Πώς επηρεάζουν οι ευρωπαϊκοί κανονισμοί το digital marketing και το κόστος συμμόρφωσης;
Ένα marketing agency διαχειρίζεται διαφημίσεις σε Google και Meta, παρακολουθεί μετατροπές μέσω tracking tools και χρησιμοποιεί τεχνητή νοημοσύνη για τη δημιουργία περιεχομένου. Κάθε δραστηριότητα εξυπηρετεί διαφορετικό επιχειρηματικό στόχο, αλλά μπορεί επίσης να συνδέεται με συγκεκριμένες νομικές υποχρεώσεις. Το agency χρειάζεται πλέον να εξετάζει όχι μόνο αν μια καμπάνια αποδίδει, αλλά και αν ο τρόπος συλλογής δεδομένων, στόχευσης και παραγωγής περιεχομένου συμμορφώνεται με τους ισχύοντες κανόνες. Οι ευρωπαϊκοί κανονισμοί στο digital marketing επηρεάζουν την καθημερινή λειτουργία των διαφημιστικών επιχειρήσεων, δημιουργώντας απαιτήσεις για προστασία προσωπικών δεδομένων, διαφάνεια και ορθή χρήση τεχνολογιών. Ο GDPR, ο Digital Services Act και ο AI Act καλύπτουν διαφορετικές δραστηριότητες, ενώ ειδικότερες ρυθμίσεις ισχύουν για την πολιτική διαφήμιση. Το 2026, η εφαρμογή νέων υποχρεώσεων για την τεχνητή νοημοσύνη και η εξέλιξη του θεσμικού πλαισίου της ψηφιακής διαφήμισης φέρνουν το κόστος συμμόρφωσης στο επίκεντρο. Ποιες υποχρεώσεις αφορούν πραγματικά τα marketing agencies, πόσο μπορούν να επιβαρύνουν τη λειτουργία τους και πώς επηρεάζουν την ανταγωνιστικότητά τους; Γιατί οι ευρωπαϊκοί κανονισμοί επηρεάζουν το digital marketing; Η ψηφιακή διαφήμιση βασίζεται σε τεχνολογίες που επιτρέπουν στις επιχειρήσεις να προσεγγίζουν συγκεκριμένα κοινά και να αξιολογούν την αποτελεσματικότητα των καμπανιών τους. Η συλλογή δεδομένων, η χρήση cookies, η ανάλυση συμπεριφοράς και η αυτοματοποίηση αποτελούν συνηθισμένα εργαλεία. Ωστόσο, οι διαδικασίες αυτές μπορούν να επηρεάζουν την ιδιωτικότητα και τα δικαιώματα των χρηστών. Η Ευρωπαϊκή Ένωση έχει αναπτύξει ένα πολυεπίπεδο κανονιστικό πλαίσιο, με διαφορετικούς κανόνες ανά δραστηριότητα. Δεν ισχύουν όλοι οι κανονισμοί με τον ίδιο τρόπο Ένα agency που διαχειρίζεται διαφημιστικούς λογαριασμούς πελατών δεν έχει απαραίτητα τις ίδιες υποχρεώσεις με μια μεγάλη ψηφιακή πλατφόρμα. Αντίστοιχα, μια επιχείρηση που χρησιμοποιεί ένα διαθέσιμο AI εργαλείο δεν αντιμετωπίζεται αυτομάτως όπως η εταιρεία που ανέπτυξε το συγκεκριμένο σύστημα. Επομένως, η συμμόρφωση ξεκινά από την κατανόηση του πραγματικού ρόλου κάθε επιχείρησης. Αυτός ο διαχωρισμός είναι σημαντικός και για τον υπολογισμό του κόστους. GDPR: Πώς επηρεάζει τη συλλογή δεδομένων και τις διαφημιστικές καμπάνιες; Ο Γενικός Κανονισμός Προστασίας Δεδομένων (GDPR) εφαρμόζεται από τις 25 Μαΐου 2018 και αποτελεί βασικό πλαίσιο προστασίας προσωπικών δεδομένων στην Ευρωπαϊκή Ένωση. Δεν είναι νέος κανονισμός του 2026, αλλά παραμένει ουσιαστικός για τις δραστηριότητες digital marketing. Οι επιχειρήσεις πρέπει να διαθέτουν κατάλληλη νομική βάση για την επεξεργασία προσωπικών δεδομένων και να τηρούν τις προβλεπόμενες αρχές διαφάνειας, περιορισμού σκοπού και ελαχιστοποίησης δεδομένων. Cookies, pixels και tracking Ένα ηλεκτρονικό κατάστημα μπορεί να χρησιμοποιεί εργαλεία μέτρησης επισκέψεων και διαφημιστικών μετατροπών. Όταν οι τεχνολογίες περιλαμβάνουν αποθήκευση πληροφοριών ή πρόσβαση στη συσκευή του χρήστη, εφαρμόζονται επίσης οι ειδικοί κανόνες της νομοθεσίας ePrivacy. Στην Ελλάδα, το σχετικό πλαίσιο συνδέεται με τον Ν. 3471/2006. Για μη απολύτως αναγκαίες τεχνολογίες παρακολούθησης, απαιτείται κατά κανόνα προηγούμενη έγκυρη συγκατάθεση, με τις προβλεπόμενες εξαιρέσεις. Αυτό σημαίνει ότι ένα διαφημιστικό pixel δεν πρέπει να εγκαθίσταται χωρίς να έχουν ελεγχθεί οι πραγματικές προϋποθέσεις νόμιμης λειτουργίας του. Η Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα διαθέτει ενημερωτικό υλικό για cookies, tracking και στοχευμένη διαφήμιση. Υπεύθυνος επεξεργασίας ή εκτελών την επεξεργασία; Ένα agency μπορεί να επεξεργάζεται προσωπικά δεδομένα για λογαριασμό ενός πελάτη. Σε μια τέτοια συνεργασία, ο πελάτης μπορεί να