Enterprise AI — Vendor evaluation

Avoid AI vendor lock-in by securing ownership, portability and a tested exit path before you sign

Rohan Hall’s practical framework helps organizations distinguish useful AI services from proprietary dependencies that make data, models and workflows difficult or expensive to move.

Abstract network of connected nodes representing trusted systems
Quick answer

The clearest vendor lock-in red flags are unclear ownership terms, proprietary data formats, restricted exports, undocumented interfaces, model access tied to one platform, punitive exit fees and no migration assistance. Protect your organization by defining ownership contractually, requiring usable exports, separating your data and business logic from vendor infrastructure, documenting dependencies and testing migration before deployment. Treat an exit plan as part of the architecture—not as a problem to solve after the relationship ends.

Key takeaways

  • Your contract should distinguish ownership of source data, prompts, configurations, model outputs, fine-tuned components and operational records.
  • A downloadable file is not meaningful portability unless its format, structure and metadata let another system use it.
  • Keep business rules, approved knowledge and critical workflows separate from vendor-specific models and interfaces wherever practical.
  • Ask the vendor to demonstrate a complete export and explain what will stop working after termination.
  • Evaluate switching cost before signing: migration labor, retraining, integration changes, downtime, vendor assistance and exit fees all matter.
01

The most important vendor lock-in red flags

Vendor lock-in exists when changing providers would cause disproportionate cost, disruption or loss of control. Rohan Hall’s work spans enterprise AI adoption, architecture, operating models and the transition from experimentation to durable capability. From that perspective, the central issue is not whether a platform uses proprietary technology. Many useful services do. The issue is whether your organization retains enough contractual and technical control to leave without losing essential data, knowledge or operating capability.

Warning signs
Ambiguous ownershipThe agreement does not clearly allocate rights to source data, prompts, outputs, configurations, fine-tuned components and feedback generated through use.
Export without usabilityThe vendor promises downloads but does not specify formats, schemas, metadata, relationships or documentation.
Closed interfacesEssential functions are available only through proprietary tools, with no stable method for extracting data or connecting replacement systems.
Hidden dependenciesWorkflows, business rules, identity controls and analytics become inseparable from the vendor’s infrastructure.
One-way customizationYour organization invests in training or configuration, but the resulting work cannot be transferred or reproduced elsewhere.
Punitive departureTermination triggers large fees, short retrieval windows, loss of access or expensive mandatory migration services.
No credible migration processThe vendor cannot explain how customers retrieve information, preserve continuity and verify deletion at the end of service.

These signals should prompt a structured investigation, not an immediate rejection. Start with a consistent list of questions that expose proprietary lock-in, then require written answers that can become contractual commitments. Sales assurances are not a substitute for enforceable terms or a technical demonstration.

02

Define what your organization must own and control

Control

Control means having the legal rights, technical access, documentation and operational ability required to retrieve, use, protect and transfer an asset without unreasonable dependence on the current vendor.

“We own our data” is too broad to protect an AI deployment. Divide the system into distinct assets: original business data; documents and knowledge supplied to the system; prompts and system instructions; evaluation sets; user feedback; conversation records; model outputs; configurations; workflow logic; embeddings or other derived representations; fine-tuned components; and performance or usage records. Decide which assets must remain yours, which may be licensed, and which are part of the vendor’s underlying service.

Pay particular attention to derived assets. A contract may confirm that you own uploaded documents while remaining silent about the structured knowledge, labels, feedback or tuning created from them. Those derived materials can represent substantial organizational effort. Ask whether they are exportable, whether they can be used with another provider and whether the vendor may use them to train systems for other parties.

Contract test

For every important asset, answer five questions in writing: Who owns it? Who may use it? In what format can it be exported? How long is it retained? What happens to it when the agreement ends?

Ownership alone is insufficient if access depends entirely on the vendor. Your agreement should therefore address both legal rights and practical custody. The next step is to negotiate AI contracts around replaceability, including retrieval periods, migration support, deletion obligations and continued access during an orderly transition.

03

Test whether data and models are genuinely portable

Portability is the ability to move information and reconstruct essential operations elsewhere. It is not merely the presence of an export button. A useful export preserves context: field definitions, relationships, timestamps, permissions, source references, version history and other metadata needed to understand the records. If the receiving team cannot interpret or import the result, the export offers little protection.

