What's Actually a Moat in AI — and What Just Looks Like a Moat

The question every investor asks in the second meeting

"What's your moat?" By 2026 it's the only question that matters in AI. Every founder has an answer. Most of them are wrong.

This guide is a field manual for telling the difference. By the end you should be able to read a Series B deck, listen to a CEO on a podcast, or look at your own product, and know whether the defensibility is real or a press release.

What a moat actually is, briefly

Warren Buffett borrowed the metaphor from medieval castles in the 1990s. A moat — a structural advantage that lets a company keep abnormal profits for years — is what stops competitors from copying you the moment you become interesting. Not "we got there first." Not "our product is better." Something the second mover physically cannot replicate, or can only replicate at a cost that wrecks their unit economics.

The classic five: network effects (Visa, Facebook), economies of scale (Amazon logistics), switching costs (SAP, Bloomberg), brand (Hermès, Coca-Cola), and intangible assets like patents or licences (Pfizer, FCC spectrum auctions).

AI in 2026 has new variants of all five, plus three counterfeits that everyone keeps confusing for the real thing.

The four moats that aren't

Model size. In 2020, when GPT-3's 175 billion parameters were a freak of nature only OpenAI possessed, raw scale looked like a moat. By July 2024 Meta released Llama 3 405B with open weights. Through 2025 DeepSeek and Alibaba's Qwen showed you could match GPT-4 class performance with a fraction of the training compute and ship the weights free on Hugging Face. Frontier capability is now a six-month lead, not a decade. The model is not the moat — it's the input cost. (If that part is fuzzy, our explainer on what a foundation model actually is covers the basics.)

The "AI-first" wrapper. A chat interface plugged into the OpenAI API is not a company; it's a feature waiting to be cloned. The ChatPDF-style products of 2023 — upload a doc, ask questions — were obliterated the moment ChatGPT shipped its own file upload, then again when Claude shipped Projects. If your entire product can be rebuilt by a competitor in a weekend, the only thing protecting you is that nobody has noticed yet.

"AI-first" as positioning. Saying you're an AI-first company in 2026 is like saying you were an internet-first company in 2002. It described a real shift; it stopped being a moat the moment everyone else figured out how to get online. Branding follows defensibility, it doesn't create it.

Proprietary prompts and "secret sauce" finetunes. A finetune — taking a base model and training it a little further on your own data — sounds proprietary, looks proprietary on a pitch deck, and depreciates to zero the day the next base model ships, which is roughly every nine months. Prompts leak the day you launch. Andrej Karpathy has been saying this since 2023 and almost everyone in the demo circuit has politely ignored him.

The four moats that actually hold

Data nobody else can legally or physically recreate. Bloomberg has 40 years of structured financial messages, every chat transcript ever sent on its terminal, and licences with every major exchange. You cannot Common-Crawl your way into that corpus. Same logic for Tesla's fleet video, UnitedHealth's claims data, Epic's clinical records, Stripe's payments graph. The model is generic; the training corpus is the asset. A foundation lab can match your model in six months. They cannot match your data.

Distribution at scale. Microsoft did not invent the best LLM in 2023; it took a stake in OpenAI and shoved Copilot into roughly 400 million Microsoft 365 commercial seats. Google did the same with Gemini in Workspace. Apple did it with Apple Intelligence on more than a billion active iPhones. The user is already there, the credit card is on file, the IT department has approved the vendor. You are competing for attention against a default. The distribution channel is the moat — the model riding on it is interchangeable.

Regulatory capture and licences. Sounds dirty, is durable. The EU AI Act, GDPR, HIPAA, the FDA process for medical devices, FedRAMP High and ITAR for defence — every regulation looks like a tax to a startup and like a moat to whoever already passed audit. A medical-AI vendor with a 510(k) clearance is, by definition, the only one allowed to market that exact claim. The certifications take three years and millions of dollars. That cost is the moat.

