Cloud infrastructure market concentration has reached historically high levels. According to data published by Synergy Research Group for Q1 2026, Amazon Web Services (AWS), Microsoft Azure and Google Cloud Platform (GCP) jointly account for 67% of the global cloud services market. This concentration creates structural dependency for private and public organisations on an oligopoly whose contractual practices have attracted increasing regulatory scrutiny — including the Bundeskartellamt's §19a GWB proceedings against Amazon (2022) and Microsoft (2023), the Competition and Markets Authority's Cloud Market Study (2023), and the entry into force of the EU Data Act (Regulation (EU) 2023/2854, applicable since September 2025).

The academic literature on cloud vendor lock-in (Armbrust et al., 2010; Petcu, 2013; Opara-Martins et al., 2016) has predominantly addressed technical dimensions of lock-in — proprietary APIs, non-portable data formats, single-vendor architectures. Economic dimensions (Farrell & Klemperer, 2007) have been partially addressed in the form of switching cost analysis. Contractual, linguistic and behavioural dimensions remain underdocumented. This study aims to address these gaps through a systematic analysis of publicly available contractual documents.

The analysis rests on the comparative examination of 47 versions of contractual documents published by AWS, Google Cloud and Microsoft Azure over the period 2022–2026, including General Terms of Service, Product Terms, Data Processing Agreements (DPAs), Service Level Agreements (SLAs), and specific addenda (Data Act Addendum, UK Switching Addendum, EES, MOSA). Documents were collected in French, English and German where available.

The analysis covers exclusively publicly available standard contractual documents. Individually negotiated contracts (Enterprise Agreements, sector-specific agreements) may differ significantly. Microsoft Azure's monthly modification of Product Terms — documented at 608 occurrences between January and June 2026 — creates documentary instability that limits the temporal scope of conclusions. Results should be read as an analysis of the standard public conditions applicable to the majority of non-negotiating clients, not as an exhaustive description of all possible contractual configurations.

Section 2 presents the six-layer taxonomy. Section 3 analyses the linguistic substitution mechanism. Section 4 models the temporal dimension of lock-in. Section 5 examines competition law implications. Section 6 sets out research and regulatory proposals. Annexes A–D reproduce the primary data underlying the analysis in full.

The classical definition of vendor lock-in (Shapiro & Varian, 1999⁵) is grounded in switching costs — the costs incurred when transitioning from one supplier to another. Porter (1980)⁶ distinguishes barriers-to-exit (retaining the customer in the relationship) from barriers-to-entry (preventing a competitor from entering). Farrell & Klemperer (2007) provide the most comprehensive treatment of switching costs in platform economics, identifying installed-base effects, learning costs and contractual switching costs as the primary categories.

The taxonomy proposed here extends these frameworks by identifying three additional layers — behavioural (Skills, Layer 4), decisional (Demand, Layer 5) and cognitive (Layer 6) — which are absent from existing cloud lock-in literature and which, empirically, may be the most durable obstacles to supplier switching in mature cloud deployments.

All three hyperscalers publish their Terms of Service in multiple languages while stipulating that the English version "prevails" or "governs" in case of divergence. This mechanism, ostensibly a practical translation disclaimer, produces three distinct legal effects: (a) it deprives the client of certainty that the version in their own language is binding on the supplier; (b) it allows the supplier to publish updates in English without awaiting translation into other languages, creating temporal gaps during which the client operates under an outdated version; (c) in the most significant cases documented, it allows clauses waiving statutory legal rights to be included in the English-only version, absent from the client-language version.

This mechanism is rendered legally significant by mandatory language legislation applicable in several EU jurisdictions. In France, the Loi Toubon (Law n°94-665 of 4 August 1994)⁸ requires that contracts concluded with French legal entities for activities conducted in France be drafted in French, the French version being legally binding. A contractual clause declaring the English version to prevail is contrary to this mandatory provision and is therefore void ab initio under French law, without any requirement for the client to have challenged it at signing.

Beyond French mandatory language law, the EU Data Act art. 23 requires that contractual terms be provided in a manner that is "easy to read, understand and accessible". The structural coexistence of an "informational" client-language version and a legally binding English version directly contradicts this accessibility requirement. In German law, BGB §305c provides that terms which, in the circumstances, a contracting party could not reasonably expect, are not incorporated into the contract — a provision directly applicable to clauses present only in the English version of a contract signed by a German entity.

Cloud lock-in does not crystallise at the moment of signing but deepens progressively through use. We propose a three-phase model, calibrated on medium-sized organisations (100–1,000 employees, cloud spend $200k–$2M/year):

We define the economic point of no return (PNR) as the moment at which the total migration cost C_m exceeds the net present value of migration benefits B_m over the remaining commitment period. Formally: PNR = {t | C_m(t) > B_m(t)}, where C_m(t) = Σ(egress fees + residual commitments + refactoring + double-run + retraining) and B_m(t) = monthly post-migration savings × residual duration. Empirically, for organisations with more than 36 months of primary-hyperscaler tenure and active commitments, this ratio consistently exceeds 48 months — making migration economically unviable absent an external regulatory or strategic constraint.