Run a portability review
  1. Inventory the assets the platform will store, create or transform. Include data, instructions, workflow logic, outputs, logs and derived materials.
  2. Request sample exports before purchase. Examine their formats, completeness, structure, documentation and compatibility with tools your team can operate.
  3. Map vendor-specific dependencies. Identify proprietary APIs, model identifiers, orchestration features, authentication methods and workflow components that would need replacement.
  4. Rebuild one representative workflow outside the proposed platform or document exactly how it would be rebuilt. This reveals dependencies that procurement questionnaires often miss.
  5. Estimate the full switching cost, including engineering work, data conversion, validation, retraining, downtime and any contractual charges.
  6. Set a recurring export and recovery test so portability remains real as the implementation changes.

Model portability requires especially careful language. Determine whether you are buying access to a hosted model, creating a fine-tuned version, configuring a workflow around a model, or commissioning a model-related asset you expect to possess. These arrangements carry different rights. Do not use “our model” internally until the agreement identifies exactly what the phrase means.

Practical boundary

Some managed AI services cannot be reproduced identically on another provider because their underlying models and infrastructure are proprietary. In that situation, protect the ability to move your data, instructions, evaluations and business logic, then define the acceptable work required to substitute a different model.

For a wider decision framework, examine how to preserve flexibility before selecting a vendor and how to demand transparent data-portability commitments. Both questions should be resolved before sensitive information or business-critical workflows enter the system.

Let’s talk about your business goals.

Privacy
04

Design the architecture so one vendor is replaceable

Contracts matter, but architecture determines how painful departure will be. The strongest approach separates enduring business assets from replaceable technology. Keep authoritative data in systems your organization controls. Maintain copies of important prompts, policies, evaluation criteria and workflow definitions outside the vendor’s interface. Document where information originates, how it is transformed and which service performs each step.

Architectural choices
Tightly coupled implementation
Vendor-specific features are embedded throughout the workflow. Initial delivery may be faster, but substitution requires broad redesign.
Layered implementation
Data, business logic, model access and user experience are separated through documented boundaries. Components can be replaced with less disruption.
Single-model dependency
Prompts, evaluations and processes assume one model’s behavior. A model change can affect the entire application.
Model-aware abstraction
The organization records model-specific requirements while preserving provider-neutral business rules and evaluation tests. Replacement still requires work, but the work is visible and measurable.

Open standards and common formats are useful when they are supported in practice. Ask the vendor which standards apply, which portions remain proprietary and whether exported assets have been imported successfully into other environments. The useful question is not “Do you support open standards?” It is “Show us the migration path for our specific implementation.” A deeper review of open standards and practical migration paths can help turn that principle into evaluation criteria.

Example

Suppose an organization deploys an AI assistant using business information it has reviewed and approved. To limit lock-in, it keeps the source material and revision history in its own controlled repository, documents the instructions that govern answers, retains evaluation questions and stores important interaction records in usable formats. If the model or interface changes, the organization still has the knowledge and tests needed to assess a replacement.

Avoid overcorrecting by refusing every proprietary feature. A specialized capability may create genuine value. Use it deliberately, document the dependency and decide in advance what replacement would entail. The goal is controlled dependence, not an unrealistic absence of vendors. Review how to avoid specialized-tool dependence when weighing convenience against future switching costs.

05

Build the exit plan before implementation

An exit plan should be a deliverable of vendor selection. It needs an owner, defined triggers, a current inventory of assets and dependencies, and a sequence for preserving service while migration occurs. Waiting until termination gives the incumbent vendor control over timing and leaves your team discovering technical constraints under pressure.

Minimum exit plan
  1. Identify exit triggers, including unacceptable price changes, security concerns, service decline, strategic change or the availability of a better architecture.
  2. Define the transition period and the access required during it. Include administrative access, exports, documentation and technical cooperation.
  3. Specify export scope and acceptance criteria. Test that files are complete, intelligible and usable by the receiving environment.
  4. Plan replacement of integrations, identity controls, monitoring, workflows and user interfaces—not just the model endpoint.
  5. Verify deletion after migration, including retained copies and derived information where applicable under the agreement.
  6. Run an exit exercise periodically and update the cost estimate as the system evolves.

Treat exit fees as only one part of the cost. The largest burden may be undocumented configuration, unavailable metadata, staff retraining or the need to recreate business logic. Ask for a detailed schedule of termination charges and distinguish unavoidable transition work from fees designed to discourage departure. The practical objective is choosing a provider without data being held hostage, not merely securing a low headline price.

