AI in business: simply using it is not a strategy in itself

How is AI changing our own business?

The question “Are we already using AI?” can now be answered with “Yes” in most companies. Generative AI supports content creation, virtual assistants make it easier to access knowledge, and in software development, AI-powered tools are transforming established processes. But what does this “Yes” actually mean?

Mandl’s answer is an uncomfortable one – not much. There is a huge difference between the occasional use of an AI tool and a company that is prepared for the changes brought about by artificial intelligence. To highlight this, he distinguishes between two concepts that are regularly conflated in practice.

AI exposure and AI resilience: two concepts, not one

AI Exposure examines the vulnerability of the economic core: How closely does the core value for which customers pay align with what today’s AI systems are capable of? How resource-intensive would it be to replicate the range of services on offer? Are competitors or platforms currently changing the market’s pricing logic?

AI resilience describes the other side of the coin: protective measures that remain effective even under changing technical conditions – proprietary data, market access, switching costs, depth of integration, regulation. Added to this is the organisational capacity to reorient itself and the technical maturity to actually operate data-driven functions productively.

Crucially, Mandl deliberately chooses not to combine the two into a single metric. This is because doing so would obscure precisely the information that matters: a company can make extensive use of AI and still be highly exposed. And it can be robust without any visible AI functionality.

Four scenarios rather than a simple answer

This separate analysis yields four categories. High exposure with high resilience – companies that are undergoing change and are able to shape it. Low exposure with high resilience – the defended niche. High exposure with low resilience – the acute emergency. And low exposure with low resilience, which Mandl considers the most deceptive situation: the market appears calm today, but the ability to react is lacking when the pressure mounts.

How reliable is one’s own assessment?

A second point is important to him. Such a classification is not a precise measurement. His model therefore documents not only each assessment but also its robustness – how up-to-date, comprehensive and independent the underlying evidence is. And critical weaknesses are not offset by good figures elsewhere. Anyone wishing to draw strategic conclusions from an analysis should not only know where the company stands, but also how reliable that assessment is.

The question applies to us too

Mandl concludes his essay with an open question: When assessing software business models in future, will it be less important whether a company uses AI, and more important how vulnerable its core is – and what sustains it when the pressure mounts?

One should not ask this question without asking it of oneself first. As a company whose business is based on the development of bespoke software, we are not mere observers of this trend. We are a case in point for the model – and not one of the comfortable ones.

About the author

Prof. Dr Peter Mandl is a managing partner at evaltech. As a professor of distributed systems at Munich University of Applied Sciences, as well as the founder, former managing director and current shareholder of iSYS, he combines academic perspectives with many years’ experience in software engineering and entrepreneurship. At evaltech, his work focuses, amongst other things, on AI applications, software architectures and the technological evaluation of software systems.

Source and related article

Prof. Dr. Peter Mandl: „Nutzt das Unternehmen schon KI? Warum das die falsche Frage ist, wenn man Softwaregeschäftsmodelle bewerten will.“ evaltech.de, August 2026