Key takeaways
  • On 3 February 2026, a single legal plug-in erased roughly 16% from Thomson Reuters and 13–14% from RELX and Wolters Kluwer in one trading session — and within weeks Morningstar cut the economic moats of two of them from wide to narrow. The market was repricing the difference between a product and a moat.
  • Source code was never the durable asset. The honest test is the investor's test: if a competitor had your codebase tomorrow and it would sink you, it was the secrecy doing the work — and you had over-priced it. The code still has to exist and run; it just stopped being scarce. AI only made that visible.
  • Every software asset sorts onto two questions — where the advantage lives (in the code, or in the assets around it) and what it takes to recreate it (engineering, or time, data, capital and licences). That produces four kinds of asset, and only one of them is a durable moat.
  • The durable quadrant has a specific shape: data gravity (the system of record), distribution, switching cost and regulatory standing. These are precisely the assets AI's productivity gains cannot compress.
  • The map is really a flow. Crown jewels decay into commodity — fastest when a regulator rewrites the regime — and open strengths convert into moats. The strategic act is not protecting code; it is moving value across the map before it decays.

The day the market confused a product with a moat

On 3 February 2026, Anthropic released a set of legal plug-ins for its desktop AI product. The market reaction was brutal. In a single session, Thomson Reuters fell about 16%, RELX about 14%, and Wolters Kluwer about 13%. The headline wrote itself: AI had come for the legal-data incumbents.

Then a more interesting argument broke out.

Skeptics pushed back. These firms do not really sell software, they argued — they sell proprietary databases, decades of editorial curation, and a contractual promise to stand behind their answers. A general-purpose model offers none of that.

A month later, Morningstar weighed in. Its verdict cut deeper than the crash.

It did not call the moat dead. It cut the economic moats of Wolters Kluwer and Thomson Reuters from wide to narrow, and trimmed their expected life from twenty years to fifteen — while still calling the shares undervalued.

The message was not "the moat is gone." It was "the moat is shorter than we thought — and we are no longer sure what it is made of."

That is the question now facing every software vendor. What, exactly, is the moat, and how much of it was ever the software?

What a moat actually is

Even before LLMs, handing a rival Salesforce's source code would not have made them Salesforce. It would have made them the owner of some code.

They would still lack the customers, the data, the integrations, the brand, the install base. And they would lack the memory of why the code is shaped the way it is. The code was the visible artefact of the business — never the business itself.

What AI changes is the cost of producing that artefact. When that cost collapses, everyone has to face a question they could previously avoid: if the code was not the moat, what was?

The honest answer is uncomfortable. Model architectures are open. Reference implementations are free. The data usually belongs to the customer, or sits in the public domain. Technical differentiation, on its own, is hard to hold.

Two distinctions matter here. Blur them, and the death-of-IP panic feels far worse than it is.

The first: how the artefact gets produced versus what does the work once it runs. AI is transforming production, across every kind of software. It is not turning your runtime probabilistic.

The second distinction holds the line. Deterministic work stays on deterministic technology. A settlement engine, a ledger, an IFRS 9 calculation, a compliance control — each demands reproducibility and auditability. You do not want a model deciding a capital ratio. Nor does the regulator.

AI writes that code faster and cheaper. But it still runs the same way, and it still has to be correct. What genuinely moves onto AI is the interpretive layer: judgement over ambiguous inputs, drafting, triage, reasoning over messy data. That is the work deterministic code was always poor at — the work people did by hand.

AI changes how the artefact is built, not how the deterministic core runs. The production method moved to AI; the runtime did not.

So the panic misfires. The engineering did not lose its value — it lost its scarcity. The deterministic code that runs a bank is still necessary infrastructure. It simply stopped being expensive to reproduce.

What expired was a strategy: defensibility by obscurity. Not the work, and not the people who did it.

So the test is not "do we own the code." It is the question a sharp investor asks in diligence:

If a competitor woke up tomorrow owning this, would it actually hurt?

When the honest answer is "not much," the value never lived in the artefact. That is good news — the artefact is the one thing AI can now reproduce.

The question is the same in the CEO's chair and the CIO's; only the words change. The CEO asks what a rival could take. The CIO asks what a rival could rebuild.

Just two questions decide where any asset falls — and together they form the two axes of a map:

  • Where does the advantage live? Inside the code itself — or in the assets that accumulate around it (the data, the customers, the licences, the ecosystem)? This is the vertical axis.
  • What would it take to recreate it? Just engineering, which AI now supplies cheaply — or time, data, capital and regulatory approval, which it does not? This is the horizontal axis.

