DORA expects a documented, tested exit strategy for any AI agent platform that supports a critical or important function. An orderly exit for agents means three things: the service keeps running through the move, every past action record leaves with you in usable form, and agents on the new platform regain authority only after they are certified again.
What does DORA require on exit, in plain words?
DORA (Regulation (EU) 2022/2554), applying from 17 January 2025, requires financial entities to have exit strategies for ICT services that support critical or important functions. In substance, the strategy must:
- be comprehensive, documented and sufficiently tested;
- cover scenarios such as provider failure, deterioration in service quality, disruption caused by the service, material risk arising from its use, and termination of the contract;
- identify alternative solutions and a transition plan;
- allow the entity to exit without undue disruption to its business, without limiting its compliance, and without harming the continuity and quality of its services to clients.
Contracts must support this with termination rights and an adequate transition period during which the provider keeps delivering the service. DORA also lists circumstances in which entities should be able to terminate, such as significant breaches, weaknesses in the provider's risk management, or obstacles to supervision. For background, see what DORA is.
Who needs an exit strategy for agents?
Every financial entity in DORA's scope whose agents run on a third-party platform supporting a critical or important function. Entities using agents in less important functions should still plan an exit, more lightly. Whether the platform is also within NIS2 matters for its own obligations, not for yours, as explained in does NIS2 apply to AI agent platforms.
What makes exiting an agent platform harder than other software?
Leaving a typical software provider means moving data and switching users. Leaving an agent platform means moving four things, and each has a trap.
The record. Every action, verdict, source, approval and disclosure the agents produced is evidence you may need for complaints, audits and regulatory records for years. If it stays with the old vendor in a proprietary format, you lose the ability to reconstruct past decisions. Retention duties do not stop because the contract did.
The agents' configuration. Briefs, bounds, limits and source connections define what each agent may do. If they cannot be exported in a readable form, you rebuild from memory.
The evidence of authority. Certification results justify each agent's depth. They do not transfer automatically: an agent on a new platform, possibly with a different model, must be tested again before it regains its authority. Until then it should run at drafting depth.
Work in flight. Held actions waiting for a person, open cases and live conversations must be finished or handed over cleanly.
How do you build and test an exit for agents?
| Requirement | Control | Evidence it leaves |
|---|---|---|
| Documented, comprehensive strategy | Exit plan per platform covering record, configuration, certification and work in flight | Approved exit plan |
| Alternative solutions identified | Named alternative platform, in-house option or staffed fallback | Options analysis |
| Exit without undue disruption | Parallel run with agents on the new platform at drafting depth until certified | Parallel-run results |
| No loss of compliance | Full export of the action record in a documented format, verified for completeness | Export manifest and integrity checks |
| Continuity of client service | Staffed fallback sized to carry the work during transition | Staffing plan and service level results |
| Contract supports exit | Termination rights, transition period and export assistance written in | Contract clauses |
| Data protection on exit | Transfer safeguards for moved records; deletion at the old vendor confirmed | Transfer assessment and deletion certificate |
| Strategy tested | Periodic export test and partial migration exercise | Test reports and fixes |
Moving records between platforms can involve international transfers, so assess them as covered in GDPR international transfers and AI agents on global platforms. The NIST AI RMF's treatment of third-party risk, discussed in NIST AI RMF third-party risk for AI agent platforms, offers a useful structure for the alternatives analysis.
What will a supervisor ask?
- Show us the exit plan for your agent platform. When was it last tested?
- If you left tomorrow, could you still answer a complaint about a decision an agent made two years ago?
- In what format is the action record exported, and have you opened it outside the vendor's tools?
- How long would it take to re-certify your agents on another platform?
- Who carries the work while that happens?
The second question is the one that exposes weak plans. An exit that preserves the service but loses the history fails the "without limiting compliance" test.
What does DORA's exit duty not cover?
It does not require you to keep a second platform running in standby. It does not require exit plans for every minor tool. It does not set the transition period; you negotiate that. And it does not address customers leaving you; decisions about closing customer relationships are a different process, covered in how to prepare customer exit decisions with an AI agent. For the wider map, see AI agent regulation mapped to controls.
This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
Where Pryme fits
Pryme files every verdict in an append-only record that belongs to the customer and can be exported with the provenance of each fact. Because authority comes from certification on the customer's own cases, the same cases can be replayed on any new setup to show whether an agent has earned its depth again.
Questions people ask
Do we need to test exit by actually leaving?
No. Test the parts that can fail: export the full record and open it independently, rebuild one agent's configuration elsewhere, and run a period on the staffed fallback.
What if the vendor goes out of business?
That is one of the scenarios the strategy must cover. Contract terms on data access in insolvency, and regular exports held by you, reduce dependence on the vendor's cooperation.
Can certification results move with the agent?
They are evidence about a specific agent, model and configuration. On a new platform, re-run the certification; the old results remain useful history.