What happens when your AI vendor is acquired?

Whatever the contract says on the day the deal closes, and most AI contracts were not written with acquisition in mind. An acquirer inherits the agreement, the data and your dependency, and can lawfully change all three within the terms you signed. The exposure is decided by five clauses: change of control, data return and deletion, model version continuity, assignment, and exit assistance.

The question matters in 2026 because acquisition is the likely outcome for most AI vendors. The market is consolidating, venture-funded suppliers need exits, and the buyers of AI companies are rarely buying customer relationships alone: they are buying models, data rights and distribution. A regulated organisation that depends on an AI supplier should assume the supplier's ownership will change during the life of the deployment.

Does your contract survive a change of control?

Usually yes, and that is not automatically good news. Most business agreements bind successors, so the acquirer steps into the vendor's shoes. The questions that matter sit in the detail. Does the agreement give you a right to exit on a change of control, or only give the vendor one? Can the new owner terminate for convenience on short notice? Does the assignment clause let the vendor transfer the contract to any group company, in any jurisdiction, without consent? Many AI contracts were signed quickly during pilots, and these clauses were never negotiated at all.

What happens to your data under a new owner?

This is the uncomfortable part. Prompts, uploaded documents, fine-tuned models built on your data and usage telemetry are assets in an acquisition unless the contract says otherwise. A new owner with a different business model may see training value where the old one saw a support burden. Read what the agreement actually grants: many licences permit the vendor and its affiliates to use customer content to improve services, and an acquisition changes who the affiliates are and what improvement means. Data return and deletion clauses matter most on exactly the day they are hardest to enforce.

Can the acquirer change the model you depend on?

Yes, within whatever notice the contract allows. An acquirer can retire the service, fold it into its own product line, change the commercial terms at renewal or redirect the roadmap. Model deprecation is a subject in its own right, and acquisition compresses its timeline, because retiring a duplicated product is standard integration practice. If workflows, prompts and validation work are tuned to a specific model version, continuity language is the only thing standing between the organisation and a forced migration on someone else's schedule.

What changes when the new parent sits in another jurisdiction?

The legal reach over your data. A vendor acquired into a group subject to United States jurisdiction comes within the reach of the CLOUD Act, which can compel providers to produce data in their possession, custody or control regardless of where it is stored. The same logic applies for other jurisdictions with extraterritorial production powers. Nothing about your usage changed, yet the set of authorities that can lawfully demand your data did. For European financial entities, DORA already expects exit strategies and attention to concentration risk in ICT contracts, and an acquisition is exactly the trigger those provisions anticipate.

Which five clauses should you read today?

Five, in every AI agreement the organisation holds.

• Change of control: whether the deal gives you an exit right, and whether it gives the vendor one.
• Data return and deletion: format, timescale, verification, and what happens to fine-tunes and telemetry.
• Model version continuity: notice periods for retirement and material change, and any right to a stable version.
• Assignment: whether the contract can be transferred without consent, and to whom.
• Exit assistance: an obligation to help you leave at a defined service level, not a gesture of goodwill.

Where the answers are unclear, raise them before any announcement, because negotiating leverage is highest while the vendor still needs the renewal.

How does operator-owned infrastructure change the calculus?

It moves the dependency. When models run on hardware the organisation owns, inside its own walls, the weights, the data, the prompts and the audit history do not change hands when a vendor changes owners. On Mickai, a Sovereign Intelligence Operating System, models run offline on operator-owned hardware behind a zero-egress perimeter, every action is sealed to a post-quantum signed audit ledger, and the record verifies offline. An acquisition upstream then becomes a support question: who answers the phone, not who holds the data. Support can be re-procured in a quarter; years of prompts inside an acquirer's data estate cannot be recalled at all.

“A vendor's ownership can change in a day; data and weights on hardware you own do not change hands with it.”

How we keep the dependency inside the operator's own boundary is set out at /sovereign-ai, and the film at /film shows the interface running on the hardware it belongs to.

Frequently asked questions

My AI vendor has just been acquired. What should I do first?

Read the agreement before reacting: change of control, assignment, data return and model continuity clauses decide the position. Then write to the vendor asking for confirmation of service continuity, data handling and sub-processor changes under the new owner, and keep the answers, because they are evidence if terms drift at renewal.

Can an acquirer use our historical prompts and fine-tunes for training?

That depends on the licence that was signed, not on the acquirer's intentions. Many agreements grant broad rights to use customer content to improve services, and those rights transfer with the business. If the contract is silent or broad, assume the data is an asset of the deal and negotiate explicit limits at the next renewal.

Does DORA require us to plan for a vendor acquisition?

DORA, in force since 17 January 2025, expects financial entities to maintain exit strategies for ICT services supporting critical or important functions and to manage concentration risk. An acquisition that changes ownership, jurisdiction or roadmap is precisely the scenario an exit strategy exists for, so supervisors will expect it to be tested rather than theoretical.

Is running AI on our own hardware just a different vendor dependency?

The dependency changes shape rather than disappearing. A sovereign deployment still has suppliers for hardware and support, but the weights, the data and the audit history sit on infrastructure the organisation owns. If a supplier changes hands, support can be re-procured without the data moving, which is a materially smaller exposure than a cloud service whose owner has changed.