Almost every AI feature in your business runs on somebody else's decision. Not your code, not your server, not your contract — somebody else's roadmap, somebody else's pricing page, somebody else's idea of what counts as an acceptable use. Most of the time that is fine, and it is a lot cheaper than the alternative. But in the first eight days of September 2026 two announcements landed that make the question worth answering on purpose rather than by accident. NVIDIA agreed to buy the place where the open AI world keeps its models, and Mistral raised the largest equity round in European technology history arguing that you should never be in that position at all. This article is about what those two events actually change for a business that runs AI, and the short dependency check you can do about it this week.
What NVIDIA Actually Bought, and for How Much
On 2 September 2026, NVIDIA entered into a definitive agreement to acquire Hugging Face, Inc. That is not a report or a rumour — it is in NVIDIA's own 8-K filing with the US Securities and Exchange Commission, which is the version of the story that carries legal consequences if it is wrong.
You will see two different prices quoted, and both are right. The filing and NVIDIA's own announcement break down like this:
The transaction is expected to close in the first half of 2027, subject to customary closing conditions including required regulatory approvals. That last clause matters and we will come back to it, because a signed deal is not a closed deal.
Why a Model Hub Is Infrastructure, Not a Website
If you have never opened Hugging Face, the scale of it is worth stating plainly. NVIDIA's announcement gives these numbers: more than 18 million developers, researchers and creators; more than 3 million models; 500,000 datasets; 1 million applications; and more than 200,000 companies using the platform to discover, evaluate, customise and deploy AI.
These are NVIDIA's figures about the company it is buying, so treat them as the seller's side of the story rather than an audit. But the direction is not in dispute. When a developer anywhere in the world reaches for an open model — for transcription, translation, image tagging, document extraction — the default place they get it is Hugging Face. It has become plumbing. And the thing about plumbing is that nobody thinks about who owns it until the day it changes.
NVIDIA has been unusually direct about the concern this raises. In his announcement, Jensen Huang wrote that Hugging Face "will remain an open platform for the entire AI ecosystem," that developers "will choose the models they want, the frameworks they want, the clouds and inference service providers they want," and — the sentence that was clearly written for the sceptics — that "NVIDIA compute will not be required to build on or deploy through Hugging Face."
That is a clear commitment, made in public, by the chief executive. It is also, for now, a promise rather than a contract you are a party to. Not everyone found it reassuring: The Register ran its piece under the headline "Hugging Face is too important to fall into Nvidia's hands," and the objection is straightforward — the industry's dominant chip supplier buying the industry's dominant open-model distribution point is a vertical combination regulators are paid to look at. The deal's own filing concedes it needs regulatory approval to close.
A dependency you have not written down is not a dependency you have chosen. It is one you inherited, and you will find out the terms at the worst possible moment.
Six Days Later, Europe Bet 3 Billion Euros on the Opposite Answer
On 8 September 2026, Mistral announced a 3 billion euro Series D at a post-money valuation of more than 21 billion euros, which the company says is the largest equity round ever completed by a European technology company, three years after launch. Samsung Electronics led it, with the EQT-managed Scaleup Europe Fund and existing investor PSG Equity as co-leads.
What makes this the same story rather than a separate one is the argument Mistral used to raise the money. In its own announcement the company frames the market shift like this: during the first wave of generative AI the question was who could build the most powerful model, and organisations are now asking instead "how to harness the power of AI for their mission-critical needs without surrendering control over the infrastructure and intelligence loop." Mistral defines its pitch as control across four dimensions — data inside the organisation's boundaries, models that are controllable and customisable, compute that is private and predictable, and production systems that are auditable — and says customers are therefore "never locked into a single vendor's roadmap, pricing or availability."
That is vendor marketing, and you should read it as such. But it is precise vendor marketing, and it names the risk correctly. It is also worth reading the investor list at the bottom of Mistral's own announcement, where NVIDIA appears among the existing investors participating in this round. The company buying the open-model hub is on the cap table of the open-weight challenger. That is not a scandal. It is simply what a concentrated supply chain looks like from the inside, and it is a good reason not to treat "we use the open alternative" as a complete answer to dependency.
