The Economics of AI Agent Access: Who Controls the Next Digital Transaction?
For years, digital businesses have paid to attract customers through search engines, advertising platforms and online marketplaces. Once a potential buyer arrived, the merchant could present its products, manage the checkout process and develop a direct commercial relationship. But a new intermediary is entering this model: the AI agent, capable of researching products, comparing offers and potentially initiating transactions on behalf of consumers. The rise of agentic commerce introduces a fundamental economic question. If customers increasingly rely on AI assistants to decide where and what to buy, who controls the transaction—and who captures the value it creates? Retailers may gain access to new audiences, but they could also face new distribution costs, platform dependencies and reduced visibility into customer behavior. Meanwhile, publishers and digital service providers are beginning to explore whether automated access to their content and infrastructure should become a paid service. By October 2026, developments from Google, OpenAI and Cloudflare have made AI agent access economics a concrete business discussion rather than a distant possibility. New commerce protocols, merchant integrations and experimental content-licensing models suggest that the next stage of digital business may depend on more than attracting website traffic. Companies must understand how AI intermediaries could redistribute revenues, operating costs, bargaining power and control over the customer relationship. AI Agent Access Economics: From Website Traffic to Transaction Control The traditional internet economy relies heavily on intermediaries. Search engines organize information and direct users toward websites. Advertising platforms sell access to audiences. Marketplaces connect sellers with buyers and often charge fees for the transactions they facilitate. These models differ, but they share a basic commercial principle: an intermediary creates value by making discovery, distribution or purchasing more efficient. AI agents introduce another possible layer. Instead of visiting several retailers, a customer may ask an assistant to compare options and identify the most suitable offer. The assistant could gather information, evaluate alternatives, interact with participating merchants and potentially help complete a purchase. The economic significance lies in the assistant’s position between the buyer and the seller. A merchant may still provide the product, manage inventory and fulfill the order. Yet an external AI platform could influence which merchant is selected, how the offer is presented and which transaction route the customer follows. This raises three distinct questions: Who controls access to the customer? Who receives payment for facilitating the transaction? Who retains the commercial relationship after the purchase? These questions do not have universal answers. Different companies are experimenting with different technical and commercial arrangements. However, the decisions being made now could shape the bargaining position of retailers, publishers and digital platforms. Why the AI Agent Could Become a New Digital Gatekeeper A gatekeeper does not necessarily manufacture products or provide the underlying service. Its power comes from controlling an important point of access. Online marketplaces illustrate this principle. Sellers may benefit from a platform’s established customer base, payment infrastructure and reputation. In exchange, they accept specific participation rules and, depending on the platform, transaction fees or other commercial charges. AI-mediated commerce could introduce a related form of dependency. A customer may increasingly rely on an assistant to identify suitable products before visiting any merchant. In that situation, the AI platform influences the selection process even if the final payment occurs elsewhere. Control Over Discovery Can Create Economic Leverage Consider two retailers offering comparable products. The first attracts customers through its own website and existing customer relationships. The second relies heavily on referrals from a major AI shopping assistant. If the AI platform changes its integration requirements, recommendation mechanisms or commercial policies, the second retailer may experience greater disruption. The risk resembles platform dependency, but the mechanism is different. The AI intermediary may influence the customer’s choice before a conventional referral or marketplace transaction occurs. A retailer could therefore become commercially dependent on a platform that does not directly process most of its sales. This dependence may be difficult to measure because part of the buying journey takes place outside the retailer’s analytics environment. The broader problem has already been examined in Market Insiders “Discovery Risk: What Businesses Lose When Customer Research Moves Outside Their Website”. That analysis focuses on the loss of visibility into early customer research. Agentic commerce extends the question into the transaction itself: what happens when the intermediary that influences discovery also participates in how the purchase is completed? Gatekeeping Does Not Automatically Mean Monopoly It would be premature to conclude that one AI company will control the entire market for automated shopping. Consumers may use different assistants, retailers may support several integrations and businesses may continue attracting customers through their own channels. The degree of market power will depend on adoption, switching costs, commercial agreements and the ability of merchants to reach consumers through alternative services. Nevertheless, the possibility of intermediary concentration deserves attention. A company that controls an influential shopping interface could eventually acquire bargaining power over participating merchants, even without owning their inventories or physical distribution networks. Google’s Universal Commerce Protocol: Who Controls the Checkout? One of the most significant developments in 2026 came from Google. On January 11, the company introduced the Universal Commerce Protocol (UCP), an open-source standard developed with participation from retailers and technology partners. According to Google’s official technical explanation, the protocol establishes common mechanisms through which AI-powered consumer interfaces, merchants and payment providers can communicate. Its purpose is to support commerce activities such as product discovery, checkout and related services through standardized integrations. From an economic perspective, the important question is not simply whether the protocol makes transactions easier. It is how responsibilities and commercial relationships are distributed among the participating companies. The Merchant of Record Remains Important Google’s merchant documentation states that participating retailers remain the seller of record within the relevant UCP-powered checkout experience. This means the merchant continues to hold the commercial role associated with selling the product, even when the customer initiates the purchasing process through Google’s interface. Under Google’s implementation, eligible users can complete checkout through supported Google Pay flows. The
The Repair Economy: How Product Longevity Is Changing Business Models
