BARC Deal Radar – September 2026: Governance moves to runtime

September took the agent stack described in August one step further. Investors and buyers focused less on assembling models, routing and data access, and more on controlling what agents may see and do once they run inside an enterprise: identity, permissions, policy enforcement, data context and audit.

One European financing dominated the headline figures. Mistral AI’s Series D supplied most of the month’s disclosed capital. Beneath that round, the market was broad rather than deep. Many early-stage companies raised capital for specific control points, and buyers paid for the same capabilities or for the specialist teams needed to deliver them.

The Deal Radar covers the transactions BARC tracks in its core coverage: enterprise data, analytics, business intelligence, performance management, and the governance and operation of enterprise AI. It reflects the deals we can see and verify, not a complete census of the global market.

September at a glance

• 50 transactions in BARC’s core coverage: 33 investments and 17 acquisitions, two of which are planned rather than completed.
• $5.29bn in disclosed funding across 31 investments, including $3.49bn from Mistral AI’s €3bn Series D. Two rounds did not disclose an amount.
• $1.82bn in recorded acquisition value across four deals with a disclosed or reported price, led by Cyera’s $1bn acquisition of Oasis Security. The other 13 acquisitions left the terms undisclosed.

Compared with August

September’s core coverage contained clearly more transactions than the August edition, but less disclosed value. Most of the additional deals were investments, and many of September’s rounds were small early-stage financings.

Both months depended on a single funding outlier: Databricks in August, Mistral AI in September. The acquisition side changed more sharply. August’s value came from two very large platform agreements, NVIDIA and Hugging Face, and Stripe and OpenRouter. September had no deal of that size. Its largest recorded acquisitions were in data security and services.

A broad US market and a single European outlier

US-headquartered companies accounted for most of the tracked transactions, a familiar pattern. Outside the Mistral round, they also raised almost all disclosed funding.

Europe led by capital only because of Mistral AI. The other European rounds in our coverage were small and early-stage, mostly in governance, data integration and execution infrastructure. Germany contributed the most of them, through Restate, Zeit AI, Kontext and sci2sci, followed by the United Kingdom with HelmGuard, AI Score and Orchestra.

Every European target in our coverage was bought by a company from another country. NetApp, Nutanix and HCLSoftware bought or agreed to buy European targets. European buyers also looked abroad: Greenly, Artefact and Solita bought targets in other European countries, and Omada acquired EmpowerID in the United States.

Governance moves from policy to runtime

September’s largest cluster covered the operational control of enterprise AI. Agents do not only generate content. They authenticate, query data, call tools and execute actions. The deals in this group address what changes when software acts on an organisation’s behalf.

The larger rounds went to platforms that join data security with identity and agent access. Cyera and Island raised the most in this group, followed by HiddenLayer, MIND and Reco. Their products differ, but each connects sensitive data, identities, applications and permissions to the activity of AI agents.

Smaller rounds targeted single control points. Cymphony maps how employees and agents access systems and data. Eve Security and Kontext intervene while agents act. Palma.ai governs interactions between agents and Model Context Protocol (MCP) servers, the standard through which agents reach tools and data. AI Score, HelmGuard, Comp AI and Complaion focus on assurance and compliance evidence, while sci2sci links governance with business context and traceability.

Buyers pursued the same architecture. Cyera completed its acquisition of Oasis Security to add non-human identity management to data security. Omada acquired EmpowerID for agent identity governance, Kiteworks bought Bonfy.AI for runtime data classification and policy enforcement, and Barndoor AI acquired Diaphora to turn governed workflows into reusable tools for agents.

