Alaaeddine Hammoudi

Writing / article

Staying in control when AI writes the code

SaaS tools, AI providers and agents now change faster than people can absorb. What control of the information system really means, why enterprises can't skip it, and three principles to hold on to when things get fuzzy.

Author
Alaaeddine Hammoudi
Published
Reading
6 min

In short

  • AI has made software cheap to produce, but owning it costs as much as ever. That gap is where information systems grow out of control.
  • SaaS tools ship a new version every two or three days, and AI providers change their models and guidance almost as fast. The problem isn’t resistance to change. It’s a rhythm imposed from outside that people can’t absorb.
  • Being in control doesn’t mean locking things down. It means knowing what exists, who owns it, what it returns, and how to stop it.
  • When the technology outruns any policy, hold on to three principles: parsimony, accountability and euro/AI.

Change has outrun governance

Much of the change now comes from outside, and vendors set the pace. The SaaS tools I see in use ship a new version every two or three days. AI providers retire model versions on a fixed schedule, replace the SDKs they recommend and rewrite their reference architectures. New features and agents appear in tools you already pay for, often switched on by default, with no change request on your side. Your own teams then build agents on top.

I hear the consequences in almost every team I work with. Developers complain that the patterns they adopted last quarter are already marked as legacy in the vendor’s documentation. Architects spend time tracking the latest Azure recommendations instead of deciding which of them matter. Whole organisations end up racing to keep up with a roadmap someone else wrote.

That puts IS control under strain: keeping the information system understood and steerable when parts of it change every few days and the architecture board meets once a month. Meir Lehman observed back in 1980 that a system in use grows more complex unless someone works to simplify it. AI accelerates the first half of that law and does nothing for the second.

This isn’t resistance to change. Most IT teams want these tools and use them well. The limit is human: how much change people can absorb, understand and still stay ahead of. Nobody in the organisation chose this rhythm, and it doesn’t wait for teams to be ready. Past a certain point, they stop steering and start reacting.

The signals are already there:

  • Instability. In Google’s 2025 DORA report, AI adoption goes with higher throughput and more unstable delivery.
  • Code debt. GitClear, a code-analytics vendor, sees duplication rising and refactoring falling.
  • Shadow AI. 69% of security leaders surveyed by Gartner suspect staff of using prohibited GenAI tools, or have evidence of it.
  • Waste. Gartner expects over 40% of agentic AI projects to be cancelled by the end of 2027.

The load falls on a few people

Writing code has become cheap. Reviewing it and answering for it hasn’t, and that work falls on a handful of experienced people.

  • Burnout rises with adoption. In an Oregon State study of 442 developers, GenAI raised burnout by intensifying job demands. Nearly a quarter had no real training on tools they were expected to use daily.
  • Oversight is tiring. BCG researchers writing in HBR call it “AI brain fry”: the mental exhaustion of supervising more AI output than one can absorb. Perceived productivity peaked at about three tools at once.

Leaders who measure only output will burn these people out first, and the expertise needed to keep the system under control will go with them.

What “in control” actually means

Control is often confused with prohibition. A ban on agents produces shadow AI. Allowing everything without an inventory produces sprawl. I use four questions instead. If you can answer them for a system, it’s under control, however it was built.

  1. Do we know it exists? It’s in an inventory, with its data flows and the models it calls.
  2. Who answers for it? A named person, not “the team” or “the vendor”.
  3. Is it worth what it costs? That means the full cost, including run, review and risk, set against the value it delivers.
  4. Can we change it or stop it? Someone else can maintain it, and switching it off breaks nothing unknown.

The aim isn’t to slow the system’s growth. It’s to keep those four answers true as it grows.

Why enterprises can’t skip this

  • Regulation. The EU AI Act’s literacy duty has applied since February 2025, and the 2026 Omnibus postponed the high-risk rules without cancelling them. You can’t show compliance for systems you haven’t inventoried.
  • Security. Every unlisted tool, agent or API key is one more way for data to leak.
  • Cost. Software produced at agent speed is maintained at human speed. Every application without an owner is a cost that grows with no decision behind it.

When things get fuzzy, hold on to principles

Principles don’t make decisions for you. They do mean you don’t have to argue every new tool from scratch.

  • Parsimony. Build only what is needed, and run it at the smallest size that does the job. Reuse before adding an agent, use a rule where a rule will do, and pick the smallest model that works. AFNOR Spec 2314 on frugal AI sets the same test: show that AI is needed before you use it.
  • Accountability. Every system has a named human owner. “The AI wrote it” doesn’t make anyone the owner. Whoever merges the code owns it.
  • Euro/AI. Govern AI by its return, with one KPI per use case: the euro/AI ratio, value delivered divided by full cost. Track it every quarter. A ratio below 1, or one that keeps falling, means scaling the use case back or stopping it. I explain how to calculate it in Measuring AI: what to count, and how.

Parsimony limits what gets built and what it consumes. Accountability makes sure someone owns it. Euro/AI keeps it worth paying for.

“Won’t this slow us down?”

It’s a legitimate question, and it deserves a straight answer: yes, a little, at first. An inventory, named owners and a quarterly ratio take time that could otherwise go into building.

The alternative, though, isn’t real speed. It’s speed now, paid for later in incidents, in rework on code nobody understands, in licences nobody cancels and in people who leave. Control is also what lets you move fast where it counts. If you know what you run, you can adopt a new model in days, because you know what it touches. If you don’t, every change is a gamble, and teams slow themselves down for fear of breaking something.

The goal isn’t to approve every tool. It’s to be able to say yes quickly to the few that matter, and no to the rest.

Five decisions for the next quarter

  1. Inventory every AI-built and AI-using system, scripts and agents included, with an owner on every line.
  2. Make ownership a condition for production. Nothing is deployed without a named owner.
  3. Put the euro/AI ratio in the portfolio review, and retire the use cases that stay below 1.
  4. Measure review load and fatigue alongside throughput, and cap how many agents one person is expected to oversee.
  5. Train before you mandate. AI literacy is a legal duty, and it is also the cheapest way to prevent burnout.

Coding agents will keep getting better and faster. The organisations that gain most from them won’t be the ones that adopt everything first. They’ll be the ones that still know what they’ve built, who answers for it, and whether it was worth it.

Sources