For decades, one of the most familiar assumptions in business has been that growth depends on selling more products. Companies manufacture goods, customers purchase them, and revenue is generated when ownership changes hands. Once a product becomes outdated, damaged or no longer desirable, a replacement creates another opportunity for a sale. But what happens when consumers begin keeping products for longer, repairing what they already own and questioning the need for constant replacement? The answer is more complicated than a simple decline in demand. Longer product lifespans can challenge traditional sales models, but they can also create opportunities in maintenance, refurbishment, resale, spare parts and subscription-based services. Instead of generating value only when a new product is sold, businesses may be able to earn revenue throughout its useful life and, in some cases, through multiple ownership cycles. This emerging repair economy is changing how companies think about growth, profitability and customer relationships. From manufacturers recovering valuable components to retailers entering second-hand markets, product longevity is becoming part of a broader economic discussion. The central question is no longer whether repair and reuse can coexist with commerce, but under which conditions businesses can make them financially sustainable. Why Longer Product Lifespans Challenge Traditional Business Models The conventional business model for many consumer goods relies on a continuous flow of new purchases. Manufacturers invest in product development, production and distribution, while retailers generate revenue through sales volumes and margins. Replacement demand plays an important role in maintaining that cycle. When a customer purchases a new smartphone, household appliance or piece of furniture to replace an older item, the transaction creates revenue across several businesses. Manufacturers, distributors, retailers and logistics providers may all participate in the sale. Extending the lifespan of the original product can postpone that replacement and potentially reduce the frequency of future purchases. For businesses dependent on high sales volumes, this creates an apparent conflict between product durability and revenue growth. Yet the relationship is not necessarily a zero-sum equation. A company that earns money exclusively from selling new products may view longer replacement cycles as a commercial risk. Another company that also sells maintenance services, replacement components, refurbished products or extended support may see a longer ownership period as an opportunity to generate additional value. The distinction lies in how the business model is structured. The Ellen MacArthur Foundation, in its 2025 analysis of circular business models, describes how companies can generate revenue through activities that keep products and materials in use, including repair, rental, resale and refurbishment. These approaches differ from the conventional model of producing and selling a succession of new goods. They seek to recover more economic value from products that have already been manufactured. However, the potential is not unlimited. The European Environment Agency’s 2026 briefing on scaling circular business models stresses that such approaches remain relatively niche in many sectors, despite growing regulatory support and commercial interest. The economic transition is therefore far from complete. Businesses must still determine whether extending product lifespans can produce sufficient revenue and margins to justify the additional complexity. From One-Time Sales to Revenue Throughout the Product Lifecycle A traditional product sale concentrates much of a company’s revenue at the point of purchase. After-sales activities may exist, but they are often treated as secondary services or costs associated with warranty obligations. The repair economy encourages a different approach. Instead of viewing the initial sale as the main economic event, businesses can examine the entire period during which a product remains useful. That period may include maintenance, component replacement, technical upgrades, professional servicing, resale and eventual recovery of valuable materials. Each stage creates a potential commercial interaction. For example, a company selling industrial equipment might generate revenue from the original machine and subsequently from maintenance contracts, spare parts, upgrades and remanufactured components. An electronics company might sell a device and later provide paid battery replacement, professional repairs or certified refurbished units. In these circumstances, extending the product’s usable life can support a longer commercial relationship. This does not mean every additional service will be profitable. Maintenance involves labour, inventory, logistics and customer support. Warranty obligations may also create expenses without additional service revenue. What changes is the business question. Rather than asking exclusively how frequently customers can be persuaded to replace their products, companies begin examining how much value can be created during the ownership period. The result may be a shift from transaction-based revenue toward a combination of product sales and ongoing services. For businesses able to manage those services efficiently, this can create additional revenue streams and reduce dependence on frequent replacement purchases. Repair and Maintenance as Recurring Revenue Opportunities Repair services are often associated with unexpected product failures, but maintenance can also be organised as a predictable commercial offering. This distinction is important. An individual repair generates revenue when a problem occurs. A maintenance contract, by contrast, may establish recurring payments for inspections, servicing, preventive work and ongoing technical support. These arrangements are already familiar in sectors such as industrial machinery, commercial equipment and building infrastructure. For customers, the attraction is often greater predictability. Instead of facing uncertain expenses whenever equipment breaks down, they can agree to a service arrangement with defined responsibilities and costs. For providers, recurring contracts can support revenue visibility and more predictable demand for technicians, replacement components and service capacity. However, recurring revenue should not be confused with guaranteed profitability. A poorly priced maintenance contract can become expensive if equipment fails more frequently than expected. Providers may also face rising labour costs, shortages of spare parts or obligations that extend beyond their original cost assumptions. Successful maintenance businesses therefore depend on understanding the relationship between service pricing, equipment reliability and expected operating expenses. The commercial opportunity becomes stronger when preventive maintenance reduces expensive failures and allows technicians to work more efficiently. Businesses that collect reliable information about product performance may also be better positioned to forecast demand for repairs and replacement components. Over time, these capabilities can transform after-sales support from a
When Customer Support Becomes Audio: The Hidden Cost of Voice Messages
A customer sends a two-minute voice message to a company’s support team. They explain a delivery problem, mention a previous conversation with another employee, describe what they expected to receive and ask whether the issue can be resolved before the weekend. For the customer, recording the message may have been considerably easier than typing a detailed explanation. They were able to speak naturally, include everything they considered important and continue with their day. For the business, however, receiving the message is only the beginning of the process. Someone needs to listen, understand the request, identify the relevant details and connect the recording to an existing customer record. If the case requires another department, the information must be transferred accurately. If the business uses automated transcription, the resulting text may need verification before anyone acts on it. This is the operational challenge behind voice messages in customer support. A communication format that feels simple and convenient to the sender can introduce additional work into a company’s service infrastructure. The issue is not whether audio messages are inherently inefficient. In some situations, they allow customers to explain complicated problems more effectively and reduce the need for repeated clarification. The real question is whether an organisation has developed processes capable of handling spoken information consistently. As voice messaging becomes part of business communication, companies need to look beyond the messaging interface and examine what happens after a recording arrives. Receiving an audio message is not the same as processing a customer request Businesses often evaluate new communication channels according to how easily customers can use them. A messaging application may already be familiar to the target audience, require little explanation and offer a convenient alternative to phone calls or contact forms. From a customer acquisition and accessibility perspective, these characteristics can be attractive. However, operational