An AI moat is what survives when your rival uses your model

AI moat: An AI moat is the part of an AI product's advantage that still stands when a competitor builds the same thing on the same model — usually proprietary data, embedded workflow, or distribution.

Where the term came from, and when

Warren Buffett spent decades describing good businesses as economic castles protected by wide moats, and the phrase runs through the Berkshire Hathaway shareholder letters archived on Berkshire's own site. It meant one thing: a structural reason margins don't get competed away.

It got attached to AI in two steps. February 2020 — before ChatGPT, before anyone was paying per token at scale — a16z published an analysis of AI company economics arguing that AI businesses carry heavier variable costs and weaker defensibility than classic SaaS. First serious attempt to ask where an AI company's moat actually sits.

Then May 2023. SemiAnalysis published a leaked internal Google document titled "We Have No Moat, And Neither Does OpenAI," arguing open models were closing the quality gap fast enough that model quality alone would not hold. That memo is why founders started using the phrase in pitch meetings. The anxiety it named is the right one.

What an AI moat is not

The term people most often swap it with is data network effect. They are not the same thing. A data network effect is a mechanism: usage by customer N makes the product measurably better for customer N+1. A moat is the outcome. Most products claiming a data network effect have a data pile — more rows, no compounding improvement, and nothing stopping a competitor buying comparable rows.

Three other things get called moats and aren't. Model quality is the most common: a lead you have to re-win at every frontier release is a lead, not a moat, and its half-life is the release cadence of the labs. First-mover advantage buys you the time to build a moat, which is not the same as being one. And prompt and pipeline engineering — if it fits in a repo a competitor could rewrite in six weeks, it's a feature.

The two senses, labelled

Most conversations about this go wrong in the first minute, because people use "AI moat" for two unrelated things.

	Sense A: product moat	Sense B: operating moat
Question it answers	Why can't a competitor clone what we sell?	Why can't a competitor match our cost to serve?
Where it shows up	Churn, win rate, pricing power	Gross margin, headcount per dollar of revenue
Built from	Proprietary data, workflow lock-in, distribution, regulated access	Agents doing work humans used to do, cheaper inference, owned infrastructure
Fails when	A rival with the same API wins your deal	A rival adopts the same tooling next quarter

I'm publicly building a zero-human company, which is squarely Sense B, so let me say plainly what that is and isn't. An operating moat is a margin advantage. Margin advantages show up in your P&L, not in your retention. They are also the easier of the two to copy, because most of the tooling is public and the rest is on GitHub by Christmas. What's hard to copy is the accumulated judgement about which work an agent can be trusted with, and that only exists if you've paid for the failures. More on that split in what actually changed for founders.

Label which one you mean before you argue about it.

The swap test, drawn

Worked example: Copilot swapped the model and kept the seats

GitHub Copilot shipped in 2021 on OpenAI's Codex. For three years the pitch sounded like a model story.

On 29 October 2024 GitHub announced model choice inside Copilot: developers could select Anthropic's Claude 3.5 Sonnet or Google's Gemini 1.5 Pro alongside OpenAI models. That's a business event, not a feature launch. GitHub handed users the ability to route their work to a competitor's model, inside a product sold at per-seat prices on the Copilot plans page, and did not lose the customer.

That is the swap test passing. The model was interchangeable — proven, by GitHub, in public. What wasn't interchangeable: the editor cursor, the repository the code lives in, the pull request flow, the enterprise seat already on the invoice, and the admin who approved it. Distribution and workflow were the moat. The model was a supplier.

Now the data side. BloombergGPT, published March 2023, was a 50-billion-parameter model trained on 363 billion tokens from Bloomberg's own financial archives plus 345 billion public tokens. The 50B parameters were the commodity part. The 363 billion tokens of licensed, decades-deep, contractually locked data were the part nobody could reproduce by calling an API.

Four tests for whether yours qualifies

Swap test. Give a competitor your exact model, your exact prompts, your exact architecture. What advantage is left? If the answer takes more than one sentence, write the sentence down anyway — that's your moat statement.
Purchase test. Can the input be bought? Licensable data is not proprietary data. If a vendor will sell your competitor the same feed, the feed isn't a moat for either of you.
Decay test. What is the half-life? Anything that resets when a lab ships a new checkpoint is a lead with an expiry date.
Friday test. If a customer cancelled today, what would they lose besides the subscription? Configuration, history, integrations, approvals, audit trail. If the honest answer is "nothing," there's no switching cost — and switching cost is where most real AI moats actually live. Owning your own inference and data path changes that answer; see what you actually control when you self-host.

Most AI products I look at fail the swap test in half a sentence. That isn't fatal. Features make money, and one capped, metered endpoint is a perfectly good business. It just isn't a moat, and calling it one is how founders end up raising against a number they can't defend in year two.