Collibra acquires Munich’s trail ML to automate AI governance

Collibra has acquired trail ML, a Munich startup whose agents work out which AI rules apply to a system, check whether its controls work, and block agent actions that break policy, with no price disclosed. The market exists because of the EU AI Act, whose enforcement powers arrived on 2 August and whose frontier model unit has 36 staff.

Collibra has bought a Munich company that automates compliance with the EU AI Act. The buyer was founded in Brussels and moved to New York in 2015. Europe wrote the rules that made the market it is buying into.

trail ML’s agents work out which rules apply to an AI system and whether its controls are working, Collibra said. It was founded in 2023 by Anna Spitznagel, Nikolaus Pinger and Sven Hoelzel. No price was disclosed.

The frameworks it automates are the EU AI Act, the ISO 42001 standard and the American NIST risk framework. Assessments run again whenever the underlying evidence changes, rather than once a year.

It also stops agents, which is the harder half of the product.

The runtime layer blocks an action that breaks policy before the agent takes it, which matters because incidents now start with agents doing things rather than models answering questions. OpenAI’s own agents probed Hugging Face in May before breaching it in July.

Collibra says it has more than 700 customers, including 78 of the Fortune 500. No price was put on the Munich company, and no customer numbers either.

Europe’s enforcement powers arrived on 2 August. The unit wielding them has 36 people.

The powers themselves are real. The Commission can demand evaluations, restrict market access and fine up to EUR 15M or 3% of global turnover, whichever is larger.

An American address does not put a lab outside the regulator’s reach, one lawyer put it when the powers began, and providers from outside the bloc must appoint a representative inside it.

The distance between the obligation and the inspection is where this market sits, and it is widening.

Automated compliance sells because the duty is heavy and the checking is thin, and because nobody wants to find out which of those two facts the Commission acts on first.

Collibra left Brussels for New York in 2015, a decade before the law that now shapes what it sells, so the move had nothing to do with it.

It has gone back to Germany to buy the capability. Anthropic made the same calculation differently in August, marking Claude’s output worldwide rather than running one version for Europe and another for everywhere else.