A question we now get on most sales calls, usually phrased carefully: “Is a person actually writing this, or is AI doing it and you are billing me for hours?” It is a fair question and it deserves a straight answer rather than reassurance. This article is ours — including the parts that would be easier to leave out.
What’s Covered
Yes, Your Vendor Uses AI
Start from the assumption that every development team working on your product in 2026 uses AI daily. Sonar’s January 2026 survey put AI at roughly 42% of all committed code. The 2025 DORA research found about 90% of technology professionals using AI at work. If a vendor tells you their team does not touch it, either they are behind, or they are not telling you the truth, and neither is good news.
So “do you use AI?” is not a useful question. The useful questions are about review, accountability and data — which is what the rest of this article is about.
Nobody Has to Tell You
This is the part most buyers do not realise. We went looking for a legal obligation and could not find one.
| Assumption | Reality |
|---|---|
| “There must be a law requiring disclosure” | No general law requires a software vendor to tell a commercial client it used AI |
| “The EU AI Act covers this” | It targets AI providers and deployers, not your supplier’s relationship with you |
| “Standard contracts handle it” | Widely used industry contract templates still leave AI unaddressed; firms are writing their own terms |
| Government work | A proposed US federal procurement clause would require contractors to disclose AI systems used — still in draft as of mid-2026 |
In other words: disclosure happens because you asked for it in writing, or it does not happen. That is not a scandal, it is just where the market is. It does mean the responsibility for asking sits with you, which is why section 05 exists.
Why It Does Not Halve Your Bill
The intuition is reasonable: if the machine writes the code, the work should cost less. Here is why the arithmetic does not land where people expect.
Producing code was never the expensive part. The expensive parts are deciding what to build, checking that what was built is correct, and living with it afterwards. AI accelerates the first of those three and adds load to the second.
The evidence is not flattering to either side of the argument. METR’s randomised trial found experienced developers were about 19% slower with AI on mature code they knew well — while believing they had been faster. The 2025 DORA research found AI adoption raising throughput and delivery instability together. GitClear’s analysis of 211 million changed lines found duplicated code rising sharply and refactoring falling about 40% as AI assistance spread.
So where does AI genuinely save you money? Boilerplate, scaffolding, first-draft tests, mechanical migrations and documentation. A fair vendor passes that on by delivering more per sprint, not by billing the same hours for less work. We went through the full economics in what adding AI actually costs, and the hiring consequences in will AI coding agents replace offshore developers.
You would not ask a carpenter for a discount because the saw is electric. You would expect the cut to be straight, the work guaranteed, and the carpenter to understand what they built. Same standard here.
Legitimate Use vs What Should Worry You
| Fine | Worth a conversation |
|---|---|
| Generating boilerplate, scaffolding, config | Shipping generated code nobody read |
| Drafting tests a human then reviews | Tests written to pass the code rather than check it |
| Explaining unfamiliar code to a developer | A developer who cannot explain what they delivered |
| Mechanical migrations under supervision | Pasting your proprietary code into consumer AI tools |
| Drafting documentation and commit messages | Using tiers that train on your data |
| Research and debugging assistance | Automating irreversible actions without a human gate |
The right-hand column is not about AI. Every one of those items was a problem before AI existed — unread code, fake tests, developers who cannot explain their work. AI just makes each of them faster to produce, which is exactly why review standards matter more now, not less.
Seven Questions to Ask
- Is your AI policy written down? Not whether they use AI — whether rules exist on paper that a new joiner reads.
- Which tools, and on which tier? Business and enterprise tiers of the major providers exclude training on your content. Consumer tiers may not.
- Who reviews AI output before merge, and against what? A good answer mentions duplication, edge cases and tests — not just “it works”.
- What is your test coverage requirement on AI-assisted code? It should be higher than for hand-written code, not lower.
- Can you turn AI off for a specific module? Some contracts, regulators and clients require it. A team that cannot say yes does not control its own process.
- Who owns AI-assisted output? The contract should assign everything to you on payment, however it was produced.
- Can the developer explain last sprint’s code without opening the tool? Ask on a call, with the actual developer. This single question tells you more than the other six.
These sit naturally alongside the checks in our 30-point vetting checklist, and they apply whichever engagement model you choose — see fixed price vs time & materials vs dedicated team for that decision.
The Clause to Add
Since no law supplies this, put it in the contract. Four provisions cover most of the risk:
| Provision | What it does |
|---|---|
| Disclosure | Provider may use generative AI tools and will identify them on the client’s written request |
| Ownership | All deliverables, AI-assisted or not, assigned to the client on payment |
| Confidentiality carve-out | Named tools only, on tiers that exclude training on client data; everything else prohibited |
| Accuracy warranty | Vendor responsible for defects regardless of how the code was produced — removes “the AI wrote it” as an excuse |
In regulated sectors add audit rights. If you are in the EU and personal data is involved, this sits alongside your Article 28 data processing agreement rather than replacing it. We sign all four as standard, and we would rather clients ask than assume.
Our Policy, In Full
It would be convenient to end here with general reassurance. Instead, here is what we actually do — answer the seven questions on ourselves.
- We use AI daily. Code assistance, test drafting, documentation, research and debugging help. Pretending otherwise would be a lie.
- Business tiers only. Client code and data go only into tools configured so the provider does not train on them. Consumer accounts are not used for client work.
- A human reviews everything before merge. Every pull request has a named reviewer who is accountable for it. “The AI wrote it” is not an accepted explanation on our side either.
- We can switch AI off per project or module when a client contract, regulator or security review requires it. Ask at onboarding and it is configured before the first commit.
- Your code is yours. Full IP assignment on payment, AI-assisted or not, with NDAs and DPAs as standard.
- We bill for the engineer, not the keystroke. Where AI makes a task genuinely faster, the gain shows up as more delivered in the sprint. If a task that used to take a week now takes two days, you get the other three days of work — not an invoice for a week.
- Our developers can explain their code. Test this on any call. It is the check we would apply to a vendor ourselves.
If you want this in writing before signing anything, ask — it goes in the MSA. Our AI engineering page sets out what we will and will not take on, and rates for every market are published on the hire developers pages — whether you are hiring from the UK, USA, Germany or anywhere else we serve.
Frequently Asked Questions
Can my agency use AI without telling me?
In most commercial contracts, yes. We could find no general law requiring a software vendor to disclose AI use to a client; EU and California rules target AI providers and deployers rather than your supplier. A proposed US federal procurement clause would require disclosure on government contracts but was still in draft as of mid-2026. For private work, you get disclosure by asking for it in writing.
Should I pay human rates for AI-assisted work?
You are paying for an outcome someone is accountable for, not for typing. The fair expectation is not a discount but a standard: reviewed, tested, and understood well enough to maintain. If the developer cannot explain code they delivered, raise that — it is the real problem, and it existed long before AI.
Does AI make outsourcing cheaper?
Less than expected. DORA 2025 found AI raising throughput and instability together; METR found experienced developers about 19% slower on mature code. Real savings land on boilerplate, scaffolding, test drafts and migrations — and should reach you as more delivered per sprint rather than as the same hours for less work.
What does AI-assisted code do to maintenance?
GitClear’s study of 211 million changed lines found duplication rising sharply, refactoring down about 40%, and churn up from 4.5% to 5.7%. Cloned code carries more defects. The code usually works — it just costs more to live with, which is why review and test standards matter more with AI, not less.
What should the contract say?
Disclosure on written request, full ownership of all output on payment, a confidentiality carve-out naming permitted tools on non-training tiers, and an accuracy warranty that holds the vendor responsible however the code was produced. Add audit rights in regulated sectors, alongside your DPA where personal data is involved.
What is the single best test?
Get the actual developer on a call and ask them to explain a decision they made in last sprint’s code, and one thing they would do differently. Someone who shipped work they do not understand cannot answer. No contract clause substitutes for that thirty-minute conversation.
The Short Version
If you read nothing else- Assume your vendor uses AI — about 42% of committed code is AI-generated.
- No general law requires them to tell you. Ask in writing or you will not know.
- AI does not halve the bill: producing code was never the expensive part.
- Savings should reach you as more delivered per sprint, not fewer hours of work billed as more.
- The worrying list — unread code, fake tests, pasted data — predates AI.
- Put four provisions in the contract: disclosure, ownership, tool carve-out, accuracy warranty.
- Best single test: ask the developer to explain last sprint’s code on a call.
- Our policy is published above — hold us to it.
Want our AI policy in your contract?
Ask and it goes into the MSA before anything starts — named tools, review process, the right to switch AI off per module, and full IP assignment either way.
Ask us