AI Chatbot Vendor Risk: What If Your Provider Goes Bust?

On October 12, 2026, Character.AI filed for Chapter 11 bankruptcy in Delaware. Five years after launch, one of the best-known chatbot platforms in the world is now running a court-supervised sale. Disney is the stalking-horse bidder: $20 million for a license to selected intellectual property. The platform stays online for now, but if no buyer agrees to keep it running by late November or early December, it will be wound down.

The part that should worry business owners is the data. User data is not part of the Disney bid, so it could still end up with another buyer. The company says chats remain “protected under our Privacy Policy”, and that same policy allows information to be shared during a sale of company assets. Millions of conversations are now waiting on a bankruptcy auction.

Character.AI is a consumer app, but the lesson applies to every company that has put an AI chatbot vendor on its website. Your chatbot holds your documentation, your customer conversations and often your leads. If the provider disappears, gets acquired, or simply retires the model it runs on, what happens to all of that?

This guide covers the questions to ask before you sign, and how to build a chatbot setup that survives a vendor failure.

AI chatbot vendor risk is no longer theoretical

2026 has been a hard year for anyone who assumed AI tools would just keep running:

• Character.AI filed for bankruptcy on October 12, with a sale expected to close in late November or early December.
• OpenAI announced on October 14 that GPT-4o and GPT-4.1 will leave its API on January 14, 2027, giving about three months’ notice. Any chatbot built directly on those models needs a migration plan.
• Drift, once the reference for B2B conversational marketing, was wound down earlier this year, and its customers had to rebuild somewhere else.
• Builder.ai collapsed in May 2025, and customers reportedly lost access to applications and data overnight.

Gartner also expects more than 40% of agentic AI projects to be cancelled by the end of 2027. Not every vendor in today’s AI chatbot market will be around in two years. That is normal for a young market. What matters is whether your business is exposed when it happens.

Three ways a chatbot vendor failure hurts your business

1. Your customer data ends up in someone else’s hands

A chatbot collects names, emails, order numbers, sometimes health or financial details typed in by visitors. Under the GDPR, your provider is usually a processor acting on your behalf. Article 28 says that when the service ends, the processor must delete or return the personal data, as you choose. A bankruptcy sale is exactly the situation where that obligation gets tested. A buyer may also want the data as an asset.

2. Your knowledge base is locked in

Some platforms make you build the chatbot’s knowledge inside their own editor, through hand-written intents, flows or fine-tuned models. When the platform closes, that work closes with it. You are not migrating anything. You are starting from zero.

3. Your website goes silent

The widget stops loading or returns errors, and visitors who used to get instant answers now get nothing. Leads arriving at 11 pm go unanswered. Most businesses only notice when a customer complains.

The AI chatbot vendor due diligence checklist

Before you choose a provider, or right now for the one you already use, ask these seven questions.

1. Where is the data hosted, and under which law? Data hosted in the EU by a European company is protected by the GDPR and European courts. Data hosted by a US provider can be reached under the US CLOUD Act, even when the servers are in Europe. In a bankruptcy, the governing law also decides who can buy what.

2. Is there a GDPR Article 28 data processing agreement? Ask for it. Check that it covers deleting or returning data at the end of the contract, and that it lists every sub-processor.

3. Where does the chatbot’s knowledge actually live? This is the most important question, and few buyers ask it. If the knowledge lives in your own documents (PDFs, Word files, your website, RSS feeds) and the chatbot retrieves from them at query time, you always keep the source. If it lives inside a fine-tuned model or a proprietary flow editor, you don’t.

4. How dependent is the vendor on a single model provider? The GPT-4o retirement shows that the model under your chatbot can be retired without much notice. Ask which model is used, whether alternatives exist, and who handles migration.

5. Is customer data used to train models? If your conversations feed a shared model, deleting your account does not take them back out.

6. How long would it take to rebuild elsewhere? If the honest answer is “months”, you are locked in. If it is “an afternoon, because we just re-upload our documents”, you are not.

7. Can you test it without commitment? A real free plan lets you check quality, speed and support before you depend on the vendor, and it shows the vendor is confident enough to let you leave.

Why RAG chatbots are structurally less risky

Retrieval-augmented generation (RAG) separates the two things a chatbot needs: your knowledge and a language model. Your documents stay the single source of truth. The chatbot searches them for each question and writes an answer grounded only in what it found.

This design has a useful side effect for vendor risk. Because the knowledge is not baked into the model, it is never trapped there. If you ever need to change provider, you take your files and upload them somewhere else. The model can be swapped too without retraining anything, because the documents never moved.

Compare that with a chatbot whose knowledge was poured into a fine-tuned model or months of scripted flows. When that vendor fails, your knowledge fails with it.

DoxyChat: built so your knowledge stays yours

DoxyChat was designed around exactly these principles:

• Your documents remain the source of truth. DoxyChat builds a RAG chatbot from your PDFs, DOCX files, website and RSS feeds. It answers only from that content, and the originals always stay with you.
• French company, data hosted in France. Infrastructure runs on Scaleway in France, the language model is Mistral, and GDPR compliance is native. No US CLOUD Act exposure.
• No training on your data. Customer content is never used to train public models.
• Deployed in 2 minutes. A single line of JavaScript adds the widget to any website. Getting started is that light, so you are not committing to a months-long project.
• A free Discovery plan. Test it on your own documents before deciding anything.

The best protection against a vendor failure is a setup where switching would be easy, and that is what a document-based RAG chatbot gives you. More guides are on our blog.

Conclusion: choose a chatbot you could leave

Character.AI’s bankruptcy will not be the last in the AI market. Prices will keep moving, models will keep being retired, and some providers will be acquired or close. You cannot control that. You can control where your knowledge lives, where your customer data is hosted, and how long it would take to move.

Ask the seven questions above, keep your documents as the single source of truth, and choose a provider that falls under European law.

Try DoxyChat free and have a GDPR-native chatbot built from your own documents live on your site in 2 minutes.