice periods and price adjustments exist? Clarify gaps in the DPA with the vendor.
Data inventory. Which data live where? Which formats? Where is there only platform-native format without export?
Skill diversification. Train power users on at least one second platform - this lowers switching costs and sharpens their judgement.
Think through the switching scenario. Once a year a “what if” workshop: which vendor, which data migration, what timeframe, what costs?

This is not a vote of no confidence against the current vendor - it is procurement hygiene.

What happens next

Three concrete steps for the next 30 days:

Lock-in scoring for every AI vendor in productive use: data, workflow, skills, compliance - 1-5 points each. Totals of 12 or more deserve particular attention.
DPA audit with your legal lead: what does it say on data return, training-use, termination?
Diversification step: establish a second model for your most important application - train at least 5 power users.

In our training programmes for Swiss SMEs we run this exercise together with your leadership, procurement and IT teams - including concrete switching scenarios for your most important tools.

Further reading on ai-edu.ch:

Sources: