Workday to acquire C1: what it means for ConductorOne customers

As of 18 October 2026, Workday has agreed to acquire C1.ai (formerly ConductorOne), but the deal has not closed: Workday expects it to close by 31 January 2027, the end of its fiscal year 2027. The announcement says nothing about existing C1 contracts, and nothing yet about what a customer outside Workday needs to plan: the C1 brand, pricing, hosting and non-Workday connectors. If you already run Workday HCM, staying is a reasonable default. If you don't, use the coming weeks to read your contract, archive your access review evidence and decide whether to renegotiate or switch before your next audit window.

Key takeaways

• Workday signed a definitive agreement on 12 October 2026 to acquire C1.ai, formerly ConductorOne, and expects the deal to close by 31 January 2027.
• As of 18 October 2026, neither Workday nor C1 has announced what happens to the C1 brand, pricing, hosting or connectors for customers who do not use Workday.
• Workday co-founder and CEO Aneel Bhusri says Workday can work with other identity providers such as Microsoft or Okta, and calls the HR system the one source of truth for employees.
• C1 access review history is audit evidence, so a switch from C1 should archive past campaigns and overlap the first new campaign with the last C1 campaign.
• Access reviews support the SOC 2 logical access criteria CC6.1 to CC6.3 and the ISO/IEC 27001:2022 Annex A controls 5.15, 5.18 and 8.2.

What happened: Workday agreed to acquire C1

On 12 October 2026, Workday entered into a definitive agreement to acquire ConductorOne, Inc., the company that now operates as C1.ai, according to the Form 8-K filed by Workday with the SEC. Workday announced the deal the next day, 13 October 2026, at its Workday Rising event in Las Vegas.

According to the Workday press release of 13 October 2026, the transaction is expected to close in the fourth quarter of Workday's fiscal year 2027, which ends on 31 January 2027, subject to customary closing conditions. Workday did not disclose the price.

Workday frames the deal around AI agents. Its release describes C1.ai as "a leading agentic identity platform for people and agents" and states: "With C1.ai, Workday will become the identity governance layer for people, money, and agents." It also notes that the Workday Agent System of Record "already gives companies one place to see and manage their agents." Gerrit Kazmaier, Workday's president, product and technology, sums up the thesis: "Today's companies run on a combined workforce of people and AI agents." On systems outside Workday, the release stays general: it describes C1 governing access "across Workday and other enterprise systems", without a connector roadmap.

For a C1 customer, the gaps in the announcement matter more than the headline. Here is what is confirmed and what is not, based on the Workday release, the 8-K and C1's own release.

C1's pricing page now carries a banner announcing that C1.ai will join Workday, and it still publishes no list price. This article covers the acquisition and what to do about it. For C1's current pricing model, product coverage and the main alternatives, read our review: Is C1 right for mid-market IGA? Pricing, coverage and alternatives.

What changes for C1 customers?

Before closing, nothing has been announced that changes your service. After closing, the changes worth planning for fall into four areas: the role of Workday as the identity source, packaging and pricing, connector priorities, and support. The scenarios below are plausible outcomes to prepare for, not predictions.

Before the deal closes

In practice, until closing, C1 still operates on its own and your current agreement still governs price, support and service levels. The deal is not certain either: Workday's forward-looking statements list regulatory approvals among the risks to completion. The useful work in this period is administrative. Find your renewal date, read the clauses listed below, and get written answers from your account manager before your notice deadline.

After the deal closes

• Workday as the identity source. In an interview with diginomica on 14 October 2026, Workday co-founder and CEO Aneel Bhusri said: "There'll only be one source of truth, and that will always be the HR system for employees." He added that the Agent System of Record plays that role for agents. For a company on Workday HCM, that is the point of the deal. For a company on another HRIS, the open question is how C1 will treat a non-Workday HR system as the source for joiners, movers and leavers.
• Other identity providers. In the same diginomica interview, Bhusri said: "We can work with other IDPs, whether it's Microsoft or Okta." Our reading: that reassurance covers identity providers, not HR systems other than Workday.
• Packaging and pricing. One plausible scenario is that C1 is sold inside Workday bundles or contracts. Nothing has been announced, which is exactly why price protection belongs in your next renewal.
• Connector roadmap. Engineering priorities may shift toward Workday-centered use cases. If your access reviews depend on specific connectors, ask for a written commitment on each one.
• Support and account management. Contacts, escalation paths and support tools can change when teams merge. Check what your SLA guarantees until the end of your current term.