Decision rule

Do not make an AI platform business-critical until your team has seen a representative export, mapped the dependencies and approved a funded migration approach.

06

Where Rohan Hall and the OceSha ventures fit

Rohan Hall approaches vendor dependence through enterprise architecture and durable AI capability. He founded OceSha Ventures and its AI-first work, which builds and operates solutions for businesses and organizations across course creation, branded academies, AI assistants such as Lumi, and business intelligence. Lumi supports conversational websites, customer inquiry handling and customer intelligence using information the business has confirmed.

That work reinforces a broader principle: an AI implementation should be governed as an operating capability, not purchased as an isolated demonstration. Organizations need clear knowledge ownership, documented workflows, evaluation methods and architecture decisions that survive changes in models and providers. Readers exploring Rohan’s ventures, book and wider work can start at Rohan Hall’s home page.

Rohan examines artificial intelligence alongside blockchain, decentralized identity, cognitive intelligence, neuromorphic technologies and other emerging fields in The Convergence of AI and the Top 10 Emerging Technologies. The book is the appropriate next step for readers interested in how converging technologies affect strategy and system design.

The wider education ecosystem includes course creation and branded academy services through OceSha Ventures, including custom builds offered through OceSha AI. Readers can explore OceSha AI and review programs connected with OceSha Academy. When assessing any AI implementation—including these offerings—apply the same discipline: identify what you own, document what depends on the provider and establish how your organization would move.

Before making a final selection, compare the proposed terms against a structured framework for maintaining flexibility when choosing an AI platform. A vendor’s willingness to answer specific portability and termination questions is itself useful evidence about the kind of relationship it intends to build.

Visit Rohan Hall’s home page to explore his ventures, writing, podcast and work across enterprise AI and emerging technologies.

Explore Rohan Hall’s work

Frequently asked questions

Should we require an AI vendor to use only open-source models?

No. Open-source models can improve deployability and inspection, but they do not automatically prevent lock-in. Proprietary orchestration, data structures, hosting, interfaces and workflow tools can still create substantial dependence. Evaluate the portability of the whole operating system around the model, not only the model license.

Is owning our input data enough?

No. Input ownership does not necessarily cover prompts, configurations, labels, evaluation sets, conversation records, outputs, embeddings, fine-tuned components or other derived materials. Define each important asset separately and specify rights, permitted uses, export formats, retention and deletion.

How often should we test exports?

Test before purchase, after material implementation changes and on a recurring schedule appropriate to the system’s importance. A previously usable export can become inadequate as new workflows, fields and proprietary features are added.

What should a model migration test measure?

Measure data completeness, reconstruction effort, workflow compatibility, output quality, security controls, downtime and the labor required to validate the replacement. Use established evaluation questions so that model behavior is compared against business requirements rather than subjective impressions.

Can a long-term vendor relationship still be safe?

Yes. Longevity is not the problem; uncontrolled dependence is. A long-term relationship can remain healthy when ownership is clear, exports are usable, dependencies are documented, pricing and termination terms are understood, and the organization periodically verifies that another path remains possible.

The bottom line

Vendor lock-in is not defined by proprietary technology; it is defined by whether dependency becomes uncontrollable. Secure explicit rights to your data and important derived assets, demand usable exports, separate business knowledge and logic from vendor infrastructure, and test a representative migration before the platform becomes critical. If a provider cannot explain what you receive when you leave, how long migration takes and what it costs, the offering is not ready for enterprise reliance. Choose value, but preserve the practical ability to change course.

Rohan Hall

Rohan Hall

Founder of OceSha Ventures · AI architect and author

Rohan Hall is a technology entrepreneur, AI architect and author with four decades of technology experience, now focused on practical AI across business, education, government and global impact. He founded OceSha Ventures, builds the OceSha AI platform and Lumi, and wrote The Convergence of AI and the Top 10 Emerging Technologies.

Who stands behind this

OceSha Ventures

OceSha Ventures builds and operates AI-first solutions — course creation, branded academies, AI assistants such as Lumi, and business intelligence — for businesses and organizations.

Sources

  1. Rohan Hall — rohanhall.com
  2. The Convergence of AI and the Top 10 Emerging Technologies (book)
  3. Rohan Hall on LinkedIn
  4. OceSha Ventures — ocesha.com

About this page. Last reviewed .

It is based on his verified public professional record.