Together, those two questions are the framework. The first decides whether the value is even in the code; the second decides whether AI can rebuild it. Hold both in mind and every asset a software business owns sorts itself.

The four kinds of asset — a map

One clarification the rest of this piece leans on. IP is what you own — code, models, data. A moat is what keeps you hard to beat. Some IP is a moat; most is not; and the strongest moats — distribution, switching costs, a licence — are not IP at all. The map below sorts the assets a software business owns by how much moat each one actually buys.

Place every asset a software business owns onto those two axes and four categories fall out. They are not equally defensible, and most firms have historically guarded the wrong ones. Read the map as a CIO and it sorts what to build, buy, protect or open. Read it as a CEO and it sorts where to invest, divest and price.

A 2x2 map of where competitive advantage lives in enterprise software: open strengths and durable moat live in the assets around the code; exposed commodity and crown jewels live inside the code itself.
Where advantage actually lives in enterprise software. The vertical axis is where the advantage lives; the horizontal axis is what it takes to recreate it.
Quadrant Where the advantage lives What it takes to recreate What it means
Exposed commodity Inside the code Just engineering AI rebuilds it for free — stop guarding it
Crown jewels Inside the code Time, data, capital Real IP, but with a half-life
Durable moat In the assets around the code Time, data, capital, licences The only quadrant AI cannot reach
Open strengths In the assets around the code Just engineering Easy to copy — and copying feeds your moat

Exposed commodity

User interfaces · standard data models · CRUD applications · workflow scaffolding · standard integrations · KYC capture forms · onboarding journeys · reporting dashboards · the standard returns library · the generic loan-origination workflow.

The advantage here was always notionally "in the code." That code still has to be built, and still has to run — it is deterministic plumbing the business depends on. What changed is the cost: building it stopped being hard, so it stopped being scarce.

This is the quadrant that stings, because it is where a great deal of defensive energy went. That was not a blunder. When reproducing this code took a strong team years, guarding it was a rational bet — the right read of the technology of its time.

The schemas and workflow models some firms protected as trade secrets sit here now. The bet expired when reproduction got cheap. The engineering behind it did not.

The secrecy battle in this quadrant is already lost — the only mistake left is to keep paying to fight it.

Crown jewels

Proprietary models and engines that encode years of outcomes: credit-bureau scoring, underwriting and fraud models, the Basel and IFRS 9 risk engines carrying fifteen years of regulatory edge cases.

This is genuine IP. The advantage really does live inside the artefact, and a leak really would transfer it. That is exactly why it was protected by secrecy and law.

But this quadrant is treacherous. It is defensible only while the domain it encodes holds still. This is "decision-making software" — and as the companion piece on the Forward Deployed Engineer argues, decision-making software is in AI's path in a way systems of record are not.

Be precise about what is at risk. The engine keeps running as deterministic, auditable code — regulators require nothing less. What AI lowers is a challenger's cost to re-implement that logic on clean, modern data. What a new accord does is strand your accumulated edge cases overnight.

The threat is cheaper reproduction and a moving regime. It is not a probabilistic model taking over a deterministic engine.

A crown jewel has a half-life — and the faster its domain changes, the shorter that half-life runs.

Durable moat

The only quadrant that survives a worst-case copy. Hand a competitor the entire codebase and they still cannot win, because the advantage was never in the code. It breaks into four distinct mechanisms, and conflating them is a common error:

  • Data-gravity moat. How much of an organisation's data already flows through your software — in other words, how deeply embedded you are. The clearest example is core banking: Finacle, Temenos, the system of record holding every account and transaction. What stops a bank leaving is not a licence; it is the risk of ripping that system out. Data gravity behaves like real gravity — imperceptible when small, overwhelming at scale.
  • Distribution moat. How many customers and partners trust your software to actually run their business: Salesforce, Shopify. AI compresses the cost of building the product; it does nothing to the cost of acquiring the users. As build cost falls toward zero, distribution becomes proportionally more of the moat, not less.
  • Switching-cost moat. How much overhead it creates to rip you out and move to something else: SAP, Oracle ERP. Once a system is wired into a hundred processes, replacing it is a multi-year project no one wants to start — and that reluctance is itself the moat.
  • Regulatory moat. Whether your software's life depends on licences or approvals from a third party: Google Pay, payment wallets, a banking charter. A moat made of capital, compliance and time — three things no model can collapse.

