Vendor lock-in and proprietary black boxes¶

Europe loves a good mystery, preferably one involving a labyrinth, a dragon, and a contractual clause written during the Bronze Age. What it mostly has are vendor systems that behave like enchanted artefacts in a Pratchettian bazaar: they work only when the vendor priests are in a good mood, they cannot be opened without voiding several warranties, and they explode on a timetable known only to themselves.

From industrial control systems to cloud ecosystems, organisations are surrounded by magnificent machinery they ostensibly own yet somehow may not touch. The code cannot be seen, the configuration cannot be adjusted, and patches arrive with the vendor’s blessing, bestowed about as often as unicorn sightings. Vulnerabilities flourish, unknown and unfixed, while customers carry on bravely clutching the risk register like a comfort blanket.

The clerk’s brief¶

September 2026: The whole Court packs¶

On 21 September 2026 Washington was reported to be preparing sanctions on the whole International Criminal Court, with a grace period of six to seven months. Dutch and Court officials want the time because “the institution needs time to sever itself from American companies”. The deputy prosecutor, Nazhat Shameem Khan, told the Financial Times that the Court had moved its office software from Microsoft to the German open-source openDesk, found workarounds for health insurance and banking, and was paying staff months in advance. As of March 2026 its evidence platform still ran on a five-year contract with Relativity, a Chicago company. The clerks note that the first exit in this file to get anywhere near finished was not entirely voluntary.

August 2026: The bank that could not leave¶

On 26 August 2026 the US Treasury sanctioned Autistici/Inventati, an Italian collective providing encrypted email and website hosting. The US-based Public Interest Registry suspended its domain two days later, The Record reported. Its bank, Banca Etica, suspended the account, explaining that secondary sanctions would cost all its customers their credit and debit cards, which “oggi dipendono da un sostanziale monopolio di operatori USA” (today depend on a near-monopoly of US operators). The collective shut down. The clerks note that the bank could not leave its dependency, so it left the customer.

November 2025: The cages get a warden¶

On 18 November 2025 the European supervisory authorities designated the first 19 critical ICT third-party providers under DORA, placing the cloud and software providers on whom European finance depends under direct oversight. The framework treats concentration itself as a risk, not merely each firm’s contract with it. The clerks note that the Union has begun supervising the cages, which is not the same as opening them, but does mean someone now counts the occupants.

October 2025: The watchdog runs out of colours¶

CISPE’s European Cloud Competition Observatory issued its third report on Broadcom’s VMware licensing in October 2025, assigning a red alert, its most severe rating, over unilateral, market-distorting programme changes, as reported by The Register. The pattern under scrutiny: acquire the incumbent, terminate longstanding licences without much notice, and reprice the captivity. The clerks admire the business model in the way one admires a well-executed heist.

June 2025: Two governments try the door¶

Denmark’s Ministry of Digitalisation announced in June 2025 it would replace Microsoft Office with LibreOffice, citing dependence rather than cost, in the same week Schleswig-Holstein confirmed its own migration. These are the most watched lock-in exits in Europe precisely because they are so rare, and because everyone wants to know the true price of the door. The clerks are keeping a separate page for what the migrations cost against what the renewals would have, and expect it to be quoted for a decade either way.

May 2025: The Minotaur sends an estimate¶

CISPE members reported VMware licensing cost increases of 800 to 1,500 per cent to the European Commission following Broadcom’s acquisition, as reported by The Register in May 2025 alongside the observatory’s second report. An increase of that size is not a price adjustment; it is a measurement of how expensive the exits are believed to be. The vendor, the clerks note, has simply published its estimate of the Minotaur.

May 2025: The mailbox goes first¶

The United States designated the Court’s chief prosecutor, Karim Khan, in February 2025, and in May he lost his Microsoft mailbox. Microsoft’s correction to a UK parliamentary committee says it was “in touch with the ICC throughout the process that resulted in the disconnection of its sanctioned official”, and “at no point” ceased or suspended services to the Court. The Dutch press had reported that the Court was told to end his access or lose email for the whole organisation.

The exit file¶

The mechanism has not changed since the file was opened: certification freezes systems, contracts forbid inspection, acquisition events reprice the dependency overnight, with the ECCO watchdog documenting the Broadcom case since February 2025, and since 2025 a foreign designation can close it from outside. What is new is the legal scaffolding around it: the Data Act, applicable since September 2025, sets a framework for switching between data-processing services, and DORA’s November 2025 designations put systemic providers under supervision. The Union’s designations supervise the cages. Washington’s lock them. The Blocking Statute, Europe’s instrument for refusing foreign sanctions, still lists only US measures on Cuba and Iran. The clerks’ standing assessment: the law is slowly making exits a right, while economics keeps making them a project, and rights that cost millions to exercise are exercised mainly in press releases.