Insights
Article 6 of 14 – State of the Market 2026
Where AI-built software actually pays for itself. So why are the demos all somewhere else?
Read Time: 5 min
AI delivers 35–40% productivity gains on new code and 10% or less on complex legacy systems. Read one way, that says build new things and leave the old ones alone. Read against where the money and the risk sit, it says the opposite: AI-built software pays for itself where the gain is hardest to get, and the proof is worth most.
The reality of the AI value map
AI produces productivity gains of 35–40% on greenfield software work and 10% or less on complex legacy code, according to DORA's study of the return on AI-assisted development. Every demo you have seen this year lives in the first, flashy number. Almost every budget that matters lives in the second.
To map where the real value lies, we scored fifteen software workloads on two axes: how strong the demand signal is in the published evidence, and how much a buyer gains from a delivery model that produces executed evidence, independent review, and compliance artefacts as it goes – call it fit.
Four workloads score exceptionally high on both, and none of them are the ones you see in popular demos.
Legacy modernisation and brownfield ingestion: In the UK, 28% of central-government systems are legacy, tying up £45 billion a year of unrealised savings. DORA's "10% or less" represents the measured gain on exactly this kind of code when tackled without a purpose-built approach.
Security remediation at scale: Roughly 45% of AI-generated code samples carry a known vulnerability, and assisted developers generate ten times the findings. Meanwhile, CVEs attributed to AI-generated code rose from six a month to 35 between January and March 2026 – a backlog the tools that created it cannot be trusted to clear unverified.
Compliance by design: Only 21% of organisations rate their agent governance as mature, even though 77% are building AI governance functions – and the regulatory deadlines set out in the seventh article of this series do not move.
Test automation and QA: While 43% of organisations are experimenting with generative AI in QA, only 15% have scaled it. And 47% of frequent AI users say their manual QA burden has got worse.
Behind those four sit three that score high on both axes:
Technical-debt reduction, where debt equals 20–40% of the value of a technology estate and refactoring has collapsed to 3.8% of code changes;
Public-sector digital services, where 47% of UK central services lack a digital pathway, 52% of government CIOs expect bigger budgets this year, and Ireland has committed to every key service being online by 2030;
Greenfield custom applications, where the 35–40% gain is real, but self-serve tools compete fiercely on price.
The middle of the map is crowded with internal tools and workflow applications, where Gartner expects 40% of enterprise applications to embed task-specific agents by the end of 2026, but low-code platforms remain the incumbent; SaaS replacement, where 32% of companies have declined to buy software they could build themselves; and mature, crowded markets like cloud migration and data platforms.
And then there is the workload that gets the attention. MVPs and prototyping are in enormous demand – Lovable reached $500 million in annualised revenue and a $13.3 billion valuation on them. Yet, the premium a buyer will pay for verification here is close to nil, unless the prototype handles regulated data. High demand, low fit: this category tops every conference slide, but sits near the bottom of the value map on fit.
Figure 1: The figure highlights four areas where AI-built software is particularly well suited to business needs: modernising existing systems, strengthening security, meeting compliance requirements and improving software testing.
Why the value hides in the hard work
This pattern has one root cause: the value of AI-built software is proportional to the cost of verifying it by hand, and the demos are all in the places where verification costs are lowest.
On greenfield work, code generation was the bottleneck, and that 35–40% gain is available to anyone with a standard subscription. That is why self-serve tools win there on price and why margins compress. Conversely, on a twenty-year-old claims system, generation is the cheap part. A legacy code change is worthless until you prove it hasn't broken the hundreds of undocumented behaviours the system relies on. A security fix is worth nothing until the exploit fails against the running system. A compliance artefact is worth nothing until an auditor accepts it. In each case, the work that costs money is the proof – and proof is exactly what most agentic tooling still leaves entirely to the buyer. The second article of this series made the same point from the incident record.
Two further facts sharpen this reality:
The broader software lifecycle: Bain & Company finds that writing and testing code make up only 25–35% of the time from concept to launch. Gains concentrated purely in generation run out fast; the rest of the cycle – requirements, review, verification, release – is where hard workloads spend most of their time and so where a verification-first model can compress the timeline.
Market-generated demand for proof: The heavier QA burden reported by 47% of frequent AI users exists because generation has outrun checking. The governance gap is, in effect, a compliance backlog. Enterprise vendors have noticed: Gartner's first Magic Quadrant for AI-augmented code modernisation tools appeared in August, naming Moderne, AWS, and Microsoft as leaders. DORA’s "10% or less" is not a structural ceiling; it simply describes what happens to legacy code when you don't build ingestion and verification directly into the toolchain – the twelfth article in our series will return to what that takes.
Figure 2: The figure highlights the scale of the economic opportunity associated with improving developer productivity across Western Europe. It estimates that each 10-percentage-point increase in developer productivity represents approximately €70 billion in annual value.
