Should we pay less for development now AI writes the code?

The same question came up in three conversations this month, with people who read the market very differently: the chairman of a technology and data consultancy with around 250 consultants, the founder of an ecommerce development and optimisation agency, and a member of a private equity investment team. If AI now writes a good share of the code, should clients still pay what they paid before?

The practice’s answer has two halves. A well-run agency or development team that uses AI will build faster, and that speed is worth more to a retailer than a discount. The same tools, used without the discipline that surrounds good development, embed risk in the ecosystem, and that risk can become a serious problem long after the project has been signed off.

Pay for the deliverable, and ask for it sooner

A retailer pays for the deliverable. How an agency produces it matters only where it affects whether the result is robust and of good quality. If AI shortens the build, the gain worth asking for is speed of delivery: a feature live before peak rather than after it. A lower price is welcome. It is worth less than the weeks.

Speed comes with one question attached. AI shortens the writing of code. It does not, on its own, shorten scoping, QA, sign-off or documentation. Where the build was most of the old schedule, a faster build can leave every review step intact. Where it was not, and the agency still promises delivery in half the time, something else in the process has been shortened. Ask which steps the time came from, and hold the agency to the same standard of QA and documentation as before.

Discipline is the difference

Code written with AI is not, on the evidence so far, the problem in itself. Inside a proper development set-up, with a product owner, an agreed scope, developers, QA and full documentation, AI is an enabler. Outside it, the code still works on the day it ships. Nobody documents it, nobody maintains it and nobody can evolve it with confidence, so the bill arrives later, when it has to change.

The research describes what happens without those controls, with two caveats: both studies come from companies that sell tools to fix the problem, and neither measures finished software built by a disciplined team. Veracode tests models given no security-specific guidance. Its pass rate rose from 56% to 62% between the summer and October. Most of the gain came from better handling of cross-site scripting; on log injection, the weakest category, the pass rate stayed at around 13%. GitClear’s analysis of 623 million code changes from 2023 to 2026 found duplicated code blocks up 81%, moved code (its measure of refactoring) down by about 70%, and long-term maintenance changes, to code last touched more than a year earlier, down by about three quarters. The study charts these trends as AI authorship grew. It does not show that AI caused them.

None of this is new risk. Custom code has always carried it. At one business I joined, custom code for click and collect and for returns to store had to be taken apart and rewritten during a replatform, which added at least three weeks, possibly four. Collect from store was switched off. When it came back, returns to store had to be switched off and handled by manual exception, and those in-store returns brought significant reconciliation problems, late refunds and customer complaints. What AI changes is how quickly a business can create more code like that, and how many people inside it can.

The practice’s reading is that over the next two or three years a good number of AI-built apps and systems will fail, one at a time rather than in a single collapse, each at the moment someone needs to change one. That is a judgement, not a forecast anyone has measured.

Code built in isolation

The Shopify app ecosystem shows the pattern from the outside. Each app is developed independently, with its own permissions, integrations and security, yet all of them meet in the same storefront. One consequence is the conflicts a retailer finds when it replatforms. Another arrived in October. From 10 October, shoppers on several Shopify stores who clicked Checkout were redirected to a lookalike payment page that took their card details. The malicious code was delivered through the configuration of third-party apps, including Hulk Product Options, Selleasy and Swym Wishlist Plus; Shopify’s own checkout was not compromised. On 20 October Shopify asked every app developer to act that week on a list of security steps.

Each of those apps could change what shoppers saw at checkout, and each was secured only as well as its own developer secured it. The merchant carried the combined risk of every app with access to its storefront. The same would happen inside a business that lets several streams of AI development run at once, with the trading team building one tool and marketing another. Unless they sit under one structure and one owner, with a product owner, clear documentation and a proper QA process, they will conflict, and the business will carry the combined risk of all of them.

The systems to be most careful with

The debate has now moved past small tools. In McKinsey’s State of AI 2026 survey, 32% of respondents said their organisation had decided against buying at least one software product or feature because it could build the functionality in-house with agentic coding tools. Retailers are now hearing that a customer data platform or an ERP could go the same way. The best-known example is Klarna, which said in 2024 that it had shut down Salesforce and planned to drop Workday. In March 2025 its chief executive explained that the project had consolidated data from many systems onto Klarna’s own internally developed stack, said Klarna had not simply replaced its software with an AI model, and said he doubted other companies would replace Salesforce with AI.

The two systems carry different risks. A CDP holds customer identity, consent and behavioural data, so a security flaw can become a serious data protection incident. An ERP holds stock, orders and the accounts, so a flaw can disrupt transactions, reconciliation and the numbers the board signs off. A vendor-hosted version of either generally comes with vendor-managed updates, security fixes and support, and may carry independent compliance certifications, although the detail depends on the deployment and the contract. The retailer still owns access controls, configuration and data governance either way. Build it yourself and a much larger share of those obligations moves in-house.

Gartner’s August 2026 guidance on the same decision starts from the position that it is not a binary choice between building and buying. The useful distinction is between building on top of a system of record and rebuilding it. An AI-built tool that reads from an existing ERP to answer a trading question is a modest risk. An AI-built ERP is the whole risk, sitting at the centre of the ecosystem.

What a board should decide

On agencies and development teams, the decision is to buy the deliverable and hold them to speed. Ask what will arrive sooner because they use AI, and which steps the time came from. A faster quote that shortens QA or documentation should be treated as a risk.

On building internally with AI, the decision is where to allow it. A prototype, an internal report or a campaign page has a small blast radius and a short life. Anything that touches customers, money, stock or personal data needs the full discipline, and every stream needs to sit under one owner.

On systems of record, the decision is where the burden of proof sits. Building on top of a CDP, ERP, order management system or payments platform with AI can be sensible. A proposal to replace one should have to show who will patch it, who will maintain it, how it will be secured and what happens when its author leaves. The licence saving on its own does not make that case.

What is not yet known is how fast the bill arrives. Veracode’s latest results show the models improving, and the same tools are getting better at reading and documenting old code, which may make the bill smaller, or later, than expected.

Sources

1. Veracode, GenAI Code Security Fall 2026, 29 October 2026, and the 2026 GenAI Code Security Report (summer 2026). Veracode sells application security testing.
2. GitClear, analysis of 623 million code changes, 2023 to 2026 (published with GitKraken branding), reported by LeadDev, 7 July 2026. GitClear sells code-quality analytics.
3. cside, The HulkApps checkout hijack, 17 October 2026. cside sells client-side script monitoring.
4. Shopify, Securing your app, together, Shopify developer changelog, 20 October 2026.
5. McKinsey, The state of AI in 2026: On the road to ROI (survey of 1,719 respondents, 4 May to 8 June 2026). McKinsey sells AI transformation advice.
6. Gartner, Build vs. Buy Application Decisions for AI Development or SaaS, 11 August 2026 (public summary only; the full document is for Gartner clients).
7. TechCrunch, Klarna CEO doubts that other companies will replace Salesforce with AI, 4 March 2025.

Back to Thinking