λειτουργεί ως υπεύθυνος επεξεργασίας και το agency ως εκτελών την επεξεργασία. Αυτό εξαρτάται από το ποιος καθορίζει τους σκοπούς και τα ουσιώδη μέσα της επεξεργασίας. Δεν αρκεί να οριστούν οι ρόλοι αποκλειστικά μέσω της ονομασίας μιας σύμβασης. Σε πολλές περιπτώσεις χρειάζεται κατάλληλη συμφωνία επεξεργασίας δεδομένων, σαφής κατανομή αρμοδιοτήτων και έλεγχος των συνεργαζόμενων παρόχων. Είναι υποχρεωτικός ο Data Protection Officer για κάθε agency; Όχι. Η ανάγκη ορισμού Υπευθύνου Προστασίας Δεδομένων (DPO) εξαρτάται από τη φύση και την κλίμακα των δραστηριοτήτων, καθώς και από τα συγκεκριμένα κριτήρια του GDPR. Η μικρή επιχείρηση δεν απαλλάσσεται γενικά από τον κανονισμό, αλλά δεν υποχρεούται αυτομάτως να διαθέτει DPO μόνο και μόνο επειδή παρέχει υπηρεσίες marketing. Digital Services Act: Τι αλλάζει στη διαφημιστική στόχευση; Ο Digital Services Act (DSA) εφαρμόζεται γενικά στις σχετικές επιγραμμικές υπηρεσίες από τις 17 Φεβρουαρίου 2024, με προηγούμενη εφαρμογή ορισμένων υποχρεώσεων στις πολύ μεγάλες πλατφόρμες. Ένας βασικός στόχος του είναι η ενίσχυση της διαφάνειας και της προστασίας των χρηστών στο διαδίκτυο. Στον τομέα της διαφήμισης, ο DSA καθορίζει υποχρεώσεις που αφορούν ιδιαίτερα τους παρόχους ψηφιακών πλατφορμών. Οι περιορισμοί στα ευαίσθητα προσωπικά δεδομένα Οι πάροχοι επιγραμμικών πλατφορμών δεν επιτρέπεται να παρουσιάζουν διαφημίσεις βασισμένες σε profiling που χρησιμοποιεί ειδικές κατηγορίες προσωπικών δεδομένων, όπως θρησκευτικές πεποιθήσεις, δεδομένα υγείας ή πολιτικές απόψεις. Επιπλέον, απαγορεύεται η παρουσίαση διαφημίσεων σε ανηλίκους βάσει profiling, όταν η πλατφόρμα γνωρίζει με εύλογη βεβαιότητα ότι ο χρήστης είναι ανήλικος. Οι κανόνες αυτοί δεν αποτελούν καθολική απαγόρευση κάθε μορφής στοχευμένης διαφήμισης. Αποτελούν συγκεκριμένους περιορισμούς που πρέπει να λαμβάνονται υπόψη στον σχεδιασμό μιας καμπάνιας. Πώς επηρεάζεται πρακτικά ένα agency; Οι άμεσες υποχρεώσεις του DSA για τη σήμανση διαφημίσεων, τις πληροφορίες χορηγών και συγκεκριμένες λειτουργίες διαφάνειας αφορούν κυρίως τους παρόχους των σχετικών υπηρεσιών. Το agency, όμως, χρειάζεται να σχεδιάζει καμπάνιες που μπορούν να υλοποιηθούν εντός των επιτρεπόμενων επιλογών της πλατφόρμας και σύμφωνα με τις δικές του εφαρμοστέες υποχρεώσεις. Για παράδειγμα, μια καμπάνια προϊόντος που απευθύνεται σε ανηλίκους δεν μπορεί να βασίζεται απλώς στις ίδιες τεχνικές profiling που χρησιμοποιούνται για ενηλίκους. AI Act 2026: Ποιες υποχρεώσεις επηρεάζουν τη χρήση τεχνητής νοημοσύνης στο marketing; Ο AI Act, Κανονισμός (ΕΕ) 2024/1689, εισάγει κανόνες για την ανάπτυξη και τη χρήση συστημάτων τεχνητής νοημοσύνης. Η εφαρμογή του είναι σταδιακή και οι απαιτήσεις διαφέρουν ανάλογα με τον τύπο του συστήματος και τον ρόλο της επιχείρησης. Από τις 2 Αυγούστου 2026, εφαρμόζονται οι υποχρεώσεις διαφάνειας του άρθρου 50. AI–generated εικόνες και βίντεο: Χρειάζονται πάντα επισήμανση; Όχι με τον ίδιο τρόπο σε κάθε περίπτωση. Ο κανονισμός διακρίνει μεταξύ των παρόχων που αναπτύσσουν συστήματα AI και των φορέων που χρησιμοποιούν τα συστήματα σε επαγγελματικό πλαίσιο. Οι πάροχοι έχουν συγκεκριμένες υποχρεώσεις για την τεχνική σήμανση και ανιχνευσιμότητα συνθετικού περιεχομένου. Οι επαγγελματίες χρήστες έχουν, μεταξύ άλλων, ειδικές υποχρεώσεις γνωστοποίησης όταν δημοσιεύουν περιεχόμενο που εμπίπτει στον ορισμό του deepfake. Ένα deepfake δεν είναι απλώς οποιαδήποτε εικόνα έχει δημιουργηθεί με AI. Πρόκειται για συνθετικό ή τροποποιημένο περιεχόμενο που προσομοιάζει σε υπαρκτά ή ευλόγως πραγματικά πρόσωπα, αντικείμενα ή γεγονότα και μπορεί να δημιουργεί ψευδή εντύπωση αυθεντικότητας. Οι απαιτήσεις διαφάνειας έχουν ειδικότερες προβλέψεις για προφανώς καλλιτεχνικό, δημιουργικό ή σατιρικό περιεχόμενο. Συνεπώς, ένα marketing agency πρέπει να αξιολογεί το
The Economics of AI Agent Access: Who Controls the Next Digital Transaction?
