AI vendor exits: what happens to your data when a startup shuts down?

AI vendors are not forever businesses

The AI tool landscape is changing faster than any other technology sector in recent memory. Companies that raised hundreds of millions of dollars are pivoting, being acquired, or shutting down within two to three years of launch. Products that became embedded in business workflows disappear with weeks of notice. And when they go, the question of what happens to the data they held on your behalf is often answered poorly — or not at all.

This isn't hypothetical. Several AI tools widely used by Australian businesses in 2023 and 2024 have since shut down, been acquired by companies with different privacy practices, or changed their terms in ways that materially affected how customer data is handled. Businesses that hadn't thought through their exit rights found themselves scrambling.

The three scenarios to prepare for

Scenario 1: The vendor shuts down. A startup runs out of funding and ceases operations. Depending on their shutdown process, they may give customers 30 days to export data, or they may go dark with minimal notice. In insolvency, your data becomes an asset of the estate — and what happens to it depends on the insolvency process and the terms of your agreement.

Scenario 2: The vendor is acquired. An acquisition can change everything about how your data is handled — the new owner's privacy practices, data storage locations, model training policies, and terms of service may all be different. An acquisition doesn't automatically trigger your right to delete your data or exit the relationship.

Scenario 3: The vendor pivots or materially changes terms. A vendor may remain operational but change its terms in ways that affect your data — adding model training on customer data, moving servers to a different jurisdiction, changing data retention periods. If the new terms are worse, your options depend on what your agreement says about term changes.

What to look for in your vendor agreement

Before signing up to any AI tool you'll use with significant data, review the following:

• Data deletion on termination. Does the agreement require the vendor to delete your data promptly when you close your account? What format can you export your data in? What is the deletion timeline?
• Change of control provisions. What happens to your data if the vendor is acquired? Do you have a right to exit if ownership changes?
• Material change notifications. Is the vendor required to notify you of material changes to their terms, particularly changes to data handling? What notice period applies?
• Your termination rights. Can you terminate without penalty if the vendor materially changes the terms? How much notice do you need to give?

Your obligations when a vendor exits

Under Australian Privacy Principle 11, you must take reasonable steps to destroy or de-identify personal information that you no longer need for the purpose for which it was collected. When a vendor exits, that obligation doesn't disappear just because the data is in their systems.

If a vendor shuts down without deleting your data, you may have an obligation to take steps to ensure the data is handled appropriately — including potentially notifying affected individuals if their personal information is no longer adequately protected.

This is another reason to maintain an AI Register with vendor contact details, data types held, and DPA details. When a vendor exits unexpectedly, that information is what you need to act quickly.

Practical steps

• Before adopting any AI tool, read the termination and data deletion clauses
• For tools used with significant personal information, ensure your DPA includes data deletion requirements
• Maintain a current AI Register so you know exactly what data each vendor holds
• Set calendar reminders to monitor significant vendors — acquisition news, funding status, product changes
• Periodically export your data from key AI tools as a business continuity measure