AI software development adds hidden governance costs

ActiveState has published research suggesting AI-assisted software development consumes more than 13,900 engineering hours a year at large enterprises. The findings are based on a survey of 307 security, governance, platform and engineering leaders in Europe and North America.

The study found that each engineer spends at least 139 hours a year fixing or revisiting AI-assisted development work. At an organisation with 100 engineers, that amounts to the annual workload of roughly seven full-time staff, according to the report.

These costs are not confined to engineering teams. The report found the burden also falls on operations, compliance and security budgets, often leaving companies without a clear view of the total cost of managing open source risk.

Only 31% of organisations surveyed said they had formally quantified the cost of unmanaged open source risk. A further 47% said they had only an informal estimate.

The research points to a gap between the productivity gains associated with AI tools and the controls used to govern software dependencies. While 93% of respondents reported higher engineering productivity, 83% said developer productivity was outpacing governance.

Even so, 71% said they believed their current approach could scale.

Operational strain

Unmanaged open source dependencies had already affected software delivery, the report found. Among respondents, 76% said they had experienced a software release delay in the past year because of such dependencies.

Compliance issues were also common. The survey found that 58% had received a compliance or audit finding related to open source governance, while 32% said they had confirmed a security incident in the past two years that could be traced to an unmanaged dependency.

Across teams, 83% said the overall cost of managing open source risk was rising.

ActiveState also found that AI tools were increasing the volume of open source software entering development workflows. Some 94% of respondents said AI had increased open source consumption.

Most governance checks, however, still happen after components have already entered the process. The report found that 63% address open source vulnerabilities only after scanners or security tools identify them, while half said new dependencies can reach production without prior review or approval.

Respondents said they currently spend 26% of their open source governance effort on prevention before deployment. They said that figure should be 37%.

Abby Kearns, Chief Executive Officer at ActiveState, said the financial effect of AI-assisted development was often obscured because different teams absorb different parts of the workload.

"AI is becoming a permanent part of how software gets built, but our research found engineers spend significant time fixing or revisiting AI-assisted work. That's only engineering's share. Security, compliance and operations pay the rest out of their own budgets, so the full bill stays hidden. The way to keep the gains is to govern open source as it enters the codebase," said Kearns.

Governance gap

The report argues that AI is moving open source software into production faster than many governance systems can handle. It points to a mismatch between rapid code generation and review processes that still rely heavily on later-stage scanning.

Jim Mercer, Program Vice President, Software Development, DevOps, and DevSecOps at IDC, said this left organisations reacting too late in the software pipeline.

"When an assistant can suggest a secure package, write the code that calls it, and push it toward production in minutes, governance built on static scanning after the fact will always be a step behind," said Mercer. "Being able to control what enters the pipeline is key to enabling organisations to scale AI-assisted development."

The research covered organisations with 1,000 or more employees in North America and Western Europe, and included 10 in-depth practitioner interviews alongside the survey.