Let’s talk about the standard that lets everything in and nothing out.
There’s a moment every operator has had, and it doesn’t feel dramatic when it happens. You’re three years into a tool. Your team lives in it. Your customer history, your pricing logic, the little exceptions only your business has — all of it sits inside somebody else’s product. Then something shifts. A price hike, a policy change, a competitor that’s suddenly good enough to try.
So you go looking for the way out.
You find the export button. You click it. You get a file.
That file has everything the vendor needed you to have, and almost nothing you needed to take. Dates in a format nothing reads. Notes truncated. Automations gone. The relationships between records flattened into rows that no longer know about each other. You have your data, in the legal sense. You don’t have your business.
Now look at the week you arrived.
When you signed up, the door was wide open. Import from anywhere. Connect your email. Sync the calendar. Pull your whole history in with one click — because they built the entrance themselves, and the entrance was the pitch.
Notice the direction.
Everything was designed to come in. Almost nothing was designed to go out. That’s not a bug someone forgot to fix. That’s the product.
This is the pattern, and 2026 is the year it stopped hiding.
Follow the open standards, because that’s where it gets interesting. Take the Model Context Protocol — the connector layer every major lab now speaks. It’s genuinely open. Anthropic released it at the end of 2024, OpenAI, Google and Microsoft adopted it inside months, and by the end of 2025 it had been handed to a neutral foundation so nobody could own it. Ten thousand public servers and counting. On paper, the most interoperable moment in the history of software.
Now read the roadmap.
The people building the standard list the parts that aren’t finished: audit trails, authentication, gateway behaviour, and — their words — configuration portability. That last one is the whole story in two words. Because your configuration is where the value lives. The prompt library, the tuned rules, the approval thresholds, the accumulated way your business thinks. The protocol will happily carry all of it into the platform. It hasn’t got a clean way to carry it back out.
Open on the way in.
Closed on the way out.
And when the industry won’t fix the exit, the law has to. In Europe, the Data Act did exactly this — and the timing tells you everything. The rules have applied since September 2025. But the part that actually matters, the ban on switching fees and egress fees, the money you pay to move your own data off somebody’s servers, does not bite until the 12th of January 2027.
Sit with what that means. The most regulated market on earth had to pass a law, and then wait seventeen months, to stop companies charging you for the privilege of leaving.
Nobody bans a fee that isn’t working.
There’s a second kind of lock-in, and this one’s worse, because you can’t even point at it.
The first lock-in was data. Your records lived in their database, so you couldn’t leave. The second one is behaviour. Your agent has now spent two years learning how your company actually works — your shorthand, your decision patterns, the exceptions you make, the customer you always carry a bit longer than the numbers say you should. That learning is the most valuable thing you now own, and none of it is in the export. There’s nothing to export. It isn’t stored as a file. It lives inside a system somebody else rents to you, in a form no competitor has agreed to read.
Which means the honest test for lock-in has changed. It’s not “can I get my data out.” Everyone will sell you on that now, because data portability became a checkbox and a marketing page. The real test is this: can I leave at the same fidelity I arrived?
Ask that about anything you’re about to build on. Not can I import. Can I export — fully, in a shape another system can actually use, without asking nicely, without paying a fee, and without losing the thing that took me two years to teach it.
The operator lesson is short and it isn’t comfortable.
Test the exit before you build the entrance. Do the migration on paper — genuinely try to reconstruct your business somewhere else while the old system is still live and nobody’s panicking. If the rebuild takes a week, you’ve got a tool. If it takes a quarter and a small team, you don’t have a tool. You’ve got a landlord who’s being nice to you, this year. Budget the migration as a recurring cost, because that’s what it is. And keep one path to the exit permanently open — a nightly dump to a place you hold the keys to, in a format a competitor’s system could swallow tomorrow. Don’t wait for the crisis to find out what you actually own.
Because the trap is never sprung the day you decide to leave. It’s sprung the day you fall in love — and you don’t notice, because the entrance was beautiful.
The principle worth keeping:
A door that only opens one way isn’t a door. It’s a wall with better marketing. Openness you only get to experience while you’re a paying customer isn’t openness. It’s a welcome mat in front of a room you can’t leave.
You’ve got this. Just check the exit before you decorate.