Switching Providers Without Lock-in: Exporting Knowledge and Conversations

Anyone introducing a chat assistant rarely plans for the day they hand it back. Yet that is exactly where it is decided whether a business can choose its provider freely: over months, it builds up ingested sources, curated question-and-answer pairs, a tuned system instruction, many conversation transcripts and the analytics derived from them. With an assistant, lock-in rarely means that the contract cannot be terminated. It means that these holdings do not come out in a form another system can work with. This article shows which five holdings should move with you when you switch, what the EU Data Act understands by exportable data, when your visitors themselves have a right to their data, how to check an export for completeness and what to settle before you sign.

Enlarge graphic

Labels in the illustration

• Holdings
• Export
• Cross-check
• Close-out
• Knowledge sources
• documents, sections, date
• Q&A pairs
• wording, variants, status
• System instruction
• every version with date
• Conversations
• messages, time, role
• Analytics
• raw data plus definition
• Export file
• one file, one section per holding
• structured
• commonly used
• machine-readable
• Header: time, scope,
• complete: yes or no
• Art. 30(5) Data Act
• Count
• Figure per holding
• in the system and
• in the file:
• must match
• Import
• into the new system,
• count again there,
• spot checks with
• special characters
• and old versions
• Deletion
• deleted or
• returned at the
• old provider,
• as you choose
• Art. 28 GDPR
• Confirmation
• in writing, with
• categories, date
• and expiry of
• backups
• Art. 20 GDPR: visitor data · Art. 25 and 30 Data Act: your holdings · Art. 28(3)(g) GDPR: deletion

Switching without lock-in: from holdings to a deleted old copy

Lock-in Sits in the Data, Not in the Contract

A contract can be terminated; the question is what is left in your hands afterwards. With chat assistants, lock-in typically shows up in small places: conversations can only be saved one at a time as PDFs, the knowledge base appears in the export only as a list of addresses without the ingested text, the system instruction counts as part of the product and is missing entirely, and curated question-and-answer pairs are visible in the interface but cannot be retrieved as a file. Each of these gaps looks harmless on its own. Together they mean that a switch starts with a rebuild instead of a move.

A rebuild costs more than working hours. Whoever rewrites the knowledge base has to approve every subject-matter statement again, and whoever leaves the transcripts behind loses the real questions against which a successor could be tested. How a switch runs as a project with parallel operation, redirects and a schedule is covered in the article Replacing a chatbot without breaking the dialogue. This article deals with the question before that: which holdings have to come out in which form so that you have a choice at all.

Five Holdings That Should Move With You

What an assistant knows and what it has experienced is spread across five holdings. They differ in who creates them, whether they contain personal data and in what form they can live on in another system. The sources of the knowledge base and the question-and-answer pairs come from you, the conversation transcripts largely from your visitors. The overview below lists, for each holding, what belongs to it, which form is suitable for a transfer and which gap often shows up in exports.

Two holdings are underestimated particularly often. The system instruction looks like a provider setting but is your work: it records what the assistant may say, when it hands over and where its limits lie – what matters there is described in the article System instruction: boundaries for an AI assistant. The question-and-answer pairs, in turn, carry wording that someone approved on subject-matter grounds; if they are lost, that approval is lost with them. As for analytics, a chart is of little use in the new system. What you should take along is the underlying data and the definition behind it, for instance what counted as a resolved conversation or as a handover. Without that definition, you compare two different ways of counting after the switch.

What the Data Act Means by Exportable Data

Regulation (EU) 2023/2854, known as the Data Act, contains rules on switching between data processing services in Chapter VI. It applies from 12 September 2025 (Official Journal of the European Union). A data processing service is defined there as a digital service providing on-demand network access to shared, scalable computing resources; recital 81 explicitly mentions software-as-a-service as well. Whether a particular assistant offering is covered depends on how it is set up and has to be assessed case by case. Where the rules apply, they start from the concept of exportable data:

This translates well to a chat assistant. Input data is what you put in: sources, question-and-answer pairs, the system instruction, settings. Output data arises in operation: answers, conversation transcripts, open questions. Metadata includes timestamps, versions, ratings and handover reasons. What remains exempt is what belongs to the provider and is protected as intellectual property or a trade secret, such as its program code or internal templates. This exemption has limits: where the provider exempts data because of a risk of breaching its trade secrets, the contract must name these categories exhaustively, and the exemption must neither impede nor delay the switch. Article 25(2) of the Regulation lists what a switching contract must at least contain; for the export, these points are central:

• An exhaustive specification of all categories of data and digital assets that can be ported during switching, including at a minimum all exportable data (point e).
• An exhaustive specification of the data categories specific to the internal functioning of the service that the provider exempts from the exportable data because of a risk of breaching its trade secrets – provided the exemption does not impede or delay the switch (point f).
• A minimum period for data retrieval of at least 30 calendar days (Official Journal of the European Union), starting after the agreed transitional period (point g).
• A clause on the full erasure of the exportable data generated directly by the customer or relating directly to the customer after the retrieval period has expired, provided the switch has been completed successfully (point h).
• In addition, Article 26 requires the provider to inform you about available switching and porting methods, formats and known technical restrictions.

Structured, Commonly Used, Machine-Readable: the Export Format

The Data Act does not prescribe a file extension. It first refers to common specifications and harmonised standards to be published in a central Union repository. As long as no such standards exist for a service type, a fallback rule applies:

The same formula appears in Article 20 GDPR for the data of individuals. In practice it means: the file can be read without the old provider’s software, its fields are named, and another system can take it over without retyping. JSON and CSV in UTF-8 usually meet this, a PDF or a screenshot usually does not – both are readable, but not machine-readable in this sense. A spreadsheet with merged cells and colour codes sits in between. How to recognise a usable export:

• The file states its format and character encoding; umlauts and quotation marks arrive unchanged.
• Every record carries an ID through which linked records can be found – conversation and message, source and section.
• Timestamps use a standardised format with time zone, not free text.
• Earlier versions of the knowledge base and the system instruction are included as separate entries.
• A header states the time and scope of the export and says whether it is complete.
• Access keys and passwords are deliberately left out; they are issued anew in the new system.

Count Completeness Instead of Assuming It

A file that opens is not yet proof that everything is in it. Exports get shorter in inconspicuous places: a date range is preset, a page limit cuts off silently, attachments are missing, drafts and superseded versions stay out, or a single section fails and the file still looks finished. None of these gaps shows when you leaf through, because what is missing cannot be seen.

How large such holdings can become is shown by our own: the knowledge base of the assistant answering on this site holds 2,670 sections from 70 documents (XICBOT, count in our own database). At that size, nobody reading through will usually notice that a document is missing; a count reveals it. How the count was made is described under measurement series. The cross-check needs no technology, only care:

• Note the count for each holding in the interface: sources, sections, question-and-answer pairs, conversations, messages.
• Count the same figures in the file itself rather than just taking the figure from the file header.
• Cross-check three samples: an old conversation, a conversation with a handover, a pair with several variants.
• Read a long text with umlauts, quotation marks and line breaks against the original.
• Import the file into the target system and count again there.

Conversation Transcripts: Your Visitors’ Data

Two rights meet in conversation transcripts. One is yours as the provider’s customer: you want to take your entire holdings along. The other belongs to the people who wrote to the assistant. For them, you are the controller within the meaning of the GDPR, while the assistant provider usually works as your processor. A visitor who wants to take their data along therefore turns to you and not to the provider. The basis is the right to data portability:

The right has conditions: the processing must be based on consent or a contract and be carried out by automated means. Which basis your chat relies on is set out in your privacy notice; in the individual case, your data protection adviser clarifies it. It covers the data the person has provided themselves – in a chat, first and foremost their own messages and details; under paragraph 4, the rights of other people must not be adversely affected. The answer is due without undue delay and in any event within one month (Official Journal of the European Union) of receipt of the request. An extension by two further months is only possible where the complexity and number of requests make it necessary, and must be communicated with reasons. What a visitor may additionally learn under Article 15 is covered in the article on the right of access to chat histories.