efficiency depends on a different set of factors. An incoming written message already contains information in a format that can be searched, copied into a customer record and reviewed by different employees. An audio recording requires an additional step before its contents become similarly accessible. Someone must listen to the message or use a transcription tool. The team then needs to distinguish the actual request from surrounding explanations and determine which details are essential. A customer might spend most of a recording explaining the background of a problem before mentioning the one piece of information that determines how it should be handled. Without a structured process, employees may need to listen several times or ask the customer to repeat information. The operational responsibility is therefore not simply to receive the recording. It is to transform an informal spoken explanation into a request that can be understood, assigned, resolved and documented. The hidden cost begins with employee attention The most obvious operational difference between written and recorded communication is the way information must be consumed. A support agent can often scan a written message, identify a familiar request and move directly to the appropriate workflow. Audio is sequential. Even when playback speed can be increased, the employee still needs to follow the recording closely enough to avoid missing important details. Listening is only one part of the workload. The employee may need to take notes, verify names or reference numbers, update the customer relationship management system and prepare a response. If the recording is unclear, background noise or interruptions can make the process more difficult. Consider two customers reporting the same problem. One writes that an item arrived damaged and provides an order number. The other sends a recording describing the purchase, delivery experience, condition of the product and earlier communication with the company. The second message may contain valuable context, but the support team still needs to identify the details required to resolve the claim. This additional processing becomes more significant when repeated across a large volume of requests. A few longer recordings may have little effect on a small team. Hundreds of recordings distributed throughout the day can influence staffing requirements, queue management and the time available for other customer interactions. The cost is not necessarily the length of the recording itself. It is the total employee effort required to convert that recording into a resolved case. Audio introduces another stage into the support workflow A well-organised customer support operation typically relies on a sequence of activities: receiving a request, identifying its subject, assigning responsibility, resolving the issue and recording the outcome. Written communication can pass through these stages with relatively little transformation. Voice messaging complicates the process because the information arrives in an unstructured format. The recording might contain several subjects, including a complaint, a request for information and a reference to an earlier transaction. Without adequate classification, the system may assign it to the wrong team or fail to recognise that multiple actions are required. For example, a customer might describe a billing error and then mention that they also want to change their subscription plan. If the first employee focuses exclusively on the billing issue, the second request could be overlooked. Businesses therefore need to decide how audio messages become structured support records. That may involve manual note-taking, automated transcription, categorisation or a combination of these approaches. The objective is not to force every customer to communicate in a rigid format. It is to ensure that the organisation can reliably identify what the customer needs. Transcription can reduce friction without eliminating verification Speech-to-text technology offers a practical response to the challenges of audio support. A transcript allows employees to scan a recording, search for relevant terms and transfer information into other systems more easily. It may also help colleagues review a case without listening to the original audio. But transcription is not the same as accurate understanding. Automatic speech recognition can struggle with names, addresses, product codes, specialised terminology and conversations involving several languages. Background sounds, poor recording quality and differences in pronunciation can create additional uncertainty. A single transcription error may have little significance in an ordinary conversation. In customer support, however,
Can I rent out my Golden Visa Property in Greece? Rules, limits and what investors get wrong
You bought a property in Athens. You have your Golden Visa. And now you’re wondering: can I rent this out while I’m not here? It’s one of the most common questions investors ask and one of the most misunderstood. The short answer is yes, you can rent out your Golden Visa property. But the rules have changed significantly since 2024, and getting them wrong carries a penalty that goes beyond a fine. It can cost you your residence permit. Here’s what you need to know. The rule that changed everything: no short-term rentals Before 2024, many investors bought Golden Visa properties with one eye on Airbnb. Athens was booming as a tourist destination, short-term yields were strong, and the numbers looked attractive on paper. That model is now off the table. Article 64 of Law 5100/2024 explicitly prohibits short-term letting of Golden Visa properties. This covers Airbnb, Booking.com, and any other platform or arrangement that falls within Greece’s statutory short-term rental framework — broadly, stays under 60 days. The penalty for violations is not a warning. It’s a €50,000 administrative fine and revocation of your residence permit. Both consequences at once. This is the rule that catches most investors off guard, especially those who did their research before 2024 and are working from outdated information. If your plan was built around short-term rental income, you need to rebuild it around a different model. Long-term rentals: fully permitted, and actually working Long-term letting — leases of 12 months or longer — remains fully legal for Golden Visa properties. And in practice, the Athens long-term rental market has absorbed the shift better than many expected. Of roughly 16,000 properties that non-EU nationals had acquired under the Golden Visa program by the end of 2024, nearly 15,000 moved into the long-term rental market. That’s not a slow transition — that’s almost the entire stock redirecting almost immediately. Why did it work? Because Athens has genuine long-term rental demand. Young professionals, international companies relocating staff, diplomatic personnel, students at international universities — the city has a large pool of tenants who want a quality apartment for a year or more. Supply in that segment was undersupplied before the short-term rental ban redirected so much inventory toward it. Long-term rental yields in Athens currently sit between 4% and 6% annually for well-located properties. That’s below the headline figures some investors were projecting with short-term letting, but it’s a stable, predictable return on a qualified asset — one that also serves as your EU residency qualifier. What counts as short-term and what doesn’t The legal definition matters here, and it’s more specific than you might think. In Greece, a stay of 60 days or longer is legally classified as a long-term lease. It falls under standard Greek lease law, requires no Airbnb-style registration, and sits outside the short-term rental regulatory regime entirely. So if you rent your property to someone for three months, six months, or twelve months, that’s a long-term lease — fully permitted, no issues. What’s banned is the sharing-economy model: nightly and weekly bookings through platforms, rolling short stays, the Airbnb playbook. That’s what Law 5100/2024 targets, and that’s what carries the €50,000 fine. There’s a separate layer worth knowing: since January 2025, new short-term rental registrations have been suspended in the three central districts of Athens. This applies to all properties, not just Golden Visa