The most dangerous thing about your smallest AI vendor is not that it might get acquired. It is that you may find out months after your data was deleted. OpenAI's purchase of the presentation startup NextSlide became public on August 8, when founder Ahmed Beshry posted a goodbye note on the company's website — TechCrunch confirmed the deal had actually closed "earlier this year", with terms undisclosed and the team already working on ChatGPT. Beshry's LinkedIn profile puts his start at OpenAI in March 2026; neither TechCrunch nor Implicator names a month. The disclosure arrived roughly five months later.
That gap is the story. Enterprise vendor risk management assumes a sequence: the vendor is acquired, you are notified, you evaluate, you decide at renewal. In the current wave of AI acqui-hires none of that sequence holds. The product dies in a week or a month, the data is deleted a few weeks after that, and the announcement — when there is one — can arrive long after all of it is finished.
An Acqui-Hire Is Not an Acquisition, and That Is the Whole Problem
An acqui-hire is a transaction priced for the engineering team, where the product is a cost to be shut off rather than an asset to be operated. That distinction is not semantic. It determines whether your contract survives the deal at all.
In a stock purchase, the buyer acquires the equity of the target entity, not its assets, and "the target entity remains the legal counterparty to all of its customer agreements" — no assignment occurs as a matter of law, and your MSA continues. In an asset purchase, each customer contract has to be transferred, and that transfer is an assignment. In an acqui-hire, frequently neither happens: the buyer takes the people, declines the customer book, and the original entity winds itself down with your agreement still nominally in force against a company that no longer exists in any operating sense.
The reporting on OpenAI's February 2026 deal for Nerve — an "AI chief of staff" wired into Slack, Microsoft Teams and internal company data — notes that terms were not disclosed, "including whether it was a formal acquisition at all". Co-founder Tanooj Luthra announced on February 17 that the team was joining OpenAI and the product would sunset in about a month. Public detail on what happened to customer data: none.
Seven Days, Not Ninety
The wind-down windows in this wave are measured in days, and the deletion windows in weeks. Here is what the last six months actually looked like.
OpenAI's acquisition of Hiro, an AI personal finance product, was announced by founder Ethan Bloch on Monday, April 13, 2026 and confirmed by OpenAI, with terms undisclosed and roughly ten employees moving across. The app stopped functioning on April 20 — seven days later. Hiro's own site states users could export from the web app until May 13, after which "all personal data will be permanently deleted from our servers". Asked directly whether data would be shared with OpenAI, the notice answers: "No. As a part of Hiro's wind down, all of your personal data will be permanently deleted from our servers." This was a product that Banking Dive reported billed itself as an "AI personal CFO" and said it helped clients manage more than $1 billion in assets.
It is not only OpenAI. Salesforce's acquihire of the scheduling tool Clockwise was announced March 19, 2026 and the product shut down March 27 — an eight-day notice window. Clockwise's own wind-down notice thanks "the 40,000 organizations who made time for what matters with Clockwise" and answers the data question in one line: "there is no transfer of data to Salesforce, and your data will be deleted." Prepaid customers received automatic prorated refunds, and there is no successor product inside Salesforce that picks up the features.
Set those against NextSlide, where the deal closed months before anyone outside knew. Beshry himself called the announcement "a few months late", and nextslide.ai now serves nothing but the line "NextSlide is joining OpenAI". Unite.AI noted that the site "now carries only the farewell note, with the product no longer presented as an independent offering". If your team was building decks in it, the export window — whatever it was — closed before the deal was news.
Steel-man the acquirers for a moment, because the argument is real. These are tiny teams — LinkedIn listed about ten people at Hiro, and NextSlide never disclosed a headcount at all. Running a small product while the team relocates into a frontier lab is genuinely uneconomic, and shutting it down cleanly with a stated deletion date is more respectful of privacy law than quietly transferring a customer database to a new owner. Deleting the data is the correct answer under most data processing agreements. It is simply catastrophic for the customer who did not know to export.
Six Deals in a Quarter Is a Pattern, Not a Coincidence
This is now a repeatable operating model at one of your largest AI suppliers, and the pace is accelerating. Crunchbase's tally shows OpenAI acquired 17 companies in the three years through March 2026 — one in 2023, two in 2024, eight in 2025, and six in the first quarter of 2026 alone, naming Convogo, Torch Health, Crixet, OpenClaw, Promptfoo and Astral in that Q1 run. Purchase prices are almost never published; the same analysis notes only one disclosed price of consequence, the $6.5 billion Io deal in May 2025. For contrast, the same data puts Anthropic at three acquisitions across 2025 and 2026.
Beshry is not a first-time founder either — he previously co-founded Caper AI, which Instacart acquired in 2021. That is the profile: small teams, early stage, founders with a prior exit. Exactly the profile of the AI point tools that entered your stack in the last eighteen months without an RFP.
