Most boards now hear two things in the same quarter: the cloud provider's AI roadmap, and the risk committee's question about what happens if that provider goes down, raises prices or becomes politically unacceptable.
Both are right. That is the problem.
The two sales pitches
The hyperscalers, the big cloud platforms, sell the way in. The AI features are real and the integration is deep. For most companies in the Benelux, leaving Microsoft, AWS, Google or Databricks is not a serious question in 2026. The sovereignty movement sells the way out. European cloud providers, open-source data platforms and EU-hosted AI models are maturing fast, and the regulators are helping them along.
What nobody sells is the bridge. The bridge is the architecture, the tests and the tools that let a company keep using the big provider for what it does well. It keeps a sovereign path open for what must stay home. And it proves to a board, a regulator and a customer that the path works.
Why the bridge is now a duty
Three pieces of regulation turn this from a preference into a duty. DORA, the EU's Digital Operational Resilience Act, has applied since 17 January 2025. It requires financial entities to have exit strategies, with tested exit plans, for ICT (information and communication technology) services that support critical or important functions. The Dutch Cyberbeveiligingswet has been in force since 15 August 2026. It turns the EU's NIS2 security directive into Dutch law and extends resilience duties to a much wider set of companies. And the EU AI Act asks anyone who builds or uses high-risk AI to keep logs, keep a human able to intervene and report serious incidents. A later EU package, the Digital Omnibus on AI, moved those duties to 2 December 2027 for most systems. AI inside regulated products gets until 2 August 2028.
DORA, the Cyberbeveiligingswet and the AI Act do not tell you to leave your cloud provider. DORA tells financial firms to be able to; the Cyberbeveiligingswet and the AI Act ask for continuity, logs and oversight that are hard to prove if you cannot. I wrote down what an exit strategy means in practice: four questions for every critical system.
What the bridge is made of
After 30 years in manufacturing, offshore and finance, I keep finding the same four parts, whatever the industry:
- A position. One page that says what runs where, what is portable, what is locked in, and why. Producing it is half the work, and most companies I meet cannot produce it.
- Open formats and open tools. Data kept in open table formats, such as Iceberg and Delta, that both platforms can read. Agents defined in a way that runs on more than one model. Logs that an auditor can read without buying the tool that wrote them.
- Evidence. A restore drill that has been run. A model swap with the quality difference measured. A logbook of what the agents did, kept where the company controls it.
- Controls that work on both sides. What an agent may do, who approves what, and how to stop it, enforced the same way on the hyperscaler and on the sovereign platform.
The first part is thinking. The other three are software, and most of it is boring, which is exactly why it is missing.
What I am doing about it
I have spent my career on the operating side of IT: plants, vessels, banks. Places where downtime has a price, connectivity is not guaranteed and a regulator reads the architecture before signing. The bridge needs the same habits, so I am making it my focus as a fractional CTO.
I am also building the boring parts in the open. The first is a sovereign agent logbook. It shows where an entry was changed, inserted or reordered (its threat model lists what it does not catch), and it ties you to no vendor. It runs on your own EU server with the model you choose, and it is published on GitHub with its tests. More small tools will follow, each one covering a duty most companies have and few want to build.
If your board heard the AI roadmap and the exit question this year, I would like to hear how it answered the second.
Sources & further reading
- Regulation (EU) 2022/2554, the Digital Operational Resilience Act (DORA): Article 28(8) on exit strategies for ICT services that support critical or important functions; applies since 17 January 2025
- Commission Delegated Regulation (EU) 2024/1773: Article 10 on documented exit plans, reviewed and tested periodically
- Rijksoverheid, "Cyberbeveiligingswet en Wet weerbaarheid kritieke entiteiten vanaf vandaag van kracht", 15 August 2026: the Dutch law that transposes NIS2
- Regulation (EU) 2024/1689, the AI Act: Articles 12, 14, 26 and 73 on logging, human oversight and incident reporting
- Regulation (EU) 2026/1744, the Digital Omnibus on AI: the new application dates for high-risk AI
- Sovereign agent logbook on GitHub, with its threat model
Jacques Domenie, Brielle. Fractional CTO at Delfen.