What it means for a buyer
Start where the proof is worth most, not where the demo is easiest. Five things follow:
Pick a first workload from the top of the map. Focus on a modernisation slice, a security-remediation backlog, a compliance evidence gap, or test-automation debt. These pay back in hard metrics a finance director recognises: retired legacy systems, closed vulnerabilities, auditor-accepted artefacts, and automated tests that run without manual intervention.
Use self-serve tools for genuine greenfield and prototypes. Unless regulated data is involved, the verification premium there is small, so avoid overpaying for specialised platforms.
Buy internal tools inside the platforms you already run. This is where task-specific enterprise agents are natively arriving anyway.
Measure payback on the whole lifecycle, not on lines generated. If writing and testing code are only a third of the work, a tool that only accelerates them cannot return more than a third of the promise.
Make the evidence a core deliverable. The executed tests, coverage matrix, software bill of materials (SBOM), and scan results that a verification-first build produces are the exact artefacts the compliance calendar demands. Done right, one build pays dividends twice.
One final warning: The path from prototype to production is where the hidden costs of the easy demo arrive. The tools that generate an application in an afternoon do not verify it, and the 170 generated applications found leaking personal data last year (CVE-2025-48757) were somebody's prototype the week before. Budget for the proof at the start, or prepare to pay for it at the end.
What we hold ourselves to
We built the map above to decide what to say no to, and we would rather publish it than pretend we fit everywhere. We do not fit prototypes, internal tools on a low-code platform, or extending an ERP; the incumbents and the self-serve tools will always do those better, and when a client asks, we say so. We concentrate on the four rows at the top – modernisation, security remediation, compliance by design, and testing – where the gain is hardest to get and the evidence is worth most, and where producing proof as a by-product is the difference between a demo and a system a regulator will accept. That is what Forge was built for, and it is why brownfield ingestion, reading a legacy estate before changing it, is the hardest engineering problem we work on rather than a feature we advertise.
The rule underneath is simple to state and hard to keep: take on the work where proof is worth more than speed, and price on the proof.
In a relatively concentrated enterprise market, leading buyers can influence expectations for software assurance and procurement. The five segments in Figure 2 – regulated mid-market and enterprise, the public sector, scale-ups, multinational subsidiaries, and private-equity portfolios – are where we expect autonomous software delivery to be tested first, though that remains a hypothesis.
Four things follow.
First, benchmark against your size class rather than only the national figure: AI adoption among large Irish firms was approximately 58%, but adoption does not imply mature governance.
Second, demand demonstrable outcomes and acceptance evidence, not simply a proposed number of contractor days.
Third, use applicable regulatory requirements as inputs to design and assurance rather than assuming DORA, the AI Act and the Consumer Protection Code mandate identical artefacts for every project.
Fourth, for small firms considering digitalisation, assess packaged tools and voucher eligibility first; commission bespoke software when a distinctive requirement or integration case justifies it.
Our thoughts? No Irish organisation will out-hire the scarcity, so buy capacity that arrives with its own verification, and keep the scarce people you have on the work that needs judgement: scope, risk, and acceptance.
What we hold ourselves to
We are a Dublin based small company building software for Irish, UK, and EU organisations (including regulated ones), so we have an interest in this argument and would rather state it than pretend otherwise. We see the opportunity in the gap between adoption and governed delivery, particularly among organisations with complex assurance demands.
Three rules follow.
We aim to sell evidence, not enthusiasm: for each engagement, we agree appropriate executed tests, coverage, software-component information and compliance records with the client, rather than claiming every Irish authority requires the same artefacts.
We say when bespoke is wrong: if a packaged tool or the Grow Digital voucher better serves a client, we say so.
And we seek to price against verified outcomes and capacity created, not simply contractor day rates. Forge exists to help a company our size deliver work at the standard regulated buyers reasonably demand.
Following the International AI Summit in Dublin on 14 October 2026, the more useful conversation is not Ireland’s position in a league table but what large organisations have actually changed in how they build, buy, and assure software.
So, a question for your own organisation: if yours is one of the 58% of large enterprises using AI, what has changed in how you build and buy software since you adopted AI – and if yours is one of the 42% that are not, what would you need to see before you moved?
