Welcome back for the final part.

In Part 1 we covered the four AI-driven gaps. In Part 2 we went through the deadline-driven ones: e-invoicing, pay transparency, the Cyber Resilience Act and carbon data.

Part 3 is different. These four gaps are about two slower forces: trust and demography.

Trust, because it's getting harder to know whether the voice on the phone is really your CEO. Demography, because a generation of owners is retiring while their employees care for ageing parents.

Neither force makes headlines as AI agents do. But they're far more predictable. You can't postpone a birthday.

1. Is that really your CFO? Deepfake fraud defence for SME finance and HR teams

This picks up from our 2023 look at cybersecurity gaps. Back then the worry was integrated security and a skills shortage. Now the attack has a face and a voice.

Voice-cloned "CEO" calls, fake video meetings, synthetic job applicants and AI-written invoice fraud all go after the same targets: whoever can move money or hire people. Banks can buy enterprise identity tools. Most SMEs rely on their staff's gut feeling, and people are not good at spotting deepfakes.

Why now? The attacks are already common. A Gartner survey of 302 cybersecurity leaders, fielded March to May 2025, found that 62% of organisations had faced a deepfake attack in the previous 12 months. Gartner's definition is broad, covering impersonation on calls and attempts to fool face or voice biometrics. The most common pattern, according to Gartner, is the simplest one: pretend to be an executive and get someone to wire money.

The AI Act's Article 50 deepfake-labelling duties have applied since August 2026. That raises awareness, but criminals won't label their fakes.

What's the potential? Big, but read the headline numbers carefully. In 2024, the Deloitte Center for Financial Services projected that generative-AI-enabled fraud losses in the US could reach $40 billion by 2027, up from $12.3 billion in 2023.

To be clear: that's a two-year-old projection, and Deloitte's aggressive scenario. It isn't a measurement. Losses actually reported so far are much lower. Treat the $40 billion as a sign of where things could go, not a market size.

What's the key to success? Process before detection. Detection software is in an arms race with generation software, and the fakes keep getting better. A callback rule, a code word or a second approver for payments works whether or not the fake is convincing. Distribution matters too. SMEs rarely shop for fraud tools, but they do listen to their bank, their insurer and their IT provider.

What you could build:

• A "callback and code-word" kit with an app for payment approvals, priced per finance team and sold through banks or insurers.
• Deepfake-resistant hiring checks for remote recruiting: liveness checks combined with document and reference verification.
• Deepfake simulation drills for SMEs, sold as an add-on through managed IT providers.

Risk check: Many headline deepfake stats come from vendors with something to sell, and ROI is hard to prove before an incident, so lean on channel partners who already have the client's trust.

2. Accessible to everyone: EAA compliance for small and mid-sized firms

The European Accessibility Act has applied since 28 June 2025 to e-commerce, banking, e-books, transport ticketing and more. Here's the thing: microenterprises providing services (fewer than 10 staff and no more than €2 million turnover) are exempt. So the obligation falls on small and mid-sized firms, the same missing middle that keeps coming up in this series.

Many of their sites don't work with a keyboard or screen reader. And no, an "accessibility overlay" widget doesn't fix that.

Why now? Year one was about awareness. Year two brought the first audits and court orders.

In March 2026 the Dutch consumer regulator ACM reported that 61% of the roughly 100 largest Dutch webshops are not digitally accessible. It found problems like order buttons you can't reach with a keyboard, and CAPTCHAs that block users.

In France, the Caen judicial court ordered Carrefour on 4 June 2026 to make its website and app accessible within six months, with a €500-a-day penalty after that. Carrefour argued that 71% compliance was enough. The judge disagreed. It's an interim order, not a final ruling, so it isn't settled case law. But the message to retailers is hard to miss.

What's the potential? The problem is almost universal. The WebAIM Million 2026 scan found detectable WCAG 2 failures on 95.9% of the top one million home pages, up from 94.8% in 2025, with an average of 56.1 errors per page.

That's an automated scan, not a legal compliance rate, and it isn't limited to EU sites. There's no EU-wide compliance dataset yet; the Commission's first report on the Act is due in 2030. Still, if the big Dutch webshops fail, it's a safe bet that smaller shops do too.

What's the key to success? Treat accessibility as CX, not a checkbox. Overlay tools gave this category a bad reputation by promising one-line fixes. The firms that win will pair automated testing with real users and fix the design system, so accessibility doesn't break again with the next release.

What you could build:

• Continuous accessibility QA for Shopify and WooCommerce stores: automated checks, manual sampling and an accessibility statement generator.
• An accessible design-system retrofit, sold as a productised agency offer covering components, forms and checkout patterns.
• A user-testing panel of people who use assistive technology, paid fairly and sold per sprint.

Risk check: Enforcement varies a lot by country, and fear-based vendor marketing has eroded buyer trust, so sell better CX, not panic.

3. Who takes over? Small-business succession, from matching to modernisation

A large group of baby-boomer owners is retiring without anyone to take over. Profitable small firms are closing, not because the business is failing, but because handing it over is hard. Someone has to value it, find a buyer, finance the deal and then bring a firm that may still run on paper into the present.

Why now? Brussels has put it back on the agenda. On 23 June 2026 the European Commission adopted a new Recommendation on business transfers, updating its 1994 Recommendation on the same topic. It explicitly encourages digital matchmaking platforms for buyers and sellers, plus dedicated funding and training schemes to widen the pool of successors. A Recommendation isn't binding, but national programmes and funding tend to follow.