We have covered the strategic shape of this buying spree before and the funding pressure sitting behind it. What is new is the disclosure lag, and what it does to the one control most enterprises rely on.
You Cannot Protect a Tool You Do Not Know You Have
The contractual fix is worthless without an inventory, and most organisations do not have one. Harmonic Security's analysis of 22.4 million enterprise AI prompts across calendar 2025 found 665 distinct generative and AI-embedded tools in use, against 40% of companies having purchased official AI subscriptions — a finding from a vendor that sells shadow-AI monitoring, which is worth knowing when reading it. Netskope's Cloud and Threat Report 2026 puts 47% of generative AI users on personal accounts, outside enterprise controls. In fairness that is down from 78% a year earlier, so the gap is closing rather than widening — but it is still nearly half.
A tool bought on a corporate card by a marketing manager has no MSA, no data processing agreement and no change-of-control clause. It also has your pitch decks, your customer names and your pricing in it. When that vendor is acquihired, you will not receive a notice, because you were never a contracting party in any way the vendor's lawyers can see. You will find out the way NextSlide's users did — by loading the site.
Two clauses do different jobs here and are routinely confused. An anti-assignment clause is preventative: "Neither party may assign this Agreement or any of its rights or obligations hereunder, either voluntarily or by operation of law, without the other's express written consent." A termination-for-change-of-control clause is permissive — it gives you an exit on written notice when ownership crosses a defined threshold, without needing anyone's consent. Neither one, on its own, guarantees you a working export. Hiro's thirty days from announcement to deletion is the kind of window a notice clause is supposed to buy you — and it only helps if someone tells you the clock has started.
Three Things Worth Doing
This Week: Pull the expense report, not the vendor master. Filter card and reimbursement data for AI-adjacent charges under $2,000 a month and match it against your CMDB. The tools that get acquihired are the ones too small to be in procurement's system. Then check the status page and homepage of every AI point tool on that list — a goodbye note is currently a more reliable notification channel than your vendor's account manager.
This Month: For every AI tool holding regulated, customer or source-code data, answer one question in writing: if this vendor stopped serving requests on Friday, what do we lose and how do we get it back? Where the answer is "we do not know", schedule a real export now and store it where your own retention policy governs it. This is the same discipline as demanding source-code escrow when a coding assistant changes owner, applied to a class of vendor small enough that nobody thought to ask.
Before Your Next Renewal: Add three terms to the template and stop treating them as optional for small purchases. First, a change-of-control notice obligation with a defined number of days, triggered on signing rather than closing — the NextSlide gap exists precisely because the trigger is usually "the transaction," and nobody defined when. Second, a minimum continued-service and export window that survives wind-down, in a machine-readable format you name specifically. Third, a deletion-notice requirement: the vendor tells you before it deletes, not in a footer after. Klaviyo's acquisition of Agency showed what a stated wind-down date buys you; the deals above show what its absence costs.
If you are already building a system inventory for EU AI Act obligations, extend it rather than starting a second one. The register you need for compliance and the register you need for vendor mortality are the same register.
The Bottom Line
Enterprise software risk was built for a world where vendors failed slowly. A SaaS company running out of money took quarters to die, and you saw it in the support response times, the missed roadmap dates and the departing account team. AI acqui-hires do not fail; they are switched off, deliberately and on a schedule set by someone with no relationship to you. The people who chose the deletion date were optimising for a clean privacy posture and a fast start at their new employer. Both are reasonable goals. Neither includes you.
The same instinct applies to first-party products, not just acquired ones — OpenAI's own shutdown of Sora taught the same lesson without an acquisition attached, as did Bending Spoons repricing Airtable's AI credits and Visa's purchase of BioCatch. And when a shadow tool does fail badly, the disclosure obligation lands on you, not the vendor.
Practically: if you use ChatGPT at enterprise scale, you are exposed to the acquirer, not the acquired, and that is the safer side of this trade. If you use a fifteen-person AI startup for anything that matters, price in a seven-day product death and a thirty-day export window — and if the deck tool is load-bearing, know that Gamma and its peers are still independent, which is a statement about today and nothing more.
Notice is not a courtesy you can rely on. It is a clause you have to buy.
Continue Reading
Klaviyo Bought Agency. The Product Dies August 31. OpenAI's Acquisition Spree: 6 Buys in 90 Days Signal Platform Play OpenAI's 17 Acquisitions: Vendor Lock-In and $207B Funding Gap OpenAI Kills Sora After $200M Loss: Enterprise-Only Pivot Tricentis Bought Tabnine's Context Engine, Not Your IDE One Employee Used an AI Tool. The Company Filed with the SEC. EU AI Act Governance Tools: Buy Inventory, Not Policy Packs Visa Bought BioCatch. Get Neutrality in Writing.