Sources:
1. InfoQ, reporting DORA's report on the ROI of AI-assisted software development, May 2026. https://www.infoq.com/news/2026/05/dora-roi-ai-assisted-dev-report/
2. UK Government, State of digital government review, January 2025. https://www.gov.uk/government/publications/state-of-digital-government-review/state-of-digital-government-review
3. Veracode, 2026 GenAI Code Security Report (spring update), March 2026. https://www.veracode.com/blog/spring-2026-genai-code-security/
4. The Register, reporting Apiiro, 5 September 2025. https://www.theregister.com/2025/09/05/ai_code_assistants_security_problems/
5. Cloud Security Alliance, Research note: AI-generated code vulnerability surge 2026, April 2026. https://labs.cloudsecurityalliance.org/research/csa-research-note-ai-generated-code-vulnerability-surge-2026/
6. Deloitte, State of AI in the enterprise 2026, January 2026. https://www.deloitte.com/us/en/about/press-room/state-of-ai-report-2026.html
7. IAPP, AI governance profession report 2025, April 2025. https://iapp.org/resources/article/ai-governance-profession-report/
8. Capgemini, World Quality Report 2025–26, November 2025. https://www.capgemini.com/insights/research-library/world-quality-report-2025-26/
9. Harness, AI coding accelerates development, DevOps maturity in 2026 isn't keeping pace, March 2026. https://www.prnewswire.com/news-releases/harness-report-reveals-ai-coding-accelerates-development-devops-maturity-in-2026-isnt-keeping-pace-302710937.html
10. McKinsey, Tech debt: reclaiming tech equity, October 2020. https://www.mckinsey.com/capabilities/tech-and-ai/our-insights/tech-debt-reclaiming-tech-equity
11. GitClear, The AI code quality and maintainability gap (623M changed lines, 2023–2026), January 2026. https://www.gitclear.com/the_ai_code_quality_maintainability_gap
12. Gartner, 52% of government CIOs expect IT budgets to increase in 2026, 26 November 2025. https://www.gartner.com/en/newsroom/press-releases/2025-11-26-gartner-survey-reveals-52-percent-of-government-cios-expect-it-budgets-to-increase-in-2026
13. Government of Ireland, Digital Ireland – connecting our people, securing our future (National Digital and AI Strategy), 18 February 2026. https://www.gov.ie/en/department-of-the-taoiseach/campaigns/digital-ireland-connecting-our-people-securing-our-future/
14. Gartner, 40% of enterprise apps will feature task-specific AI agents by 2026, up from less than 5% in 2025, 26 August 2025. https://www.gartner.com/en/newsroom/press-releases/2025-08-26-gartner-predicts-40-percent-of-enterprise-apps-will-feature-task-specific-ai-agents-by-2026-up-from-less-than-5-percent-in-2025
15. Yahoo Finance, reporting McKinsey: 32% of companies decided against buying software they could build, September 2026. https://finance.yahoo.com/technology/ai/articles/build-vs-buy-shift-32-113806700.html
16. CNCF, Annual cloud native survey, January 2026. https://www.cncf.io/reports/the-cncf-annual-cloud-native-survey/
17. BCG, How AI is paying off in the tech function, January 2026. https://www.bcg.com/publications/2026/how-ai-is-paying-off-in-the-tech-function
18. GitLab, 2025 global DevSecOps survey: the AI paradox, November 2025. https://ir.gitlab.com/news/news-details/2025/GitLab-Survey-Reveals-the-AI-Paradox-Faster-Coding-Creates-New-Bottlenecks-Requiring-Platform-Solutions/default.aspx
19. TechCrunch, Lovable says it has hit $500M in annualised revenue, 9 June 2026. https://techcrunch.com/2026/06/09/lovable-says-it-has-hit-500m-in-annualized-revenue-with-1-million-new-projects-a-week/
20. TechCrunch, Lovable confirms new $13.3B valuation, raises another $400M, 12 August 2026. https://techcrunch.com/2026/08/12/lovable-confirms-new-13-3b-valuation-raises-another-400m/
21. Bain & Company, From pilots to payoff: generative AI in software development (Technology Report 2025), September 2025. https://www.bain.com/insights/from-pilots-to-payoff-generative-ai-in-software-development-technology-report-2025/
22. Moderne, Moderne named a Leader in the 2026 Gartner Magic Quadrant for AI-Augmented Code Modernization Tools, August 2026. https://moderne.ai/blog/moderne-leader-gartner-magic-quadrant-ai-code-modernization
23. Microsoft, Microsoft named a Leader in the 2026 Gartner Magic Quadrant for AI-Augmented Code Modernization Tools, August 2026. https://azure.microsoft.com/en-us/blog/microsoft-named-a-leader-in-the-2026-gartner-magic-quadrant-for-ai-augmented-code-modernization-tools/
24. Superblocks, Lovable vulnerabilities and CVE-2025-48757, 2025. https://www.superblocks.com/blog/lovable-vulnerabilities
25. AWS, AWS Transform continuous modernisation (AWS named a Leader in the 2026 Gartner Magic Quadrant for AI-Augmented Code Modernization Tools), August 2026. https://aws.amazon.com/transform/continuous-modernization
Made with AI, not by it. Claude researched and drafted; I rewrote and verified it. The charts are Claude's.
