Collibra acquires trail ML: AI Act compliance checked continuously, not annually

Collibra acquires trail ML: AI Act compliance checked continuously, not annually

The acquisition, announced on October 5, 2026, gives data governance company Collibra an agent-based engine that assesses compliance continuously against the EU AI Act, ISO 42001 and NIST AI RMF – and that can block policy violations by autonomous agents before they are executed. Terms were not disclosed.

What happened

Collibra, a data governance and AI governance company, has acquired the Munich-based startup trail ML. The announcement came on October 5, 2026, and none of the sources state the purchase price. trail ML was founded in 2023 by Anna Spitznagel, Nikolaus Pinger and Sven Hoelzel, according to The Next Web.

trail ML builds software agents that automate compliance work: they figure out which rules apply to a given AI system, check whether the controls actually work, and stop agent actions that violate policy. The acquisition gives Collibra the ability to connect this automation to its existing platform, which the company itself says governs over 2 billion data assets and has more than 700 customers, including 78 of the Fortune 500 – all figures are the company's own statements.

How the product works

The core of trail ML's offering is continuous assessment rather than periodic audit. According to The Next Web, the company's agents automate three frameworks: the EU AI Act, the ISO 42001 standard, and the US NIST risk framework. The assessments are re-run every time the underlying evidence changes – not once a year, as with traditional audits.

On top of this sits a runtime layer. It blocks an agent action that violates policy before the agent executes it. The point is not just documentation: as companies put autonomous agents into production, incidents start with agents doing things, not with models answering questions. A pre-execution block is therefore a different kind of control than a retrospective audit.

trail ML's own website, as reproduced by Unite.AI, also describes a mechanism the company calls Copy-on-Write: the agents write to customer systems only when a human has approved it. The company describes agent work spanning risk classification, gap analyses, control assessments, evidence collection and report generation across teams for business operations, IT security, legal, compliance, privacy and risk management.

The integrations include tools such as Jira, GitHub, ServiceNow, OneTrust, Databricks and Hugging Face – according to the company's own statements.

Why Collibra bought it

According to the announcement, Collibra's platform gives enterprises context and control to govern AI across data, models, applications and agents. trail ML adds agent-driven automation that can review evidence, determine which requirements apply, assess controls, find gaps and automate governance workflows.

The leadership on both sides frames the deal the same way. "AI governance cannot become another manual process that slows organizations down as AI scales," said Felix Van de Maele, co-founder and CEO of Collibra, according to Unite.AI. "We founded trail ML because we believe AI governance must be automated and operational," said trail ML's co-founder and CEO Anna Spitznagel in the company's own announcement of the deal.

According to Citybiz, trail ML's runtime technology can apply Collibra's policies where the agents operate, blocking actions that violate established requirements before they are executed. That is the link between the two platforms: Collibra defines the policy, trail ML enforces it in production.

The market it lands in

The timing is not accidental. According to The Next Web, the EU AI Act's enforcement powers came into force on August 2 – a detail that here rests on a single source, but which places the acquisition right after the regulation got teeth. At the same time, enterprises are deploying autonomous agents at increasing scale. The risk picture is shifting, as The Next Web puts it: from what a model says to what an agent does. A governance layer that only documents compliance after the fact does not address that risk.

There is also a geographical irony in the picture. Collibra was founded in Brussels and moved to New York in 2015, The Next Web points out. Europe wrote the rules that created the market the company is now buying its way into.

What the sources state – and what is marketing

It is worth drawing a sharp line between what the sources report and what are the companies' own claims:

• Stated in the sources: the acquisition date, the founders' names, which frameworks trail ML automates, that assessments are re-run when evidence changes, and that the runtime layer blocks violations before execution.
• Company claims: Collibra's figures of 700+ customers, 78 of the Fortune 500 and over 2 billion governed assets are the company's own statements.
• Unverified marketing claims: trail ML itself states that the solution delivers 4x faster rollout of AI solutions and 70% faster compliance execution – figures the company says are based on customer results, but which are not independently verified and are presented without a stated method. trail ML's customer count has also not been disclosed.

One further caveat: all three sources in this story are secondary reports of the same announcement. No press release or filing underlies them, so the companies' claims are not corroborated independently of one another. The purchase price is unknown.

The open questions

It remains to be seen how the integration between the two platforms works in practice: how quickly can Collibra's policies be translated into trail ML's runtime rules, and who maintains them when the frameworks change? The Copy-on-Write mechanism also raises the question of where human approval sits in practice – and how thin human oversight becomes at scale.

The biggest question is whether automated compliance can actually withstand a regulator's scrutiny. Continuous, evidence-based assessment is a different methodology from the audit-based documentation many frameworks have historically assumed. If the agents themselves can document and enforce compliance, it shifts accountability – but the claims of speed gains remain, for now, sales figures.