For years, digital businesses have paid to attract customers through search engines, advertising platforms and online marketplaces. Once a potential buyer arrived, the merchant could present its products, manage the checkout process and develop a direct commercial relationship. But a new intermediary is entering this model: the AI agent, capable of researching products, comparing offers and potentially initiating transactions on behalf of consumers. The rise of agentic commerce introduces a fundamental economic question. If customers increasingly rely on AI assistants to decide where and what to buy, who controls the transaction—and who captures the value it creates? Retailers may gain access to new audiences, but they could also face new distribution costs, platform dependencies and reduced visibility into customer behavior. Meanwhile, publishers and digital service providers are beginning to explore whether automated access to their content and infrastructure should become a paid service. By October 2026, developments from Google, OpenAI and Cloudflare have made AI agent access economics a concrete business discussion rather than a distant possibility. New commerce protocols, merchant integrations and experimental content-licensing models suggest that the next stage of digital business may depend on more than attracting website traffic. Companies must understand how AI intermediaries could redistribute revenues, operating costs, bargaining power and control over the customer relationship. AI Agent Access Economics: From Website Traffic to Transaction Control The traditional internet economy relies heavily on intermediaries. Search engines organize information and direct users toward websites. Advertising platforms sell access to audiences. Marketplaces connect sellers with buyers and often charge fees for the transactions they facilitate. These models differ, but they share a basic commercial principle: an intermediary creates value by making discovery, distribution or purchasing more efficient. AI agents introduce another possible layer. Instead of visiting several retailers, a customer may ask an assistant to compare options and identify the most suitable offer. The assistant could gather information, evaluate alternatives, interact with participating merchants and potentially help complete a purchase. The economic significance lies in the assistant’s position between the buyer and the seller. A merchant may still provide the product, manage inventory and fulfill the order. Yet an external AI platform could influence which merchant is selected, how the offer is presented and which transaction route the customer follows. This raises three distinct questions: Who controls access to the customer? Who receives payment for facilitating the transaction? Who retains the commercial relationship after the purchase? These questions do not have universal answers. Different companies are experimenting with different technical and commercial arrangements. However, the decisions being made now could shape the bargaining position of retailers, publishers and digital platforms. Why the AI Agent Could Become a New Digital Gatekeeper A gatekeeper does not necessarily manufacture products or provide the underlying service. Its power comes from controlling an important point of access. Online marketplaces illustrate this principle. Sellers may benefit from a platform’s established customer base, payment infrastructure and reputation. In exchange, they accept specific participation rules and, depending on the platform, transaction fees or other commercial charges. AI-mediated commerce could introduce a related form of dependency. A customer may increasingly rely on an assistant to identify suitable products before visiting any merchant. In that situation, the AI platform influences the selection process even if the final payment occurs elsewhere. Control Over Discovery Can Create Economic Leverage Consider two retailers offering comparable products. The first attracts customers through its own website and existing customer relationships. The second relies heavily on referrals from a major AI shopping assistant. If the AI platform changes its integration requirements, recommendation mechanisms or commercial policies, the second retailer may experience greater disruption. The risk resembles platform dependency, but the mechanism is different. The AI intermediary may influence the customer’s choice before a conventional referral or marketplace transaction occurs. A retailer could therefore become commercially dependent on a platform that does not directly process most of its sales. This dependence may be difficult to measure because part of the buying journey takes place outside the retailer’s analytics environment. The broader problem has already been examined in Market Insiders “Discovery Risk: What Businesses Lose When Customer Research Moves Outside Their Website”. That analysis focuses on the loss of visibility into early customer research. Agentic commerce extends the question into the transaction itself: what happens when the intermediary that influences discovery also participates in how the purchase is completed? Gatekeeping Does Not Automatically Mean Monopoly It would be premature to conclude that one AI company will control the entire market for automated shopping. Consumers may use different assistants, retailers may support several integrations and businesses may continue attracting customers through their own channels. The degree of market power will depend on adoption, switching costs, commercial agreements and the ability of merchants to reach consumers through alternative services. Nevertheless, the possibility of intermediary concentration deserves attention. A company that controls an influential shopping interface could eventually acquire bargaining power over participating merchants, even without owning their inventories or physical distribution networks. Google’s Universal Commerce Protocol: Who Controls the Checkout? One of the most significant developments in 2026 came from Google. On January 11, the company introduced the Universal Commerce Protocol (UCP), an open-source standard developed with participation from retailers and technology partners. According to Google’s official technical explanation, the protocol establishes common mechanisms through which AI-powered consumer interfaces, merchants and payment providers can communicate. Its purpose is to support commerce activities such as product discovery, checkout and related services through standardized integrations. From an economic perspective, the important question is not simply whether the protocol makes transactions easier. It is how responsibilities and commercial relationships are distributed among the participating companies. The Merchant of Record Remains Important Google’s merchant documentation states that participating retailers remain the seller of record within the relevant UCP-powered checkout experience. This means the merchant continues to hold the commercial role associated with selling the product, even when the customer initiates the purchasing process through Google’s interface. Under Google’s implementation, eligible users can complete checkout through supported Google Pay flows. The
The Economics of Third Places: Can Community Spaces Become Sustainable Businesses?
A neighbourhood café offers more than coffee. A community centre provides somewhere to meet, learn and participate in local activities. A public library creates a welcoming environment without requiring visitors to purchase anything. These spaces can strengthen communities, but they all face a practical challenge: someone has to pay for the building, staff, utilities and services that make them possible. The renewed interest in third places has brought attention to the social importance of gathering spaces beyond home and work. Yet their financial foundations receive less attention. Commercial venues must generate sufficient revenue, community-owned enterprises need sustainable operating models, and publicly funded spaces depend on investment that may be difficult to maintain under budget pressures. This creates a fundamental question for the economics of third places: how can an organisation remain financially sustainable while preserving the accessibility that makes it valuable to a community? The answer involves more than selling coffee, renting rooms or attracting visitors. It requires an understanding of fixed costs, revenue diversification, asset ownership, public funding and the difference between commercial profitability and social value. Why Third Places Face a Different Economic Challenge Most commercial establishments are designed around transactions. A restaurant generates revenue through food and beverage sales. A retailer depends on product purchases. A coworking business typically charges for access to desks, offices or related services. Third places introduce another element: people may want to spend time in a space without continuously purchasing something. That creates an interesting economic tension. A café that encourages visitors to remain for several hours may become a valued neighbourhood gathering place. However, customers who occupy tables for extended periods without making additional purchases can reduce the venue’s ability to serve other paying visitors during busy periods. A community centre may offer free activities that encourage participation but generate little direct income. A library might provide educational, cultural and social benefits without collecting fees from the people who use those services. These different environments cannot be evaluated through exactly the same financial model. For a commercial café, the challenge may involve generating enough revenue per available seat while maintaining an atmosphere that encourages people to return. For a community organisation, financial sustainability may depend on combining commercial activities with grants, donations or support from public institutions. For a publicly funded library, the objective is not necessarily to produce an operating profit. It is to deliver public benefits at a cost that the funding organisation can justify and sustain. The shared problem is that the value people receive from these places does not always translate directly into revenue for the organisation responsible for maintaining them. That difference is central to understanding third place economics. The Fixed Costs Behind a Welcoming Community Space A third place may appear informal, but the infrastructure