The Board Room

Deep dives

1. 01

   The Platform Mediation Decision: Microsoft, Google, and Qualcomm Are Betting Your Lock-in Lives in Different Layers

   Three Moves, One Week, Three Different Lock-in Theories

   Microsoft, Google, and OpenAI all shipped capabilities this week that reclassify AI from individual assistant to autonomous organizational actor. The convergence is not coincidence. It is customer pull. The more useful observation is that each vendor has placed the durable moat in a different layer of the stack, and the architecture decisions made this quarter determine which bet a buyer is implicitly making.

   The decision this quarter is not whether to use AI assistants. It is whether the governance model for AI that acts on the organization's behalf gets designed deliberately or assembled by accident.

   Microsoft: Lock-in at the Workflow Layer

   Copilot Skills is not a feature. It is the moment Copilot becomes the substrate other software plugs into. When a finance team encodes its performance methodology as a named Skill, that institutional IP lives inside Microsoft's platform in no portable format. The switching cost compounds quietly for 12 to 18 months before anyone notices it on a renewal line. Microsoft already owns identity, permissions, and seat-level distribution. Those are the parts competitors must build from scratch.

   Google: Commoditizing the Agent Framework

   Gemini 3.5 Flash's native computer use cuts the opposite direction. When screen interaction is a model-native capability requiring no additional setup, the orchestration scaffolding a dozen startups spent 18 months building becomes a free feature. Good news for buyers. Existential news for anyone whose moat was a wrapper. The standalone agent infrastructure category just had its ceiling lowered.

   Qualcomm: Abstraction Attacks Silicon Lock-in

   The $3.9B Modular acquisition is Qualcomm's attempt to rewrite data center economics. A reasonable skeptic would point out that silicon-agnostic compute has been promised before and has not arrived. The reasonable skeptic is correct. The reason to take this attempt seriously anyway is that if the abstraction works at production scale, NVIDIA's pricing power erodes by more than 40 percent, because that pricing power depends on switching costs the abstraction is designed to dissolve. None of this materializes in 2026. The 2028 and 2029 infrastructure contracts should be written with the optionality in mind.

   ---

   The Strategic Frame

   These are not competing products. They are competing theories of where value accrues in the AI stack. Microsoft bets on workflow mediation. Google bets on model capability making middleware irrelevant. Qualcomm bets on hardware abstraction breaking the infrastructure premium. Buyers who choose deliberately will set switching costs in their own favor. Buyers who let procurement defaults decide will discover the cost in 18 months.

   What to do

   1. →

      Audit where Copilot Skills adoption is encoding critical workflows into Microsoft's ecosystem — map every custom Skill created by end of Q3

      This sprintSwitching costs compound silently for 12-18 months; you need visibility before the next EA renewal
   2. →

      Reassess investments in standalone agent infrastructure (internal builds or vendor contracts) against native model capabilities by August

      This sprintGoogle's native computer use commoditizes the layer — validate that any agent framework spend still has differentiated value
   3. →

      Write 2028-2029 infrastructure contracts with silicon-agnostic optionality clauses

      This quarterQualcomm/Modular won't ship production-ready in 2026, but locking into single-vendor silicon pricing now forfeits future leverage
2. 02

   The Reorganization Premium: Why 'Bolt-on AI' Is Structurally Underperforming and the Market Has Already Priced It

   A 515-Firm Study Settles the Definition

   A study of 515 high-growth startups tried to measure what 'AI-native' actually means in production. Firms given guidance to reorganize around the question 'what outcome does AI make newly possible?' rather than the question 'where can we plug AI in?' produced results that are not subtle:

   • 44% more AI use cases discovered
   • 2x revenue at the top decile
   • 40% less capital consumed

   The useful analogy is electrification. Factories that won were the ones redesigned around electric drive, not the ones that bolted a motor onto the spot where the steam engine used to sit. Most enterprise AI programs are the second kind.

   The Market Has Already Rendered Judgment

   Accenture's compression from 30x to 6x free cash flow is not an Accenture-specific story. A reasonable skeptic would call it a multiples correction in a single name, and the skeptic would be partly right, but the more complete reading is that the consulting-led implementation model is structurally mismatched to what AI adoption actually requires. The work is deep organizational redesign, and consultants rarely deliver redesigns that threaten the client's existing power structure. If the transformation is consultant-led, the market is already pricing in that it will underperform.

   The Minimum Viable Organization Has Shifted

   Stripe reports solopreneurs earning $5M+ tripled between 2023 and 2025. YC AI startups from batches W20-F24 run smaller and flatter than their non-AI peers. The next competitor entering an existing market is less likely to be a 200-person startup and more likely to be a five-person team producing comparable output on a fraction of the cost base. Where headcount functions as moat has narrowed.