Agent governance matters whatever tools you use. Our AI agent governance framework covers the access controls that apply to agents independently of any vendor.

Should you stay, renegotiate or switch?

"What are my options now?" is the question C1 customers are already asking in identity management forums. The answer depends on four facts about your company: whether you run Workday HCM, when your next audit is, when your C1 renewal falls, and whether you need more than identity governance. Use the table to find your starting point.

None of these options is wrong by default. A company standardized on Workday HCM may get more value from C1 after closing, not less. The risk sits with companies whose HR data lives elsewhere and whose next audit falls inside the integration period.

What to check in your C1 contract

Read eight clauses before you decide, and get every answer in writing. This is a practical checklist, not legal advice: have your legal team review the actual wording of your agreement.

• Change of control. Does the contract give you a right to terminate or renegotiate if C1 changes ownership? Question to ask your account manager: "Does the Workday acquisition trigger any change of control right on our side, and from which date?"
• Renewal and notice period. Check the auto-renewal date and the notice deadline. Question to ask: "What are our exact renewal date and notice deadline, and can we extend the current term on the same terms?"
• Price protection. Look for a cap on increases at renewal. Question to ask: "Will you cap price increases for our next renewal in writing, whatever the packaging after closing?"
• Export of data and campaign history. Your access review history is evidence, not just product data. Question to ask: "Can we export the full history of our access review campaigns, with decisions, reviewers, timestamps and justifications, in a format our auditor accepts, and at what cost?"
• DPA and subprocessors. An acquisition can add new subprocessors. Question to ask: "Will Workday entities become subprocessors after closing, and how will you notify us?"
• Data location. Confirm where your tenant is hosted today. Question to ask: "In which region is our tenant hosted, and is that region guaranteed after closing?"
• SLA. Check uptime and support commitments. Question to ask: "Do our SLA and support channels stay unchanged until the end of our current term?"
• Non-Workday connectors. List the connectors your reviews and provisioning depend on. Question to ask: "Will you commit in writing to maintaining the connectors we use, including our HRIS if it is not Workday?"

How to move access reviews and certification campaigns without an audit gap (SOC 2, ISO 27001)

Treat your C1 campaign history as audit evidence, not as product data. Archive it for the whole audit period, never stop a campaign halfway, overlap the first campaign in the new tool with the last one in C1, and tell your auditor about the change before it happens.

An access certification campaign is a scheduled review in which app owners or managers confirm or revoke each user's access. The record of who approved what, when and why is the evidence an auditor looks at. A tool change is a moment when that record can break.

1. Export and archive past campaigns for the full audit period

Export every campaign that falls inside your current audit period, plus the previous one for context. For each campaign, keep:

• the scope and dates of the campaign, and the apps it covered;
• each decision (keep, revoke, modify) and the account it applied to;
• the identity of each reviewer and the timestamp of each decision;
• the justification or comment attached to each decision;
• the proof of remediation for each revocation, such as a ticket or a deprovisioning log.

Store the export read-only in your evidence repository, and check that it opens and reads correctly without access to C1.

2. Never cut a campaign in progress

A campaign stopped halfway leaves decisions without remediation and accounts without a reviewer. Finish or formally close any running campaign in C1, export it, then switch.

3. Overlap the first new campaign with the last C1 campaign

Launch the first campaign in the new tool before the last C1 campaign ends. The overlap shows that reviews never stopped, and it lets you compare scopes app by app before you stop paying for C1. See how automated access reviews work in Corma.

[VISUAL 1 : schéma de chevauchement des campagnes d'access review, dernière campagne C1 et première campagne dans le nouvel outil, fourni par Nikolai]

4. Document the switch as a change to a control

Write a short change record: what changes, on which dates, who owns each step, where the archived evidence lives and how continuity is ensured. Share it with your auditor before the switch, not during fieldwork. Your auditor decides what evidence is sufficient, so agree the plan with them first.

5. Map the controls your access reviews support

• SOC 2. The AICPA Trust Services Criteria group logical access under criteria CC6.1 to CC6.3. Their points of focus include reviewing the appropriateness of access credentials (CC6.2) and of access roles and rules (CC6.3) on a periodic basis.
• ISO 27001. ISO/IEC 27001:2022 lists in Annex A the controls 5.15 (access control), 5.18 (access rights) and 8.2 (privileged access rights).

For campaign cadence and evidence on the ISO side, our user access reviews roadmap for ISO 27001 goes into detail.