Deletion at the Old Provider

After the export, the holdings exist twice: with you and with the previous provider. The switch is only complete once the second copy is gone. For personal data, the data processing agreement governs this. Article 28(3) GDPR requires the contract to stipulate that the processor

The Data Act supplements this for exportable data, including non-personal data: the switching contract must contain a clause on full erasure after the retrieval period, provided the switch has been completed successfully. The order matters: export first, then count, then import, and only after that request deletion. A second point is easily overlooked. If a visitor previously requested erasure of their conversation under Article 17 GDPR, that conversation must not return to the new system through an older export. Use a fresh export, therefore, not last month’s backup. What else the contract with the provider should cover is described in the article on the data processing agreement. A deletion confirmation should usually contain:

• the deleted categories, matched against the list in the contract
• the time of deletion in the live system
• details of backup copies and the date on which they expire
• sub-processors involved and their deletion
• a named contact for questions
• a note on data retained because of statutory retention duties, such as invoices

Switching Charges and the Retrieval Period

An export that can only be released against a high fee is an obstacle too. The Data Act phases such charges out. Switching charges are defined there as charges for the actions the Regulation requires for switching, including data egress charges; standard service fees and early termination penalties do not count. From 12 January 2027 (Official Journal of the European Union), providers may no longer impose switching charges for the switching process. Until then, reduced charges are permitted that do not exceed the costs directly linked to the switch.

Besides money, time matters. Where the switching rules apply, a retrieval period of at least 30 calendar days remains after the agreed transitional period, in which you can still collect the data. Still, put the trial export at the beginning and not in that period: anyone who discovers only after giving notice that the system instruction is missing negotiates under time pressure. How the notice period, transitional period and retrieval fit into a schedule is shown in the article on switching without a break.

Before You Sign: Ten Questions for the Provider

The exit is easiest to settle before the entry. Before signing, you usually have more room to negotiate than later, and a written answer costs the provider nothing. These questions cover the points in this article:

• Which holdings can be exported, and is the complete list in the contract?
• Which categories does the provider exempt, and on what grounds?
• In which format, with which character encoding and with which IDs does the export arrive?
• Does it include earlier versions of the knowledge base and the system instruction?
• Can the export be run from the account at any time, or only after termination?
• Does the file itself report whether it is complete, and what happens if one part fails?
• Who in the team may trigger the export, and is it logged?
• How long can you still retrieve data after the contract ends?
• Are there charges for the export or the switch?
• How is data deleted, including in backups, and how does the provider confirm the deletion?

The answers can be tested during the trial phase: create a few sources, question-and-answer pairs and test conversations, trigger an export and count. This short trial usually reveals more than any promise. Who in the team may later trigger the export belongs in your role model; the article on roles and approvals explains why export and deletion belong with the owner role.

What XICBOT Provides for the Export

In XICBOT, the owner role can retrieve an export from the account, including before and independently of any termination. The export is a structured JSON file with a section per data type, including the assistants with their versions with role, tone, topic scope, handover rule and greeting, the knowledge base with sources, documents, sections and question-and-answer pairs, and the conversations with their messages. The other rules of a version are not included: the never-discuss list, maintained facts, master data fields, handover topics, the handover score and trigger words, and the handover address. Each section reports whether it was exported; if one failed or an entire table is missing, the file notes this and does not count as complete. This note does not cover missing fields or rows, and individual sections such as the activity log have an upper limit on rows – so count here as well, as described above. Passwords and the stored keys for the API, for webhooks and for the shop connection do not appear in the file. Because it contains conversations and thus personal data, keep it as well protected as the account itself.

A single conversation can be output as a CSV file for your records, masked in the same way as in the admin view; retrieval uses sign-in via the request header and not a key in the address bar. Your visitors have a route of their own: in the chat window, a visitor retrieves information on their conversation themselves via its ID, without an account or sign-in, and can also delete the conversation there; this information names you as the controller. If someone approaches us with their request, we refer them back to you. For your answer to a data portability request, the conversations are in your export as structured data, with time and role per message. Hosting, data processing and the deletion concept are described on the data protection and hosting page. If you would like to see in advance how an export is structured, get in touch.

Frequent questions