supporting it is not free. Before a visitor purchases a coffee, attends an event or uses a shared workspace, the operator may already be responsible for substantial recurring expenses. Property costs can include rent, maintenance, property-related taxes, insurance and utilities. Depending on the type of organisation, additional expenses may involve cleaning, security, equipment, accessibility improvements and regulatory compliance. Staffing is another important consideration. A welcoming community environment requires people to open the building, manage activities, maintain facilities, support visitors and respond to operational problems. Even organisations that rely heavily on volunteers need coordination, administration and appropriate safeguarding arrangements. These costs continue whether the space attracts hundreds of visitors or only a handful. Research has documented the financial pressures facing community-managed facilities. In 2019, a study titled Community Hubs: Understanding Survival and Success, funded by Local Trust and Power to Change, examined the finances and business models of community hub organisations in England. The report found that staffing was often the largest expense, while building-related costs could account for a substantial proportion of operating expenditure. Across the historical financial records examined, average annual surpluses were very small, highlighting how little room some organisations had to absorb unexpected costs. Those figures relate to an earlier period and should not be interpreted as a current estimate of profitability across all third places. Nevertheless, the underlying business problem remains relevant: organisations that offer accessible shared environments often operate with costs that cannot easily be reduced when revenue declines. Why Visitor Numbers Can Be a Misleading Measure of Success High footfall is usually viewed as a positive sign in retail. For community-oriented spaces, however, visitor numbers tell only part of the story. A venue may attract a large number of people but generate insufficient revenue to cover its expenses. Consider a café that becomes popular among remote workers. Its tables might remain occupied throughout the day, creating the appearance of strong demand. Yet if customers purchase relatively little while staying for long periods, the financial contribution from each table may be limited. The opposite situation is also possible. A smaller venue may accommodate fewer visitors but maintain healthier margins because its products, operating costs and customer spending patterns are more favourable. For community organisations, a different complication emerges. A free workshop might attract participants who would otherwise have limited access to educational or cultural activities. That can represent meaningful social impact even if the activity produces no direct commercial revenue. An operator therefore needs to distinguish among three different questions. How many people use the space? How much financial contribution do those activities generate? And what broader benefits does the organisation create for its community? These questions are connected, but their answers are not interchangeable. A financially sustainable third place needs reliable information about demand and revenue. A socially valuable third place also needs to understand who benefits from its services and whether those benefits justify the resources required. Simply counting visitors cannot provide either answer in isolation. The Revenue Models That Can Support Third Places There is no single business model suitable for every community-oriented space. The available options depend on ownership, location, audience, operating costs and the purpose of the organisation. Commercial cafés and hospitality venues usually rely on sales of food,
Quishing Turns a Simple QR Code Into an Operational Risk
A QR code may be one of the smallest pieces of technology used in modern business operations, but the processes connected to it can be surprisingly important. Companies use QR codes for payments, employee access, event registration, visitor information, equipment management and customer services. They offer a convenient way to connect a physical object, printed document or workplace interaction with a digital system. That convenience also creates opportunities for deception. Quishing, or QR code phishing, involves using malicious QR codes to direct people toward fraudulent websites, credential-harvesting pages or other harmful interactions. What makes the threat particularly relevant to businesses is that a seemingly ordinary scan can move an employee or customer outside an organisation’s expected security controls. The business risk is therefore broader than someone opening a suspicious website. Depending on the circumstances, a compromised QR interaction can affect account security, payments, customer confidence and the continuity of everyday operations. The larger question is no longer simply whether employees know how to recognise phishing emails. It is whether businesses understand the risks created when ordinary operational processes begin depending on scannable links. Quishing brings phishing into a different environment Phishing is not a new problem for businesses. Organisations have spent years investing in email filtering, suspicious-link detection, employee training and authentication controls to reduce the likelihood of successful attacks. Quishing changes how that familiar threat reaches the user. Instead of placing an ordinary hyperlink inside a message, an attacker can embed a malicious destination in a QR code. The recipient scans the image with a smartphone and may be directed toward a website imitating a legitimate business application, payment service or authentication page. The UK’s National Cyber Security Centre has highlighted three reasons this approach can be attractive to criminals: QR codes obscure the destination, some email security tools do not examine QR images as thoroughly as ordinary links, and users may switch from a protected workplace computer to a personal smartphone. That final point is especially important for organisations. A phishing message may arrive inside a managed corporate environment, but the next interaction can happen on a device the company’s security team cannot fully monitor. The attack begins inside one security boundary and continues outside it. The move from work computer to personal phone creates a security gap Many organisations have reasonably mature security controls on company laptops. They may use endpoint detection, managed browsers, restricted downloads, network filtering and centralised monitoring. Employees may also access business applications through identity systems that record unusual login behaviour. A personal smartphone does not necessarily have the same protections. When a QR code displayed on a corporate computer is scanned with an unmanaged phone, the suspicious destination may open through a different browser, operating environment and security configuration. In January 2026, the FBI specifically warned about this technique, describing QR-based spearphishing campaigns that attempted to move targets from corporate endpoints to mobile devices before presenting fraudulent login pages. This does not mean personal smartphones are inherently insecure or that every QR scan bypasses enterprise protection. It means the organisation may have less visibility over an interaction that can still affect its corporate accounts and systems. That is an operational problem because the consequences can return to the business even when the initial interaction happens on a device it does not own. The real target may be a corporate identity Many quishing attacks are designed to obtain credentials rather than damage the phone itself. An employee might receive a message claiming that access to a company document requires verification. Instead of providing a familiar login link, the message presents a QR code that appears to lead to the organisation’s authentication service. After scanning, the employee reaches a convincing imitation of a familiar sign-in page and enters their credentials. The attack can then move from deception to unauthorised account access. The FBI’s January 2026 advisory described targeted campaigns associated with North Korean Kimsuky actors, including QR codes that directed recipients toward counterfeit authentication pages. The agency also warned that some operations may involve session-token theft, potentially allowing attackers to compromise cloud identities even when conventional multi-factor authentication is present. The significance for businesses is substantial. The initial incident may look like a single employee interacting with a suspicious code, but the resulting exposure can involve email accounts, cloud services, stored information or other systems accessible through that identity. The QR code is only the entry point. The business account behind it may be the actual target. The threat is not limited to ordinary phishing emails Quishing can also appear through documents and attachments that employees might otherwise consider routine. A PDF containing a registration form, event invitation or administrative notice can include a QR code that encourages the recipient to continue the process on a phone. That is relevant because businesses routinely exchange documents with suppliers, customers, contractors and external organisations. The ENISA Threat Landscape 2025 documented QR-based phishing activity associated with the Scanception campaign. Malicious QR codes embedded in PDF attachments were used to direct recipients toward credential-harvesting pages hosted through trusted cloud environments, with targets including users in the EU. This illustrates how malicious interactions can be wrapped inside familiar document workflows. The employee may believe they are opening a registration form, accessing a shared file or completing an administrative request. The underlying process, however, can redirect them into an attacker-controlled authentication flow. For businesses, the risk becomes harder to manage when employees encounter QR codes across email, PDFs, physical documents and external communication channels. A printed QR code can become a physical attack surface Not every relevant scenario begins on a screen. Businesses increasingly use QR codes in physical environments, including reception desks, customer service counters, parking areas, internal signage and payment points. In these settings, the QR code becomes a physical object that connects people to a digital destination. A criminal who can replace or cover a legitimate code may be able to change that destination without modifying the underlying website or information system. In September 2026, the
