Disrupted or supercharged? Mapping AI risks in Services andSoftware In this note, we propose a simple methodology to assess AI disruption risks for software andservices providers, based on our numerous conversations with corporate IT/business teamsand industry experts. Richard Nguyen+33 1 42 13 54 22 Mark L. Moerdler, Ph.D.+1 917 344 8506 evaluate each segment’s and company’s position both independently by AI risk and incomparison with one another. However, this framework is relatively static at present, andneeds to be regularly updated, as it does not factor in each company’s continuous AI efforts(e.g. devoted R&D, number of data/AI experts, number of use cases already available/soon- Derric Marcon+33 1 58 98 06 30 Specialist Sales rather than coming from a single dataset, but they are grounded in widely observed AI impactpatterns across categories - where AI does core work versus where it only enhances it, andhow moats/switching costs behave in each. Kiran Shah+44 20 3547 1533 profile more favorable than many software peers, with a significant upside potential if theyexecute their respective AI roadmaps well. to AI disruption risks. Capgemini is relatively well-positioned (see Capgemini - An "AItransformer"), in our view. Furthermore, we are convinced that a rapid transition to AI-firstis crucial for services providers as they must rapidly reinvent their business model to fullycapitalize on the seismic shift toward Services-as-Software (IT Services: The irresistible rise BERNSTEIN TICKER TABLE We reiterate our ratings and price targets. Outperform: 74software (PT €53)Alten (PT €140)Arcadis (PT €52)Aubay (PT €65)Capgemini (PT €208)Dassault Systèmes (PT €29)Indra (PT €57)SAP (PT €273 / $322) Nemetschek (PT €132)Sage (PT 1,340p)Reply (PT €133)TeamViewer (PT €11) Atos (PT €45)CGI PT C$143) DETAILS ASSESSMENT OF AI DISRUPTION RISK FOR SOFTWARE PROVIDERS We propose here a simple methodology to assess AI disruption risks for software providers based on our numerous conversationswith software industry experts, services consultants, and corporate IT/business teams. While our methodology is far from perfect, we believe that it could nonetheless help position different software segments, andcompanies, relative to each other. Moreover, this assessment is theoretical and static as it does not consider each company’scontinuous AI efforts (e.g. R&D devoted, partnerships with leading AI providers, number of use cases/features already availableand planned, current internal usage, etc.). Automatability (i.e. ability to be automated) of core value: “How much of what this product does could reasonably be done by ageneral‑purposeor slightlyfine‑tunedmodel plus some glue?”. Low automatability means value depends on proprietarydata, complex workflows, and deep integration (difficult for generic AI models to fully replace). High automatability means valueis mostly created by processing public/standardized information and/or repeatable tasks that AI frontier models can easilyreplicate. defensibility means low switching cost, limited ecosystem, and weak lock-in/network effect. High defensibility means high switching costs, strong ecosystem, embedded enterprise workflows, and powerful brand/community. Client switching costis a substantial part of this dimension as it reflects migration complexity, retraining users,re‑implementingintegrations, andperceived risk of switching. data is even more valuable. In addition to the data itself is the semantic knowledge(also called the metadata or knowledgegraph) that defines the context of how the data relates to itself and the functions that the application will be performing.Without having the context and understanding the business processes any application (AI or non-AI) fails. The morecomplex the data, semantic knowledge, and a deep understanding of the business processes the more defensible is the from being replaced or even augmented with automated agents. For the weighting, one can explicitly score each software segment on a scale of 1 to 10 on automatability (A) and defensibility (D);and then compute a simple risk score. As a result, AI disruption risk score = Ax[1-(D/10)]. This is ahybrid quantitative–qualitativeframework: the numbers codify structured judgment rather than coming from a singledataset, but they are grounded in widely observed AI impact patterns across categories (where AI does the core work vs where itonly enhances it, and how moats/switching costs behave in each). EXHIBIT 1:Scoring methodology for AI disruption risk for software Score / rationale 1-3: little differentiation; easy to replace, few deep integrations, thin data moats4-6: some embedding and data, but alternatives are plentiful and switching is feasible7-10: deep workflow lock‑in, mission‑critical role, strong proprietary data, ecosystem, and high migration risk/cost Most of SAP’s business is tied to ERP, supply chain, and data platforms, which are deeply embedded systems of