Germany shows why it matters. The KfW Nachfolge-Monitoring (January 2026) found that 545,000 Mittelstand owners want a successor by the end of 2029, roughly 109,000 a year. Another 569,000 plan to close their business instead.

That's the first time planned closures have outnumbered planned successions. Wild, right?

What's the potential? The German numbers alone describe a huge pipeline of deals, and of firms disappearing if nobody steps in. EU-wide figures are less current. The often-quoted estimate of about 450,000 firms changing hands each year, with around 150,000 at risk of failed transfer, repeats a Commission estimate from roughly 2011–13. It's more than a decade old, so treat it as an order of magnitude, not a current count.

The interesting part comes after the deal. A newly acquired 20-person firm usually needs everything at once: digital processes, a refreshed brand and often its first real use of automation.

What's the key to success? Trust, and local presence. These are rare, high-stakes deals. Owners sell once in their lives, and accountants and banks control most of the deal flow. A marketplace without regional liquidity is just an empty listings page. Winners will partner with those gatekeepers rather than try to route around them.

What you could build:

• A regional succession marketplace with AI-assisted valuation and anonymised listings, one per country or language, because local trust matters.
• An "acquire and automate" service: a 100-day digital and AI modernisation plan for newly acquired traditional SMEs, sold to buyers, search funds and lenders.
• An owner-readiness programme that captures processes and know-how (including AI-assisted SOPs) so the business can actually be handed over.

Risk check: Deal flow is slow and gatekept, and valuation multiples are under pressure as more firms come up for sale, so build for patience, not volume.

4. The sandwich generation: support for working carers, sold through employers

Our 2025 look at AI agent opportunities floated elderly-care AI and family scheduling as ideas. This is the grown-up B2B version.

Millions of employed Europeans coordinate care for their parents, and often their children, alongside a full-time job. Formal care is stretched. Very few products help with care navigation, paperwork, benefits, scheduling or booking respite care. Almost none are packaged for employers to offer.

Why now? The scale is already here. Eurofound reported in July 2025 that 45% of the EU population provides unpaid care. Among people aged 35 to 44, it's 57%. And more than 61% of long-term carers are also in paid work.

That's the core of most companies' experienced workforce.

Ageing will only push this up as baby boomers reach their late seventies and eighties. Meanwhile, labour shortages make it expensive to lose experienced staff who quietly cut their hours or leave to care for a parent.

What's the potential? Big in need, unproven in price. Nobody has published a solid figure for what employers will pay for carer support, and we won't invent one.

What we can say is that the buyers exist. HR teams already pay for wellbeing and childcare benefits, and insurers look for retention products. Almost nobody sells carer support in a form a 50-person firm can buy.

What's the key to success? Service design. Caring for a parent is an emotional, bureaucratic and highly local journey. An app alone won't solve that. A human-plus-AI service that knows the local system can.

What you could build:

• A care-navigation benefit for SMEs: a human-plus-AI concierge for care options, paperwork and public entitlements, priced per employee per month.
• A family care coordination app with a shared calendar, medication tracking, documents and remote check-ins, distributed through insurers or employers.
• A carer-friendly workplace programme covering policy design, manager training and flexible-work tools.

Risk check: Care systems are national and health data is a GDPR special category, so localisation is expensive and HR buyers will need a clear retention case before they pay.

The full watchlist: 12 gaps for 2027

That's the series. Here's the whole map on one page.

Part 1: The AI gaps

1. AI agent governance for the mid-market
2. AI search visibility for SMEs and B2B service firms
3. Agent-ready shops for AI shopping assistants
4. AI Act compliance for small firms that use AI

Part 2: The deadline gaps 5. E-invoicing for micro and small firms in mandate countries 6. Pay transparency tooling for mid-sized employers 7. Cyber Resilience Act readiness for small product makers 8. Carbon and product data for small suppliers and exporters

Part 3: The trust and demography gaps 9. Deepfake fraud defence for SME finance and HR teams 10. Accessibility under the European Accessibility Act 11. Small-business succession, from matching to modernisation 12. Support for working carers, sold through employers and insurers

The pattern is clear: nearly every gap lands on firms that are too big to ignore the change and too small to have a team for it. And trust keeps showing up. AI governance, agent oversight, deepfake controls and accessibility are all ways of proving you can be trusted, to regulators, to customers and to machines.

Here's the thing, though. AI gets the hype, and deadlines create urgency. But demography is the most certain driver on this list. Owners will retire. Parents will age. Nobody has to vote for that.

Before you build, validate

A watchlist is where you start, not proof. Every gap above is real at continental scale. Whether it's real for your market and price point is another question.

So test it first. Our step-by-step guide to market gap analysis walks through defining the market, mapping customer needs, sizing up the competition and validating demand before you commit budget.

Want to think one of these through together?

Several of these gaps sit close to what we do every day. Accessibility is inclusive CX. Carer support is service design for a complicated, emotional journey. Succession needs a relaunch strategy and a modernisation plan once the deal closes.

If one of the twelve lines up with something your team is already exploring, we'd be glad to work through it with you, from checking whether the gap is real to designing what you'd build first. Solutions without strategy are just temporary fixes, and these gaps reward the companies that get the strategy right before they start building.

So, out of all twelve, which one is already knocking on your door?

‍