The New Identity Layer: How Europe Is Rebuilding Digital Verification
The EU Digital Identity Wallet may eventually look simple from the user’s side: open an app, select a credential and approve what you want to share. Making that interaction work across 27 Member States is anything but simple. Behind the wallet sits an emerging digital identity infrastructure connecting governments, wallet providers, credential issuers, universities, banks, transport companies, public authorities and thousands of organisations that may eventually need to verify information presented by a user. The challenge is not merely to digitise an identity card. Europe is attempting to create a common trust layer in which different organisations can issue and verify digital credentials without every service having to build its own isolated identity system. That makes the EU Digital Identity Wallet as much an infrastructure project as a consumer product. A wallet only works if an ecosystem trusts what is inside it A physical credential works because institutions recognise the authority behind it. A university diploma is useful because a recognised institution issued it. A driving licence matters because an authorised public authority stands behind it. An identity document works because the receiving party trusts the issuing state. Digital credentials need the same chain of confidence. Under the European Digital Identity Framework, users can hold person-identification data and electronic attestations of attributes inside a wallet, while relying parties can request and validate them. The regulation establishes common mechanisms for issuance, presentation, verification and authentication across that ecosystem. The important business shift is therefore not that documents become files on a phone. It is that trust itself becomes machine-readable and interoperable. Europe is building a network of roles rather than one central platform There is no single organisation doing everything. Different actors perform different functions. A wallet provider supplies the wallet used by the individual. A Person Identification Data provider supplies trusted identity data. Public or private issuers can create digital credentials or attestations. A relying party is the organisation that requests information from the wallet in order to provide a service. Behind those actors sit certification bodies, trust-service providers, registries and technical infrastructure designed to establish who is authorised to perform each role. The EU’s 2026 interoperability testing already includes national wallet teams, PID providers, credential issuers, relying parties, certification bodies and standardisation organisations working against production-oriented implementations rather than simple prototypes. That is why describing the EUDI Wallet as simply “an identity app” misses most of the economic story. The app is only the visible endpoint of a much larger network. Issuers become a critical part of the new identity economy A wallet with nothing useful inside it has little value. The system therefore depends heavily on organisations willing and able to issue recognised digital credentials. That can include a public authority issuing a residence credential, a university issuing a diploma, a healthcare organisation providing an eligible credential or another trusted organisation issuing information that can later be verified by a third party. The Commission’s current EUDI guidance describes issuers as trusted public or private organisations capable of issuing identity information or digital documents directly into wallets. Those credentials must follow common schemas, formats and proof mechanisms so that other systems can understand and verify them. This creates an important infrastructure dependency. Europe can mandate wallet availability. But wallet usefulness depends on the supply of credentials around it. Relying parties determine whether those credentials become useful The other half of the network is demand. A diploma inside a wallet matters only if an employer or university can accept it. An age credential matters only if a service can request and validate it. A digital identity becomes useful only where businesses and public organisations can actually rely on it. The EU is therefore paying increasing attention to relying-party adoption. In September 2026, the Commission’s EUDI programme described relying parties as central to turning the wallet into real-world services and launched engagement work around sectors including travel, hospitality, education and public services. This creates a classic platform challenge. Users have little reason to adopt a wallet that few organisations accept. Organisations have less incentive to integrate a wallet that few customers use. The ecosystem needs both sides to grow together. The real network effect sits between credentials and acceptance This is where digital identity begins to resemble other platform markets. More issuers create more useful credentials. More useful credentials make wallets more valuable. More wallet users give relying parties greater incentive to integrate. More relying parties give citizens more reasons to use the wallet. The Commission itself describes this reinforcing relationship in its 2026 relying-party programme: more usable services can drive adoption, which can encourage more credentials and further ecosystem growth. The strongest version of the EUDI ecosystem therefore does not emerge simply because every Member State releases an app. It emerges when credential supply and service acceptance reinforce one another. Trust lists are becoming part of the infrastructure When two organisations have never interacted before, how does one know that the other can be trusted? That is one of the central technical and governance problems the European framework is trying to solve. The EUDI ecosystem uses trusted entities and certification mechanisms so participants can verify roles such as wallet providers, Person Identification Data providers and other authorised actors. During the 2026 Launchpad testing programme, the EU’s eIDAS Dashboard and Lists of Trusted Entities are being tested as a central mechanism for establishing trust between participants. The lists being tested include categories for wallet providers, PID providers, mobile-driving-licence providers and providers of certificates used by wallet-relying parties. This sounds highly technical, but the economic purpose is straightforward. A cross-border digital market cannot scale efficiently if every company must manually establish trust with every issuer and every wallet provider individually. Shared trust infrastructure reduces that coordination problem. Certification turns technical compatibility into an economic requirement Interoperability is only useful if implementations actually conform to the rules. The regulation therefore requires certification of EU Digital Identity Wallets against defined security and technical requirements, with conformity assessment carried out through nationally designated bodies.
Content Provenance Is Becoming Business Infrastructure
For a small creative team, knowing where an image came from is usually straightforward. Someone took the photograph, another person edited it and the final version was uploaded to a campaign folder. At enterprise scale, that simplicity disappears. A single organisation may produce thousands of assets across internal teams, agencies, freelancers, markets and platforms. The same image can be resized, localised, edited with generative AI, reused in another campaign and exported through several different systems before reaching the customer. At that point, the question “Where did this file come from?” stops being only about authenticity. It becomes an operational question. That is why content provenance is beginning to look less like a niche media-verification feature and more like another layer of business infrastructure. The content supply chain is becoming harder to see Businesses already have content supply chains, even when they do not call them that. A campaign may begin with a brief, move to an agency, pass through photography or design, enter an approval process, receive local adaptations, move into a digital asset management system and eventually reach websites, advertising platforms and social networks. AI is increasing the number of possible steps. One source asset can now generate dozens or hundreds of variations. Backgrounds can change, copy can be localised, objects can be replaced and formats can be adapted for different audiences with much less manual production. Adobe describes enterprise content supply chains as increasingly pressured to produce more assets for more channels while maintaining brand consistency and governance. Its 2026 research also notes that generative AI is accelerating content production while organisations continue to face challenges around data readiness, governance and integrated workflows. More production therefore creates another problem: more history to keep track of. Provenance becomes useful before a customer ever sees the asset Much of the public discussion around Content Credentials focuses on the viewer. Can someone determine whether AI was used? Can they see where an image originated? Can they inspect its editing history? Those are important questions, and Athens Pulse recently approached the issue from exactly that consumer perspective in “Why Every Photo Online Is Starting to Need a History” Inside a business, however, the same information can have value long before the asset is published. Teams may need to know which application created a file, whether generative AI was involved, who issued the credential, what modifications occurred and whether the asset being used is actually the approved version. Adobe’s current Experience Manager implementation, for example, can expose information such as the credential date, the application or AI tool involved in changes and the entity that issued the credential. That turns provenance from a public-facing transparency feature into something that can also support internal asset management. The bigger problem is not creation. It is chain of custody Creating digital content has become dramatically easier. Keeping control of it has not. Imagine an international brand