Metric 0 Pre-Check
Complete these five gates before beginning any exit strategy assessment. If any gate fails, pause and remediate before proceeding.
- M0.1 — SUS-01 current: Confirm the most recent Vendor Performance Review (SUS-01) for this vendor is complete and the performance data triggering this assessment is documented.
- M0.2 — VEN-04 decommissioning requirements: Confirm the Security and Compliance Checklist (VEN-04) for this vendor has been reviewed to identify any security decommissioning obligations (data deletion, access revocation, certificate withdrawal).
- M0.3 — AI BoM entry verified: Confirm the AI Bill of Materials entry for the vendor’s tools is current — this entry will be updated to deregistered status on exit.
- M0.4 — GOV-03 risk entry current: Confirm the Risk Register (GOV-03) has a current vendor risk entry that this assessment will update or close.
- M0.5 — STR-07 engaged for High/Critical exits: For any exit classified as High or Critical urgency, confirm the AI Task Force (STR-07) has been briefed and has authorised the exit assessment to proceed.
Do not begin an exit strategy assessment if any Metric 0 gate fails. Remediation is a prerequisite, not a follow-on task.
Module Guide
Purpose
The Exit Strategy Checklist enables legal departments to systematically plan and execute AI vendor transitions while minimising operational disruption, data loss, and contractual risk. It covers the full exit lifecycle — from annual readiness reviews through triggered assessments and managed transition execution — with Risk Taxonomy 2026 exit trigger classification and Agentic Tier shutdown governance for Level 4 tools.
When to Use
- Blueprint Stage: Pillar 8 — Sustaining Long-Term Value (vendor relationship management and strategic flexibility)
- Frequency: Annual exit strategy reviews, triggered assessments on performance issues, contract renewal periods
- Audiences: General Counsel, Legal Operations, IT, Procurement, Risk Management
- Context: Contract renewals, vendor performance failures, strategic technology changes, cost optimisation, regulatory risk
How to Use
- Risk Assessment: Evaluate vendor relationships for lock-in risks, integration complexity, and exit complexity.
- Planning Preparation: Develop exit plans including data migration, successor vendor selection, and contract obligations.
- Trigger Classification: Map the exit trigger to a Risk Taxonomy 2026 class before proceeding — class determines escalation level.
- Contract Negotiation: Incorporate exit-friendly terms in agreements and renewals before a vendor relationship is established.
- Execution Readiness: Maintain updated exit procedures and alternative vendor relationships.
- Agentic Tier Governance: Apply the shutdown protocol for any Level 4 tool being decommissioned.
- AI BoM and GOV-03 Updates: On exit, deregister the tool from the AI BoM and close the vendor risk entry in GOV-03.
Best Practices
- Plan exits before they become necessary — rushed exits cost more and create higher compliance risk.
- Test data export and migration procedures regularly, not only at exit time.
- Maintain relationships with alternative vendors before exit situations arise.
- Include Class 6 Shadow AI screening in annual exit readiness reviews: if staff have already migrated to an alternative tool informally, this signals a shadow AI risk that must be addressed regardless of the formal exit timeline.
- Coordinate annual reviews with the SUS-05 renewal calendar and SUS-01 performance trend data.
Risk Taxonomy 2026 Exit Trigger Classification
Before beginning any exit assessment, classify the primary trigger using the Risk Taxonomy 2026 framework. The classification determines escalation level and documentation requirements.
| Exit Trigger Type | Risk Taxonomy 2026 Class | Escalation Requirement |
|—|—|—|
| Vendor insolvency or acquisition | Class 5: Supply Chain | STR-07 notification within 24 hours |
| Persistent SLA failures | Class 9: Operational Resilience | STR-07 notification if Critical |
| Data breach or confidentiality failure | Class 2: Privilege/Confidentiality | STR-07 notification + GOV-03 incident log immediately |
| Bias or discriminatory output detected | Class 3: Bias/Fairness | GOV-04 assessment required before exit |
| Privacy or data protection violation | Class 4: Privacy/Data Protection | Legal/compliance review required; notify regulators if obligated |
| Regulatory non-compliance (EU AI Act etc.) | Class 7: Regulatory Compliance | Legal review required; document remediation steps |
| Shadow AI proliferation caused by vendor | Class 6: Shadow AI | Immediate STR-07 escalation; cannot be deferred |
| AI output quality failure (hallucination) | Class 1: Hallucination | Document accuracy failures; trigger Class 1 incident in GOV-03 |
| IP or licensing issue | Class 8: IP/Licensing | Legal review required; document IP exposure |
| Strategic technology change | No primary risk class | STR-07 strategic briefing required |
Class 6 Shadow AI escalation rule: If the exit trigger is or includes Class 6 (shadow AI risk generated by this vendor relationship), the assessment cannot be deferred. Notify STR-07 immediately and log in GOV-03 before proceeding with any other steps.
Exit Urgency Levels
| Level | Timeframe | Trigger Examples |
|—|—|—|
| Immediate (Class 6 or data breach) | Within 24–48 hours | Shadow AI proliferation; data breach; insolvency announcement |
| Critical | Within 30 days | Regulatory non-compliance; persistent SLA breach; Class 9 failure |
| High | Within 90 days | Performance deterioration; strategic misalignment; significant price change |
| Planned | Aligned with contract cycle | Annual review; better alternative available; capability gap |