Sector rules require audit rights over providers and a tested exit plan. How does that shape your architecture and supplier choices?

What is being tested

Whether you recognise that regulatory obligations constrain the supplier set and the technology set together.

How it shapes supplier choice

Audit rights favour large providers with established compliance programmes and standard contractual clauses. Smaller vendors frequently cannot offer them, which narrows the supplier set before any technical evaluation begins — and that is worth knowing before you have a favourite.

Sub-outsourcing transparency matters: you need to know who your provider depends on, because their concentration is yours. A small vendor built on a single hyperscaler adds a layer without adding independence.

Notification lead times are a real constraint on the delivery plan. If a material workload move requires regulator notification with a waiting period, that is weeks in the schedule, not a formality.

How it shapes architecture

Exit obligations favour portable choices. A workload on managed Kubernetes with a standard database engine is far easier to move than one built on provider-specific serverless and proprietary managed services.

That does not forbid the latter — it means the choice must be justified for anything material, and the justification should be recorded.

Concentration requirements may mandate multi-provider capability for critical services. This is expensive and complex, and the pragmatic response is to make the critical path portable rather than the whole estate.

Data location and access must be demonstrable, including which personnel in which jurisdictions can reach the data — which constrains the provider's support model, not just the storage region.

What to do practically

• Classify workloads by materiality, and apply the constraints proportionately. Not everything is material, and treating it as though it were makes the programme unaffordable.
• Record the justification where a provider-specific service is chosen for a material workload.
• Test part of the exit plan — restore a backup to a different provider, run a component elsewhere. Evidence beats assertion.
• Map sub-outsourcing so concentration is not understated.

The failure to avoid

Provider-specific services embedded in a critical path, discovered at a regulatory review with an exit obligation attached and no plan that survives scrutiny.