One honest caveat. A platform is only as defensible as the gravity it has actually banked. An empty platform is just unprotected code — racing to accumulate gravity before someone else does.

A platform is not a moat. It is a machine for manufacturing one.

Open strengths

Published API conventions, open-sourced SDKs, documentation, developer experience. Google open-sourced Android and gave it away — and made it the default mobile platform. Then it harvested the ecosystem on top: Play, search, ads.

Stripe did the same with its API. It was copied endlessly — and every copy made Stripe's design the pattern developers reach for first. Easy to imitate, and the imitation strengthens you rather than drains you.

The strategic error is treating these as crown jewels and guarding them. The strategic move is the opposite: you trade secrecy you could not have kept anyway for the ecosystem gravity that becomes a switching cost. Open-source the framework, monetise the platform. Publish the API, own the network.

Open strengths are the cheapest on-ramp you have to the durable quadrant.

The map is really a flow

A static 2×2 is where most framework articles stop. It is also where they are weakest. The interesting thing is not which box an asset sits in today — it is the direction it is moving. Assets migrate across this map, and they migrate predictably.

Crown jewels decay into exposed commodity. The decay is slow while the domain is stable, and abrupt when the regime changes.

Those fifteen years of Basel edge cases are an asset in a stable regime — and a liability the moment a new accord lands. Your code is calcified around the old world; a challenger builds clean on the new data, with no legacy to carry. The Morningstar downgrade was this decay caught in the open.

Open strengths convert into durable moats. This is the one migration a firm controls deliberately. The published API becomes the integration standard; the standard accretes an ecosystem; the ecosystem becomes a switching cost. The giveaway in the top-left becomes the gravity in the top-right.

So the framework is a set of vectors, not a filing cabinet. The job is not to defend a box — it is to move value up and to the right, into the quadrant AI cannot reach, before the regime change that would strand it.

What this means — for the CEO and the CIO

For a CEO recalibrating where capital goes and a CIO recalibrating where the architecture is defensible, the framework reduces to three uncomfortable questions.

How to use the map: stop guarding the bottom-left, treat crown jewels as decaying assets, migrate value to the top-right, and use open strengths as the on-ramp.
How to use the map. Your data, distribution and standing would obviously hurt to lose — so the test that does real work is narrower: if a competitor had your source code tomorrow, would it actually hurt?
  • For every asset you guard today: if a competitor had it tomorrow, would it actually hurt? If the answer is no, you are spending real budget defending an exposed commodity. Stop. (CEO read: stop funding it. CIO read: stop hiding it — open it if it helps.)
  • Where does your value sit today, and is it decaying? If most of it is crown jewels, you are one regime change from a repricing. What is the plan to move it up and to the right — into data gravity, distribution, switching cost and regulatory standing — before that change lands?
  • Are you treating domain know-how as a moat or as a service? Know-how is a service business until it is institutionalised into proprietary data, customer relationships and switching cost. A brilliant team that can be hired away is not a moat. The same expertise, wired into a data flywheel, is.

A vendor whose honest answer is "losing the code would end us" has not yet built a moat. A vendor who would be largely fine has already built one somewhere more durable. That — not the code — is the asset to compound.

In closing

The enterprise software industry treated source-code secrecy as the moat for two decades. It was always a proxy — a way to avoid the harder question of what actually held a customer in place. AI removes the proxy and forces the question into the open.

None of this makes the engineering worth less. The deterministic core still has to be built, and still has to run correctly. What it makes worthless is keeping that core secret.

  • When the code is cheap to reproduce, secrecy stops being a strategy.
  • When a model encodes a regime that regulators rewrite, the crown jewel has a half-life.
  • When build cost falls toward zero, distribution, data gravity and regulatory standing become proportionally more of the moat, not less.
  • When know-how can be hired away, it is a service business until it is institutionalised into assets.

The firms that mourn the death of software IP have misread the obituary. The IP they mean is the code — and the code is cheap to reproduce now. But defensibility is not dying. It is moving — out of the artefact and into the ground around it.

The companies that win the next cycle will not be the ones with the best-guarded code. They will be the ones that knew which of their assets AI could reach, and moved everything that mattered onto the ground it could not.

References

Wekalp · Article Back to top