Company	HQ Country	Value (US$)	Stage
Oasis Security	United States	$1bn	Acquired by Cyera
Cyera	United States	$400m	Series G extension
Island	United States	$400m	Series F
HiddenLayer	United States	$100m	Series B
MIND	United States	$72m	Series B
Reco	United States	$55m	Additional funding
Comp AI	United States	$34m	Series A
Cymphony	United States	$30m	Launch funding
Complaion	Italy	$15.36m	Funding
HelmGuard	United Kingdom	$7.3m	Seed
AI Score	United Kingdom	$5.4m	Seed
Eve Security	United States	$4.5m	Seed extension
Kontext	Germany	$4m	Seed
Palma.ai	United States	$1.8m	Pre-seed
sci2sci	Germany	$1.4m	Pre-seed
EmpowerID	United States	undisclosed	Acquired by Omada
Diaphora	United States	undisclosed	Acquired by Barndoor AI
Bonfy.AI	United States	undisclosed	Acquired by Kiteworks

Table 1: Runtime governance deals, September 2026

Data context becomes part of the agent architecture

Agents need more than access to data. They need current data, business meaning and controls that survive the move from a warehouse into an AI workflow.

Euno reconstructs lineage, meaning, ownership and governance rules into a context layer for agents. Ekai approaches the same gap from the business side, capturing definitions from domain experts and turning them into governed semantic models. Feldera processes lakehouse data continuously with SQL, while Keewano and Antfly build databases designed for machine reasoning and agent retrieval. Tile.ai secured a strategic investment for its governed data layer. Zeit AI, Orchestra and Custodea focus on data integration and preparation.

Two platform vendors bought into the same problem. Databricks acquired Row Zero to bring a spreadsheet experience onto live, governed data, a direct challenge to the CSV exports and spreadmarts that sit outside platform governance. ServiceNow acquired Sweep, which maps metadata, dependencies and governance rules across business-system configurations. The strategic question for both is whether context captured inside one platform remains usable for agents that work across many.

Company	HQ Country	Value (US$)	Stage
Euno	United States	$23m	Series A
Feldera	United States	$21.5m	Seed and Series A
Keewano	Israel	$12m	Seed
Zeit AI	Germany	$5m	Seed
Orchestra	United Kingdom	$3.3m	Seed
Antfly	United States	$2m	Pre-seed
Ekai	United States	$1.7m	Pre-seed
Custodea	Netherlands	$0.40m	Seed
Tile.ai	United States	undisclosed	Strategic investment
Row Zero	United States	undisclosed	Acquired by Databricks
Sweep	United States	undisclosed	Acquired by ServiceNow

Table 2: Data context deals, September 2026

Model scale and the machinery to run AI

Mistral AI’s Series D was the month’s largest financing by a wide margin. Mistral now offers more than foundation models: its AI Studio platform covers building, deploying and governing agents in the enterprise.

The other transactions in this group address the machinery behind AI in production: keeping workloads, agents and automated processes running reliably and at acceptable cost. Temporal’s Series E was the month’s second-largest round. Temporal and Restate both provide durable execution: long-running workflows and agents keep their state, retry after failures and resume where they stopped. Ascerta is expanding from AI cost management into broader enterprise AI management. flowscope deploys agents that map, redesign and automate business processes.

Buyers added the same layer. NetApp agreed to acquire PEAK:AIO for AI storage, and Nutanix acquired Ryax Technologies for GPU scheduling and AI workload orchestration. HCLSoftware plans to acquire Robotiq.ai to give its agentic orchestration a robotic process automation (RPA) layer, software robots that operate applications without usable APIs.

Company	HQ Country	Value (US$)	Stage
Mistral AI	France	$3.49bn	Series D
Temporal	United States	$550m	Series E
Restate	Germany	$20m	Series A
Ascerta	United States	$18m	Series A
flowscope	United States	$3.8m	Seed
PEAK:AIO	United Kingdom	undisclosed	Planned acquisition by NetApp
Ryax Technologies	France	undisclosed	Acquired by Nutanix
Robotiq.ai	Croatia	undisclosed	Planned acquisition by HCLSoftware

Table 3: Model and AI execution deals, September 2026

Services buyers secure delivery capacity

September brought a concentrated wave of data and AI services deals. CDW’s acquisition of Lovelytics was the largest. CDW gains data modernisation, governance, AI delivery and Databricks expertise. Cyient completed its purchase of TAO Digital Solutions, adding data engineering, platform modernisation and AI lifecycle operations.

