Last week on the blog, we summarised the “Cyfrowa racja stanu” report (“Digital National Interest” report”): a PLN 60 billion digital trade deficit, licence fees rising year after year, and the data of people living in Poland valued at PLN 224 billion a year. The report was written with the state in mind. But it raises three questions that apply to any business. This week, we revisit them with a practical focus, leaving geopolitics aside.

The cost of switching providers

Vendor lock-in is not usually a problem on day one. It becomes one in year five, when your data is stored in proprietary formats, your integrations are built around a single environment, and your people know only one ecosystem. By then, “Is this a good deal?” is no longer the question that matters, because the answer to “How much would it cost to leave?” is simply “Too much.”

That is why management should put a figure on the cost of an exit before it becomes an urgent issue. How much would it cost to migrate away from each of our critical providers, and how long would it take? The ability to leave can also be built into the contract: open data formats, documented interfaces, the right to a full data export within a defined timeframe, and a tested migration process. These provisions cost nothing at the point of signing. And a customer who is free to leave is simply treated better, even if they never do.

Jurisdiction matters more than server location

It is natural to focus on where the servers are located. In practice, what matters more is who controls the service and which laws apply to its operator and wider corporate group. One widely reported case from the past year involved the prosecutor of the International Criminal Court, who lost access to his work email after being placed under US sanctions. There was no outage or cyberattack. According to media reports, the technology provider simply complied with the laws in force in its home country.

The implication for businesses is straightforward: a provider’s jurisdiction belongs in the evaluation alongside price, service level agreements (SLAs) and security. A global provider will be a perfectly reasonable choice for many systems. For the most critical systems, where business continuity or trade secrets are at stake, consider carefully which laws will apply and who will have operational control.

Cost increases beyond your control

The third question is about the budget. Prices for software licences, cloud services and AI tools have risen by an average of 8.7% a year in recent years, with forecasts pointing to annual increases of 12% over the next five years. A company spending PLN 1 million a year today would pay around PLN 1.76 million for the same tools and services in five years. That increase would come without any new deployments or decisions on its part.

The mechanism is familiar: when there is no alternative, there is no negotiating power. When planning for the longer term, businesses should therefore distinguish between the costs they can influence and those set by a provider’s price list. Cost predictability deserves to be a selection criterion in its own right, sometimes carrying more weight than the price in the first year of a contract.

Being honest about the tools we use

One point needs to be clear. We are not suggesting that anyone abandon global technology platforms. We use them ourselves, as almost every company in Poland does, because in many areas there are simply no viable alternatives. For a business, data sovereignty does not mean complete self-sufficiency. It means knowing which assets are critical and having a plan if conditions change. The difference between a sovereign business and a dependent one is not which tools it uses. It is whether it knows what will happen when conditions change.

How we put this into practice

These three questions have been part of our day-to-day work in infrastructure for years. In our colocation facilities, customers retain ownership and control of their equipment and data. We provide a secure environment in which their systems run. Backup and disaster recovery environments give customers a tested plan B, giving customers the ability to exit and to keep running. That plan is tested in practice, not just written into a contract. We structure our contracts so that costs can be planned years ahead, and our facilities undergo independent security and business continuity audits. And we do not replace our customers’ IT teams. We provide the infrastructure and support they need so that one person is not left to carry the most demanding responsibilities alone.

Management can work through all three questions in a single afternoon, without consultants or a dedicated budget. If you would like to discuss your answers with someone who works with these environments every day, get in touch for a short conversation, with no obligation. The report that started this series was written with the state in mind. But the decisions that make a real difference to how dependent we are on technology providers are made within business.