Concentration is efficient right up until switching stops being theoretical. Two governments just discovered they could put a number on leaving. Almost no private board has ever produced that number, which is why lock-in gets discussed as a feeling.
Ask a chief executive whether the company is too dependent on any one supplier and you will usually get a thoughtful answer about raw materials, logistics or a single-source component. Ask the same question about software and the answer changes register. People say "we're locked in" the way they describe weather — as a condition, not a decision.
That framing survived because nobody had a price for the alternative. Over the past three months, two governments produced one.
What happened
In July, Ireland canceled a software framework tender worth an estimated €750 million to €1 billion — a vehicle intended to replace an expiring €350 million framework — after an interested party raised concerns about the Microsoft-only approach. The challenge cited two reference points: Schleswig-Holstein's migration of roughly 30,000 seats to openDesk, with claimed savings of more than €15 million a year, and the French national police's move of about 100,000 desktops to Linux.
Two months earlier, in May, the UK's Competition and Markets Authority opened a Strategic Market Status investigation into Microsoft's business software ecosystem — productivity software, PC and server operating systems, database management, security software and AI integration — examining bundling, interoperability, defaults and third-party integration. There is a statutory nine-month clock. A final designation decision is due by February 2027. Sarah Cardell's framing was blunt: business software is "a cornerstone of how the UK economy functions."
One detail in the CMA's scoping is more informative than the investigation itself: it did not open an equivalent investigation into cloud infrastructure. AWS was left out, with voluntary commitments preferred there instead.
The regulator looked at the whole stack and concluded that the place switching costs actually bite is not compute. It is the productivity, identity and application layer — the part most boards worry about least, because the invoice is smaller.
And in the same quarter, the opposite bet
If this were a straightforward story about concentration being dangerous, it would be less interesting. It is not.
In July the Pentagon awarded Oracle an enterprise software agreement worth approximately $7 billion — a five-year base with a five-year option — consolidating Department of Defense, Coast Guard and Intelligence Community Oracle licenses into a single vehicle. It is explicitly a consolidation of existing contracts rather than new spending, with the DoD claiming at least $441 million in savings, unaudited. It followed a $9.7 billion Dell Federal Systems deal in May consolidating Microsoft services.
So within roughly ninety days, one government pulled back from concentration and another leaned into it much harder. Both were acting rationally. Concentration is not good or bad — it is a trade, and the two parties simply valued the sides differently.
What both had in common is more useful than which way they went: each of them had produced a number. Ireland could see what leaving might cost because Schleswig-Holstein and the French police had already done the exercise in public. The Pentagon could see what consolidating would save because it counted. Neither was operating on a feeling.
Why private companies never make the estimate
Three reasons, and none of them are laziness.
There is no reference set. Governments publish their migrations. Private companies do not. If a manufacturer in your sector moved off a major platform last year, you will never hear the real numbers — not the cost, not the duration, not what broke. Every board is therefore making the estimate from scratch, which usually means not making it.
The person who would produce it is conflicted. The estimate falls naturally to IT leadership, who chose the platform, are certified in it, staffed for it, and would personally own a migration nobody wants. That is not corruption; it is an entirely ordinary incentive, and it reliably produces the answer that switching is impractical.
The cost is entangled, not itemized. A supplier relationship that spans identity, email, documents, database, security and now AI integration does not have a clean exit line. That entanglement is the product working as designed, and it is precisely what makes the number hard and important.
Visual 1 — Turning lock-in from a feeling into a number
Question | What a usable answer looks like | What it tells the board |
|---|---|---|
What would it cost to leave, in money and months? | A range, with the three largest line items named | Whether "locked in" is a real constraint or a habit |
Which layers are substitutable and which are entangled? | A split list — compute and storage on one side; identity, data model and workflow on the other | Where you have leverage now, without a migration |
What is our annual price escalation, compounded over five years? | A number, taken from the last three renewals | The cost of doing nothing, which is rarely quoted |
Can we get our data out in a usable form? | Tested, not asserted. Someone has actually exported it. | Whether the exit is expensive or impossible — different problems |
What would a 20% price rise do to our operating margin? | A single figure the CFO can state | How much the supplier could take before you would have to act |
How to read it: Nobody is suggesting you migrate. The point of the estimate is that a supplier who knows you have never made one prices accordingly — and a supplier who knows you have, does not.
The layer distinction matters more than the total
Most executives think about vendor risk in terms of the largest invoice, which is usually cloud infrastructure. The CMA's decision to leave that alone suggests the opposite conclusion.
Compute and storage are comparatively substitutable. The workloads are portable in principle, the pricing is public, and competitors exist at every size. It is expensive to move and it is not existential.
Identity, productivity, the data model and the workflow layer are different. They touch every employee, every process and increasingly every AI integration. They accumulate configuration nobody has documented. That is where the entanglement lives, and it tends to be a smaller line on the budget than the infrastructure that gets all the attention.
A free option worth diarizingThe CMA must decide on Strategic Market Status by February 2027. If designation follows, remedies could include interoperability and data-portability requirements — which would reduce your switching costs without you doing anything at all. That is a genuine option with a known expiry date. If a major renewal falls near it, the timing is worth considering.
What to do
Commission the exit estimate, and not from the incumbent's owner. A range is enough. The purpose is not to migrate — it is to convert an unexamined assumption into a figure that can be discussed at board level and referenced in a negotiation.
Separate the substitutable from the entangled, explicitly. You almost certainly have more leverage on infrastructure than you are using, and less on the application layer than you assume.
Put portability into the next renewal while you still have attention. Data export in a usable format, on demand, tested annually. Escalation caps. These are ordinary commercial terms that go unrequested because nobody frames the relationship as a risk.
Ask what your compounded price escalation has been. Most companies can produce the current year's increase and have never compounded it across the last five. The result is often the most persuasive slide in the pack.
Model a 20 percent rise against operating margin. One number. It tells you how much room the supplier has before their pricing becomes your strategy problem, and whether you would notice in time.
Ireland did not leave Microsoft. It canceled a tender, which is a much smaller act — and it could only do that because two other public bodies had made the alternative legible. The lesson for a private board is not about any particular vendor. It is that dependency you have never priced is not a constraint you have accepted. It is one you have declined to examine, and your supplier knows which of those two it is.
Sources and method. A LookatBusiness original. Ireland's cancellation of a software framework tender estimated at €750 million to €1 billion, replacing an expiring €350 million framework, and the references to Schleswig-Holstein's approximately 30,000-seat openDesk migration and the French police's roughly 100,000-desktop Linux move, as reported by The Register, July 22, 2026 — the savings figures cited in that challenge are claims made by the migrating bodies, not independently audited. CMA Strategic Market Status investigation into Microsoft's business software ecosystem, opened May 14, 2026, with a statutory nine-month deadline for a designation decision, per GOV.UK; the decision not to open an equivalent investigation into cloud infrastructure per Computer Weekly. Pentagon Oracle enterprise software agreement of approximately $7 billion and the preceding $9.7 billion Dell Federal Systems deal per DefenseScoop, July 23, 2026; the $441 million savings figure is the Department of Defense's own claim and is unaudited.
