A supplier exit clause can look satisfactory while the company has no practical way to leave. The contract permits export, but the exported files cannot be used by another system. Staff have stopped practising the old process. Customer service depends on a retrieval index that nobody can rebuild quickly.
For Norwegian boards, I would treat a critical AI supplier as part of the operating model. The procurement decision includes the company's ability to continue serving customers when that supplier is unavailable or no longer acceptable.
The problem begins before the contract ends
An AI dependency can change without a dramatic failure. A model version is retired, a connector loses access, a service tier changes, or revised commercial terms undermine the business case. An outage is only one of the scenarios the board should ask management to consider.
NSM's guidance on outsourcing and cloud services emphasises lifecycle control, purchasing competence, risk assessment, appropriate requirements and decisions at the right level. My practical interpretation is that an exit plan belongs in the original investment case, not in a procurement file opened only at renewal.
Start with the service customers must still receive
Imagine a hypothetical Norwegian wholesaler using an assistant to interpret emailed orders and create drafts in its business system. If the assistant stops, the warehouse may still have stock, staff and vehicles. The bottleneck is converting customer messages into accurate, confirmed orders.
Management should therefore define the minimum service it will maintain: perhaps priority orders are entered manually, while routine requests receive a realistic response time. “We can work manually” is incomplete until someone has tested capacity, access to source messages and how duplicate orders are prevented when automation resumes.
The board should see the business consequence of the fallback. A technically successful recovery can still leave a two-day queue that breaches customer expectations.
Run an exit exercise before relying on the exit
I would ask the service owner to demonstrate four things using a bounded, authorised test:
- Recover the material: Export the company-controlled instructions, knowledge documents, evaluation examples and necessary records in usable formats. Confirm contractual rights to use them elsewhere.
- Rebuild a narrow task: Reproduce one important workflow with an alternative service or manual method. Record differences in quality, Norwegian-language handling and review effort.
- Continue safely: Show who can stop integrations, preserve evidence, operate the fallback and reconcile work already in progress.
- Estimate the transition: Identify the people, elapsed time, costs and customer effects involved. Record what the exercise did not prove.
This does not require duplicating the entire platform. A small company can learn a great deal by moving one representative task. A second supplier is not automatically independent if both routes rely on the same identity system, cloud infrastructure or underlying model provider.
Procurement questions that deserve specific answers
Ask which data can be exported, what is excluded and whether deletion includes copies held by subprocessors under the applicable agreement. Distinguish an export of chat history from the material needed to reproduce the workflow. Check notice periods for material changes and the support available during transition.
For services priced in foreign currency, include a NOK sensitivity case and an agreed response to unexpectedly high consumption. For confidential customer information, verify contractual restrictions rather than treating a supplier's standard security page as permission to process it.
Where personal data are processed, GDPR Article 28 specifies requirements for processor arrangements, including return or deletion after services end, subject to legal retention requirements. Article 44 and the following provisions address transfers to third countries. Those are separate questions from whether a service advertises an EEA storage location.
Give the board a dependency decision
The useful board report names the critical workflow, the supplier dependency, the tested alternative and the remaining gap. It should make clear which gap management can close and which exposure the board is being asked to consider within its role.
Use the AI investment framework to account for continuity and exit costs. The aim is a workable service with known dependencies, rather than a promise that the business can switch vendors overnight.
Sources and scope
Sources checked on 11 October 2026. NSM provides security guidance; it is not a blanket certification of a supplier or a statement that every company is subject to the Security Act. The exit exercise and wholesaler example are my analysis and a hypothetical scenario.