Defence AI Contracts Need a Data Exit Plan

The UK wants modular, open-architecture AI buying that avoids lock-in, while NATO data principles tie discoverability to authorised sharing. Both are direction, not proof of portability. Treat supplier exit as a contractual, commercial and lifecycle question, tested through early non-operational acceptance checks before any dependency hardens.

Put supplier choice into the contract

The UK’s AI-at-the-heart-of-defence policy seeks modular, open-architecture procurement that avoids vendor lock-in and supports integration across multiple providers. (UK procurement direction). NATO’s data strategy pairs discoverability with authorised access, governed sharing and interoperability between Allies and the NATO enterprise. (Alliance data principles).

Write multi-supplier integration into the requirement rather than the aspiration. Where policy calls for modular, open-architecture procurement that avoids lock-in, make the exit route a scored criterion: named alternative integrators, documented interfaces, transition cost. Ask whether a second supplier could bid to extend the system tomorrow without new licences, and log the answer as evidence.

Related reading: defence technology coverage.

Make the data usable outside its original platform

The earlier UK Defence AI Strategy links a data-driven organisation to common data architectures, standards, labelling conventions and integrated, curated data. (earlier strategy). NATO’s revised AI strategy calls for growing interoperability between AI systems throughout the Alliance, as part of its intended adoption outcomes. (AI interoperability).

Common architectures, standards and labelling conventions matter only if they let data leave its first platform. Align requirements with NATO discoverability and authorised-sharing principles, then specify export formats, metadata and identifiers. Test it directly: can a different tool, under the same access rules, find and read the records without the original vendor present?

Related reading: public sector AI analysis.

Ask what another supplier could actually inherit

UK AI procurement guidelines link the ability to engage other suppliers to continuing or building upon a system, limiting vendor lock-in. (AI procurement guidance). The government’s Open Standards principles identify software interoperability, component reuse and data sharing as ways open standards can help reduce supplier dependence. (standards principles).

Interoperability claims are cheap; inheritable assets are not. Procurement guidance ties engaging other suppliers to whether a system can be continued or built upon, and open standards principles treat reuse and data sharing as the route to less supplier dependence. Demand an inventory of what transfers, ask whether a new team could operate it unaided.

Related reading: defence procurement coverage.

Turn interoperability into an acceptance test

The Technology Code of Practice says technology should work with existing systems, processes and infrastructure while adapting to future demands. (technology code). Government guidance on open standards recommends specifying held data and identifiers, avoiding duplication and using RESTful APIs for integration where possible. (integration guidance).

Guidance that technology should work with existing systems and adapt to future demands becomes testable only when written as scenarios. Specify held data, identifiers and API integration, then rehearse a handover in a non-operational environment. The measurable question: does a replacement component pass the same integration tests as the incumbent, without bespoke glue code?

Related reading: AI governance coverage.

Keep exit rights inside lifecycle governance

The MOD’s dependable AI policy framework includes governance, development and assurance across the AI lifecycle, covering quality, safety and security considerations. (lifecycle responsibilities). The recommended government standards profiles include choices made through peer review and public comment, rather than a supplier’s interoperability claim alone. (standards selection).

Exit is a lifecycle obligation. The MOD framework places governance, development and assurance across the whole AI lifecycle, covering quality, safety and security, which is where knowledge transfer belongs. Anchor standards choices to peer-reviewed government profiles, not a supplier's interoperability claim. Can an incoming team evidence governance continuity at handover?

Related reading: defence industry analysis.