AI Exposure and AI Resilience: A Two-Dimensional Assessment Framework for Software and Software-Based Business Model

I. INTRODUCTION

• The framework complements technical due diligence with assessment of customer value, competitive position, and business-model economics.AI can affect technical and strategic dimensions simultaneously.Source: §I · p. 1
• AI-ER separates AI exposure—the pressure AI places on value propositions, margins, and customer access—from AI resilience—the capacity to absorb pressure and adapt.The dimensions remain separate rather than being collapsed into one overall score.Source: §I · p. 1
• The assessment uses defined metrics and confidence information so comparisons preserve both rating differences and uncertainty in the supporting evidence.Metric ratings remain linked to documented evidence, while confidence reflects evidence quality and agreement rather than rating magnitude.Source: §II · pp. 1–2
• AI-ER derives distinct metrics from AI capabilities, deployment conditions, business-model change, market structure, and organizational adaptability.The derivation retains metrics that add distinct assessment questions and can be supported by observable evidence.Source: §II · p. 2
• AI capabilities are economically relevant only when they can be repeatedly delivered, integrated, and scaled under acceptable operating conditions.Technical availability alone does not establish durable economic advantage because similar capabilities may be accessible to firms, customers, competitors, and platforms.Source: §III · p. 2, A. Economically Relevant Capability… · p. 2

Deployment conditions and limits

• Deployable AI requires more than model capability because workflows must maintain state, detect errors, preserve responsibility, and provide integration, monitoring, and human control.Uncertainty can accumulate across longer workflows, especially when outputs affect complex or liability-sensitive processes.Source: B. Deployment Conditions and Limits · pp. 2–3
• Economic viability remains distinct from technical feasibility because operating, assurance, integration, legal, security, traceability, and oversight requirements can reduce or restrict benefits.AI-ER treats capabilities as economically relevant only when they are sufficiently reliable, available, viable, and permissible in context.Source: B. Deployment Conditions and Limits · pp. 2–3, B. Organizational Resilience and… · p. 3

Conceptual foundation

• AI-ER combines technological exposure, business model, platform economics, and organizational resilience perspectives to assess individual companies.The framework connects technical overlap with value creation, economic capture, competition, customer access, and organizational response.Source: §IV · p. 3, A. Technological Exposure and Business… · p. 3, B. Organizational Resilience and… · p. 3
• Technical proximity to AI capabilities indicates potential for change but does not establish automation, economic weakening, or company-level exposure.Operational conditions, business logic, market structure, and customer access determine how technical overlap affects a company.Source: A. Technological Exposure and Business… · p. 3
• AI-ER distinguishes AI exposure as pressure on a business model from AI resilience as the capacity to absorb pressure, adapt, and use AI for value creation.The dimensions are deliberately not combined: high exposure can coexist with high resilience, and low exposure with weak adaptability.Source: C. Research Gap and Conceptual… · p. 3, B. Organizational Resilience and… · p. 3

Exposure metrics

• Exposure begins with substitutability of the paid customer benefit and replicability of the offering, which remain separate because customer displacement and technical copying need not coincide.Replicability accounts for company-specific data, integrations, domain knowledge, and regulatory requirements.Source: B. Deriving the AI Exposure Metrics · p. 4
• Competitive dynamics, the business model modulator, and customer access capture changes in provider behavior, value capture, willingness to pay, intermediation, and the provider-customer relationship.Productivity or quality gains can dampen exposure when value is retained by the company, but amplify it when benefits mainly accrue to customers, competitors, or new entrants.Source: B. Deriving the AI Exposure Metrics · p. 4, A. Economic Impact Mechanisms · p. 4
• The framework defines four numerical exposure metrics and one categorical business model modulator covering core benefit, offering replicability, competition, economic direction, and customer access.The metrics are retained when they ask distinct assessment questions and can be supported by observable evidence.Source: B. Deriving the AI Exposure Metrics · p. 4, §V · p. 4

Resilience metrics

• Economic viability compares development, operation, control, and external-dependency effort with expected value creation and customer benefit.This prevents technical feasibility from being treated as sufficient evidence of lasting economic value.Source: C. Deriving the AI Resilience Metrics · p. 4
• Resilience comprises five distinct metrics: protective positions, adaptability, technical AI maturity, implementation capability, and economic viability.Together they assess both the ability to respond and the conditions for converting technical possibilities into operational and economically lasting solutions.Source: C. Deriving the AI Resilience Metrics · p. 4

