Key takeaways
  • On 3 February 2026, a single legal plug-in erased roughly 16% from Thomson Reuters and 13–14% from RELX and Wolters Kluwer in one trading session — and within weeks Morningstar cut the economic moats of two of them from wide to narrow. The market was repricing the difference between a product and a moat.
  • Source code was never the durable asset. The honest test is the investor's test: if a competitor had your codebase tomorrow and it would sink you, the code was a liability you had not priced. AI just made that visible.
  • Every software asset sorts onto two questions — where the advantage lives (in the code, or in the assets around it) and what it takes to recreate it (engineering, or time, data, capital and licences). That produces four kinds of "IP," and only one of them is durable.
  • The durable quadrant has a specific shape: data gravity (the system of record), distribution and switching cost, and regulatory standing. These are precisely the assets AI's productivity gains cannot compress.
  • The map is really a flow. Crown jewels decay into commodity — fastest when a regulator rewrites the regime — and open strengths convert into moats. The strategic act is not protecting code; it is moving value across the map before it decays.

The day the market confused a product with a moat

On 3 February 2026, Anthropic released a set of legal plug-ins for its desktop AI product. The market reaction was brutal. In a single session, Thomson Reuters fell about 16%, RELX about 14%, and Wolters Kluwer about 13%. The headline wrote itself: AI had come for the legal-data incumbents.

Then a more interesting argument broke out.

Skeptics pushed back. These firms do not really sell software, they argued — they sell proprietary databases, decades of editorial curation, and a contractual promise to stand behind their answers. A general-purpose model offers none of that.

A month later, Morningstar weighed in, and its verdict cut deeper than the crash. It did not call the moat dead. It cut the economic moats of Wolters Kluwer and Thomson Reuters from wide to narrow, and shortened the period it expected those moats to last from twenty years to fifteen — while still calling the shares undervalued. The message was not "the moat is gone." It was "the moat is shorter than we thought, and we are no longer sure what it is made of."

That is the question now facing every software vendor. What, exactly, is the moat, and how much of it was ever the software?

What a moat actually is

Even before LLMs, handing a rival Salesforce's entire source code would not have made them Salesforce. It would have made them the owner of some code. They would still have lacked the customers, the accumulated data, the integrations, the brand, the install base, and the institutional memory of why the code is shaped the way it is. The code was the visible artefact of the business — never the business itself.

What AI changes is the cost of producing that artefact. When the cost of the visible thing collapses, everyone is forced to confront the question they could previously avoid: if the code was not the moat, what was? Model architectures are developed in the open, reference implementations are freely available, and the data an AI system runs on usually belongs to the customer or sits in the public domain. Technical differentiation, on its own, is hard to hold.

So the test is not "do we own the code." It is the question a sharp investor asks in diligence:

If a competitor woke up tomorrow owning this, would it actually hurt?

When the honest answer is "not much," the value never lived in the artefact — and that is good news, because the artefact is the one thing AI can now reproduce. It is the same question whether you sit in the CEO's chair or the CIO's; only the vocabulary differs. The CEO asks what a rival could take from us. The CIO asks what a rival could rebuild.

Just two questions decide where any asset falls — and together they form the two axes of a map:

  • Where does the advantage live? Inside the code itself — or in the assets that accumulate around it (the data, the customers, the licences, the ecosystem)? This is the vertical axis.
  • What would it take to recreate it? Just engineering, which AI now supplies cheaply — or time, data, capital and regulatory approval, which it does not? This is the horizontal axis.

Together, those two questions are the framework. The first decides whether the value is even in the code; the second decides whether AI can rebuild it. Hold both in mind and every asset a software business owns sorts itself.

The four kinds of "IP" — a map

Place every asset a software business owns onto those two axes and four categories fall out. They are not equally defensible, and most firms have historically guarded the wrong ones. Read the map as a CIO and it sorts what to build, buy, protect or open. Read it as a CEO and it sorts where to invest, divest and price.

A 2x2 map of where IP lives in enterprise software: open strengths and durable moat live in the assets around the code; exposed commodity and crown jewels live inside the code itself.
Where IP actually lives in enterprise software. The vertical axis is where the advantage lives; the horizontal axis is what it takes to recreate it.
Quadrant Where the advantage lives What it takes to recreate What it means
Exposed commodity Inside the code Just engineering AI rebuilds it for free — stop guarding it
Crown jewels Inside the code Time, data, capital Real IP, but with a half-life
Durable moat In the assets around the code Time, data, capital, licences The only quadrant AI cannot reach
Open strengths In the assets around the code Just engineering Easy to copy — and copying feeds your moat

Exposed commodity

User interfaces · standard data models · CRUD applications · workflow scaffolding · standard integrations · KYC capture forms · onboarding journeys · reporting dashboards · the standard returns library · the generic loan-origination workflow. The advantage was always notionally "in the code," but the code is now reproducible at near-zero cost.

This is the painful quadrant, because it is where most firms spent their defensive energy. The database schemas and workflow models that some product companies guarded as trade secrets sit here now.

The secrecy battle in this quadrant is already lost — the only mistake left is to keep paying to fight it.

Crown jewels

Proprietary models and engines that encode years of outcomes: credit-bureau scoring models, underwriting and fraud models, the Basel and IFRS 9 risk engines that carry fifteen years of accumulated regulatory edge cases. This is genuine IP. The advantage really does live inside the artefact, and a leak really would transfer it — which is exactly why it was protected by secrecy and law.

