change of control

Beacon Software acquired AI red-teaming firm Haize Labs to run its internal AI platform, and the announcement says nothing about existing customers. Here is what to secure before renewal.

MRO bought Vyne Medical, the Trace, Refyne and Cloud Fax business serving 800+ hospitals. Its HITRUST r2 was earned before the carve-out, and MRO's own certification does not name Trace — so ask who runs those controls now.

Fathom's privacy policy says pre-acquisition recordings stay under the terms in force when they were made, but any revised policy applies the day it is posted. On individual plans, employees rather than IT control model training, so the window to lock things down is now.

Glass Imaging trains a separate neural ISP for every camera module, and it ships in Honor's 600 phones. With OpenAI reportedly buying it, licensees need retraining rights, their calibration data and change-of-control terms before the next sensor.

Kiteworks will keep selling Bonfy.AI 'as a separate solution while it is integrated.' It gave WAMNET Japan and Zivver customers pricing, support and renewal terms in writing. Bonfy buyers should ask for the same.

Alianza bought Skribby, the meeting-bot API behind 200+ notetaker, sales-intelligence and other meeting apps. Its terms allow assignment at will, its DPA gives no remedy on objection, and five of 13 transcription sub-processors are US-only.

Analog Devices is paying $1.35B for Alif and will own two edge-AI NPU lines with incompatible toolchains. Ethos-U55 models recompile for Renesas, Infineon or Himax parts; the board, Alif's device-locked DFP and U85 designs don't move.

Shopify's purchase of Tailwind Labs leaves the MIT-licensed framework untouched but closes Tailwind Plus and ui.sh to new buyers. The bigger lesson: AI agents broke the docs-to-paid funnel that funded it.

Bending Spoons guided to 'later this year' on Airtable and closed in 31 days. It now guides to Q4 on Miro. Both of Miro's standard agreements permit assignment in a merger without customer consent, and neither caps what you pay at renewal, so the review window is a month, not a quarter.

Stilla's founders promised continuity the day Meta's purchase was reported. Meta's own stated reason for buying is merchant messaging on WhatsApp, not the workplace agent you run on Slack and GitHub. The continuity promise came from the party about to stop existing.

Silver Lake already owns both Cegid and Silae, so their €10bn merger fires no change-of-control clause. What moves instead is Cegid's DGFiP e-invoicing registration — number 0007, three years, renewable in 2027, the same year the deal closes and French SMEs must start issuing.

Valsoft's TAG Software Group acquired Square 9 Softworks on September 8, 2026. A perpetual-hold holdco with 150+ companies is built to compound margin on an installed base; whether that extends to funding a generative-AI model refresh is unanswered — and Square 9 has never named the model behind its extraction engine.

Harvey acquired Guardrails AI's founders on the same day it raised $550M, and its CEO says on the record that he buys teams rather than products. The Hub installer and hosted validator inference had already been switched off on August 25.

Mistral's €3 billion Series D moved its lead investor to Samsung Electronics without changing one customer contract. The same announcement publishes a four-part sovereignty definition that maps to clauses you can actually test — and the European Commission's own reference rubric weights ownership at 15%.

ServiceNow's purchase of Sweep hands a Salesforce competitor a metadata-deep connection into its customers' Salesforce orgs. Salesforce's partner agreement lets it terminate that relationship immediately on written notice, triggered by the announcement itself — and the customer is not a party to it.

Adobe licensed Rilo's technology and hired its six-person team; Rilo shuts down. But Rilo was a free-tier agent platform wired into 100+ systems, and the OAuth grants it holds in your Slack, Salesforce and Gmail outlive the company that issued them.

Deloitte acquired substantially all of Wavicle's assets on August 31, so any statement of work with a standard anti-assignment clause needs your written consent to assign. If Deloitte & Touche LLP signs your audit opinion, SOX 201 may bar the engagement outright.

OpenAI stops serving its models to Cursor on 12 November 2026. Pointing Cursor at your own OpenAI key is not a swap — Cursor's documentation says its Zero Data Retention policy does not apply to custom keys, and every request still routes through Cursor's backend.

Nasuni acquired DryvIQ on August 27, 2026, taking ownership of the classification and migration engine 1,100 enterprises use across 40+ repositories. The announcement funds integration with Nasuni's own platform and commits to nothing about the connectors that move data elsewhere.