   ---

   Two Questions That Look Like One

   The first question is whether software and product exposure is positioned for a capital rotation that may take three to seven years to play out. The second is whether the AI work itself is a genuine reorganization or a bolt-on. These look related and are not. A bolt-on strategy underperforms on both axes simultaneously, and the underperformance will not be visible until the comparison set has already pulled ahead. This quarter's framing decision sets next quarter's catch-up problem. The organizations that treat it as a this-quarter decision write the terms the rest spend two years trying to match.

   What to do

   1. →

      Identify 3-5 business outcomes where AI enables entirely new processes (not faster existing ones) and present to leadership by end of July

      This sprintThe 2x revenue gap accrues to firms that start from outcomes, not tools — the methodology from the 515-firm study is replicable
   2. →

      Benchmark your org structure against AI-native competitors in adjacent segments — headcount, output ratios, cost base — within 60 days

      This sprintFive-person teams producing comparable output means your cost structure is the vulnerability, not your technology choices
   3. →

      Terminate or restructure any consultant-led AI transformation engagement that isn't producing measurable org redesign (not just tool implementation) by Q3

      This quarterAccenture's 80% valuation compression signals market consensus that bolt-on consulting doesn't deliver structural change
3. 03

   AI Governance Is the Sleeper Strategic Decision of 2026 — Build It or Inherit It

   Three Vectors, One Conclusion

   The next eighteen months bring pressures arriving on the same audit cycle, which we have flagged separately over the past quarter. Taken in isolation, each is manageable. Taken together, they compound, because the audit cycle compresses three remediations into one budget. The calendar is not offering the option to take them in sequence.

   Vector 1: GDPR Meets AI (Sources Agree: This Is Accelerating)

   GDPR at ten years is entering enforcement maturation just as AI deployment accelerates. European regulators have said in plain language that the 'next test from AI' enforcement actions are coming. The framework was not designed for probabilistic systems. Enforcement is intensifying anyway. Building compliance-native AI costs 3-5x less than retrofitting it, and the window to choose which side of that ratio you sit on is closing.

   Vector 2: AI Agents Create an Accountability Gap

   A reasonable skeptic will call autonomous agents a security problem. That framing is incomplete. The harder question is an accountability problem: which named human signs the memo when the agent does something the company has to explain. The 2014-2015 cloud security parallel is the right reference. Capability shipped years before governance did, and the firms that defined the governance layer captured the value hyperscalers left on the table. Most enterprises today have no observability into what their agents actually do.

   Vector 3: Model Extraction Is Now Industrial-Scale

   Alibaba allegedly ran 25,000 fake accounts generating 28.8 million queries against Anthropic, in what is being described as industrial model extraction. The honest reading is a business-model tension, not a security incident. Serving the model via API is revenue. Protecting the model from extraction is the moat. Every API-exposed AI advantage now carries an expiration date determined by API security sophistication.

   ---

   FedRAMP 20x: The Compliance Standard Is Changing Beneath You

   FedRAMP's shift from narrative attestation to evidence-based verification means compliance infrastructure now has to produce demonstrable, auditable proof of control effectiveness. This is a multi-year platform investment, not a procurement line. Vendors that automate evidence collection will have meaningful advantage in regulated markets. GRC postures built on storytelling are about to discover what the new auditors actually read.

   The next FedRAMP audit cycle will separate vendors that treated governance as back-office cost from vendors that treated it as platform investment. The first group will spend the cycle explaining. The second group will spend it winning the contracts the first group is explaining away.

   What to do

   1. →

      Stand up an AI agent governance function by end of Q3 — define policies for agent access, autonomous action boundaries, and decision audit trails

      This quarterThe accountability gap fills either by your design or by the first eight-figure incident; Rubrik's Agent Cloud launch signals the category is forming now
   2. →

      Commission a gap analysis mapping every AI deployment touching EU data against GDPR + emerging AI Act requirements within 45 days

      This sprintEnforcement actions specifically targeting AI data practices are signaled; retrofit costs 3-5x more than compliance-native builds
   3. →

      Assess API-layer vulnerabilities to model extraction — rate-limiting adequacy, query pattern detection, and behavioral anomaly monitoring by August

      This sprint28.8M-query extraction proves this is no longer theoretical; your AI IP has an expiration date tied to your detection capabilities
   4. →

      Audit GRC processes for evidence-based defensibility vs. narrative compliance; begin platform investment planning for continuous proof generation

      This quarterFedRAMP 20x will reshape how governments and enterprises evaluate vendor posture — early movers gain regulated market advantage