ones. It’s part of Greece’s broader response to the housing affordability pressure that short-term rentals created in the city center. Even if the Golden Visa restriction didn’t exist, you couldn’t register a new Airbnb-style listing in central Athens right now anyway. What about subleasing? The same law that bans short-term letting also prohibits subleasing of Golden Visa properties. You cannot rent to a tenant and have that tenant sublet to a third party. The property must be used by the tenant who signed the lease. This is a less common issue in practice, but it’s worth being aware of if you’re structuring a rental arrangement with a corporate tenant or an intermediary property manager. Any arrangement that creates a chain of occupancy between you and the actual resident falls outside what the law permits. The new Golden Visa category to watch In August 2026, the Greek government published its National Housing Strategy, which includes a proposed new Golden Visa category specifically linked to long-term rentals. Under this proposal, investors would be able to qualify for a Golden Visa through a portfolio of properties, not just a single property provided those properties are committed exclusively to long-term residential letting and kept off short-term rental platforms entirely. This is still at the legislative proposal stage as of October 2026 and has not been enacted. But it signals something important: the Greek government is actively designing the Golden Visa program around long-term rental use. If you’re investing now, you’re investing into the model the government is explicitly building toward. Three mistakes investors make The investors who run into problems tend to make one of three errors. The first is assuming old advice is still current. A lot of information circulating about Golden Visa rental rules predates the 2024 legislation. If someone told you before 2024 that you could use Airbnb for your Golden Visa property, that advice is no longer accurate. The second is confusing Golden Visa restrictions with general Greek property rules. The short-term rental ban applies specifically to properties acquired under the Golden Visa thresholds defined in Law 5100/2024. If you own a separate property in Greece purchased outside the Golden Visa framework, different rules may apply to that property. Don’t conflate the two. The third is choosing a property without thinking about long-term rental demand. Some investors buy purely to meet the investment threshold, without considering whether the property has a real tenant market. A property in a neighborhood with low long-term rental demand doesn’t become easier to let just because the short-term option is closed. Location and tenant profile matter as much in a long-term
Quishing Turns a Simple QR Code Into an Operational Risk
A QR code may be one of the smallest pieces of technology used in modern business operations, but the processes connected to it can be surprisingly important. Companies use QR codes for payments, employee access, event registration, visitor information, equipment management and customer services. They offer a convenient way to connect a physical object, printed document or workplace interaction with a digital system. That convenience also creates opportunities for deception. Quishing, or QR code phishing, involves using malicious QR codes to direct people toward fraudulent websites, credential-harvesting pages or other harmful interactions. What makes the threat particularly relevant to businesses is that a seemingly ordinary scan can move an employee or customer outside an organisation’s expected security controls. The business risk is therefore broader than someone opening a suspicious website. Depending on the circumstances, a compromised QR interaction can affect account security, payments, customer confidence and the continuity of everyday operations. The larger question is no longer simply whether employees know how to recognise phishing emails. It is whether businesses understand the risks created when ordinary operational processes begin depending on scannable links. Quishing brings phishing into a different environment Phishing is not a new problem for businesses. Organisations have spent years investing in email filtering, suspicious-link detection, employee training and authentication controls to reduce the likelihood of successful attacks. Quishing changes how that familiar threat reaches the user. Instead of placing an ordinary hyperlink inside a message, an attacker can embed a malicious destination in a QR code. The recipient scans the image with a smartphone and may be directed toward a website imitating a legitimate business application, payment service or authentication page. The UK’s National Cyber Security Centre has highlighted three reasons this approach can be attractive to criminals: QR codes obscure the destination, some email security tools do not examine QR images as thoroughly as ordinary links, and users may switch from a protected workplace computer to a personal smartphone. That final point is especially important for organisations. A phishing message may arrive inside a managed corporate environment, but the next interaction can happen on a device the company’s security team cannot fully monitor. The attack begins inside one security boundary and continues outside it. The move from work computer to personal phone creates a security gap Many organisations have reasonably mature security controls on company laptops. They may use endpoint detection, managed browsers, restricted downloads, network filtering and centralised monitoring. Employees may also access business applications through identity systems that record unusual login behaviour. A personal smartphone does not necessarily have the same protections. When a QR code displayed on a corporate computer is scanned with an unmanaged phone, the suspicious destination may open through a different browser, operating environment and security configuration. In January 2026, the FBI specifically warned about this technique, describing QR-based spearphishing campaigns that attempted to move targets from corporate endpoints to mobile devices before presenting fraudulent login pages. This does not mean personal smartphones are inherently insecure or that every QR scan bypasses enterprise protection. It means the organisation may have less visibility over an interaction that can still affect its corporate accounts and systems. That is an operational problem because the consequences can return to the business even when the initial interaction happens on a device it does not own. The real target may be a corporate identity Many quishing attacks are designed to obtain credentials rather than damage the phone itself. An employee might receive a message claiming that access to a company document requires verification. Instead of providing a familiar login link, the message presents a QR code that appears to lead to the organisation’s authentication service. After scanning, the employee reaches a convincing imitation of a familiar sign-in page and enters their credentials. The attack can then move from deception to unauthorised account access. The FBI’s January 2026 advisory described targeted campaigns associated with North Korean Kimsuky actors, including QR codes that directed recipients toward counterfeit authentication pages. The agency also warned that some operations may involve session-token theft, potentially allowing attackers to compromise cloud identities even when conventional multi-factor authentication is present. The significance for businesses is substantial. The initial incident may look like a single employee interacting with a suspicious code, but the resulting exposure can involve email accounts, cloud services, stored information or other systems accessible through that identity. The QR code is only the entry point. The business account behind it may be the actual target. The threat is not limited to ordinary phishing emails Quishing can also appear through documents and attachments that employees might otherwise consider routine. A PDF containing a registration form, event invitation or administrative notice can include a QR code that encourages the recipient to continue the process on a phone. That is relevant because businesses routinely exchange documents with suppliers, customers, contractors and external organisations. The