The Exit Clause Is the Product: Five Software Terms UK SMEs Should Negotiate Before Renewal

Software procurement tends to be judged on the demonstration, the price and the implementation date. The contract arrives late, is treated as an administrative hurdle, and is signed by someone who has already spent more time choosing a coffee machine. The Post Office Horizon inquiry has shown, at public expense, what happens when the contractual and governance scaffolding around a critical system is allowed to lag behind the operational dependency. Most UK SMEs will never run a system of that scale. They can still recognise the pattern: a business becomes dependent on software it cannot easily leave.

Lock-in rarely arrives as a dramatic trap. It accumulates through renewal notices, proprietary export formats, support arrangements that favour the incumbent and liability terms that make the supplier’s failure the customer’s problem. The remedy is not a legal department. It is a short list of terms that a ten-person firm can ask for, understand and, if necessary, walk away from. Procurement diligence is almost always cheaper than a rescue project.

1. Exit and transition assistance

Many contracts describe termination in detail but say almost nothing about the day after termination. That is the point at which the customer discovers whether the supplier will help with migration or simply switch off access. A useful clause should make transition a defined service, not a favour.

Example wording: “Upon termination or expiry for any reason, the Supplier shall provide transition assistance for up to 90 days at rates no higher than those set out in Schedule X, including data export, knowledge transfer, reasonable cooperation with a successor supplier and continued access to the Service on the same terms.”

Questions for the supplier: What exactly happens on the termination date? Is transition assistance included in the fee or charged separately? At what rate? Who is responsible for exporting attachments, audit logs and configuration? Will access continue during the notice period if the bill is disputed? A small firm does not need an unlimited commitment, but it does need a clear exit path.

2. Source code escrow, with realistic triggers

Source code escrow is not relevant to every SaaS product, and it is not a magic wand. It matters most where bespoke software, a specialised line-of-business application or an on-premises system supports a process that cannot simply be replaced. The clause should say what is deposited, how often it is updated, who holds it and what events release it.

Example wording: “Supplier shall deposit the current source code, build instructions, database schema and third-party dependency list with the Escrow Agent within 30 days of each major release. The deposit shall be released to the Customer if the Supplier ceases trading, enters administration, ceases support for the Product or fails to remedy a material breach within 30 days.”

Questions for the supplier: Is the deposit complete and buildable, or merely a code snapshot? Who is the escrow agent? Does the agreement cover updates? What happens if the supplier is acquired? For SaaS, ask instead about service continuity, data extraction and a verified exit plan. Escrow is useful only if the customer could actually use what is released.

3. Data portability in a usable format

The customer’s data should remain the customer’s data. A clause that promises “reasonable assistance” with extraction is weaker than a clause that specifies format, frequency and cost. A CSV file containing only current records may be insufficient if the business needs history, attachments, workflow states or audit trails.

Example wording: “The Customer may export all Customer Data, including historical records, attachments, metadata and audit logs, in a structured, machine-readable format at any time during the Subscription Term and for 90 days after termination, at no additional charge. The Supplier shall provide a data dictionary and schema sufficient to interpret the export.”

Questions for the supplier: What formats are supported? Can we export attachments in bulk? Are audit logs included? Is there a fee for a full export? How quickly is the export produced? What happens to backups after termination, and will the supplier certify deletion? Portability is not a theoretical right; it is a tested operational process.

4. Audit rights that work both ways

Suppliers often reserve the right to audit customer usage for licence compliance. That is reasonable in principle, but the customer should also be able to verify the things it depends on: security controls, subcontractors, service levels and support performance. Audit rights should be practical, confidential and proportionate.

Example wording: “The Customer may, on 30 days’ written notice and no more than once in any 12-month period, audit the Supplier’s records and controls relevant to the Service, including security certifications, subprocessor lists and service-level reports. The Supplier shall provide a summary of any material findings and a remediation plan within 30 days.”

Questions for the supplier: What independent security certifications are held? Can we see the subprocessor list? How are support response times evidenced? What happens if a service level is missed? Will you accept a right to audit, or at least a right to receive audit reports? A right that cannot be exercised in practice is not much of a right.

5. Liability caps that reflect the dependency

A liability cap is not a technicality. It determines who carries the cost when the software fails, data is lost or a migration goes wrong. A token cap may be acceptable for a low-risk tool; it is not acceptable for a system that runs payroll, billing or regulatory reporting.

Example wording: “The Supplier’s aggregate liability shall be no less than two times the fees paid or payable in the 12 months preceding the claim, and shall not apply to breaches of confidentiality, infringement of intellectual property rights, loss of Customer Data caused by the Supplier’s negligence or wilful misconduct.”

Questions for the supplier: Is the cap a multiple of annual fees or a fixed sum? Does it cover data loss and restoration costs? Are there carve-outs for confidentiality and intellectual property? Is the supplier insured? Does the cap apply to subcontractors? The aim is not to punish the supplier but to make the risk allocation honest enough that both parties take it seriously.

Negotiating as a small buyer

A ten-person firm will not always get every clause. It can still ask, and it can still make renewal conditional on a sensible answer. Suppliers have standard terms, but standard terms are not immutable; they are the starting position. The strongest leverage often comes six to nine months before renewal, when the supplier wants to retain the account and the customer has time to evaluate alternatives.

A practical process is to keep a one-page contract register, note the renewal date, identify the business processes that depend on the system and agree internally what an acceptable exit would look like. The questions above should be asked in writing. If the answers are vague, that is a finding in itself.

Horizon is an extreme case, but the lesson is not confined to government-scale systems. The contract should reflect the operational reality: if the business cannot leave without losing its data, its history or its ability to trade, then the exit terms are part of the product. They deserve to be procured as carefully as the features.