The Leave-Behind Annex: Putting Supplier Exit Terms in the Procurement Pack

UK IT procurement still has an onboarding bias. Teams spend weeks on requirements, security questionnaires and integration plans, then treat exit as a legal footnote. In 2026, that imbalance is harder to defend. Supplier estates are more interconnected, data volumes are larger, and a disorderly exit can disrupt operations long after the final invoice has been paid.

The answer is not a longer termination clause. It is an exit file: a practical annex, agreed at signature and rehearsed during the contract, that tells both parties who does what when the relationship ends. Whether the supplier provides an AI tool, a managed service or a core platform, the file should sit in the procurement pack alongside the service description and the security schedule.

Why exit terms belong in the procurement pack

Exit risk is easy to defer because it sits in the future. Onboarding risk sits in the next sprint. That asymmetry encourages buyers to accept vague termination assistance, undefined data formats and deletion promises that are never tested. By the time notice is served, the buyer has less leverage and less time.

Treating the exit file as a procurement artefact changes the conversation. It forces the buyer to describe, before signature, what a clean exit looks like: which data leaves, in what format, through which channel, by when and with what evidence. It also gives the supplier a chance to price the work honestly rather than discover it under pressure.

What goes in the offboarding file

The file should be short enough to use and specific enough to enforce. Six sections cover most IT and AI supplier relationships.

Data extraction and portability. Define the datasets, metadata, model outputs and configuration records that must be exported. Specify machine-readable formats, delivery method, frequency and a test export before notice. For AI tools, include prompts, evaluation sets and any user-generated content that the buyer needs to retain. Avoid format language that only the supplier can interpret.

Termination assistance. Set a minimum assistance window, named roles, response times and knowledge-transfer activities. Require parallel running where continuity matters. State whether assistance is included in the contract price or charged at pre-agreed rates, and cap those rates.

Escrow and continuity artefacts. For business-critical software or models, identify what is deposited: source code, build scripts, configuration, documentation, model artefacts and dependency lists. Agree verification, release conditions and who pays for updates. Escrow without verification is a filing cabinet, not a fallback.

Credential and domain handover. List administrative accounts, API keys, service accounts, secrets, certificates, DNS entries, SaaS tenancies and integration endpoints. Require rotation after handover and a written confirmation that supplier-held access has been removed. This is often the difference between a controlled exit and a security incident.

Asset return and disposal. Cover hardware, media, access cards, labels and any buyer-owned equipment held by the supplier. Require secure erasure to a stated standard and a certificate that identifies the asset.

UK GDPR deletion evidence. Map personal data, including backups and sub-processor locations. Set deletion deadlines, require a certificate from the supplier and a summary of sub-processor confirmations, and state how the buyer can audit the claim. The ICO expects accountability, not just a promise in an email.

The 30/60/90-day exit checklist

Attach this to the contract as an operational schedule. It assumes notice has been served and a transition lead is in place.

• Day 30: Confirm the exit plan, name owners on both sides, agree the data extraction specification, start the test export and inventory all credentials and assets.
• Day 60: Complete a full data export and validation, test escrow release or continuity arrangements, run a parallel service where required, confirm deletion scope with the DPO and begin asset reconciliation.
• Day 90: Receive deletion evidence, close credentials and domains, return or dispose of assets, sign off the transition report and record any residual dependencies.

The dates should move with the risk. A payroll provider may need a longer parallel run; a marketing analytics tool may need a shorter one. The point is to have a cadence that both parties have already accepted.

Price the exit before you need it

Exit costs are easier to negotiate at signature than at notice. Ask for a fixed termination assistance fee, a schedule of rates for additional work and a clear statement of what is included. Challenge exit taxes: charges that appear only when a customer leaves are a commercial signal worth understanding.

The file should also say who pays for what. Data extraction, escrow verification, secure disposal and deletion certificates all have costs. Allocating them in advance prevents a standoff when the relationship is already strained.

Evidence, sign-off and rehearsal

An exit file is only useful if it produces evidence. Require a transition report, a decision log, deletion certificates, credential closure records and an asset return schedule. Assign sign-off to procurement, IT, security and the DPO, not to a single account manager.

Rehearse the file annually. A one-hour walkthrough with the supplier can expose unclear formats, missing contacts and unrealistic timelines while there is still time to fix them. The rehearsal is not a sign of distrust; it is the same discipline buyers already apply to incident response and business continuity.

A procurement habit, not a legal nicety

The strongest time to design an exit is before entry. A supplier that cannot describe a clean exit in specific, testable terms is telling the buyer something important about the relationship. In 2026, UK buyers should treat the offboarding file as a standard part of the procurement pack: not because every contract will end badly, but because every contract will end.