Four Business Models for the AI Era

Jun 8

4 min read

The MIT Center for Information Systems Research (MIT CISR), led by Peter Weill and Stephanie Woerner, recently released a major update to its renowned digital business model framework. Based on an analysis of 2,378 companies studied between 2013 and 2025, this new framework is no longer “digital”: it is AI-native. It is based on two simple axes:

action along the value chain (assisting vs. representing the customer)
and business execution (structured vs. adaptive),

which define four quadrants. An educational breakdown, with examples, adaptation to agent-based AI, the importance of compliance, and avenues for governance by design.

1. Existing+: Enhancing Existing Operations with AI

Principle. The company sells its current products and services, but its predefined processes are enhanced by AI. Employees make decisions, improve processes, and perform the bulk of the work. Revenue: Traditional sales of products and services.

Examples. Most major traditional banks (BNP Paribas, Crédit Agricole) are at this stage with their Copilot advisors; Microsoft integrating Copilot into Office 365, Salesforce with Einstein AI in its CRM, or L'Oréal enhancing its existing brands with AI-powered virtual try-ons all fall under the same model.

Agent-based AI? Low. AI remains an assistant, rarely an autonomous agent. We are in the realm of suggestion — consistent with a human-augmented approach.

Compliance. Moderate weight. Processes remain human-in-the-loop, so EU AI Act requirements (transparency, documentation of high-risk systems) can be managed using existing mechanisms (DPO, CISO, internal control). ISO 27001 is more than sufficient; ISO 42001 becomes a differentiator but not a necessity.

Governance by design. Systematic logging of AI interactions, user-side opt-out rights, quarterly reviews of bias in AI outputs, and above all clear accountability: humans sign off, AI suggests.

2. Customer Proxy: acting on behalf of the customer via structured processes

Principle. The company achieves a outcome defined by the customer through predefined processes. The employee becomes the customer’s advocate. Revenue: compensation based on achieving the outcome, not on product sales.

Examples. Robo-advisors like Yomoni or Nalo (“achieve your retirement savings goal”); Wealthfront and Betterment in the United States; health insurance providers like Alan that manage reimbursement end-to-end; Amazon with Subscribe & Save, which automatically restocks. A financial services firm could define parameters to automatically manage a client’s investment portfolio - this is typically Customer Proxy.

Agentic AI? Medium-high. Agents execute predefined processes within strict guardrails. This is constrained agentic AI, what the Agentic Risk Standard calls Level 1 or 2 agents.

Compliance. High weight. Acting on behalf of the client engages the company’s contractual and regulatory liability (MiFID II in finance, GDPR for automated decisions, PSD2 for payments). Article 22 of the GDPR on automated decision-making becomes central. ISO 42001 is virtually indispensable for demonstrating control.

Governance by design. Auditable outcome tracking (client KPIs + proof of compliance with guardrails), an opt-out mechanism available at any time, human escalation for borderline cases, and end-to-end traceability of every automated decision. Key principle: the agent must be able to explain why it acted.

3. Modular Curator: assembling building blocks in real time

Principle. The company delivers services, either individually or bundled, created through AI-mediated cross-company collaborations. Revenue: share of customer service bundles. Employees ensure that products integrate in real time with those of other companies.

Examples. Stripe composes payment + anti-fraud + KYC in real time via third-party APIs; Shopify assembles e-commerce + payment + logistics + marketing; Plaid aggregates banking data; Booking.com combines flight + hotel + rental. In France, Qonto integrates accounting, invoicing, and payment via a network of partners, or Doctolib orchestrates telemedicine, electronic prescriptions, and pharmacy services.

Agent-based AI? Strong. AI dynamically composes bundles based on the customer context, this is the very essence of compositional agent-based systems.

Compliance. Very high and distributed burden. Each partner in the bundle brings its own regulatory framework (DORA for operational resilience, DSA for intermediaries, GDPR for data transfers). chain liability becomes a legal nightmare. The EU AI Act imposes different obligations depending on each agentic building block.

Governance by design. Inter-company contracts with AI clauses (SLAs on models, audit rights), mandatory data lineage (knowing where every piece of data used by the AI comes from), and continuous supervision of the composition (a bundle that changes with every client request is a bundle that must be monitored with every request). An agent registry becomes indispensable.

4. Orchestrator: Representing the customer in an adaptive ecosystem

Principle. The company achieves the customer outcome through AI-mediated adaptive collaborations. Revenue: a share of customer value. Employees are accountable for the design, ethics, and results of the business model. This is the most ambitious quadrant.

Examples. A financial services firm could provide a fully managed wealth management solution that automatically and continuously optimizes the portfolio. This is known as autonomous wealth management. Ping An in China with its health+insurance+finance ecosystem; DBS Bank in Singapore with its “life goals” model; Tesla orchestrating vehicle + energy + insurance; Amazon in global logistics.

Agentic AI? Maximum. The orchestrator is an ecosystem of agents. This is the core of Level 3-4 agentic systems.

Compliance. Extremely critical. The cumulative impact of all previous regulations plus systemic liability. The EU AI Act will classify these systems as high-risk and quasi-systemic. Algorithmic transparency, explainability, right to appeal, fairness: all apply, at every moment, throughout the entire chain.

Governance by design. This is where governance by design truly comes into its own: an AI ethics committee with the power to halt operations, a regularly tested agentic kill switch, permanent red teaming, simulation of adversarial scenarios, and explicit alignment with ISO 42001 standards + the EU AI Act + sector-specific regulations. The board of directors must be a stakeholder—we are moving beyond the technical into the strategic.

The subtle signal not to be missed

“Ecosystem driver” companies have grown from 12% in 2013 to 58% in 2025, and they are the only ones to exceed their industry’s average growth. Translation: the upper-right quadrant is where economic performance lies, but it is also where regulatory complexity is at its peak. Attempting to reach this quadrant without addressing governance upstream, by design, not bolted on, is akin to building a skyscraper without a soil study.

The real question for your executive committee isn’t “Which quadrant are we in?” but “Which quadrant do we want to be in three years from now, and what governance structure do we need to build right now to get there?”

---

Sources: Weill, Sebastian, Woerner, Benedict, “Business Models in the AI Era,” MIT CISR Research Briefing, Oct. 2025; Brian Eastwood, “How digital business models are evolving in the age of agentic AI,” MIT Sloan Ideas Made to Matter, Jan. 2026.