• AI-ER derives four numerical exposure metrics, one categorical business-model modulator, and five numerical resilience metrics.Source: D. Overview of the Metrics · p. 5, Table I · p. 6
• The non-compensatory score logic keeps critical individual scores visible instead of allowing favorable values on other drivers to hide major weaknesses.Source: §VI · p. 5, A. Notation · p. 5, B. Determining the Individual Scores… · p. 6
• AI-ER supports public-information assessments that can later be refined with internal evidence, changing scores or confidence without changing the underlying model.Source: §VI · p. 5
• Metrics are rated against substantive scale anchors, while thresholds, combination rules, and modulators are fixed configuration parameters requiring empirical comparison.Source: A. Notation · p. 5, B. Determining the Individual Scores… · p. 5
• Exposure uses substitutability and replicability as core drivers, with competitive dynamics and customer-access pressure entering through an additional indicator.Source: B. Determining the Individual Scores… · p. 6
• Resilience uses protective positions and adaptability under weakest-link logic, while technical maturity and implementation capability provide additional assessment dimensions.Source: B. Determining the Individual Scores… · p. 6

• Evidence quality evaluates directness, timeliness, completeness, independence, and agreement, with configurable positive weights and equal weighting as the default.Source: C. Evidence, Consistency, and Confidence · p. 7
• Independent-run agreement measures deviation from the joint median, with identical ratings producing Aij = 1 and larger deviations lowering agreement.Source: C. Evidence, Consistency, and Confidence · p. 7
• Evidence-source agreement and independent-run agreement remain distinct because they assess the evidence base and rating stability, respectively.Source: C. Evidence, Consistency, and Confidence · p. 7
• With multiple runs, confidence is limited by the weaker of evidence quality and rating agreement; with one run, it relies on evidence quality alone.Source: C. Evidence, Consistency, and Confidence · p. 7
• Dimension confidence uses only decision-relevant metrics, including selected core drivers, activated indicators, and modulator-determining metrics.Source: C. Evidence, Consistency, and Confidence · pp. 7–8
• A high dimension score with low confidence requires further evidence, and near-threshold scores may change quadrant assignments after reassessment.Source: C. Evidence, Consistency, and Confidence · p. 8, Figure 2 · p. 8, Table II · p. 8

• The Defended Niche combines low exposure with high resilience, making the core benefit comparatively difficult to attack while retaining adaptation capacity.Source: D. The Two-Dimensional AI-ER Profile · p. 8
• The AI-Ready Compounder combines high exposure with high resilience, indicating strong environmental change alongside conditions for active adaptation and AI use.Source: D. The Two-Dimensional AI-ER Profile · p. 8
• Rebuilding Required combines low exposure with limited resilience, placing the primary action need on protective, adaptive, and implementation capability.Source: D. The Two-Dimensional AI-ER Profile · p. 8
• Acute Threat combines high exposure with low resilience, creating an immediate need for review and action around vulnerable services and insufficient capability.Source: D. The Two-Dimensional AI-ER Profile · p. 8

Outside-in analysis

• Public information produces an initial rating for the nine metrics and business model modulator, while also identifying weak support and information gaps.This makes a provisional AI-ER profile available before internal data collection is complete.Source: E. Analysis Layers and Presentation of… · p. 8

Inside-in analysis

• The subsequent inside-in run adds internal technical, organizational, process, and economic information and can change metric scores and confidence.It tests assumptions formed from public evidence using the same metrics and score logic.Source: E. Analysis Layers and Presentation of… · p. 8
• A nonzero Δxij revises the preliminary rating, while unchanged scores can still receive different confidence when added evidence changes Qij.With one inside-in run, L = 1 and confidence reduces to Cij = Qij.Source: E. Analysis Layers and Presentation of… · p. 8

Presentation of results

• The profile combines two dimension scores, a quadrant position, and a complete metric profile rather than relying on one aggregate score.Exposure and resilience remain jointly interpretable because both dimensions can be high at the same time.Source: E. Analysis Layers and Presentation of… · p. 8
• Each metric remains traceable through its justification, evidence quality, rating agreement, confidence, assumptions, and recorded information gaps.Tables III and IV provide the illustrative exposure and resilience ratings for Company A.Source: E. Analysis Layers and Presentation of… · p. 9, Table III · p. 9, Table IV · p. 9

Exposure calculation

• Company A reaches the highest exposure level because substitutable core benefits, threshold-level competitive dynamics, and an amplifying business model effect raise its score.The core exposure drivers have values of 3, with a base value of 4 before the additional steps.Source: F. Illustrative Numerical Example · p. 9

Resilience calculation

• Resilience is limited more strongly by adaptability than by technical AI maturity, although economic viability remains above the penalty threshold.The resilience core drivers have value 3, while technical AI maturity and implementation capability reach 4.Source: F. Illustrative Numerical Example · p. 9

Confidence calculation

• With ratings 4, 4, and 5, evidence quality 0.8, and agreement ≈0.83, metric confidence equals the lower value, 0.8.Dimension confidence is then calculated from the decision-relevant metrics.Source: F. Illustrative Numerical Example · p. 9