Databricks expertise drew capital twice: through the Lovelytics acquisition and through a growth investment in Climb, a Databricks-native consultancy founded this year. Atrium also took a growth investment. Artefact acquired The Nunatak Group to expand in Germany and the wider DACH region, Solita bought Danish consultancy Heyra, Insero Advisors added Cause + Effect Strategy and ALKU acquired rockITdata.

These are not simply headcount deals. Buyers are paying for teams that can connect enterprise AI to data platforms, governance and operating processes. The open question is how much of that specialist capability survives integration into a broader services portfolio.

Company	HQ Country	Value (US$)	Stage
Lovelytics	United States	$525m	Acquired by CDW
TAO Digital Solutions	United States	$218m	Acquired by Cyient
Climb	United States	~$5.7m (reported)	Growth investment
Atrium	United States	undisclosed	Growth investment
The Nunatak Group	Germany	undisclosed	Acquired by Artefact
Heyra	Denmark	undisclosed	Acquired by Solita
Cause + Effect Strategy	United States	undisclosed	Acquired by Insero Advisors
rockITdata	United States	undisclosed	Acquired by ALKU

Table 4: Data and AI services deals, September 2026

Finance, performance and carbon reporting

Five transactions targeted software for the office of finance and for sustainability reporting. They follow two different logics.

Agentic tools are reaching planning and performance management. Outline builds an agentic platform for financial planning and analysis (FP&A) aimed at mid-market CFOs. Augmeta assigns an AI agent to each business KPI to monitor, investigate and act on changes. BlackLine acquired NetNow to add customer onboarding, credit assessment and portfolio monitoring to its invoice-to-cash offering.

Carbon accounting is consolidating while early-stage capital still enters. Greenly combined its platform with Normative’s in a transaction both companies describe publicly as a merger. Remedium raised pre-seed funding in Saudi Arabia for carbon management and sustainability accounting.

Company	HQ Country	Value (US$)	Stage
Normative	Sweden	~$73.1m (reported)	Acquired by Greenly
Outline	France	$3m	Pre-seed
Augmeta	United States	$3m	Seed
Remedium	Saudi Arabia	$1.5m	Pre-seed
NetNow	Canada	undisclosed	Acquired by BlackLine

Table 5: Finance, performance and carbon reporting deals, September 2026

Who is doing the buying

The more useful question is not where buyers are based but what each wanted to control.

The acquisitions fall into three patterns:

• Platform vendors bought control points around data context, storage and AI workloads: Databricks with Row Zero, ServiceNow with Sweep and Nutanix with Ryax Technologies. NetApp and HCLSoftware plan to follow with PEAK:AIO and Robotiq.ai.
• Software vendors expanded into adjacent governance or workflow layers, such as Cyera with Oasis Security, Omada with EmpowerID and BlackLine with NetNow. Greenly’s combination with Normative is the exception: horizontal consolidation in carbon accounting.
• Services buyers secured specialist data and AI delivery capacity. CDW, Cyient, Artefact, Solita, Insero Advisors and ALKU each acquired a consultancy with data, analytics or AI expertise.

These patterns raise different integration questions. Governance acquisitions test whether agent controls work as a feature of a larger security or identity platform. Platform acquisitions decide where business context lives. Services deals depend on retaining specialist teams after integration.

What this means for data and analytics leaders

• Check what your existing identity, data-security and AI platforms already cover, or plan to cover, before buying separate agent-control tools. Acquisitions such as Cyera’s purchase of Oasis Security and Omada’s of EmpowerID show these functions moving into larger platforms.
• Treat business context as an architecture decision. Semantics, lineage and ownership captured inside one platform, as Databricks and ServiceNow now do with Row Zero and Sweep, may not be usable by agents that work across systems.
• Plan for execution reliability before agents run critical processes. Durable state, retries and fallback execution, the focus of Temporal and Restate, belong in the operating model, not only in the pilot.
• If an implementation partner has been acquired, check team continuity and platform neutrality. Several data and AI consultancies changed ownership in September.
• We will watch whether identity and data-security platforms keep buying agent-control start-ups. If they do, runtime governance will become a platform feature rather than a product category of its own.