ENISA Threat Landscape 2025 documented QR-based phishing activity associated with the Scanception campaign. Malicious QR codes embedded in PDF attachments were used to direct recipients toward credential-harvesting pages hosted through trusted cloud environments, with targets including users in the EU. This illustrates how malicious interactions can be wrapped inside familiar document workflows. The employee may believe they are opening a registration form, accessing a shared file or completing an administrative request. The underlying process, however, can redirect them into an attacker-controlled authentication flow. For businesses, the risk becomes harder to manage when employees encounter QR codes across email, PDFs, physical documents and external communication channels. A printed QR code can become a physical attack surface Not every relevant scenario begins on a screen. Businesses increasingly use QR codes in physical environments, including reception desks, customer service counters, parking areas, internal signage and payment points. In these settings, the QR code becomes a physical object that connects people to a digital destination. A criminal who can replace or cover a legitimate code may be able to change that destination without modifying the underlying website or information system. In September 2026, the
The New Identity Layer: How Europe Is Rebuilding Digital Verification
The EU Digital Identity Wallet may eventually look simple from the user’s side: open an app, select a credential and approve what you want to share. Making that interaction work across 27 Member States is anything but simple. Behind the wallet sits an emerging digital identity infrastructure connecting governments, wallet providers, credential issuers, universities, banks, transport companies, public authorities and thousands of organisations that may eventually need to verify information presented by a user. The challenge is not merely to digitise an identity card. Europe is attempting to create a common trust layer in which different organisations can issue and verify digital credentials without every service having to build its own isolated identity system. That makes the EU Digital Identity Wallet as much an infrastructure project as a consumer product. A wallet only works if an ecosystem trusts what is inside it A physical credential works because institutions recognise the authority behind it. A university diploma is useful because a recognised institution issued it. A driving licence matters because an authorised public authority stands behind it. An identity document works because the receiving party trusts the issuing state. Digital credentials need the same chain of confidence. Under the European Digital Identity Framework, users can hold person-identification data and electronic attestations of attributes inside a wallet, while relying parties can request and validate them. The regulation establishes common mechanisms for issuance, presentation, verification and authentication across that ecosystem. The important business shift is therefore not that documents become files on a phone. It is that trust itself becomes machine-readable and interoperable. Europe is building a network of roles rather than one central platform There is no single organisation doing everything. Different actors perform different functions. A wallet provider supplies the wallet used by the individual. A Person Identification Data provider supplies trusted identity data. Public or private issuers can create digital credentials or attestations. A relying party is the organisation that requests information from the wallet in order to provide a service. Behind those actors sit certification bodies, trust-service providers, registries and technical infrastructure designed to establish who is authorised to perform each role. The EU’s 2026 interoperability testing already includes national wallet teams, PID providers, credential issuers, relying parties, certification bodies and standardisation organisations working against production-oriented implementations rather than simple prototypes. That is why describing the EUDI Wallet as simply “an identity app” misses most of the economic story. The app is only the visible endpoint of a much larger network. Issuers become a critical part of the new identity economy A wallet with nothing useful inside it has little value. The system therefore depends heavily on organisations willing and able to issue recognised digital credentials. That can include a public authority issuing a residence credential, a university issuing a diploma, a healthcare organisation providing an eligible credential or another trusted organisation issuing information that can later be verified by a third party. The Commission’s current EUDI guidance describes issuers as trusted public or private organisations capable of issuing identity information or digital documents directly into wallets. Those credentials must follow common schemas, formats and proof mechanisms so that other systems can understand and verify them. This creates an important infrastructure dependency. Europe can mandate wallet availability. But wallet usefulness depends on the supply of credentials around it. Relying parties determine whether those credentials become useful The other half of the network is demand. A diploma inside a wallet matters only if an employer or university can accept it. An age credential matters only if a service can request and validate it. A digital identity becomes useful only where businesses and public organisations can actually rely on it. The EU is therefore paying increasing attention to relying-party adoption. In September 2026, the Commission’s EUDI programme described relying parties as central to turning the wallet into real-world services and launched engagement work around sectors including travel, hospitality, education and public services. This creates a classic platform challenge. Users have little reason to adopt a wallet that few organisations accept. Organisations have less incentive to integrate a wallet that few customers use. The ecosystem needs both sides to grow together. The real network effect sits between credentials and acceptance This is where digital identity begins to resemble other platform markets. More issuers create more useful credentials. More useful credentials make wallets more valuable. More wallet users give relying parties greater incentive to integrate. More relying parties give citizens more reasons to use the wallet. The Commission itself describes this reinforcing relationship in its 2026 relying-party programme: more usable services can drive adoption, which can encourage more credentials and further ecosystem growth. The strongest version of the EUDI ecosystem therefore does not emerge simply because every Member State releases an app. It emerges when credential supply and service acceptance reinforce one another. Trust lists are becoming part of the infrastructure When two organisations have never interacted before, how does one know that the other can be trusted? That is one of the central technical and governance problems the European framework is trying to solve. The EUDI ecosystem uses trusted entities and certification mechanisms so participants can verify roles such as wallet providers, Person Identification Data providers and other authorised actors. During the 2026 Launchpad testing programme, the EU’s eIDAS Dashboard and Lists of Trusted Entities are being tested as a central mechanism for establishing trust between participants. The lists being tested include categories for wallet providers, PID providers, mobile-driving-licence providers and providers of certificates used by wallet-relying parties. This sounds highly technical, but the economic purpose is straightforward. A cross-border digital market cannot scale efficiently if every company must manually establish trust with every issuer and every wallet provider individually. Shared trust infrastructure reduces that coordination problem. Certification turns technical compatibility into an economic requirement Interoperability is only useful if implementations actually conform to the rules. The regulation therefore requires certification of EU Digital Identity Wallets against defined security and technical requirements, with conformity assessment carried out through nationally designated bodies.
