At MACH X, Composable Stacks Pay Off a Second Time

Most companies that moved to composable commerce did it for flexibility. They wanted faster change, less vendor lock-in, and the freedom to swap a component without rebuilding everything around it. At MACH X Amsterdam last week, several of the brands on stage described a second return they hadn't planned for. Simoné Ciccioni, AI Enterprise Manager at PhotoSì, summed it up on a slide: "We chose composability for flexibility. It also gave us a foundation for AI." Business capabilities exposed through defined interfaces turn out to be exactly what AI tools and agents need to do useful work.

Antonia Hansen, Group Director of Product at JD Sports, described the first return in concrete terms. Two years ago, JD ran a heavily customized, home-grown monolith, and more than 12 months had passed since its last release. It has since replaced seven or more legacy systems with a stack that includes commercetools, Algolia, Amplience, Bloomreach, and Stripe. While Hansen noted the revenue impact was important, she said the bigger gains were in delivery: three features launched since early August, two more developed, and four planned before November peak. For a team that had gone more than a year without a release, that's a different operating model.

"To fail fast," she said, "you have to be able to build fast." And JD Sports is already pointing that capacity at AI, with LLM-based channels on its medium-term roadmap.

Flaconi is further along the same path. The beauty retailer moved to a MACH architecture between 2019 and 2021 and has been optimizing continuously since. Its AI and automation strategy (run by a dedicated taskforce led by Sven Rosemann, Flaconi’s CTO) operates on three levels. Every employee gets safe access to generative AI tools, business teams automate their own work without code or a backlog, and custom agentic solutions are built where they pay off, under a build-or-buy discipline. The ambition Rosemann described on stage was more speed with the same people, and the composable foundation Flaconi laid years ago is what makes that ambition practical.

Daniel Gebler, Founder & CTO of Picnic, brought the perspective of a company that has never had a monolith to escape. Picnic's view is that a million customers need a million storefronts, each unique and tailored to the individual’s needs and preferences. Their innovation extends beyond the front end into fulfillment, where robotics has supported human efficiency to ensure customers get what they want when they want it. Rather than have people walk an expansive warehouse to pick orders, Picnic uses robotics to bring the items to the people.

Gebler shared his five lessons from scaling a disruptive business, which apply just as well to any company introducing agentic AI: dream big and act small, put the mission first and use data as support, do data science first and AI second, launch first and scale second, and trust small teams to build great products. Gebler also argued for killing ideas deliberately and quickly once the evidence turns against them— a sentiment echoed by Hansen in her keynote. Gebler credited a strong engineering culture with outweighing the suboptimal decisions every growing company makes.

On the vendor side, Vercel CTO Malte Ubl offered an important perspective. Vercel is eyeing a world where machines write all of the code, and already they have seen AI drive up output from 1 million to 10 million deployments per day. That increase in capability is impressive, but Ubl shared a warning alongside it: "Everything hackable will get hacked." It became the sharpest point of the day. He argued that the industry is underinvesting in security, and pointed to Vercel's seven-figure bug bounty as one response for counter-acting the threat.

Ubl's warning perhaps got less airtime than it deserved, given how closely it connects to everything else said on stage. The defined interfaces that give PhotoSì's agents a head start are also an attack surface. A team shipping at JD Sports' new pace has less time to scrutinize each change, and a world of machine-written code multiplies the number of changes to scrutinize.

Seen in that light, Ciccioni's vendor question about whether an agent can use a capability "with the permissions and controls we require" is a security requirement as much as an architectural one. Brands that already have a composable foundation can start asking it of every vendor in their stack now, and brands still planning a first replatform have the chance to write it into their requirements before they choose anyone.