Enterprise AI / Data Governance

When 15 million genetic profiles sold for roughly $20 each during a bankruptcy liquidation, it exposed a structural gap in how enterprises think about third-party data risk - and the exposure is far wider than most compliance teams realize.

April 15, 2026  |  PATech Labs Editorial  |  8 min read

In March 2025, 23andMe - once valued at $6 billion - filed for Chapter 11 bankruptcy protection. What followed was not just a cautionary tale about consumer biotech hubris. It was a live demonstration of a legal mechanism that enterprise AI teams have systematically underestimated: the bankruptcy exception to privacy agreements. Regeneron Pharmaceuticals ultimately acquired the company's assets for approximately $256 million. That figure, divided across roughly 15 million customer profiles, works out to just under $17 per person - genetic ancestry data, health predisposition markers, family tree connections, all transferred to a new owner the original customers never consented to.

The mechanics that enabled this transfer are not unique to consumer genomics. They are embedded in the same standard commercial data licensing agreements that enterprise AI teams sign every quarter when onboarding training datasets, behavioral analytics pipelines, enrichment APIs, and market intelligence feeds. The question is not whether your enterprise has exposure. The question is how much - and whether your legal and data engineering teams have mapped it.

The Bankruptcy Exception Nobody Built Into Their DPA

Data Processing Agreements are written to govern normal commercial relationships. They specify retention limits, sub-processor chains, geographic constraints, and deletion obligations. What the vast majority of DPAs do not address with specificity is what happens when the counterparty becomes insolvent and a bankruptcy court applies Section 363 of the U.S. Bankruptcy Code - a provision that allows a trustee to sell estate assets "free and clear" of most contractual encumbrances.

Courts have interpreted data assets - including licensed datasets, model training corpora, and customer behavioral profiles - as property of the bankruptcy estate. Privacy promises made by the original vendor do not automatically transfer. The Federal Trade Commission filed an objection in the 23andMe case arguing the data should not be sold without enhanced protections, but the court allowed the sale to proceed under conditions critics called inadequate. That precedent is now set.

For enterprise AI teams, the practical implication is this: any dataset your models were trained on, fine-tuned with, or that flows into a RAG pipeline could, in theory, end up under the control of a competitor, a foreign entity, or a company with fundamentally different data ethics standards - and your legal agreement with the original vendor provides no guaranteed shield against that outcome.

Why Enterprise AI Amplifies the Exposure

Traditional data licensing risk was manageable when data sat in a warehouse and was queried by analysts. The exposure was bounded - a vendor going bankrupt meant you lost access to data, not that you gained a new liability. Generative AI and machine learning change that calculus in two critical ways.

First, trained models internalize data. Unlike a database query, a fine-tuned model cannot simply "forget" training data when the license lapses or transfers to a new owner. The data becomes encoded in model weights. Regulators in the EU have begun asserting that this constitutes continued processing under GDPR Article 28, which requires a valid data processing agreement at all times - not just at the point of initial ingestion. If your DPA with Vendor A terminates and Vendor A's assets are acquired by Vendor B without an updated agreement in place, you may be processing personal data without a legal basis. That is not a hypothetical risk: the Austrian DPA and France's CNIL have already issued guidance suggesting exactly this interpretation.

Second, the supply chain has grown invisibly complex. A typical enterprise AI system in 2025 draws on data from dozens of vendors simultaneously - enrichment APIs, behavioral signals, market intelligence feeds, public web crawls licensed through intermediaries. Mapping the full provenance of training data well enough to answer the question "who owns this data if Vendor C goes bankrupt next quarter?" is a task that very few AI teams have actually completed. In most organizations, it has never been formally attempted.

What Regulators Are Watching - and What Comes Next

The 23andMe case drew FTC attention, multiple state AG inquiries, and a congressional letter to the bankruptcy court within weeks of the filing. The policy machinery is in motion. Two legislative proposals in the U.S. - the Health and Genetic Data Protection Act and a proposed amendment to COPPA 2.0 - explicitly address the treatment of sensitive personal data in insolvency proceedings. Neither has passed as of this writing, but both have bipartisan co-sponsors, which is unusual in the current congressional environment.

In the EU, the AI Act's data governance provisions - which took full effect in February 2025 - require that high-risk AI systems maintain documentation of training data provenance throughout the system lifecycle. The European Data Protection Board has signaled it will interpret "throughout the lifecycle" to include events like vendor insolvency. Enterprises deploying high-risk AI systems in the EU without a documented chain of data custody - including contingency provisions for vendor failure - are operating in a grey zone that enforcement action could clarify quickly and painfully.

Beyond regulation, there is a reputational dimension. The companies whose data ended up in the 23andMe sale - research partners, API customers, enterprise licensees - did not create the bankruptcy. But they now share the headline. As AI systems become more visible and more scrutinized, the provenance of the data that powers them will increasingly become a brand and trust issue, not just a legal one.