When we evaluate software moats, we almost always ask the same question: will customers stick around? Most diligence still stress-tests against competitors, not against the platforms the company is built on top of. But the emerging threat to European software companies is not about customer relationships or competitive dynamics. It is about whether the infrastructure layer (the NVIDIAs, Stripes, and OpenAIs) can perform the same function. By the time that threat shows up in your retention numbers, the damage is already done.

In March, all three independently built ways to reach the end user directly, skipping the application layer entirely. NVIDIA launched an agent platform for enterprise workflows. Stripe built a protocol for AI agents to handle purchasing and payments autonomously. OpenAI built agent capabilities into its core product. Previously, this required rebuilding the application feature by feature. AI changes the calculus. An agent does not need to copy your features. It just needs to do your job.

This creates a risk that does not have a good name yet: being commoditised in place. It does not look like disruption. The company does not lose customers. The contract stays, the logo stays on the slide. What disappears is pricing power. The customer’s team stops opening the platform and starts asking an AI agent for the same outputs. Everything the dashboard tracks says the company is healthy. The reality is that the company is being repriced.

The early warning is not churn. It is customers renewing but resisting pricing, shrinking seat counts, or passing on upsells. At the extreme, when the customer’s data already lives in a cloud data lake that Salesforce’s Agentforce can read directly, the application does not just lose pricing power. It stops being necessary at all. That is not commoditisation. That is category collapse.

Evaluating European software deals from New York, I have watched this dynamic hit differently in Europe. Europe’s software ecosystem is built on companies that go deep into specific industries: logistics, healthcare, manufacturing compliance, legal. That specialisation is usually a strength, but not all depth protects equally against the infrastructure layer. Two recent regulatory shifts, both positive, have an unintended side effect. The EU Data Act, in force since September 2025, gives customers the right to leave SaaS contracts with two months’ notice. The EU–INC proposal published last month makes it easier to incorporate and operate across all 27 member states. Both strengthen Europe’s single market. But both also reduce the friction protecting companies whose lock-in was contractual rather than structural.

Wolters Kluwer sits on decades of jurisdiction-specific legal content that it owns outright. A law firm cannot point an AI agent at its own files and get the same output. When Wolters Kluwer adds AI, as it is doing with its Libra workspace across nine European markets, every new feature makes the proprietary content more useful. AI strengthens the company.

Now take a European spend management platform with strong retention and real domain knowledge. The core job is operational, not regulatory. The Data Act has weakened its contractual lock-in. And the data it works with (invoices, vendor records, payment histories) does not belong to the software company. It sits inside whatever platform the customer already runs its business on: SAP, Microsoft, Oracle. Those platforms can build an AI agent directly on top of data they already hold and absorb the spend management function. The software layer on top becomes optional. Same technology. Opposite result.

Three questions separate these two outcomes in diligence. First: could the infrastructure vendor build the same data advantage just by running its own platform, or did the company’s data take years of domain-specific work to accumulate? Second: does the customer use the application directly, or are they starting to access it through an AI agent that sits on top? Third: if you gave a good AI team access to the customer’s own data but not the company’s proprietary assets, could they replicate the output?

Here is how those questions map onto outcomes:

The question that gets to the heart of it: does the AI you are adding deepen your moat, or does it teach your landlord to do your job?

These positions are not fixed. The EU Data Act is pushing companies from structural toward contractual protection. Direct data access is pushing some from contractual toward nonexistent. Where a company sits today matters. Where it is heading matters more.

Some portion of European software portfolios are already mispriced on this basis. Retention numbers look fine, but retention cannot tell you whether the infrastructure layer is learning to do what your portfolio company does. Think of it as relative moat evaluation: testing every claimed moat not just against competitors, but against the infrastructure layer beneath it. The firms that start running this test now will see the repricing coming and will be able to take action. For the ones that do not, by the time they realise, it might be too late.

Alessia Russo is a technology investor at Insight Partners, a $90B global software investment firm, based in New York City. Originally from Turin, Italy, she holds a dual degree from Columbia University and Sciences Po. She focuses on structured equity investments in growth-stage software and technology companies across the US and Europe.