If your EU AI Act or ISO 42001 evidence lives in trail ML, your governance tool now belongs to a data-catalog vendor that hasn't said whether it will keep working with your GRC system. Collibra announced the acquisition on October 5, 2026 without disclosing terms, and neither its release nor trail's own post says anything about existing customers, standalone availability, pricing or the OneTrust and ServiceNow integrations trail advertises. Until Collibra puts those answers on paper, treat any trail renewal or new signature as a change-of-control negotiation.
The timing works in your favour. The high-risk obligations most buyers bought these tools for have moved to December 2027, so you have room to ask hard questions before you commit.
What Collibra Actually Bought
Collibra bought a small, young assessment engine and plans to wire it into its own control plane. trail is a Munich company founded in 2023 by Anna Spitznagel, Nikolaus Pinger and Sven Hölzel. Its only publicly reported round was a €1.45 million pre-seed in July 2024, led by CapitalT with NP-Hard Ventures, Mozilla Ventures and Common Magic.
Per Collibra's release, trail's agents read the context around an AI system, work out which frameworks and controls apply (the EU AI Act, ISO 42001 and the NIST AI Risk Management Framework are named), check whether those controls are in place, and re-run the assessment when the evidence changes. The release also says trail's runtime features will be "enforcing Collibra policies directly where agents run," blocking violating actions before they happen. That phrase is the clearest signal of direction: the policies being enforced are Collibra's.
Collibra's CEO Felix Van de Maele framed the deal in the release as making governance "continuous and operational." Collibra describes itself as having more than 700 customers, including 78 of the Fortune 500, which is the company's own count.
CDO Magazine's write-up adds no quotes, terms or customer commitments. As of October 23, the trail homepage carries a "trail is now part of Collibra" banner linking to the announcement.
What trail Customers Stand to Lose
The integrations are what's at risk, because trail sold itself as the layer that sits beside your existing GRC stack. Its homepage lists connectors to OneTrust, Collibra, ServiceNow and SAP LeanIX on the GRC and enterprise-architecture side; Confluence, Jira, GitHub, GitLab, SharePoint and Notion among enterprise tools; Databricks, MLflow, Hugging Face, ZenML and n8n on the MLOps side; plus a GraphQL API. It offers SaaS in EU data centres, on-premises, or bring-your-own-cloud on AWS, Azure or GCP.
Look at that list from Collibra's side. OneTrust and ServiceNow AI Control Tower both sell AI governance against Collibra. ServiceNow expanded AI Control Tower in May 2026 with five risk frameworks aligned to NIST and the EU AI Act and general availability expected in August. A trail customer whose system of record is OneTrust or ServiceNow is running a feed into a competitor's product, and an acquirer has every commercial reason to let that connector age.
Three things sit inside trail that you would struggle to rebuild quickly:
- The AI system registry and risk classifications, which are the inventory an EU AI Act programme starts from.
- Completed assessments and their evidence trail, including the re-assessment history that shows a control stayed effective over time.
- Approval records from trail's "Human in Control" step, which the homepage says requires a person to approve before agents write to other systems.
If those live only in trail's schema, losing the product means losing the history an auditor asks for.
How Collibra Handled Its Last Governance Acquisition
The precedent points toward absorption. When Collibra bought data-access startup Raito in June 2025, Van de Maele told TechCrunch the plan was to "really make it part of Collibra, our unified governance platform for data and AI." Today raito.io returns a 302 redirect to Collibra Data Access, a Collibra product page that offers a platform demo and lists no standalone option or price.
That was a sensible outcome for Collibra and it may have been fine for Raito's customers. It does tell you what "part of Collibra" has meant once already: the brand went away and the product became a module you reach through Collibra's sales motion.
The strongest case on the other side deserves its due. Collibra was already on trail's integration list, so a share of trail's customers are Collibra shops for whom this is good news. A company whose last public raise was €1.45 million carried real survival risk as a vendor, and a 700-customer parent removes much of that. Collibra may also see trail's OneTrust and ServiceNow connectors as a way into accounts where it does not own the catalog, which would give it a reason to keep them. Neither company has stated any of it as a commitment.
Why the EU AI Act Delay Gives You Leverage
The regulatory clock has slowed, which turns a forced renewal into a negotiation you can afford to lose. The AI Omnibus, Regulation (EU) 2026/1744, was published in the Official Journal on July 24, 2026 and entered into force on July 27. It moved the obligations for stand-alone Annex III high-risk systems from August 2, 2026 to December 2, 2027, and those for AI embedded in regulated products to August 2, 2028, per Gibson Dunn's summary.
That gives most trail customers roughly 13 months before the obligations they bought the tool for apply. You can wait for Collibra's roadmap, run a parallel evaluation, or sign a short bridge term without putting compliance at risk. A buyer who signs a three-year renewal this quarter, on today's paper, gives that leverage away.
ISO 42001 is a different matter if you hold or are pursuing certification, because the management system has to keep producing evidence regardless of what the law's dates say. Whoever owns the tool, your certification body will ask whether last quarter's assessments still exist.
What to Ask Collibra Before You Renew or Sign
Each question below should end in a contract clause. Collibra's public statements so far cover vision and nothing contractual, so the commitments have to come through your paper.
This Week:
- Export everything trail holds for you: the AI registry, every assessment, the evidence links, and the approval log. Use the GraphQL API if the UI export is incomplete, and store the output somewhere you own.
- List every trail integration you depend on, in particular OneTrust, ServiceNow, LeanIX and Databricks, and name the system of record for each data flow.
- Ask your trail account contact in writing three questions: will trail be sold standalone, on what terms, and for how long?
This Month:
- Request a written commitment that the named third-party connectors stay supported for the remainder of your term plus 12 months, with notice of at least two quarters before any is deprecated.
- Confirm your deployment model survives. If you run trail on-premises or in your own cloud, ask whether that option continues or whether Collibra's SaaS becomes the only path.
- If you are mid-evaluation, put the same questions to OneTrust, ServiceNow and Credo AI, and compare answers on export format and framework coverage, using the inventory test in our EU AI Act governance platform guide.
Before Renewal:
- Add a change-of-control clause: if trail is merged into another product, you get a no-cost migration of your data and the right to terminate without penalty.
- Cap any price change on conversion to a Collibra SKU, and get the cap written down before conversion is offered.
- Prefer a 12-month term over a multi-year one until Collibra publishes a roadmap with dates.
The Bottom Line
AI governance is consolidating the way data governance did, with catalog, GRC and ITSM vendors each buying the assessment layer and wiring it to their own system of record. The same pattern showed up in Alation's compliance score and with Collibra's own AI Command Center earlier this year. Small specialist tools that integrated with everyone tend to end up integrating mostly with their new parent, and the Raito redirect shows Collibra's version of that path.
The same continuity questions came up when Freshworks bought Torii and Boomi bought Elementary Data. The fix is the same too: get your data out, and get the integrations into the contract. If you are vetting any AI governance vendor, the six security review questions and the agent audit logging guide cover what the evidence trail has to contain.
Run the export this week, before anyone at Collibra decides what your trail instance becomes.
Continue Reading
- EU AI Act Governance Tools: Buy Inventory, Not Policy Packs
- Collibra AI Command Center Cuts Agent 'Hallucination Tax' by 30% with Real-Time Governance
- 78% Can't Pass an AI Audit. Alation Just Made It a Score.
- AI Vendor Security Review: 6 Questions That Change the Answer
- Freshworks Buys Torii, Silent on Customers Running ServiceNow
- Boomi Buys Elementary Data, Which Stays Standalone Only 'for Now