Deep workflow integration. SAP, Salesforce, Epic, AutoCAD — these companies have charged customers more for less for thirty years. Not because the software is great. Because three thousand of your employees know the keystrokes, your accounting team has wired its month-end close into the API, and ripping it out costs a year of consulting fees and somebody's career. AI bolted onto an entrenched workflow inherits that lock-in. AI as a standalone workflow has to build it from scratch, slowly, against incumbents already doing the same.

The case worth thinking hardest about

The most underestimated moat in AI right now is the boring one: your customer's habits. When Notion shipped Notion AI in 2023, it did not have a better model than ChatGPT. It had your last three years of meeting notes, project briefs, and team wiki — which made its summaries useful in a way no general chatbot could match. Same story with Salesforce Einstein, GitHub Copilot, Adobe Firefly, Figma AI. Each one is a mediocre model wrapped around an excellent context the user has already paid years to build.

This is where the question gets sharp. Is the moat the AI feature, or the underlying tool? The honest answer is the underlying tool. The AI is a value-add that lets the incumbent raise its tax, not the asset that defends it. But — and this is the part most pundits miss — the AI feature does compound the moat. Every prompt the user runs against their own Notion data trains them on a workflow that exists nowhere else. Switching to a competitor means losing not just the notes, but the muscle memory of asking the notes anything.

This is why Marc Andreessen and Benedict Evans have been arguing since 2024 that the safer AI bet is not the foundation lab but the application layer that already owns the user's data and behaviour. The foundation model is rented. The customer relationship is owned.

Why most pure-AI startups will quietly die

Here is the uncomfortable arithmetic. By some estimates well over $200 billion has flowed into AI-native startups since 2023. Most of them sell a workflow that a foundation model could absorb in its next major release. Jasper, the AI-copywriting unicorn valued at $1.5B in October 2022, was effectively zeroed by ChatGPT in three months. Inflection AI, valued at around $4B in mid-2023, was effectively acqui-hired into Microsoft a year later. Character.ai followed a similar arc into Google in 2024. The pattern is consistent: the product was real, the users were real, the moat was a feature roadmap that the foundation lab eventually shipped for free.

The test is brutally simple. Take any AI product and ask: if GPT-6 ships tomorrow with the exact capability you sell, what's left? If the answer is "our brand" or "our UX" or "our prompt engineering" — you do not have a business, you have a runway. If the answer is "the seventeen years of customer call logs my SaaS has indexed", or "the 40,000 hospitals running our EHR", or "the FDA clearance" — you have something the next model cannot eat.

What this means for you

If you are building: pick a fight where the model is the input, not the product. Sell into a vertical with proprietary data locked behind contracts (legal, healthcare, defence, industrial). Or sit on top of a workflow your customer cannot replace without a year of pain. Do not build a thin layer on the OpenAI API and tell yourself the prompts are the moat. They are not, and you have known that since you read this paragraph.

If you are investing: ignore the model demo. Ask three questions. What data do they have that the next foundation model cannot scrape? What distribution channel are they riding, and would they survive losing it? What does it cost their customer to leave them in eighteen months? If the founder cannot answer all three concretely, the round is a bet on the next exit window, not on a business.

If you are reading this as a citizen, not a builder: when a CEO calls their model "industry-leading", translate as "this quarter." When they say "proprietary AI", ask "proprietary what — weights, data, or marketing?" The interesting companies in 2026 are not the ones with the loudest model claims. They are the ones whose customers would be in genuine trouble if they disappeared tomorrow. Track the latter.

Ask Gradient

For any company you are sizing up, the moat question is rarely answered honestly in the press release. Ask Gradient — our retrieval-augmented (RAG) search over Gradient.news's full archive of AI coverage — can pull together the data deals, regulatory filings, customer churn signals, and infrastructure dependencies we have reported on a given lab or startup. Try a question like: "What proprietary data and distribution channels does Anthropic actually have in 2026, versus OpenAI?" The picture you get back tends to look very different from the marketing.