This formalisation extends the "lock-in value" concept introduced by Shapiro & Varian (1999, op. cit.) to the specific structure of hyperscaler cloud contracts, where the asymmetry between entry cost (zero) and exit cost (positive and volume-dependent) systematically accelerates PNR as a function of data accumulation.

AWS, Azure and GCP jointly account for 67% of the global IaaS/PaaS cloud market (Synergy Research Group, Q1 2026). This concentration exceeds the collective dominance threshold established in EU case law (CJEU, United Brands v Commission, 1978¹³). The Digital Markets Act (DMA, Regulation (EU) 2022/1925) has designated both Microsoft and Alphabet as gatekeepers, though its provisions address market access rather than contractual retention mechanisms specifically. The EU Data Act (2023/2854) represents the most directly applicable instrument, specifically targeting obstacles to cloud switching in Articles 23–25.

In UK competition law, the Competition Act 1998 section 18 prohibits the abuse of a dominant position. The CMA's 2023 Cloud Market Study explicitly identified switching barriers as a primary competition concern, concluding that "the combination of technical barriers, egress fees and contract terms can make switching or multi-clouding excessively difficult"¹⁴. No formal enforcement action has followed from this finding at the date of this paper.

Layer 6 (cognitive lock-in) falls outside all existing regulatory frameworks. It involves no clause to challenge, no anticompetitive behaviour in the classical sense, and no obstacle to portability in the technical meaning of the Data Act. Yet it may represent the most durable barrier to competition in mature cloud markets — because it operates on organisations' capacity to conceive and evaluate alternatives. After five years of primary-hyperscaler dependency, an organisation's performance KPIs, benchmarking criteria and team evaluation frameworks are defined within the supplier's console. A migration implies not merely technical and financial costs but the loss of the organisation's own measurement standard. This observation suggests that an effective regulatory response to cloud lock-in must ultimately address organisational dependency beyond the contractual and technical dimensions currently covered by existing instruments. The UK case Streetmap.EU Ltd v Google Inc [2016]¹⁵ offers a precedent for competition law engaging with the cognitive dimensions of market dominance — though the context (search default settings) differs from the cloud dependency analysed here.

A review of the cloud vendor lock-in literature (Opara-Martins et al., 2016; Petcu, 2013; Armbrust et al., 2010; Farrell & Klemperer, 2007) confirms that Layers 1 to 3 of the proposed taxonomy are partially documented — primarily from a technical perspective and, to a lesser extent, an economic one. Layers 4 (Skills Lock-in), 5 (Demand Lock-in) and 6 (Cognitive Lock-in) are, to the author's knowledge, absent from the formalised academic literature on cloud computing. The linguistic substitution mechanism — the substitution of the client-language version by an English-only version declared legally binding — is not documented in any of the reviewed works. These gaps represent research opportunities of both academic and policy significance.

The six-layer taxonomy presented in this working paper maps the full architecture of retention mechanisms operating in hyperscaler cloud contracts. It reveals that the most durable mechanisms — Layers 5 and 6 — are precisely those which are least visible, least legally contestable, and least covered by existing regulatory frameworks. An effective regulatory response to cloud vendor lock-in cannot be complete without a theory of organisational digital dependency that integrates these behavioural and cognitive dimensions beyond the contractual and technical obstacles currently addressed by the Data Act, the DMA and national competition law instruments.

Contractual documents were collected directly from the official websites of the three providers (aws.amazon.com/legal/ · cloud.google.com/terms · microsoft.com/licensing) between January 2022 and June 2026. For each provider, versions available in the three languages (FR · EN · DE) were downloaded upon each detected update, via systematic monitoring of the terms pages. Publication dates are extracted either from document metadata or from explicit internal mentions (e.g. Azure EES: "Published February 1, 2026 in English, translated February 9, 2026").

HTML documents were pre-processed in two stages: (a) text extraction by removal of HTML tags, scripts and CSS styles; (b) text normalisation by replacement of HTML entities, non-breaking spaces and typographic ligatures (e.g. fi → fi), and compression of multiple whitespace characters. This normalisation step is essential to distinguish substantive modifications from formatting changes — which represent the majority of "modifications" detected by a raw HTML diff. All differences identified as substantive were independently confirmed in the original documents to exclude normalisation artefacts.

Comparison between versions was conducted using normalised textual diff, section by section (each section identified by its number: s.1.4, s.5.5, s.50.12.2, etc.). For each pair of sections (version X vs version Y), normalised Levenshtein distance was computed to flag substantive modifications. Section pairs exhibiting greater than 95% similarity after normalisation were classified as "identical in substance" — residual typographic and formatting artefacts not constituting legally significant modifications.

All modifications identified as substantive by the algorithm were subject to manual review to: (a) confirm that the difference constitutes a legally significant modification and not a normalisation artefact; (b) characterise the nature of the modification (addition · deletion · reformulation · change in scope); (c) identify the relevant lock-in layer under the six-layer taxonomy. The results of this manual review are reproduced in Annex B for linguistic comparisons and in the corpus of 19 individual legal analyses of which this study constitutes the synthesis.