If your MPLS contract renews within the next 18 months, that window is your one moment of real leverage: miss the 60-to-90-day notice deadline and most carrier contracts auto-renew for another 12 months at list prices. The replacement direction is settled — new MPLS links are declining 24% per year while SD-WAN and SASE take over — so the question is no longer whether to leave, but how to run the exit without breaking voice, deadlines or budgets. This is the playbook.
Key takeaways
- Start 6 to 18 months before contract expiry: that is when procurement leverage peaks, and early termination otherwise costs 80–100% of the remaining monthly charges.
- The economics are decisive: a 1 Gbps MPLS circuit averages $1,439/month against $966 for dedicated internet access, and full internet-first transformations cut annual WAN TCO by up to 54%.
- Belgian underlay reality: Proximus stop-sold copper-based EFM circuits on 1 January 2025 (service ends 31 December 2028) and fibre passed 42% of the country in Q1 2026 — but dedicated business lines still take 60–120 days to deliver.
- Modern SD-WAN answers the classic MPLS objections: forward error correction, packet duplication and dynamic path steering keep voice stable on best-effort links.
- Gartner expects 60–65% of new SD-WAN purchases to ship inside a single-vendor SASE platform by the end of 2026 (up from 15% in 2022) — if you touch the WAN anyway, security consolidates in the same move.
Why renewal time is the decision moment
Enterprise MPLS agreements typically run three to five years with a tacit auto-renewal clause: no written cancellation 60 to 90 days before expiry means another year at non-discounted rates. Cancelling mid-term is worse — standard early-termination liability runs 80% to 100% of the remaining monthly recurring charges, plus repayment of unamortised installation costs, per telecom procurement data from Savecall. TeleGeography’s benchmarking shows negotiating leverage peaks 6 to 18 months out, when competitive DIA quotes can be used to negotiate penalty-free phased migration clauses with the incumbent.
The carriers themselves are pushing the same direction. Proximus completed its SDH outphasing in March 2024, stop-sold Ethernet over Copper on 1 January 2025 with definitive end of service on 31 December 2028, and is retiring copper loops per fiberhood, per its official Network Transformation Outlook 2025–2030. BT, Orange Business and KPN steer enterprise clients from legacy private circuits toward SD-WAN overlays. Waiting a contract cycle does not preserve the status quo; it just postpones the same migration to worse terms.
When does keeping MPLS still make sense?
Honesty first: MPLS still wins in specific situations, and the exit playbook starts by identifying them.
| Keep MPLS (for now) if | Leave for SD-WAN/SASE if |
|---|---|
| Over 70% of application workloads still run in on-premises data centres | Over half of your traffic goes to SaaS and public cloud |
| Sites run legacy SCADA/OT needing deterministic sub-millisecond Layer-2 routing | More than 20% of staff work remotely or hybrid |
| Contract has 18+ months left with 100% termination penalties | You are inside the 6–18 month renewal window |
| Rural sites lack business fibre or reliable DIA | Sites have access to business fibre or high-speed 5G underlays |
| Branch firewalls were just renewed everywhere | Branch firewalls approach end-of-life or need NIS2 upgrades |
Each classic objection now has a technical answer. Deterministic QoS? SD-WAN measures latency, jitter and loss continuously and steers voice over the best path, applies forward error correction so lost packets are reconstructed without retransmission, and can duplicate critical packets across two links simultaneously. No fibre? Aggregate 5G, LEO satellite and broadband into one active-active logical WAN while the fibre order works through civil permits.
What do the replacement options cost?
Benchmark data compiled by Lightyear (April 2026) and TeleGeography’s TCO modelling put hard numbers on the choice — all figures per site, as of August 2026, and volatile enough to warrant a fresh quote:
| Cost component (1 Gbps reference) | Legacy MPLS | DIA only | Managed SD-WAN (DIA + overlay) | Single-vendor SASE |
|---|---|---|---|---|
| Average monthly cost | $1,439 | $966 | $1,066 | $1,250–$1,500 |
| Overlay/security licensing per site | Included in carrier fee | — | $100–$300/month | $300–$600/month (replaces branch firewall, SWG, VPN licences) |
| 3-year TCO vs MPLS baseline | 100% | ~60% | 58–62% | 46–54% after tool consolidation |
Two structural notes. First, buying underlay circuits through an SD-WAN provider adds roughly a 20% aggregator markup over direct carrier sourcing — convenient for lean teams, avoidable for teams with procurement capacity. Second, converged SASE looks more expensive per site until you count what it deletes: branch firewalls, VPN concentrator licences and standalone web filters, with net ROI typically inside 18–24 months. That maths is the same logic covered in single-vendor versus multi-vendor SASE and the hidden costs of a SASE migration.