But notice the property that makes this quadrant treacherous: it is defensible only while the domain it encodes holds still. This is "decision-making software," and as the companion argument for the Forward Deployed Engineer model sets out, decision-making software is in AI's path in a way systems of record are not.

A crown jewel has a half-life — and in banking, as we will see, that half-life is unusually short.

Durable moat

The only quadrant that survives a worst-case copy. Hand a competitor the entire codebase and they still cannot win, because the advantage was never in the code. It breaks into three distinct mechanisms, and conflating them is a common error:

  • Data-gravity moat. Snowflake, Databricks — and, in banking, the core banking platform itself: Temenos, Finacle, Thought Machine, the system of record holding every account and transaction. What stops a bank leaving is not a licence; it is the migration risk of ripping out the system of record. Data gravity behaves like physical gravity — imperceptible in a small system, overwhelming at scale.
  • Distribution and switching-cost moat. Shopify's merchants, a payments platform's installed base. AI compresses the cost of building the product; it does nothing to the cost of acquiring the users. As build cost falls toward zero, distribution becomes proportionally more of the moat, not less.
  • Regulatory moat. A payments licence, a banking charter, the capital and compliance machinery behind them. A moat made of capital, compliance and time — three things no model can collapse.

One honest caveat belongs here, because a careful reader will raise it. A platform is only as defensible as the gravity it has actually banked; an empty platform is just unprotected code racing to accumulate gravity before someone else does.

A platform is not a moat. It is a machine for manufacturing one.

Open strengths

Published API conventions, open-sourced SDKs, documentation quality, developer experience. Google open-sourced Android and gave it away — and in doing so made it the default mobile platform, then harvested the ecosystem that sat on top: Play, search, ads. Stripe did the same with its API: copied endlessly, and every copy made Stripe's design the pattern developers reach for first. Easy to imitate, and the imitation strengthens rather than drains you.

The strategic error is treating these as crown jewels and guarding them. The strategic move is the opposite: you trade secrecy you could not have kept anyway for the ecosystem gravity that becomes a switching cost. Open-source the framework, monetise the platform. Publish the API, own the network.

Open strengths are the cheapest on-ramp you have to the durable quadrant.

The map is really a flow

A static 2×2 is where most framework articles stop. It is also where they are weakest, because the interesting behaviour is not which box an asset sits in today — it is the direction it is moving. Assets migrate across this map, and they migrate in predictable directions.

Crown jewels decay into exposed commodity. The decay is slow while the domain is stable and abrupt when the regime changes. The fifteen years of Basel edge cases encoded in a risk engine are an asset in a stable regime and a liability the moment a new accord lands — your code is calcified around the old world while a challenger builds clean on the new data, with no legacy to carry. The Morningstar downgrade was exactly this decay caught in the open: a data-and-curation asset losing half-life in public markets.

Open strengths convert into durable moats. This is the one migration a firm controls deliberately. The published API becomes the integration standard; the standard accretes an ecosystem; the ecosystem becomes a switching cost. The giveaway in the top-left becomes the gravity in the top-right.

So the framework is a set of vectors, not a filing cabinet. The job is not to defend a box — it is to move value up and to the right, into the quadrant AI cannot reach, before the regime change that would strand it.

What this means — for the CEO and the CIO

For a CEO recalibrating where capital goes and a CIO recalibrating where the architecture is defensible, the framework reduces to three uncomfortable questions.

How to use the map: stop guarding the bottom-left, treat crown jewels as decaying assets, migrate value to the top-right, and use open strengths as the on-ramp.
How to use the map. Your data, distribution and standing would obviously hurt to lose — so the test that does real work is narrower: if a competitor had your source code tomorrow, would it actually hurt?
  • For every asset you guard today: if a competitor had it tomorrow, would it actually hurt? If the answer is no, you are spending real budget defending an exposed commodity. Stop. (CEO read: stop funding it. CIO read: stop hiding it — open it if it helps.)
  • Where does your value sit today, and is it decaying? If most of it is crown jewels, you are one regime change from a repricing. What is the plan to move it up and to the right — into data gravity, distribution and regulatory standing — before that change lands?
  • Are you treating domain know-how as a moat or as a service? Know-how is a service business until it is institutionalised into proprietary data, customer relationships and switching cost. A brilliant team that can be hired away is not a moat. The same expertise, wired into a data flywheel, is.

A vendor whose honest answer to the first question is "losing the code would end us" has not yet built a moat. A vendor who would be largely fine has already built one somewhere more durable — and that, not the code, is the asset to compound.

In closing

The enterprise software industry treated source-code secrecy as the moat for two decades. It was always a proxy — a way to avoid confronting the harder question of what actually held a customer in place. AI removes the proxy and forces the question into the open.

  • When the code is cheap to reproduce, secrecy stops being a strategy.
  • When a model encodes a regime that regulators rewrite, the crown jewel has a half-life.
  • When build cost falls toward zero, distribution, data gravity and regulatory standing become proportionally more of the moat, not less.
  • When know-how can be hired away, it is a service business until it is institutionalised into assets.

The firms that mourn the death of software IP have misread the obituary. IP is not dying; it is moving — out of the artefact and into the ground around it.

The companies that win the next cycle will not be the ones with the best-guarded code. They will be the ones that knew which of their assets AI could reach, and moved everything that mattered onto the ground it could not.

References

Wekalp · Article Back to top