producing a campaign through an external agency. The original creative is approved, sent to regional teams, translated, resized, edited again and uploaded to several platforms. Three months later, someone finds another version in a shared folder. Which version is it? Was it approved? Was AI used to modify it? Is the person who created the original asset still correctly credited? Is it safe to publish in another market? Traditional filenames, folders and manual documentation can answer some of these questions, but they become increasingly fragile as content volumes rise. Content provenance introduces the possibility of carrying part of that history with the asset itself. A business may eventually need to know how an asset changed This becomes particularly important when a single “asset” no longer has a single production history. A photograph may begin as a camera capture, enter Photoshop, receive a generative modification, move into another system for localisation and finally become multiple advertising variants. C2PA is designed around the idea that producers and custodians can make verifiable assertions about the creation of an asset and actions taken after its creation. Importantly, the standard is intended to verify the association and integrity of those assertions rather than decide whether they are “good” or “bad”. For businesses, that distinction is useful. Provenance does not need to decide whether an edit was appropriate. It can simply provide more reliable information about what happened. Governance teams can then apply the organisation’s own rules. AI makes asset governance much more difficult Before generative AI, a company could already struggle with duplicate files, outdated campaign materials and inconsistent versions. AI adds another layer because content can now multiply extremely quickly. One approved image can become 20 regional variations, several product adaptations and dozens of social formats. Some may involve only resizing, while others may contain generative changes that meaningfully alter the asset. The traditional question “Is this the approved file?” therefore evolves into something more complicated: “Is this approved version derived from the approved source through an approved process?” That is a provenance problem. Modern digital asset management systems are already moving in this direction. Adobe Experience Manager, for example, combines governance features around asset status, rights and compliance with Content Credentials that can expose tamper-evident provenance information. Provenance can become part of approval workflows Businesses rarely publish important assets immediately after creation. They move through approvals. Legal teams may check claims. Brand teams review design. Regional teams confirm localisation. Compliance teams may need to verify that specific imagery or disclosures are appropriate. The more automated production becomes, the more important it becomes to preserve the relationship between the asset being reviewed and the asset eventually published. Otherwise, organisations risk approving one version and distributing another. Provenance does not replace approval software, DAM systems or workflow management. But it can add another layer by helping preserve information about the asset as it moves through those systems. This is especially relevant because the C2PA standard was explicitly designed to fit into existing workflows rather than require one specific hosting or asset-management architecture. The metadata itself can become a governance decision There is another operational issue:
The Replacement Cycle Problem: What Happens When Customers Upgrade Less Often
A company can have more customers, more active devices and stronger loyalty while still facing a difficult commercial problem: those customers may simply be buying less often. That is increasingly relevant in the smartphone market, where replacement cycles have moved close to four years. Devices remain capable for longer, software support has improved and higher prices give consumers another reason to postpone replacement. For Market Insiders, the interesting question is therefore not why people keep their phones longer, but what happens to a business model when the customer remains satisfied while the next hardware transaction moves further into the future. This is the replacement cycle problem. A satisfied customer can become a less frequent customer Most businesses naturally want customers to remain satisfied with their products. Smartphones create an unusual tension because greater satisfaction can also reduce the urgency to purchase again. If a device remains fast, secure and useful for four years instead of two, the customer relationship may be healthy while hardware purchase frequency falls sharply. That makes satisfaction and transaction frequency increasingly separate metrics. A customer who does not upgrade may not be disengaged. The product may simply be working too well to replace. Small changes in replacement timing can have large effects The difference between replacing a smartphone every two years and every four years sounds simple, but economically it is substantial. Over an eight-year relationship, a two-year cycle could theoretically generate four replacement events. A four-year cycle reduces that to two. Real customer behaviour is obviously more complex, but the principle illustrates why replacement timing matters so much for hardware businesses. Even modest extensions across millions of users can materially change annual unit demand. The installed base may remain large while the number of customers entering the market each year becomes smaller. The installed base and annual sales start telling different stories A growing installed base is usually positive because it represents more people using the company’s products. But installed base growth does not automatically translate into equivalent hardware growth. If devices remain active for longer, the number of products in use can rise even while annual replacement demand slows. Second-hand and refurbished devices can extend that divergence further by keeping hardware active after the original owner has moved on. Businesses therefore need to distinguish between how many customers are inside the ecosystem and how many are currently generating a hardware transaction. Those are increasingly different questions. Forecasting becomes harder Replacement-driven markets depend heavily on predicting when existing customers will return. When ownership cycles were relatively stable, historical replacement patterns offered a stronger basis for forecasting. Longer and more variable ownership makes that process harder. Battery health, repair decisions, device prices, software support, economic conditions, trade-in values and new product features can all influence when an individual customer finally replaces a phone. For manufacturers, retailers and carriers, a longer cycle therefore creates more uncertainty around when installed demand converts into actual sales. A delayed purchase is not always a lost purchase This distinction matters. When a consumer decides not to replace a three-year-old smartphone this year, the sale may not disappear permanently. It may simply move into next year. For forecasting purposes, however, that delay still matters. Revenue expected in one period moves into another, production assumptions can become less accurate and inventory planning becomes more difficult. Across millions of customers, repeated delays can reshape an entire annual sales cycle. The replacement cycle problem is therefore partly about timing revenue correctly, not simply about whether the revenue exists at all. Hardware businesses become more exposed to replacement waves Long ownership periods can also create more pronounced cohorts. Large groups of customers who purchased devices during the same strong product cycle may eventually approach replacement at similar times. Conversely, a weak upgrade generation can push that demand forward again. This creates the possibility of irregular replacement waves rather than a consistently predictable annual market. A company may therefore experience periods of strong demand followed by quieter years without necessarily gaining or losing the same proportion of customers. That can make short-term performance more difficult to interpret. Revenue growth becomes less connected to user growth In a rapidly expanding market, acquiring more users can naturally produce more device sales. In a mature market, the relationship becomes weaker. A company can increase its active user base through customer retention, second-hand devices and longer device lifespans without seeing equivalent growth in annual hardware shipments. That means management can no longer treat installed-base growth as a direct proxy for hardware revenue growth. The economic question becomes how much value each active user generates throughout the ownership period, not simply how many active devices exist. Recurring services become strategically more important This is where services enter the equation. If the customer purchases hardware less frequently, recurring revenue generated between those purchases becomes more valuable. Cloud storage, device protection, payments, subscriptions, content services, AI features and other ecosystem products can create commercial activity even when the smartphone itself remains unchanged. The hardware transaction becomes one part of a longer revenue relationship rather than the only meaningful moment. For companies with large installed bases, that can reduce dependence on replacement frequency. The installed base becomes an economic asset A large installed base therefore has value beyond future smartphone replacements. Every active device can represent a customer who may subscribe to a service, purchase accessories, use payments, buy another ecosystem product or eventually trade the device in for something newer. This changes the way businesses can think about hardware. The smartphone is not only a unit sold. It can also function as an entry point into years of additional transactions. That makes the quality and monetisation of the installed base increasingly important. Hardware margins and ecosystem margins become connected Longer ownership can also change where profit is generated. A company may earn less frequently from smartphone replacements but continue generating margin from services, accessories and adjacent devices. That makes ecosystem design more than a retention strategy. It becomes part of the revenue architecture.