Content Provenance Is Becoming Business Infrastructure
For a small creative team, knowing where an image came from is usually straightforward. Someone took the photograph, another person edited it and the final version was uploaded to a campaign folder. At enterprise scale, that simplicity disappears. A single organisation may produce thousands of assets across internal teams, agencies, freelancers, markets and platforms. The same image can be resized, localised, edited with generative AI, reused in another campaign and exported through several different systems before reaching the customer. At that point, the question “Where did this file come from?” stops being only about authenticity. It becomes an operational question. That is why content provenance is beginning to look less like a niche media-verification feature and more like another layer of business infrastructure. The content supply chain is becoming harder to see Businesses already have content supply chains, even when they do not call them that. A campaign may begin with a brief, move to an agency, pass through photography or design, enter an approval process, receive local adaptations, move into a digital asset management system and eventually reach websites, advertising platforms and social networks. AI is increasing the number of possible steps. One source asset can now generate dozens or hundreds of variations. Backgrounds can change, copy can be localised, objects can be replaced and formats can be adapted for different audiences with much less manual production. Adobe describes enterprise content supply chains as increasingly pressured to produce more assets for more channels while maintaining brand consistency and governance. Its 2026 research also notes that generative AI is accelerating content production while organisations continue to face challenges around data readiness, governance and integrated workflows. More production therefore creates another problem: more history to keep track of. Provenance becomes useful before a customer ever sees the asset Much of the public discussion around Content Credentials focuses on the viewer. Can someone determine whether AI was used? Can they see where an image originated? Can they inspect its editing history? Those are important questions, and Athens Pulse recently approached the issue from exactly that consumer perspective in “Why Every Photo Online Is Starting to Need a History” Inside a business, however, the same information can have value long before the asset is published. Teams may need to know which application created a file, whether generative AI was involved, who issued the credential, what modifications occurred and whether the asset being used is actually the approved version. Adobe’s current Experience Manager implementation, for example, can expose information such as the credential date, the application or AI tool involved in changes and the entity that issued the credential. That turns provenance from a public-facing transparency feature into something that can also support internal asset management. The bigger problem is not creation. It is chain of custody Creating digital content has become dramatically easier. Keeping control of it has not. Imagine an international brand producing a campaign through an external agency. The original creative is approved, sent to regional teams, translated, resized, edited again and uploaded to several platforms. Three months later, someone finds another version in a shared folder. Which version is it? Was it approved? Was AI used to modify it? Is the person who created the original asset still correctly credited? Is it safe to publish in another market? Traditional filenames, folders and manual documentation can answer some of these questions, but they become increasingly fragile as content volumes rise. Content provenance introduces the possibility of carrying part of that history with the asset itself. A business may eventually need to know how an asset changed This becomes particularly important when a single “asset” no longer has a single production history. A photograph may begin as a camera capture, enter Photoshop, receive a generative modification, move into another system for localisation and finally become multiple advertising variants. C2PA is designed around the idea that producers and custodians can make verifiable assertions about the creation of an asset and actions taken after its creation. Importantly, the standard is intended to verify the association and integrity of those assertions rather than decide whether they are “good” or “bad”. For businesses, that distinction is useful. Provenance does not need to decide whether an edit was appropriate. It can simply provide more reliable information about what happened. Governance teams can then apply the organisation’s own rules. AI makes asset governance much more difficult Before generative AI, a company could already struggle with duplicate files, outdated campaign materials and inconsistent versions. AI adds another layer because content can now multiply extremely quickly. One approved image can become 20 regional variations, several product adaptations and dozens of social formats. Some may involve only resizing, while others may contain generative changes that meaningfully alter the asset. The traditional question “Is this the approved file?” therefore evolves into something more complicated: “Is this approved version derived from the approved source through an approved process?” That is a provenance problem. Modern digital asset management systems are already moving in this direction. Adobe Experience Manager, for example, combines governance features around asset status, rights and compliance with Content Credentials that can expose tamper-evident provenance information. Provenance can become part of approval workflows Businesses rarely publish important assets immediately after creation. They move through approvals. Legal teams may check claims. Brand teams review design. Regional teams confirm localisation. Compliance teams may need to verify that specific imagery or disclosures are appropriate. The more automated production becomes, the more important it becomes to preserve the relationship between the asset being reviewed and the asset eventually published. Otherwise, organisations risk approving one version and distributing another. Provenance does not replace approval software, DAM systems or workflow management. But it can add another layer by helping preserve information about the asset as it moves through those systems. This is especially relevant because the C2PA standard was explicitly designed to fit into existing workflows rather than require one specific hosting or asset-management architecture. The metadata itself can become a governance decision There is another operational issue:
The Replacement Cycle Problem: What Happens When Customers Upgrade Less Often
A company can have more customers, more active devices and stronger loyalty while still facing a difficult commercial problem: those customers may simply be buying less often. That is increasingly relevant in the smartphone market, where replacement cycles have moved close to four years. Devices remain capable for longer, software support has improved and higher prices give consumers another reason to postpone replacement. For Market Insiders, the interesting question is therefore not why people keep their phones longer, but what happens to a business model when the customer remains satisfied while the next hardware transaction moves further into the future. This is the replacement cycle problem. A satisfied customer can become a less frequent customer Most businesses naturally want customers to remain satisfied with their products. Smartphones create an unusual tension because greater satisfaction can also reduce the urgency to purchase again. If a device remains fast, secure and useful for four years instead of two, the customer relationship may be healthy while hardware purchase frequency falls sharply. That makes satisfaction and transaction frequency increasingly separate metrics. A customer who does not upgrade may not be disengaged. The product may simply be working too well to replace. Small changes in replacement timing can have large effects The difference between replacing a smartphone every two years and every four years sounds simple, but economically it is substantial. Over an eight-year relationship, a two-year cycle could theoretically generate four replacement events. A four-year cycle reduces that to two. Real customer behaviour is obviously more complex, but the principle illustrates why replacement timing matters so much for hardware businesses. Even modest extensions across millions of users can materially change annual unit demand. The installed base may remain large while the number of customers entering the market each year becomes smaller. The installed base and annual sales start telling different stories A growing installed base is usually positive because it represents more people using the company’s products. But installed base growth does not automatically translate into equivalent hardware growth. If devices remain active for longer, the number of products in use can