The AI supplier changed ownership: seven decisions that should not wait for renewal

The signal and the facts that change the decision

OpenAI's published decision following SpaceX's acquisition of Cursor makes a commonly overlooked risk-register event visible: change of supplier control. Even without an immediate product change, ownership, priorities, integrations, and commercial relationships can shift.

OpenAI's communication is one party's position and does not replace contract review or direct confirmation from the organisation's supplier. NIST treats supply-chain risk as continuous across the relationship, including changes and external dependencies.

Continuity risk can exist without data loss: the model, price, support, API, identity, or roadmap may be essential to the process. Waiting for renewal can outlast objection, terms-change, or migration windows. Reacting only to reputation creates an unverifiable decision, while ignoring the event assumes corporate control never changes operational risk.

Decision, limits, and stop condition

The event should open seven checks: continuity, data and subprocessors, security, contract, concentration, portability, and user communication. Each needs an owner, deadline, and condition determining whether to retain, constrain, renegotiate, or exit.

Waiting for renewal can outlast objection, terms-change, or migration windows. Reacting only to reputation creates an unverifiable decision, while ignoring the event assumes corporate control never changes operational risk.

Execution and proof of completion

Execution should start by triggering the change-of-control clause and workflow while retaining notices, current terms, and effective dates. Then, reassessing the seven domains with evidence, including a technical export test and provider alternative. Closure requires taking the decision to the authority level matching impact and communicating relevant changes to internal users.

The event closes when each domain has current evidence, exceptions are approved and dated, and the exit plan has been tested; 'no known impact' is acceptable only when it results from documented checks.

• triggering the change-of-control clause and workflow while retaining notices, current terms, and effective dates.
• reassessing the seven domains with evidence, including a technical export test and provider alternative.
• taking the decision to the authority level matching impact and communicating relevant changes to internal users.
• The event closes when each domain has current evidence, exceptions are approved and dated, and the exit plan has been tested; 'no known impact' is acceptable only when it results from documented checks.