The Authentication Cost: What Businesses Pay for Password-Based Identity
A password looks inexpensive. It is a string of characters, a login field and a database record. From that perspective, password-based authentication can appear to be one of the simplest pieces of digital infrastructure a business operates. The real cost appears later. Employees forget passwords. Customers lose access. Helpdesk teams handle resets. Security teams investigate compromised credentials. IT departments maintain recovery systems, multifactor authentication, access policies and legacy exceptions designed to compensate for weaknesses in the original authentication model. This is the authentication cost hidden behind password-based identity. For Market Insiders, the relevant question is therefore not whether passwords work. They clearly do, and businesses have relied on them for decades. The more important question is how much organisational complexity is required to keep them working safely at scale — and whether that cost still makes sense as passwordless alternatives mature. The Password Is Free Until Someone Forgets It The direct technical cost of creating a password credential is tiny. The operational cost of supporting that credential throughout its lifecycle is not. A user forgets the password and starts a reset. The reset email does not arrive, so they contact support. An employee changes devices and loses access to an authentication method. A customer enters the wrong credential repeatedly and locks the account. A compromised password triggers additional investigation. Each incident may appear minor in isolation, but at organisational scale they become repetitive operational work. The password therefore creates an unusual cost structure. It is cheap to issue, but potentially expensive to maintain. That makes the economics of authentication different from the economics of many other digital features. The business does not pay primarily when the password is created. It pays whenever the credential fails, is forgotten, is stolen or needs to be recovered. Password Resets Are an Operations Problem The familiar “Forgot password?” link hides an entire workflow. The system must verify identity, send recovery messages, manage tokens, expire reset links and prevent attackers from abusing the recovery mechanism. When automated recovery fails, the task moves to customer service or internal IT. In workforce environments, this can become particularly repetitive. FIDO Alliance’s 2026 workforce research found that among organisations already rolling out passkeys, 35% reported reductions in helpdesk tickets for password resets, while 45% reported faster employee login times. The survey covered 1,400 decision-makers in organisations with at least 500 employees across ten countries, so the figures should be read as evidence from that population rather than a universal business benchmark. The significance is not the precise percentage. It is that authentication design can change the workload of an IT organisation. A login method that fails less often does not merely improve UX. It removes tickets before they need to be handled. Helpdesk Cost Is Only the Visible Part Password-reset tickets are relatively easy to see because they appear in support systems. Other costs are less obvious. Employees lose productive time while waiting to regain access. Managers become involved when identity verification is unclear. Security teams create procedures for high-risk resets. Systems need audit logs and abuse protection. Customer-support agents require training around account recovery. The cost is distributed across departments, which makes it difficult to recognise as a single category. There is rarely a line in the financial statements called “password complexity.” Instead, the cost appears as slightly more support headcount, slightly longer onboarding, slightly more security engineering and slightly more downtime whenever access fails. That distribution is precisely why password-based identity can remain operationally expensive without looking expensive. The Business Pays When Credentials Are Stolen Too The cost of passwords is not limited to legitimate users forgetting them. Attackers can steal them. Verizon’s 2025 Data Breach Investigations Report found that stolen credentials were involved in about 88% of breaches classified as Basic Web Application Attacks, illustrating how central compromised credentials remain in that specific attack pattern. Verizon’s broader findings also continued to show strong overlap between social engineering and credential abuse. A compromised credential creates a completely different category of business cost. Incident response. Fraud investigation. Account restoration. Customer communication. Potential downtime. Security remediation. Regulatory or contractual consequences depending on the nature of the incident. The password is therefore unusual because the same mechanism creates both support cost when users cannot remember it and security risk when attackers manage to obtain it. Businesses Compensated by Building More Authentication Around the Password Most organisations did not respond to password weaknesses by removing passwords. They added more layers. SMS codes. Authenticator apps. Security questions. Backup codes. Risk-based verification. Device approvals. Recovery emails. These controls can substantially strengthen authentication, but they also expand the identity system that must be maintained. Now the organisation is not managing one credential. It is managing a credential ecosystem. The employee has a password plus an authenticator app. The customer has a password plus SMS recovery. Administrators may use stronger authentication again. Legacy applications may require different rules. Contractors may have separate access processes. Each additional layer solves a real security problem while simultaneously creating another operational process. Authentication Complexity Becomes Identity Complexity As organisations grow, identity management stops being simply a login issue. Employees join. Employees leave. Roles change. Contractors gain temporary access. Administrators receive privileged accounts. Customers change devices. Systems move to the cloud. Applications are added through acquisitions or departmental purchases. The organisation must continuously answer a fundamental question: Who should still have access to what? Recent FIDO Alliance and HID research illustrates how complicated this environment has become. In a 2026 survey of 500 IT and cybersecurity decision-makers across five countries, 59% of organisations reported managing three or more credential or authentication systems, while 58% said digital identity management had become more complex during the previous two years. Passwords are only one part of that complexity, but they often sit at the centre of it. Onboarding Creates Credentials — Offboarding Must Destroy Them Identity systems have a lifecycle. When an employee joins, the organisation creates accounts and permissions. When that employee changes position, access may need to change. When they
Feature Creep: When More Product Features Create More Cost Than Value
Adding a new feature can look like progress. It gives product teams something new to announce, sales teams another benefit to mention and customers one more reason to consider an upgrade. The problem begins when features accumulate faster than the value they create. This is feature creep: the gradual expansion of a product through new functions, options and exceptions until the product becomes harder to build, maintain, explain and support. What appears to be a small addition on the roadmap can create costs across development, testing, documentation, customer service and operations. For Market Insiders, feature creep is therefore not simply a product-design issue. It is a business question about where growth in functionality stops creating meaningful value and starts creating structural complexity. Feature Creep Rarely Starts With a Bad Idea Most unnecessary complexity does not begin with an obviously unnecessary feature. A customer asks for something. A competitor introduces a new capability. A sales team wants to remove an objection. A large client needs an exception. A product manager sees an opportunity to improve retention. Individually, each request can look reasonable. The problem appears when these additions are evaluated one by one while the cumulative cost of the product is ignored. Over time, a product that once solved one clear problem can become a collection of overlapping functions, legacy options and edge cases that nobody originally intended to support indefinitely. Feature creep is therefore often less about poor decisions than about many locally rational decisions creating a globally inefficient product. Every Feature Creates More Than Development Cost The visible cost of a new feature is usually the engineering time required to build it. That is only the beginning. Once released, the feature may need to be tested every time the product changes. It needs documentation, onboarding, analytics, customer support and compatibility with other parts of the product. Bugs have to be fixed, security issues monitored and future updates checked against the new functionality. A feature can therefore move from being a one-time project to becoming a permanent obligation. The real question is not simply: How much will this feature cost to build? It is: How much will this feature cost to keep? That distinction changes the economics of product expansion. Complexity Compounds One feature rarely exists in isolation. New functionality interacts with existing functionality, which means complexity often grows faster than the number of features themselves. A new pricing option may affect billing, checkout, reporting and support. A new integration can create compatibility questions across multiple workflows. A new permission level can require changes throughout the interface. As these dependencies increase, teams spend more time understanding how changes affect the rest of the system. This connects directly with a broader principle explored in Market Insiders’ “The Cost of Complexity: When Growth Makes a Business Weaker Instead of Stronger” Growth does not only add revenue or capability. It can also