rise even while annual replacement demand slows. Second-hand and refurbished devices can extend that divergence further by keeping hardware active after the original owner has moved on. Businesses therefore need to distinguish between how many customers are inside the ecosystem and how many are currently generating a hardware transaction. Those are increasingly different questions. Forecasting becomes harder Replacement-driven markets depend heavily on predicting when existing customers will return. When ownership cycles were relatively stable, historical replacement patterns offered a stronger basis for forecasting. Longer and more variable ownership makes that process harder. Battery health, repair decisions, device prices, software support, economic conditions, trade-in values and new product features can all influence when an individual customer finally replaces a phone. For manufacturers, retailers and carriers, a longer cycle therefore creates more uncertainty around when installed demand converts into actual sales. A delayed purchase is not always a lost purchase This distinction matters. When a consumer decides not to replace a three-year-old smartphone this year, the sale may not disappear permanently. It may simply move into next year. For forecasting purposes, however, that delay still matters. Revenue expected in one period moves into another, production assumptions can become less accurate and inventory planning becomes more difficult. Across millions of customers, repeated delays can reshape an entire annual sales cycle. The replacement cycle problem is therefore partly about timing revenue correctly, not simply about whether the revenue exists at all. Hardware businesses become more exposed to replacement waves Long ownership periods can also create more pronounced cohorts. Large groups of customers who purchased devices during the same strong product cycle may eventually approach replacement at similar times. Conversely, a weak upgrade generation can push that demand forward again. This creates the possibility of irregular replacement waves rather than a consistently predictable annual market. A company may therefore experience periods of strong demand followed by quieter years without necessarily gaining or losing the same proportion of customers. That can make short-term performance more difficult to interpret. Revenue growth becomes less connected to user growth In a rapidly expanding market, acquiring more users can naturally produce more device sales. In a mature market, the relationship becomes weaker. A company can increase its active user base through customer retention, second-hand devices and longer device lifespans without seeing equivalent growth in annual hardware shipments. That means management can no longer treat installed-base growth as a direct proxy for hardware revenue growth. The economic question becomes how much value each active user generates throughout the ownership period, not simply how many active devices exist. Recurring services become strategically more important This is where services enter the equation. If the customer purchases hardware less frequently, recurring revenue generated between those purchases becomes more valuable. Cloud storage, device protection, payments, subscriptions, content services, AI features and other ecosystem products can create commercial activity even when the smartphone itself remains unchanged. The hardware transaction becomes one part of a longer revenue relationship rather than the only meaningful moment. For companies with large installed bases, that can reduce dependence on replacement frequency. The installed base becomes an economic asset A large installed base therefore has value beyond future smartphone replacements. Every active device can represent a customer who may subscribe to a service, purchase accessories, use payments, buy another ecosystem product or eventually trade the device in for something newer. This changes the way businesses can think about hardware. The smartphone is not only a unit sold. It can also function as an entry point into years of additional transactions. That makes the quality and monetisation of the installed base increasingly important. Hardware margins and ecosystem margins become connected Longer ownership can also change where profit is generated. A company may earn less frequently from smartphone replacements but continue generating margin from services, accessories and adjacent devices. That makes ecosystem design more than a retention strategy. It becomes part of the revenue architecture.
The Authentication Cost: What Businesses Pay for Password-Based Identity
A password looks inexpensive. It is a string of characters, a login field and a database record. From that perspective, password-based authentication can appear to be one of the simplest pieces of digital infrastructure a business operates. The real cost appears later. Employees forget passwords. Customers lose access. Helpdesk teams handle resets. Security teams investigate compromised credentials. IT departments maintain recovery systems, multifactor authentication, access policies and legacy exceptions designed to compensate for weaknesses in the original authentication model. This is the authentication cost hidden behind password-based identity. For Market Insiders, the relevant question is therefore not whether passwords work. They clearly do, and businesses have relied on them for decades. The more important question is how much organisational complexity is required to keep them working safely at scale — and whether that cost still makes sense as passwordless alternatives mature. The Password Is Free Until Someone Forgets It The direct technical cost of creating a password credential is tiny. The operational cost of supporting that credential throughout its lifecycle is not. A user forgets the password and starts a reset. The reset email does not arrive, so they contact support. An employee changes devices and loses access to an authentication method. A customer enters the wrong credential repeatedly and locks the account. A compromised password triggers additional investigation. Each incident may appear minor in isolation, but at organisational scale they become repetitive operational work. The password therefore creates an unusual cost structure. It is cheap to issue, but potentially expensive to maintain. That makes the economics of authentication different from the economics of many other digital features. The business does not pay primarily when the password is created. It pays whenever the credential fails, is forgotten, is stolen or needs to be recovered. Password Resets Are an Operations Problem The familiar “Forgot password?” link hides an entire workflow. The system must verify identity, send recovery messages, manage tokens, expire reset links and prevent attackers from abusing the recovery mechanism. When automated recovery fails, the task moves to customer service or internal IT. In workforce environments, this can become particularly repetitive. FIDO Alliance’s 2026 workforce research found that among organisations already rolling out passkeys, 35% reported reductions in helpdesk tickets for password resets, while 45% reported faster employee login times. The survey covered 1,400 decision-makers in organisations with at least 500 employees across ten countries, so the figures should be read as evidence from that population rather than a universal business benchmark. The significance is not the precise percentage. It is that authentication design can change the workload of an IT organisation. A login method that fails less often does not merely improve UX. It removes tickets before they need to be handled. Helpdesk Cost Is Only the Visible Part Password-reset tickets are relatively easy to see because they appear in support systems. Other costs are less obvious. Employees lose productive time while waiting to regain access. Managers become involved when identity verification is unclear. Security teams create procedures for high-risk resets. Systems need audit logs and abuse protection. Customer-support agents require training around account recovery. The cost is distributed across departments, which makes it difficult to recognise as a single category. There is rarely a line in the financial statements called “password complexity.” Instead, the cost appears as slightly more support headcount, slightly longer onboarding, slightly more security engineering and slightly more downtime whenever access fails. That distribution is precisely why password-based identity can remain operationally expensive without looking expensive. The Business Pays When Credentials Are Stolen Too The cost of passwords is not limited to legitimate users forgetting them. Attackers can steal them. Verizon’s 2025 Data Breach Investigations Report found that stolen credentials were involved in about 88% of breaches classified as Basic Web Application Attacks, illustrating how central compromised credentials remain in that specific attack pattern. Verizon’s broader findings also continued to show strong overlap between social engineering and credential abuse. A compromised credential creates a completely different category of business