The Four Dependencies You Already Have
Strip out the billions and the industry politics, and a business running AI has four exposures. Most companies can name one of them and are surprised by the other three.
| What you depend on | What it looks like when it moves | What actually protects you |
|---|---|---|
| Price | A published rate changes on a date you did not choose, and your unit economics change with it | Knowing your cost per transaction, not per month, and having a second provider you have already tested |
| Availability | A model is deprecated, rate-limited, or degraded for a day. Your feature is simply gone | Automatic failover to a different provider, and local processing for anything that must not stop |
| Policy | An acceptable-use rule changes and a workload you built is no longer allowed | Reading the terms for your actual use case before you build on it, not after |
| Data | Where your files sit, who can read them, and which jurisdiction they are in changes hands with the company | Knowing what leaves your premises and what does not, in writing, per feature |
The NVIDIA acquisition touches the last two hardest. If your software pulls an open model from a hub at build time or at run time, the ownership of that hub is now part of your supply chain — and it is changing hands, pending approval, some time before the middle of 2027.
What This Looks Like When You Build It Properly
We take the availability problem seriously in our own products because we have to. Our AI Cam platform is built with enterprise AI verification and built-in redundancy, so there is no single point of failure and analysis does not stop when one path fails. If a device dies, a standby device you nominated takes over on its own terms — the same rules, zones and hours as the camera it is covering.
The more useful design decision is the boring one: detection and recording run locally on the device, so they keep working with no internet at all, and events detected during an outage are queued and delivered when the connection returns. Footage never leaves the building. That is not a marketing position about sovereignty. It is what makes a security camera a security camera rather than a subscription that stops watching your shop when somebody else has a bad afternoon.
The general principle transfers to any business:
- Decide what must never stop. For most businesses that is a very short list, and everything on it should run somewhere you control. Everything else can safely live in the cloud.
- Never let one vendor be the only path. A second provider you have tested once is worth more than three you have read about.
- Write the switching cost down. If moving away from a tool means re-training staff, re-entering data and rebuilding integrations, that number is your real lock-in — not the monthly fee.
- Separate the model from the workflow. The value is in your process and your data. If the model is a component you can swap, an acquisition three thousand miles away is somebody else's news story.
- Know where the data physically is. This is the one that becomes a compliance problem rather than an inconvenience, particularly for anything touching financial records.
A Dependency Check You Can Run This Week
You do not need a consultant for this. Take an hour, open a spreadsheet, and list every AI feature your business currently relies on — the chatbot, the transcription, the document reader, the forecasting, the thing somebody in accounts set up and never told you about. For each one, answer four questions honestly:
- Who supplies it, and what did that cost last month? Not the plan price. The actual invoice.
- If it disappeared on Monday, what stops? If the answer is "nothing much", stop worrying about it. That is a legitimate outcome for most items on the list.
- Does our data leave the building to make it work? If yes, to which country?
- What is plan B, and has anyone ever tried it? An untested plan B is not a plan B.
The point of the exercise is the ranking, not the list. Most items will fail at least one question and it will not matter, because nothing important stops when they do. Two or three will matter, and those are the only ones worth spending money to make redundant. The rest you can leave exposed on purpose, which is a decision rather than an oversight.
One honest caveat on all of this: the NVIDIA deal has not closed. It is expected to complete in the first half of 2027 and needs regulatory approval to do so, and large vertical acquisitions in concentrated markets are exactly the kind that get conditions attached or fall apart. Nothing about your model hub changed this week. What changed is that you now know who is planning to own it, which is more warning than businesses usually get.
Where to Start
If this week's news made you realise you could not actually answer the four questions above, that is the finding — not a reason to change anything yet. Start with the exposures that cost money on a schedule: our guide to what changes in AI pricing on 1 January 2027 covers rates that are already published with dates on them, which is the easiest form of this risk to plan for. If you are weighing whether to build a capability rather than rent it, the trade-offs are set out in our piece on build versus buy with AI coding agents.
For the two dependencies that usually matter most in a real business, the answers are more concrete. Security and monitoring should keep working when the internet does not, which is how AI Cam is built. Financial records should sit where your accountant and your tax authority can both live with them, which is what IO Snack Accounts is designed around. If you would rather talk it through against your actual setup than fill in a spreadsheet, get in touch and we will go through the list with you.
