McKinsey’s QuantumBlack team published From AI table stakes to AI advantage: Building competitive moats with a thesis that cuts against a year of AI-procurement instinct. Buying the best model, the report argues, is now table stakes. It is necessary to stay in the game and insufficient to win it, because the same models are available to every competitor on roughly equal terms.

The economic stakes are real. McKinsey finds that companies that genuinely rewire around AI improve EBITDA by 10 to 30 percent, with an average near 20 percent. But the firms capturing that value are not the ones with a marginally better model. They are the ones who have built something around the model that rivals cannot quickly reproduce. McKinsey names three such moats.

10–30%
EBITDA improvement at rewired companies
~20% on average
~$2B
realized AI returns reported by JPMorgan Chase
trust as a moat
4 yrs
JPMorgan ranked #1 on the Evident AI Banking Index
consecutive
~60%
widening of the leader–laggard gap in recent years
velocity compounds

The three moats

McKinsey’s moats are worth stating plainly, because each has a precise engineering counterpart.

  • Trust. In finance, healthcare, and identity, trust gates adoption. The example is JPMorgan Chase, ranked first on the Evident AI Banking Index four years running and publicly reporting AI returns approaching $2 billion. Trust is slow to build and hard to copy, which is exactly what makes it a moat.
  • Proprietary data. Amazon’s advantage is data generated inside a closed loop — search behavior, product views, purchases, fulfillment, ad response — signals competitors cannot replicate because they do not have the ecosystem that produces them.
  • Organizational velocity. The ability to reimagine end-to-end workflows and ship through small, cross-functional teams on reusable platforms. McKinsey notes the gap between leaders and laggards has widened by roughly 60 percent in recent years. Velocity is not a one-time gain; it compounds.

The unifying point: the model is rented; the moat is owned. Anything you can buy off a shared API is, by definition, also available to everyone who can buy it. The advantage lives in the assets you generate and control.

Now run the same argument on the engineering org

Every software team building with AI is making the table-stakes purchase right now. They are adopting Claude, GPT, Gemini, or all three. That adoption is necessary. It is also not a differentiator, for precisely McKinsey’s reason: the team across the street is adopting the same models on the same terms.

So where is the engineering moat? It is not in the generation. Generation is the commoditizing layer. It is in the decisions that shape the generation — the architecture your team has chosen, the patterns it standardizes on, the constraints it refuses to violate — and, critically, in whether those decisions are enforced or merely hoped for. McKinsey’s three moats map onto that layer almost one to one.

McKinsey’s moats, translated to AI-assisted engineering
01
Proprietary data → Decision memory
Your accumulated architectural decisions are data generated inside a closed loop: your engineering history. They are absent from every public training set. Made retrievable and enforceable, they steer generation in a direction no competitor’s model can reproduce — the exact shape of McKinsey’s proprietary-data moat.
02
Organizational velocity → Velocity without drift
AI velocity is easy to get and easy to squander, because speed without constraint produces architectural drift that you pay for later. Governance is what lets a team move fast and stay coherent — velocity that compounds instead of accruing as debt. That is the difference between leading and laggard McKinsey is measuring.
03
Trust → Deterministic enforcement and provenance
In regulated domains, you cannot trust output you cannot account for. Deterministic enforcement plus enforcement provenance — every verdict traceable to a recorded decision — turns agent output into something auditable and defensible. That is how the engineering layer earns the trust moat McKinsey locates at the business layer.

Why this is not a documentation problem

A natural reaction is that teams already hold their architectural decisions — in ADRs, wikis, a CLAUDE.md, the heads of senior engineers. If the decisions exist, isn’t the moat already there?

No, and the reason is the same one McKinsey gives about models. A moat is not an asset you possess; it is an asset that actively produces advantage your competitors cannot copy. Decisions that sit in a document the agent reads inconsistently produce nothing reliably. They are advisory. The model weighs them against its training-set defaults and, under context pressure, the defaults often win. An ADR that is not enforced is closer to a press release than a moat: it states an intention without changing what gets built.

Decisions as documentation
An asset you possess
ADRs, wikis, prose conventions. Read inconsistently, applied probabilistically, overridden by model defaults under load. Possessed but not productive. Not a moat.
Decisions as governance
An asset that produces advantage
Typed, retrieved by relevance, enforced before generation, traceable after. The decision shapes every generation deterministically. Owned, productive, and unavailable to anyone running the same model. A moat.

The distinction matters because it is the whole McKinsey thesis restated. The model is the part everyone has. Decision memory you merely store is the part everyone roughly has too — every team has some docs. Decision memory you enforce is the part that is yours alone, because it is produced by your history and applied to your generation in a way no competitor can clone by buying the same tools.

The stack view

It helps to place this on the layers a software team actually controls.

Layer
Moat status
Frontier model
Table stakes — rented, shared, converging
Prompts and harness
Replicable — copied within a release cycle
Documentation of decisions
Possessed but inert — not enforced, not productive
Enforced decision memory
The moat — owned, compounding, uncopyable by tooling

Everything above the accent row is available to your competitors. The bottom row is the only one that is structurally yours. It is generated by your engineering history, it gets stronger every time your team makes and records a decision, and it cannot be acquired by signing the same vendor contracts you signed.

The model is the part of your stack a competitor can buy on Monday. The governed decision layer is the part it would take them your entire history to reproduce.
The McKinsey moat thesis, applied to the engineering stack

What McKinsey’s thesis asks of engineering leaders

If the report is right that advantage has moved from the model to the moat, the implication for an engineering organization is concrete:

  • Stop treating model choice as strategy. Pick a capable model, then spend your strategic attention on the layer above it. The model is a procurement decision, not a competitive one.
  • Turn decisions into a productive asset. A decision that is only documented is possessed, not productive. Make it retrievable and enforce it so it shapes what gets generated.
  • Treat enforced decision memory as proprietary data. It is the closed-loop, uncopyable input McKinsey describes — build it deliberately and compound it.
  • Buy velocity that does not decay. Speed that accrues as architectural drift is borrowed, not earned. Governance is what makes the velocity gain durable.

McKinsey wrote the report for executives weighing AI investment at the level of the enterprise. The argument survives translation to the level of the codebase without losing a single joint. The frontier model is table stakes. The advantage is the architecture you can prove you enforced — the one asset in the stack that your history produced and your competitor’s budget cannot.