Overall profile

• Company A combines exposure E_A = 5 with resilience R_A = 4 and falls in the AI-Ready Compounder quadrant.The example is hypothetical and has no empirical meaning.Source: F. Illustrative Numerical Example · p. 9
• The example shows why AI exposure and AI resilience should not be collapsed into one score.High exposure and substantial response capacity coexist in the same company profile.Source: F. Illustrative Numerical Example · p. 9

Limits

• The framework has not yet been empirically validated, so its metrics, application reliability, score stability, and relationship to later company developments remain open questions.The confidence model also requires separate examination because it is intended to distinguish well-supported ratings from provisional ones.Source: §VII · p. 9

Comparative case studies

• Comparative case studies should span software business models, exposure-resilience combinations, company sizes, market positions, and prior AI use.Each case can be assessed first from public information and then reassessed with internal evidence.Source: A. Approach to Empirical Validation · p. 9

Reliability and distinctness

• Independent assessments should test rating reliability with statistics such as Krippendorff’s alpha or Cohen’s kappa.Large deviations would indicate unclear concepts, weak scale anchors, or excessive interpretive freedom.Source: A. Approach to Empirical Validation · p. 9
• Validation should examine whether metrics within each dimension remain empirically distinct and whether exposure and resilience can be separated as intended.These tests address whether the framework’s dimensions retain distinct constructs in application.Source: A. Approach to Empirical Validation · p. 9

Longitudinal validation

• Longitudinal validation should compare earlier assessments with later developments in differentiation, pricing, margins, customer access, products, processes, technical structures, or business models.This tests the proposed predictive relevance of high exposure and high resilience.Source: A. Approach to Empirical Validation · p. 9

Sensitivity and confidence

• Sensitivity analysis should vary thresholds, combination rules, weights, and modulators to determine whether dimension scores remain stable.The confidence model should also be tested against later evidence and repeated assessments, with high-confidence ratings expected to be more stable if it works as intended.Source: A. Approach to Empirical Validation · pp. 9–10

B. Limits of the Assessment Framework

• The exposure maximum and resilience minimum rules are conceptual choices whose suitability across industries and business models remains an empirical question.The current scale anchors, thresholds, combination rules, evidence weights, and modulators have not been calibrated on a large sample.Source: B. Limits of the Assessment Framework · p. 10
• Public information often covers products and visible AI activities better than internal technical or organizational conditions, limiting evidence quality.The confidence model makes this asymmetry visible but cannot replace missing evidence.Source: B. Limits of the Assessment Framework · p. 10
• AI-ER assessments are time-bound because changes in AI capabilities, costs, competition, regulation, or internal transformation can alter both dimensions.Assessments should be updated when material conditions change, and scale anchors or evidence requirements may need industry-specific adaptation.Source: B. Limits of the Assessment Framework · p. 10
• A single AI-ER assessment does not establish causality, because company performance is influenced by factors beyond AI.Dimension scores should be read with individual metrics, supporting evidence, and confidence, alongside strategic, technical, and financial analysis.Source: B. Limits of the Assessment Framework · p. 10
• AI-ER keeps exposure and resilience separate, making visible cases where a company is highly exposed but also well prepared to respond.The framework is intended to provide a structured profile rather than a universal company grade.Source: §VIII · pp. 10–11
• The proposal requires empirical validation through comparative cases, independent assessment runs, longitudinal observation, and sensitivity analysis.Implementation tests can support practical applicability but do not replace broader validation or refinement of anchors, thresholds, weights, and modulators.Source: §VIII · p. 11

APPENDIX A NOTATION AND MODEL PARAMETERS

• Resilience notation covers protective positions, organizational and strategic adaptability, technical AI maturity, implementation ability, and economic viability.The corresponding ratings are xprot_i, xadapt_i, xtech_i, ximpl_i, and xecon_i.Source: Appendix A · p. 13
• The model includes an economic-viability modulator M_econ_i for low economic viability within the resilience assessment.The parameter is defined as a modulator for company i rather than as another resilience capability rating.Source: Appendix A · p. 13
• The formal notation includes company-level exposure and resilience dimension scores, indicator functions, decision-relevant metric sets, and dimension confidence scores.Ei and Ri denote AI exposure and resilience scores, while CEi and CRi denote confidence in those dimension scores.Source: Appendix A · p. 13
• Evidence quality Qij aggregates five properties: directness, timeliness, completeness, independence, and substantive agreement.Component scores q(k)ij lie in {0, 0.5, 1}, and weighted evidence components contribute to the quality measure.Source: Appendix A · p. 13
• Agreement Aij represents agreement among independent ratings when at least two assessors provide ratings, while Cij denotes confidence in a combined metric score.These quantities separate rating agreement and evidence quality from the metric value itself.Source: Appendix A · p. 13
• Table VI lists configurable AI-ER parameters with value ranges and default configuration, and deviations should be documented for validation.The default values reflect the initial configuration used in the paper.Source: Appendix A · p. 12, Table VI · p. 14