add coordination cost. Feature creep is one of the clearest ways that principle appears inside a product. More Features Can Make Development Slower A larger product does not simply contain more code. It contains more relationships between different parts of the product. That means developers may need more context before making changes. QA teams must test more scenarios. Product managers need to consider more dependencies. Releases become harder to coordinate because changing one area may create unexpected consequences elsewhere. Eventually, the organisation can enter a strange situation: the product contains more functionality than ever, but the team becomes slower at improving it. The feature set has grown while product velocity has declined. This is one of the hidden costs of feature creep. Complexity created by past additions begins consuming the resources required for future innovation. Customer Support Becomes More Expensive Every additional capability creates another way for a user to become confused. Different configurations produce different problems. Older features may behave differently from newer ones. Support teams need to understand more workflows and explain more exceptions. A feature used by a small percentage of customers may still generate documentation, tickets and training requirements for years. The cost is particularly difficult to see because it is distributed. There may be no single budget line called “cost of feature X”. Instead, the cost appears gradually across support time, onboarding calls, knowledge-base articles and internal training. A product can therefore become more expensive to operate without anyone identifying one specific moment when the cost increased. Feature Creep Can Make Sales Harder, Not Easier More functionality initially appears helpful to sales because every feature creates another possible selling point. But once the product becomes too broad, another problem appears: the story becomes harder to explain. Sales teams may need longer demonstrations. Prospects can struggle to understand which functions matter to them. Different customers hear different versions of what the product actually is. A product with twenty capabilities may technically address more use cases, but it can also become more difficult to position. This is where product complexity begins affecting go-to-market efficiency. The recently published Targeted.gr article, “The Anti-Feature Consumer: When Simplicity Becomes a Marketing Advantage” examines the customer-facing side of this problem: when fewer features can make a value proposition easier to understand and the product easier to position. For the business behind the product, the same simplification can reduce internal complexity as well. Customer Requests Are Not Automatically Product Strategy One of the biggest drivers of feature creep is the belief that customer demand should always determine the roadmap. Listening to customers is essential. Building everything they request is not. Customers experience their own problems, not the entire product architecture. One customer may reasonably request a specialised workflow that creates long-term complexity for thousands of other users. Enterprise clients can make this pressure even stronger because a feature request may be connected to a significant contract. That creates a strategic tension between winning revenue today and maintaining product coherence tomorrow. The correct question is not whether customers want a feature. It is whether enough customers experience the underlying problem, whether the feature strengthens
Discovery Risk: What Businesses Lose When Customer Research Moves Outside Their Website
For years, businesses could observe a large part of the digital customer journey through familiar signals: search impressions, website sessions, product-page visits, downloads, enquiries and conversions. AI-assisted research is beginning to complicate that picture. A potential customer can now ask an AI assistant to explain a market, compare several products, identify trade-offs and narrow the options before visiting a company website. When the first measurable session finally appears, part of the decision-making process may already have happened elsewhere. This creates what we can call Discovery Risk: the strategic risk that arises when a growing share of customer discovery, comparison and early decision-making takes place in environments the business does not own and cannot fully observe. At Market Insiders, this matters because the issue is bigger than lost website traffic. It affects attribution, customer insight, competitive intelligence and the company’s ability to understand how buyers are forming their first impressions. What Is Discovery Risk? Discovery Risk describes the loss of visibility and control that can occur when customers begin researching a category outside the company’s own digital properties. The problem is not simply that someone may receive an answer from AI instead of clicking a search result. The deeper issue is that the company may no longer see what happened before the customer arrived. A buyer could ask which solutions are suitable for a particular use case, compare three competitors, eliminate one because of price and choose another because it appears easier to use. None of those interactions necessarily creates a website visit. Yet commercially, something important has already happened. The customer has formed a shortlist. The Website Is No Longer Always the Beginning of the Journey Businesses have traditionally treated websites as one of the central points of digital discovery. Search, advertising, social media and email might bring the customer in, but the company could then observe what happened next. AI can move some of that activity upstream. Google says users of AI Mode tend to ask substantially longer questions than traditional search users and often continue with follow-up questions, illustrating how conversational interfaces can support more complex research inside the search experience itself. The result is not necessarily the disappearance of websites. It is a change in timing. A customer may still visit the site, but much later — after the category has already been explained and the alternatives narrowed. That distinction is strategically important because the business may only observe the final part of a much longer decision process. What Businesses Lose First: Visibility Into Intent One of the most valuable assets in digital commerce is not traffic itself, but information about intent. Search queries, landing-page behaviour, product comparisons and conversion paths have historically helped companies understand what customers want and where they struggle. When research moves into AI assistants or AI-enhanced search environments, some of those signals become less visible to the business. The customer may ask extremely specific questions such as: Which accounting platform is best for a ten-person agency that works across three countries and wants to avoid enterprise-level complexity? That question contains far more context than a traditional keyword such as best accounting software. But unless the user eventually reaches the company, the business may never see that intent directly. The irony is that customer questions may become richer at exactly the same time that companies gain less direct access to them. Discovery Risk Creates an Attribution Blind Spot The second problem is attribution. Imagine that a customer first encounters a company through an AI recommendation, remembers the brand name and searches for it directly two days later. Traditional analytics may record: Branded Search → Website → Conversion But that is not necessarily where the journey began. The actual sequence may have been: AI research → AI comparison → brand shortlist → branded search → website → conversion The earlier part of the journey is largely invisible. The Targeted.gr article “The Zero-Click Customer: What Happens When AI Answers Before the Brand Does” examines this marketing problem from the brand perspective: customers can begin forming opinions and shortlists before a company receives a measurable click. For executives, however, the issue extends beyond campaign reporting. If management misidentifies where demand is being created, budget allocation and channel strategy can also become distorted. A Direct Visit May No Longer Mean Direct Discovery This is why some familiar analytics categories may become less informative on their own. A customer who reaches a website directly is not necessarily discovering the company directly. They may have learned about the brand through an AI assistant, a community discussion, a creator, a comparison article or another external environment before typing the URL or brand name. This makes the difference between discovery channel and arrival channel increasingly important. The channel recorded by analytics tells the business how the customer arrived. It does not always explain where the customer’s interest began. The Company Also Loses Control Over the First Explanation Discovery Risk is not only about measurement. It is also about framing. When customers begin their research on a company website, the business controls the initial explanation of its products, positioning and differentiators. When research begins through AI, the first explanation may come from an external system synthesising information from the broader web. The business does not decide which competitors appear next to it, which strengths receive emphasis or which weaknesses are considered important. This creates a strategic asymmetry. The company remains responsible for the quality of the product and the clarity of its positioning, but it no longer controls every environment in which that positioning is interpreted. The Wider Information Environment Becomes a Business Asset For this reason, the value of a company’s digital presence increasingly extends beyond its own website. Reviews, professional coverage, product comparisons, customer discussions, industry publications and other third-party references can all contribute to the information environment in which a brand is understood. This is not entirely new. Reputation has always extended beyond owned media. What changes with AI is the speed at which fragmented information can be