Cellebrite moves its parent company to the United States: who answers for the Italian contract?

If your command, your prosecutor’s office or the unit that runs internal investigations has a workstation that extracts data from phones, the contract keeping it alive is almost certainly not signed with its maker: it is signed with an Italian reseller. As long as the updates keep arriving, the difference is invisible. It becomes visible the day the manufacturer changes its parent company’s country — and on 14 September 2026 it announced that it will.

A board resolution announced, not yet filed

The press release, datelined Tysons Corner (Virginia) and Petah Tikva (Israel), announces that the board of Cellebrite DI Ltd. (Nasdaq: CLBT) has authorised a corporate reorganisation that will make a new United States corporation the ultimate parent company, subject to shareholder and regulatory approvals. Chief executive Shiven Ramji — in post since 13 August 2026, thirty-two days earlier — states: “Redomiciling is a strategic evolution of our company structure.” Completion is expected within the first half of 2027.

The distinction matters more than the news: this is declared, not filed. As of the date of this article the company’s SEC filing index records no Form 6-K later than that of 2 September 2026, and a full-text search across its filings returns no occurrence of redomicile. The release says so: the details will come through further filings with the SEC. The document that binds does not exist yet.

In Italy the contract is with somebody else

The point is not price, it is the chain: in two Italian public procedures the operator that signs is not the manufacturer. On 28 November 2025 the Comando Generale della Guardia di Finanza published the award notice (TED 791353-2025) for the «acquisizione della soluzione software Cellebrite “Inseyets Online Pro”» (acquisition of the Cellebrite software solution “Inseyets Online Pro”): EUR 395,292, a single tender received, awarded to Datamatic Sistemi e Servizi S.p.A. The earlier voluntary ex ante notice (TED 695604-2025) justifies the negotiated procedure without prior publication by the protection of exclusive rights, and describes the object as the «unica soluzione tecnica in grado di consentire l’elusione delle più evolute misure di sicurezza a protezione della maggior parte dei device presenti sul mercato» (the only technical solution able to circumvent the most advanced security measures protecting most of the devices on the market).

Second document: the Comando Generale dell’Arma dei Carabinieri awarded EUR 268,461, notice published on 28 April 2024 (TED 254586-2024), for the «rinnovo, per un periodo di n. 12 mesi, di n. 27 licenze Cellebrite di due tipologie» (renewal, for a period of 12 months, of 27 Cellebrite licences of two types), to 4N6 S.r.l.

Two administrations, two different intermediaries, a manufacturer party to neither instrument. If the parent company changes country, the counterparty the authority can summon remains an Italian firm that governs neither updates nor export licences.

Jurisdictions are not swapped, they accumulate

The filed record describes constraints the new flag does not dissolve. In the Form 20-F of 3 March 2026 the company writes that the export of some of its products is subject to Israeli control administered by DECA, the defence export controls agency: the existing licences prohibit exports to customers in certain countries and, for others, require the agency’s consent. On 18 November 2025 the Israeli Minister of Defense signed an order repealing the encryption control regime and adopting a new one, effective from 18 March 2026; the company believes that “our current license will remain valid until September 2027 with respect to our existing products”.

The second constraint already exists, and it is American. Again in the 20-F: the acquisition of Corellium, closed in December 2025, was allowed to proceed by CFIUS on the basis of an interim national security agreement requiring, among other things, that the group “maintain supply of certain products to the U.S. government”. Formal clearance, the company writes, is not assured.

Add them up: continuity depends on an Israeli licence with a declared expiry, on a control regime that is changing and on a priority already promised to a third government. Moving the parent company does not remove the first constraint: it adds the second. We wrote about the same supplier in July: a terminated contract does not switch off a tool already delivered.

Three checks, before the next signature

The procurement code obliges you to look. Article 120(1)(d)(2) of Italian legislative decree 36/2023 allows another operator to succeed the awarded contractor «a seguito di ristrutturazioni societarie» (following corporate restructuring) only where that operator meets the original selection criteria, without other substantial amendments and without circumventing the code. It is a check to carry out and minute: without a change-of-control clause it arrives too late.

Processing changes perimeter when the supplier’s controller changes. For policing and justice, Italian legislative decree 51/2018 applies (article 18 on the processor, chapter IV on transfers to third countries); for companies, the GDPR. The question to put in writing is one: which components sit in the cloud, who administers them, and which foreign authority can turn to the parent company.

Supply chain security is already a duty. Article 24(2)(d) of legislative decree 138/2024 requires supply chain security measures and, at paragraph 3, an assessment of each supplier’s vulnerabilities: a change of parent company reopens it. And for Annex III systems under the AI Act, the high-risk obligations apply from 2 December 2027, after the window in which the reorganisation is meant to complete.

Why a closed system

A forensic extraction is the heaviest data an organisation can produce: the complete copy of a device, often of somebody who is not yet anything. It cannot leave, not even to be analysed. The second reason is continuity, and here it has a date and a ministry: the licence declared valid until September 2027 was not negotiated by you, and your contract is with a reseller that does not govern it. The third is that you must be able to say what is inside: when a judge asks on what basis the software proposed a link, answering the tool did it will not do. The fourth is that the work done on your own corpus — annotations, links, case models — changes flag with the supplier if it lives inside its platform.

The right direction is the opposite: the analysis stays inside the perimeter, on open-weight models running on guarded machines, and only the result leaves, with its audit trail. It is the arrangement in which a foreign reorganisation goes back to being a stock market item, not an operational problem.

The two axes, applied to this case

Complying. The control we put into service is a living register of critical suppliers: who the parent company is, which jurisdiction governs it, which export licences hold the product up and when they expire, which change-of-control clause sits in the contract and who checked it — with the dated trail to show an inspection, under article 24 of legislative decree 138/2024 and article 120 of legislative decree 36/2023.

Deciding. The same architecture holds contracts, tender documents, corporate filings and public registers in a single operating model, on which AI agents execute decisions with a human operator in command — for large companies, public administration, healthcare and defence. On-premises on autonomous machines, or in a dedicated cloud with a data centre in Italy staffed by us, always with shared management.

Could you say, for your three most critical suppliers, who the parent company is and where it will be in a year? Half an hour with one of our engineers is enough to start.

What we do not know

We do not know which group entities will be parties to the contracts after the reorganisation: the release speaks of the parent company, not of the subsidiaries that sign. We do not know whether the Italian contracts cited contain change-of-control clauses: TED notices report object, value, procedure and winner, not the text. The absence of other above-threshold notices does not prove the absence of direct dealings below threshold. We do not know whether the configurations purchased contain AI components falling under Annex III of the AI Act. We found no coverage of the change in Reuters, the FT, the WSJ, AP or Bloomberg: the source is the company’s own release.