Planning a switch before your next audit? Book a Corma demo to plan an overlapping first campaign before your C1 renewal date.

Migration checklist: how to switch from C1 without a gap

Run the switch in six phases, and keep C1 live until the last one. Start the inventory at least one campaign cycle before your C1 renewal date.

1. Inventory. List the connected apps, roles and entitlements, access policies, access request workflows, joiner, mover and leaver (JML) automations, and the owner and reviewers of each app.
2. Export. Export the campaign evidence described above, plus your configuration: app list, policies, approval chains and campaign schedules.
3. Connect. Connect the new platform to your identity provider and your HRIS, then rebuild your provisioning and onboarding rules for joiners, movers and leavers.
4. Parallel run. Run the first access review campaign in the new tool while C1 still holds the previous one, and compare the scope app by app. Our guide to user access review software lists what to test at this stage.
5. Cutover. Move access requests and JML to the new platform on a set date, and announce it to reviewers and app owners.
6. Decommission. Revoke the API tokens and service accounts C1 used in each connected app, confirm data deletion under your DPA, and keep the archived evidence for your retention period.

Why Corma for C1 customers

Corma is a SaaS Management and IAM platform, founded in Paris in 2023, built for mid-market companies rather than as a large-enterprise IGA suite. It runs access reviews, provisioning, deprovisioning and JML in the same platform as SaaS spend and license management, with native connectors to Google Workspace, Microsoft Entra ID, Okta and JumpCloud.

• Compliance. Corma is ISO/IEC 27001:2022 certified, and customer data is hosted in the EU on all plans.
• Recognition. Corma is recognized in the Gartner® Magic Quadrant™ for SaaS Management Platforms in 2025 and 2026.
• Speed. A full rollout typically takes less than a month.
• Scope. Identity governance and administration and SaaS Management share one inventory of apps and users.
• Pricing. A free plan covers up to 10 integrations, and the Essential plan starts at €3 per user per month on an annual commitment (see Corma pricing).

[VISUAL 2 : capture de l'écran access reviews dans Corma, fournie par Nikolai]

Method: C1 facts checked on 18 October 2026 on C1's pricing page and in the Workday and C1 announcements; Corma facts from Corma's pricing page and company information.

If you run Workday HCM and C1 works for you, this table is not a reason to move. It matters if your HR data lives outside Workday, if you need EU hosting, or if you want SaaS Management and identity governance in one tool.

Frequently asked questions

Is C1 being shut down?

No shutdown has been announced. Workday says that with C1.ai it will become the identity governance layer for people, money and agents. The deal is expected to close by 31 January 2027, and Workday has not detailed product changes for existing C1 customers.

When does the Workday acquisition of C1 close?

Workday expects the deal to close in the fourth quarter of its fiscal year 2027, which ends on 31 January 2027. Closing is subject to customary conditions. The agreement was signed on 12 October 2026 and announced on 13 October 2026.

Do I need Workday to keep using C1?

Nothing has been announced either way as of 18 October 2026. Workday CEO Aneel Bhusri said Workday can work with other identity providers such as Microsoft or Okta, but neither company has said how C1 will support HR systems other than Workday after closing.

Will switching tools affect my SOC 2 or ISO 27001 audit?

It does not have to. Archive every C1 campaign in your audit period, never stop a campaign halfway, overlap the first campaign in the new tool with the last C1 one, and agree the plan with your auditor before the switch.

Can I export my access review history from C1?

Ask your account manager in writing before your notice deadline. Request the full history of each campaign: decisions, reviewers, timestamps, justifications and remediation, in a format your auditor accepts. Check your contract for export terms and costs.

Will C1 prices change after the acquisition?

Workday and C1 have not announced pricing changes. C1 publishes no list price on its pricing page, so the protection you have is in your contract. Ask for a written cap on increases at your next renewal.

What are the best ConductorOne alternatives for mid-market companies?

For 100 to 2,000 employees, shortlist tools that cover access reviews, provisioning and JML, connect to your identity provider and HRIS, and publish pricing. Corma combines these with SaaS Management. Our guide to the best IGA solutions for mid-market companies compares the main options.

Conclusion

Workday's agreement to acquire C1 does not change your service today, but it opens a decision window that closes with your next renewal or your next audit, whichever comes first. If you run Workday HCM, stay and protect your price. If you don't, get written answers on your contract, archive your campaign evidence, and plan an overlapping first campaign in your next tool. To see how that first campaign would run in Corma, request a demo.