vendor risk

Stilla's founders promised continuity the day Meta's purchase was reported. Meta's own stated reason for buying is merchant messaging on WhatsApp, not the workplace agent you run on Slack and GitHub. The continuity promise came from the party about to stop existing.

Silver Lake already owns both Cegid and Silae, so their €10bn merger fires no change-of-control clause. What moves instead is Cegid's DGFiP e-invoicing registration — number 0007, three years, renewable in 2027, the same year the deal closes and French SMEs must start issuing.

The NSA, CISA and FBI advisory AA26-251A tells AI providers to flag accounts by 24/7 usage, instant maximum throughput and cache-optimised traffic — an exact description of a production agent fleet. Its recommended mitigation is an undisclosed model downgrade, engineered to defeat quality measurement.

OpenAI's own IP block reached the German wiki its agents had taken over on 21 June; the public heard on 5 September. Classifying it as misalignment rather than a security incident is what kept it quiet — and your vendor's notification clause delegates that same call to the vendor.

ServiceNow's purchase of Sweep hands a Salesforce competitor a metadata-deep connection into its customers' Salesforce orgs. Salesforce's partner agreement lets it terminate that relationship immediately on written notice, triggered by the announcement itself — and the customer is not a party to it.

Deloitte acquired substantially all of Wavicle's assets on August 31, so any statement of work with a standard anti-assignment clause needs your written consent to assign. If Deloitte & Touche LLP signs your audit opinion, SOX 201 may bar the engagement outright.

Three of the four best-known synthetic data vendors were acquired or shut down between November 2024 and June 2026. Prove synthesis works with a free Apache-2.0 SDK inside your own perimeter before you buy a platform — and for most test-data problems, masking is still the cheaper and more explainable answer.

OpenAI stops serving its models to Cursor on 12 November 2026. Pointing Cursor at your own OpenAI key is not a swap — Cursor's documentation says its Zero Data Retention policy does not apply to custom keys, and every request still routes through Cursor's backend.

Socure's Fravity acquisition puts agents into AML alert disposition at a vendor serving top-five US banks and 600+ fintechs. The 70% false-positive cut it is sold on is an undisclosed-deployment vendor figure — and the April 2026 model risk guidance explicitly excludes agentic AI, so the validation evidence is yours to build.

Thomson Reuters' new in-house legal model is a Qwen derivative two hops down, and Harvey's Tenet is post-trained from Kimi K3. Neither lineage appears in a DPA or a subprocessor list — because an open-weight base model provider processes nothing.

Groq certified as an NVIDIA Cloud Partner on August 12 and closed a $350M down round on August 17 with Nvidia planning to participate. If your capacity plan lists Groq as the non-Nvidia leg, that row no longer exists — and the API was built so you would never notice.

Airtable bundles 15,000 AI credits into a $20 seat and sells the same allowance standalone for $30. Bending Spoons — which capped Evernote's free tier and moved to cut 75% of WeTransfer — just bought that subsidy. The deal has not closed, which is the only window you have to convert it into contract terms.

d-Matrix acquired Wallaroo.ai on 3 August 2026, taking ownership of a platform sold as 'any model, any hardware, anywhere'. Neither company committed to keeping third-party silicon supported — which turns a portability guarantee into a roadmap you do not control.

Yellow.ai's $550M merger with Bluerock Acquisition Corp. funds a plan to buy BPO operators and automate them. The committed capital is $30M, not the $205M headline — and the acquisition targets are the same outsourcers already running its software.

Anthropic eyes $900B valuation, surpassing OpenAI's $852B. Why 46% of Google's Q1 profit comes from its stake — and what enterprise buyers should do.

Google committed $40B and Amazon $25B to Anthropic in 5 days. Two rivals now backstop Claude with $100B+ in commitments. What it means for enterprise AI.

OpenAI shuts down Sora April 26 to focus on enterprise AI. $5.4B annual burn vs $2.1M revenue. What the pivot means for CIO roadmaps and contracts.