cost. Incident response. Fraud investigation. Account restoration. Customer communication. Potential downtime. Security remediation. Regulatory or contractual consequences depending on the nature of the incident. The password is therefore unusual because the same mechanism creates both support cost when users cannot remember it and security risk when attackers manage to obtain it. Businesses Compensated by Building More Authentication Around the Password Most organisations did not respond to password weaknesses by removing passwords. They added more layers. SMS codes. Authenticator apps. Security questions. Backup codes. Risk-based verification. Device approvals. Recovery emails. These controls can substantially strengthen authentication, but they also expand the identity system that must be maintained. Now the organisation is not managing one credential. It is managing a credential ecosystem. The employee has a password plus an authenticator app. The customer has a password plus SMS recovery. Administrators may use stronger authentication again. Legacy applications may require different rules. Contractors may have separate access processes. Each additional layer solves a real security problem while simultaneously creating another operational process. Authentication Complexity Becomes Identity Complexity As organisations grow, identity management stops being simply a login issue. Employees join. Employees leave. Roles change. Contractors gain temporary access. Administrators receive privileged accounts. Customers change devices. Systems move to the cloud. Applications are added through acquisitions or departmental purchases. The organisation must continuously answer a fundamental question: Who should still have access to what? Recent FIDO Alliance and HID research illustrates how complicated this environment has become. In a 2026 survey of 500 IT and cybersecurity decision-makers across five countries, 59% of organisations reported managing three or more credential or authentication systems, while 58% said digital identity management had become more complex during the previous two years. Passwords are only one part of that complexity, but they often sit at the centre of it. Onboarding Creates Credentials — Offboarding Must Destroy Them Identity systems have a lifecycle. When an employee joins, the organisation creates accounts and permissions. When that employee changes position, access may need to change. When they
Feature Creep: When More Product Features Create More Cost Than Value
Adding a new feature can look like progress. It gives product teams something new to announce, sales teams another benefit to mention and customers one more reason to consider an upgrade. The problem begins when features accumulate faster than the value they create. This is feature creep: the gradual expansion of a product through new functions, options and exceptions until the product becomes harder to build, maintain, explain and support. What appears to be a small addition on the roadmap can create costs across development, testing, documentation, customer service and operations. For Market Insiders, feature creep is therefore not simply a product-design issue. It is a business question about where growth in functionality stops creating meaningful value and starts creating structural complexity. Feature Creep Rarely Starts With a Bad Idea Most unnecessary complexity does not begin with an obviously unnecessary feature. A customer asks for something. A competitor introduces a new capability. A sales team wants to remove an objection. A large client needs an exception. A product manager sees an opportunity to improve retention. Individually, each request can look reasonable. The problem appears when these additions are evaluated one by one while the cumulative cost of the product is ignored. Over time, a product that once solved one clear problem can become a collection of overlapping functions, legacy options and edge cases that nobody originally intended to support indefinitely. Feature creep is therefore often less about poor decisions than about many locally rational decisions creating a globally inefficient product. Every Feature Creates More Than Development Cost The visible cost of a new feature is usually the engineering time required to build it. That is only the beginning. Once released, the feature may need to be tested every time the product changes. It needs documentation, onboarding, analytics, customer support and compatibility with other parts of the product. Bugs have to be fixed, security issues monitored and future updates checked against the new functionality. A feature can therefore move from being a one-time project to becoming a permanent obligation. The real question is not simply: How much will this feature cost to build? It is: How much will this feature cost to keep? That distinction changes the economics of product expansion. Complexity Compounds One feature rarely exists in isolation. New functionality interacts with existing functionality, which means complexity often grows faster than the number of features themselves. A new pricing option may affect billing, checkout, reporting and support. A new integration can create compatibility questions across multiple workflows. A new permission level can require changes throughout the interface. As these dependencies increase, teams spend more time understanding how changes affect the rest of the system. This connects directly with a broader principle explored in Market Insiders’ “The Cost of Complexity: When Growth Makes a Business Weaker Instead of Stronger” Growth does not only add revenue or capability. It can also add coordination cost. Feature creep is one of the clearest ways that principle appears inside a product. More Features Can Make Development Slower A larger product does not simply contain more code. It contains more relationships between different parts of the product. That means developers may need more context before making changes. QA teams must test more scenarios. Product managers need to consider more dependencies. Releases become harder to coordinate because changing one area may create unexpected consequences elsewhere. Eventually, the organisation can enter a strange situation: the product contains more functionality than ever, but the team becomes slower at improving it. The feature set has grown while product velocity has declined. This is one of the hidden costs of feature creep. Complexity created by past additions begins consuming the resources required for future innovation. Customer Support Becomes More Expensive Every additional capability creates another way for a user to become confused. Different configurations produce different problems. Older features may behave differently from newer ones. Support teams need to understand more workflows and explain more exceptions. A feature used by a small percentage of customers may still generate documentation, tickets and training requirements for years. The cost is particularly difficult to see because it is distributed. There may be no single budget line called “cost of feature X”. Instead, the cost appears gradually across support time, onboarding calls, knowledge-base articles and internal training. A product can therefore become more expensive to operate without anyone identifying one specific moment when the cost increased. Feature Creep Can Make Sales Harder, Not Easier More functionality initially appears helpful to sales because every feature creates another possible selling point. But once the product becomes too broad, another problem appears: the story becomes harder to explain. Sales teams may need longer demonstrations. Prospects can struggle to understand which functions matter to them. Different customers hear different versions of what the product actually is. A product with twenty capabilities may technically address more use cases, but it can also become more difficult to position. This is where product complexity begins affecting go-to-market efficiency. The recently published Targeted.gr article, “The Anti-Feature Consumer: When Simplicity Becomes a Marketing Advantage” examines the customer-facing side of this problem: when fewer features can make a value proposition easier to understand and the product easier to position. For the business behind the product, the same simplification can reduce internal complexity as well. Customer Requests Are Not Automatically Product Strategy One of the biggest drivers of feature creep is the belief that customer demand should always determine the roadmap. Listening to customers is essential. Building everything they request is not. Customers experience their own problems, not the entire product architecture. One customer may reasonably request a specialised workflow that creates long-term complexity for thousands of other users. Enterprise clients can make this pressure even stronger because a feature request may be connected to a significant contract. That creates a strategic tension between winning revenue today and maintaining product coherence tomorrow. The correct question is not whether customers want a feature. It is whether enough customers experience the underlying problem, whether the feature strengthens