Software that only holds a workflow is going extinct. The vendors with the data will outlive it.

Back to Insights

On a Friday afternoon this year, in a fund business you would recognise, a head of compliance who has never written a line of code built a breach register. She described what she wanted to a language model, pointed it at the firm's data warehouse, corrected it twice, and by five o'clock had a tool that did what the £30,000-a-year product it replaced did, minus the features she never used. Nobody raised a ticket. The renewal notice for the old tool is still in someone's inbox.

The same is happening to the CRM the sales team tolerates, the risk dashboard that took a vendor two quarters to change, the onboarding tracker. Each was a database with workflow on top, and the workflow is now the part a subject matter expert can describe into existence. What she cannot describe into existence is the data: clean, connected, permissioned, with a history. The software is becoming disposable and the data layer is becoming the asset, and most firms have their spending and their governance the wrong way round.

What actually died

Satya Nadella said it in December 2024: "the notion that business applications exist, that's probably where they'll all collapse, right in the agent era". The market took fourteen months to believe him. Between 12 January this year, when Anthropic released agent plugins for legal, compliance, sales and financial analysis, and 23 February, a software index lost a quarter of its value. Investors were pricing the end of paying for a workflow.

Klarna got told both ways. In 2024 its CEO announced the firm was shutting down Salesforce and Workday in favour of its own AI. By March 2025 he was correcting the record: "We started consolidating; put things together, connected our knowledge, removed the silos. So no, we did not replace SaaS with an LLM." What Klarna kept, and invested in, was the data layer. What it stopped needing was the software on top. Data as a service and data science as a service grow from here. Software as a service dies wherever it was only ever a workflow behind a login.

The five-mark test

Not every vendor on your list is in trouble, and the test is short enough to run before the next renewal round. One mark for each. It holds no data of its own, so everything it works on is your data and cancelling it would cost you the screens and nothing else. Its functionality is fixed. It charges annual recurring revenue for access rather than for outcomes or data. It ships updates every few months. And it performs no regulated function, so nobody licensed it and if it fails the liability is yours. Five out of five and a department can rebuild it in a week. Two or fewer and you are looking at a platform. You could build a transfer agency system with a language model; you cannot build the licence, the connectivity, the counterparty who answers to the regulator at 3am, or the trust of every other firm in the market, which is what a register actually sells.

The data layer is the system of record now

Take the CRM. Strip away the pipeline screens and what is left is a table of people, firms, interactions, permissions and consent, joined to the fund register and the fee schedule. That table is the asset; the screens were the price of getting at it. When the sales team builds its own front end, more of the firm is reading and writing to that table through tools nobody vetted. Every tool your people build makes the data underneath it more important and more exposed at once.

So the data layer has to be run like a system of record, which in most mid-sized firms it is not. Who owns each dataset? What is its lineage, and who may change it? Which tools can read it, which can write to it, through what credentials? When the vendor that sat on top of it goes, who inherits the controls it quietly performed? Answer those and your data becomes the platform your subject matter experts build on. Not every firm will build that layer. A forty-person manager with no engineers will rent it as a managed service, its own data hosted and governed by someone else, and that is a sound answer provided the firm still owns the data, the lineage and the right to walk away with it, because the accountability does not move with the hosting.

The same line separates the vendors, and the question is whose data it is. Your clients, positions and consents are yours; only you can consolidate them. The regulatory corpus and how it changes, the product and instrument universe, market and reference data, a domain model refined across many firms over years: those you cannot originate, and that is what a vendor's data layer holds. Regulatory reporting is the clearest case. The vendor that maintains the taxonomies, the validation rules and the interpretation of every change, refined across hundreds of firms and connected to the submission channel, is selling something no compliance team can describe into existence on a Friday afternoon. A vendor whose layer is a schema over your own records is a tool with a good story. A vendor whose layer holds knowledge you do not have, with lineage under every answer, the integrations into your core systems, and the governance that lets you run forty agents rather than one, is selling data as a service whether it calls itself that or not. It is a position a vendor can build on purpose, as ratings houses and market data providers did long before anyone said agent, and those vendors are the ones to move spend towards, not away from.

What the CTO does now

When I held CIO and CTO seats, the scarce thing was the ability to build, and part of the job was saying no often enough to keep the estate under control. That constraint has gone. Compliance builds its own register, risk its own dashboard, sales its own front end, and none of them files a change request because none of them thinks of it as software. The CTO who tries to stop it will lose, and the CTO who ignores it will one day explain to a regulator why a tool nobody logged was writing to the client file.

So the job inverts, into three things. A register: every tool the firm runs, who owns it, what data it reaches, what model it calls, what it may decide alone, because a tool your own people built needs the same file as one a vendor sold you. A governed data layer: access controls, a model gateway, secrets management and lineage, so a prototype reads and writes through doors the firm controls. And a review gate, because the failures will be security failures first. In May 2025 a researcher found more than 170 applications built on Lovable, a popular build-it-yourself platform, had left their databases open, live API keys included. First-week developer mistakes, made by people who did not know they were developers. Your head of compliance has never heard of row-level security, and she pasted a credential into a prompt.

None of this shrinks the engineering team. It moves its work down a layer. The most valuable thing the firm's engineers can build now is the data layer itself: consolidating the client, portfolio, product and regulatory data that sits in six vendors and four spreadsheets into one governed layer, which is what Klarna did, or, where the data is the firm's edge, building the proprietary model nobody else can rent. Where the technology is the service itself, an exchange, a depository, an administration platform, that layer is the product and the engineers are the firm. The departments build the tools on top; the engineers run the gate and harden the best of what the subject matter experts produce into the product. So the CTO still builds, but builds the data layer, and governs the tools: the person who can tell the board what every tool can reach, what it runs on, and who signed for it.

There is a regulatory sting in this that I set out in the accountability piece. Rent a vendor's agent and you are the deployer. Build the tool yourself, or change what the vendor's does, and under Article 25 of the EU AI Act you have become the provider, with nobody to call when it drifts. The tool is free to build and expensive to own, and the register is how a firm knows what it owns.

The first piece in this series asked what stops a language model rebuilding your product by Friday. The five marks are that question answered from the buyer's side. When I wrote my book, build versus buy was one of the hardest technology decisions a firm made. It is now one of the easiest, and the hard decision has moved underneath, to who owns and governs the data everything is built on.

So three things for Monday. Score the vendor list against the five marks and stop renewing the fives. Move the money and the attention from the tools to the data layer: own it, clean it, govern who reads and writes to it, buy in what you cannot originate. And point your engineers at the data layer and your subject matter experts at the tools on top of it, with someone accountable for the register of what they have built.

If you run the firm, this is the ground my Operating Model and AI Business Case and Technology Selection work covers. If you sell to firms like it, the five marks are a product strategy: move every mark you can from the tool column to the platform column. That is the conversation I have with vendors every week.

Declan Sheehy is the founder of One Blackwater Consultancy and advises FCA-regulated fund and asset managers, and the fintech and RegTech firms that serve them, on GTM, AI strategy, governance, and operating models. He spent eighteen years scaling an alternative investments platform from $200 million to $31.6 billion. He is an IAPP-certified Artificial Intelligence Governance Professional (AIGP) and the author of Disruptive Innovation in Financial Services (2026).