AWS is not acquiring DuckDB — the MIT license and the IP stay with the independent DuckDB Foundation. But it is hiring the two people who hold two of that Foundation's three board seats, and the deed of incorporation lets the board appoint its own successors.

Nvidia's reported $12.9B deal for Hugging Face puts optimum-neuron, optimum-habana, optimum-intel and optimum-amd — the Transformers bridge for every rival accelerator — inside Nvidia. optimum-tpu was archived read-only in January, and its own README points the exit at vLLM.

Hugging Face has retained bankers to test buyer interest at $13 billion. Most enterprises pull model weights from it under a click-through agreement nobody signed — here is the mirroring playbook to run this week.

Descartes paid about $100M for Tai and named broker transaction, carrier and shipment data as the rationale. Tai's published terms already pre-authorize assignment to a successor by merger and permit pooling of aggregated data — so the only lever a broker holds is the 60-day notice before auto-renewal.

Nvidia licensed Poolside's Model Factory for $6 billion and made offers to 109 of its engineers without buying the company — so a standard change-of-control, assignment or notification clause never fires. Here are the three triggers to write into your next renewal.

Oakley Capital Fund VI took majority control of Graphwise on August 19. GraphDB's engine is proprietary — RDF4J is the open-source framework it plugs into — and since version 11.0 even the Free edition requires a license file you request from the vendor.

Anthropic is in advanced talks to buy Decart for roughly $7 billion, mostly in its own pre-IPO stock, to cut what a Claude token costs it to produce. Every Sonnet through 4.6 still lists at its March 2024 price, and the one cut that did land arrived as a new model number — which is why a flat multi-year rate card is the wrong thing to sign this quarter.

DoiT bought Attribute, the eBPF-based AI cost-attribution startup, for an estimated $65M. DoiT also resells the cloud it now meters — and the kernel sensor you approved has a new owner nobody re-reviewed.

Stripe is reportedly paying over $7 billion for the gateway 8 million developers route prompts through. Its privacy toggles bind the downstream model providers, not OpenRouter itself — and the only DPA anybody countersigns is enterprise-tier.

Dynatrace is paying $915 million for Arize, and the change that matters is the meter: Arize bills trace spans with unlimited users, Dynatrace bills $0.20 per GiB ingested and $0.0035 per GiB scanned. Normalize your OpenInference attributes to OpenTelemetry gen_ai.* in your own collector before the deal closes.

OpenAI's NextSlide deal closed early in 2026 and only surfaced on August 8, when the founder posted a goodbye note — five months after he joined OpenAI in March. In this wave of AI acqui-hires the product dies in seven to thirty days and the data is deleted weeks later — so the export window has to be contractual, not assumed.

Visa is paying $2.4 billion in cash for BioCatch, the behavioral-biometrics layer running inside more than 350 banks. Neither announcement commits to network neutrality, standalone pricing or data limits — and the roughly eight months before close is the only window in which a bank client can get those in writing.

Klaviyo's press release says it acquired Agency's team and technology. Agency's own homepage says the product winds down on August 31 — 26 days after the announcement. That gap between the acquirer's asset language and the target's own notice is the reliable tell for an AI acqui-hire.

AlixPartners announced its completed acquisition of agentic AI consultancy Artium on 4 August 2026. Your build partner now sits inside a restructuring firm that advises creditors, takes CRO seats, and files Rule 2014 connection disclosures naming its clients.

Airtable bundles 15,000 AI credits into a $20 seat and sells the same allowance standalone for $30. Bending Spoons — which capped Evernote's free tier and moved to cut 75% of WeTransfer — just bought that subsidy. The deal has not closed, which is the only window you have to convert it into contract terms.

Anaconda acquired Enkrypt AI on August 4 for undisclosed terms, putting the red-teaming vendor you chose for its neutrality inside a platform company. The bigger exposure is the license: Anaconda spent 2024 and 2025 enforcing a 200-employee 'free' threshold with demand letters that threatened back bills, and Enkrypt's $0 and $149 self-serve tiers now belong to it.

d-Matrix acquired Wallaroo.ai on 3 August 2026, taking ownership of a platform sold as 'any model, any hardware, anywhere'. Neither company committed to keeping third-party silicon supported — which turns a portability guarantee into a roadmap you do not control.

Yellow.ai's $550M merger with Bluerock Acquisition Corp. funds a plan to buy BPO operators and automate them. The committed capital is $30M, not the $205M headline — and the acquisition targets are the same outsourcers already running its software.