Documented results confirm the ranges: TeleGeography’s 150-site benchmark enterprise cut annual WAN TCO by 42% while growing average site bandwidth 77% (246 to 435 Mbps); UK automotive group JCT600 replaced its BT MPLS with secure SD-WAN and gained bandwidth, central policy control and OT/guest segmentation in the same project.
The five-phase exit playbook
For a standard 10-site WAN, plan 4 to 6 months from audit to final disconnect.
| Phase | Timing | What happens | Watch out for |
|---|---|---|---|
| 1. Contract & site audit | Weeks 1–4 | Inventory circuit IDs, bandwidth use, expiry dates and notice windows; map application flows (SaaS vs data centre vs voice) | The auto-renewal notice deadline — put it in writing early |
| 2. Underlay sourcing | Weeks 5–12 | RFP for DIA plus a diverse second link (broadband/5G) per site; order fibre | 60–120 day DIA lead times in Benelux; up to 180 with municipal digging permits — get firm dates before cancelling anything |
| 3. Overlay pilot | Weeks 11–14 | Deploy SD-WAN/SASE edges at HQ plus one branch; test failover, FEC, voice under synthetic packet loss, zero-trust policies | Validate DSCP/QoS mapping for SIP before any cutover |
| 4. Phased cutover | Weeks 15–20 | Migrate sites in waves of ~20%, running MPLS and overlay in parallel 30–60 days per wave | Route filtering between old and new edges — hybrid phases breed routing loops |
| 5. Decommission | Weeks 21–24 | Formal disconnect letters, CPE returns, billing verification | Unamortised installation charges surfacing on the final invoice |
The security dimension: private was never encrypted
MPLS separates customers with routing labels, but packets cross the carrier core in plaintext — “private” describes the routing table, not the payload. And a classic MPLS WAN is flat: one breached branch can reach every other site without hitting an internal barrier. That architecture now collides with regulation. NIS2, in force since October 2024, requires encryption, segmentation and zero-trust access for essential and important entities; DORA has applied the same logic to financial firms since January 2025. An SD-WAN overlay encrypts transit with IPsec or TLS 1.3; a SASE architecture goes further by replacing flat site-to-site reachability with identity-aware, per-application access — which is why the compliance argument and the cost argument point at the same destination.
Exit once, consolidate twice
The market has already voted: Gartner puts 60–65% of new SD-WAN purchases inside single-vendor SASE platforms by end 2026, Dell’Oro projects 90% of the SASE market by 2029, and 75% of security leaders are actively consolidating vendors. If the renewal window forces you to touch every site anyway, doing the WAN and the security stack in one move is the version of this project that pays for itself — one platform for SD-WAN, firewall, web security and zero-trust access instead of a parallel refresh in two budgets. For EU mid-market teams, Jimber delivers exactly that consolidation as an EU-sovereign platform with integrated SD-WAN, flat per-site economics and local breakout that ends the backhauling MPLS was built for. Book a demo to model your site list against the playbook above — ideally before your notice window closes.
Frequently asked questions
Is data on a private MPLS network automatically encrypted?
No. MPLS isolates traffic with routing labels, creating logical separation, but packets travel unencrypted through the carrier network. True encryption requires an IPsec or TLS overlay on top — which is precisely what SD-WAN establishes by default.
How far before contract expiry should we start the exit?
Start site audits and underlay sourcing 6 to 12 months out, and open negotiations up to 18 months out. That covers the 60–120 day fibre lead times and keeps you clear of the cancellation notice window.
What happens if we miss the cancellation notice window?
Most contracts auto-renew for 12 months at standard list prices when written notice isn’t delivered 60 to 90 days before expiry. That single missed date can fund the entire migration’s delay.
What does early termination of an MPLS contract cost?
Typically 80% to 100% of the remaining monthly recurring charges for the unexpired term, plus immediate repayment of unamortised installation or hardware subsidies. Mid-term exits rarely pay off; renewal-window exits almost always do.
Can SD-WAN really match MPLS voice quality on internet links?
Yes. Modern edges combine continuous path measurement, forward error correction and packet duplication across dual links, steering real-time traffic over the best available path. The JCT600 and TeleGeography cases both ran voice on internet-first WANs after migration.
How long does a business fibre (DIA) installation take in Belgium?
Plan for 60 to 120 days, extending to 180 where municipal permits and street works are involved. Standard business broadband installs in 10–20 working days and works as an interim underlay, as does 5G.
How long should the parallel dual-run period last?
Keep the MPLS circuit alive alongside the new overlay for 30 to 60 days per site wave. Cancel legacy circuits only after application performance and voice quality are validated on the new path.
Does moving off MPLS help with NIS2 compliance?
It can. NIS2 expects encryption, segmentation and zero-trust access — none of which flat, plaintext MPLS provides natively. A SASE-based replacement delivers encrypted transport and per-application access in the same migration.
