Software is more than code.
The strongest moats in software aren't built from algorithms or data structures. They're built from regulatory licenses, money movement capabilities, insurance relationships, and tax system integrations. These are the real-world complexities that foundation models cannot replicate.
The Regulatory Maze
Consider what it takes to operate a payroll and HR system at scale. You need financial and money-transmission licenses in 50 states, plus Canada, the UK, the EU, and Australia. Each of these took years of legal work and advocacy.
You need to be licensed to sell insurance, as a PEO, as a reseller, as a travel agent, and more. These aren't software problems—they're regulatory problems. They require understanding complex legal frameworks, building relationships with regulators, and maintaining compliance across jurisdictions.
I suspect it will be a long time before LLMs can secure this type of regulatory licensing, if they ever will be able to do so. These are human problems that require human relationships, legal expertise, and years of work.
The Rippling Example
This is why Rippling is exciting. They've built a system that collides with a lot of "real world atoms"—and they've solved the hard problems that go beyond code.
You need to move money. You need to issue credit cards and ship them to people. You need reseller relationships that let you ship computers from Apple and Dell. You need to enroll people in health insurance. You need to be wired into the IRS' systems for tax filings, payments, and W2s.
These problems go beyond code and software. First, you need to understand the real world in ways that make building software difficult—because it needs to account for this messy reality. But also, you need a level of connectivity with the real world that requires much more than just software to recreate.
Rippling has done all of this. They've secured the licenses, built the relationships, and integrated with the real-world systems. That's a moat that cannot be replicated by writing better code or training a better model.
The Stripe Example
Stripe is another example of a company with real-world moats that go far beyond code. To process payments, you need to be a licensed money transmitter in every state where you operate. You need relationships with banks, card networks, and financial institutions. You need to handle chargebacks, disputes, and fraud detection.
Stripe spent years building these relationships and securing these licenses. They understand the regulatory landscape, the compliance requirements, and the operational complexities of moving money at scale. This isn't something you can replicate with a better algorithm or a larger model.
The same applies to their international expansion. Each country has different regulations, different payment methods, different banking systems. Stripe had to build relationships and secure licenses in each one. That's a real-world moat that goes beyond code.
The Epic Example
Epic demonstrates real-world moats that are even more complex. To build electronic health records and hospital management systems, Epic needed HIPAA compliance, which required years of security audits, privacy controls, and regulatory certifications. They needed to integrate with hundreds of different medical devices, lab systems, and pharmacy networks, each with their own protocols and standards.
Epic built relationships with hospital systems, insurance companies, and state medical boards. They learned medical coding, billing regulations that vary by state, and the complex workflows of different medical specialties. When their software touches medical devices, they need FDA approval. When they handle prescription data, they need to comply with DEA regulations.
Epic spent decades building these relationships, securing these certifications, and understanding these regulations. A foundation model company couldn't replicate this—they'd need to navigate the same regulatory maze, build the same relationships, and earn the same trust. That's a moat that takes years, not months, to build.
The Nature of These Moats
These real-world moats have a few key characteristics that make them durable:
They require time: Regulatory licenses don't happen overnight. They require years of legal work, relationship building, and compliance maintenance.
They require relationships: You can't automate your way into a relationship with a regulator, an insurance company, or a bank. These are human relationships that require trust and credibility.
They require domain expertise: Understanding tax law, insurance regulations, and financial compliance isn't something you can learn from a textbook. It requires deep domain knowledge built over years.
They require operational excellence: When you're moving money or handling payroll, mistakes are costly. You need operational processes, monitoring, and escalation paths that have been refined over years.
Why Foundation Models Can't Replicate This
Foundation models are incredible at many things, but they can't secure regulatory licenses. They can't build relationships with regulators. They can't handle the operational complexity of moving money at scale or processing payroll for thousands of companies.
These are problems that require more than intelligence—they require institutional knowledge, regulatory relationships, and operational capabilities that have been built over years. A foundation model company would have to start from scratch and spend years building what companies like Rippling and Stripe have already built.
And by the time they did, the software companies would have moved even further ahead, building more integrations, securing more licenses, and deepening their relationships with the real-world systems they depend on.
The Competitive Advantage
Software companies that operate in regulated spaces or deal with real-world complexity have moats that foundation models cannot easily cross. These moats aren't built from code—they're built from years of regulatory work, relationship building, and operational excellence.
As AI makes it easier to build software, these real-world moats become even more valuable. They're the things that cannot be automated away, cannot be replicated by training a better model, and cannot be built overnight. They're the durable advantages that will matter most in the AI era.