Your AI Model may be Replaceable. Memory Isn’t.

The AI model your company picks this year is your least sticky technology decision. What you cannot switch so easily is everything your agents learn about your business while they use it. The lock-in has moved from the model to the memory, and you need to ask who keeps it.

What’s happening?

For two years the AI race was about models. In the past six weeks the competition has moved down a layer, to memory. Memory here means what an AI agent keeps between conversations: who you are, how your team works, what was decided last time and why.

Let’s take a look at what enterprise vendors shipped just this year:

• 20 October: Couchbase made its managed Agent Memory generally available on AWS. It stores profiles, conversation history and facts across sessions. Couchbase claims it cuts token use by 33–45%. Tokens are the units AI providers bill by.
• 21 October: Microsoft updated its documentation for memory in Copilot Studio agents, a preview feature. Memories sit in Microsoft-managed storage. Users can view and delete theirs. They are deleted after 28 days of user inactivity.
• 5 November: At BoxWorks, Box announced a “context layer” for enterprise agents, built with Nvidia models. It lets agents search your contracts and documents within existing file permissions. Box claims up to 90% fewer tokens; general availability is planned for early next year.

These follow Redis‘s May launch of Iris, a “context and memory platform for AI agents“, and Notion‘s open-source shared-memory tool for agents in August. On the consumer side, Anthropic now lets people import what ChatGPT or Gemini remembers about them into Claude.

The pitch is the same everywhere. An agent that remembers needs to be told less, so it costs less and makes fewer mistakes. That pitch is mostly true. It is also why memory is about to become the stickiest part of your AI stack.

Why it matters: the notebook problem

Imagine you hire a brilliant contractor through an agency. Over a year they fill a notebook with which clients get exceptions, why a policy bends at month-end and which approver actually matters. You can replace the contractor. You can’t easily replace the notebook, and if it belongs to the agency, changing agencies just got very expensive.

The model is the contractor and memory is the notebook. It is easy to sign an AI contract without ever asking who keeps it.

The investors Jaya Gupta and Ashu Garg of Foundation Capital set out the logic last December. The last generation of business software locked customers in by owning their data and workflows. The next prize is “decision traces”: the exceptions, overrides and approvals that today live in chat threads and people’s heads. Whoever captures them at the moment decisions are made holds the most valuable asset. They also predicted incumbents would make that data expensive to extract.

Three things follow for enterprise leaders to keep on their radar.

• Your leverage over model vendors depends on moving memory. New frontier models arrive almost monthly and prices keep falling. You only benefit from that competition if you can switch without losing what your agents have learned.
• Portability is thin today. Claude’s memory import works by asking ChatGPT to summarise what it remembers and pasting that in. It is a summary, not a record. Microsoft’s memory documentation explains how users view and delete memories, but says nothing about exporting them.
• Memory rots. When Notion’s engineers audited their own agent memory, 15–20% of it was duplicates and about 13% had no value. They made stored facts expire unless reinforced. If an agent remembers something wrong, it keeps acting on it.

What it means for your organisation?

Keeping model and memory apart affects several decisions.

• Buying and architecture. Treat the model and the memory as two separate purchases. You would never let a vendor hold your core banking ledger in a format only they can read. Agent memory deserves similar thought, at least for core workflows.
• Data governance. Memory is a new kind of corporate record. In a bank or telco it will hold traces of customer conversations, staff preferences and the reasons behind decisions. It needs the same rules as any record: who can see it, how long it is kept, how it is deleted. Vendor defaults will not always match your policy. Microsoft’s 28-day deletion rule may be too short for an audit trail, or too long for sensitive data.
• An error in memory can spread without anyone noticing, and so can a secret. Memory is also a target: anyone who can plant a false “fact” in an agent’s memory can steer its future actions.
• Teams and skills. Someone has to curate what agents remember. Clearing stale facts, merging duplicates and checking for sensitive data is closer to a librarian’s or data steward’s job than a prompt engineer’s.
• Services and client expectations. For software houses building agents for clients, trust will depend on how they handle the memory layer. Clients will start asking who owns what the agent learns. Firms that can answer “you do, and here is the export” will have a selling point.

What to do immediately?

Secure the notebook now, while it is still thin and cheap to move.

• Map your agents’ memory. For every AI tool in use, write down what it remembers, where that is stored, who can see it and how long it lasts.
• Add three clauses to every AI contract. Export of memory and context in a usable format. Deletion on request, with confirmation. No use of your memory to train vendor models without consent.
• Keep core memory in a layer you control. For workflows that matter, store agent memory in your own database or cloud account. Connect it through open standards such as MCP, the Model Context Protocol, a common plug that lets agents from different vendors reach the same tools and data.
• Run a switching drill. Pick one live agent and move it to a different model, keeping its memory. What breaks tells you how locked in you are.
• Name a memory owner. Give one person or team the job of reviewing what agents remember: removing stale facts, merging duplicates and flagging sensitive data.

The counter-argument

The lock-in risk may be smaller than it sounds, for now. Much agent memory today is short notes and summaries that could be rebuilt in weeks. Your real data still sits in your core systems, not in the agent. Building your own memory layer also costs engineering time, although, for low-stakes tools, the vendor’s built-in memory is fine.

Still, the valuable part, the record of how and why your organisation decides things, grows every day. It is cheap to secure while it is small and expensive to recover once it is large.