8 min read Build vs Buy

A third of companies skipped a software purchase: the ownership cost nobody priced

A third of companies skipped a software purchase: the ownership cost nobody priced

Close to a third of organizations, 32% exactly, report having decided against buying at least one software product or feature because they could build it in-house with agentic coding tools. The figure comes from the 2026 edition of McKinsey's global State of AI survey, published on 25 August 2026 and fielded from 4 May to 8 June among 1,719 respondents across 97 countries. The same survey records a consistent acceleration among large enterprises: the share scaling agents in at least one function rose from 27% to 40% in a year, while smaller organizations stayed flat at 22%.

The instinctive response to that number is to ask whether you could build too. In a third of cases the question is already settled, and the survey holds a more useful signal. The organizations McKinsey ranks at the top, those attributing at least 5% of EBIT to AI and making up only 6% of respondents, are also the ones skipping purchases most often, nearly one in two against 31% for everyone else. They are equally the ones reporting, about three times more often than others, that operating costs constrain their use of software coding agents. The group that builds best is therefore the first to hit the cost ceiling.

The 27 July article on agentic arbitrage looked at this shift from the market side, the $234 billion of SaaS spending whose pricing model no longer holds. What follows sits at the other end, on the balance sheet of the buyer who just said no. A cancelled licence is one spending line that disappears and about a dozen that appear elsewhere, spread across budgets nobody consolidated before the decision was taken.

Abstract diagram contrasting a single spending line on the left with six cost lines spread over time on the right
A cancelled licence moves the spending rather than removing it, and moves it into budgets that were not part of the decision.

What the survey says, and what it does not

The number has to be read precisely, because it is easy to make it say more than it does. The 32% denote a decision not to buy, not a delivered system, not a system in production, and not a system that replaced the product that was passed over. It is a procurement call, measured at the moment it is made, and the survey does not observe what becomes of it afterwards.

The industry spread tracks the maturity of the engineering function. McKinsey puts technology and healthcare at the top, followed by professional services and energy and materials. Nothing surprising there: walking away from a purchase assumes a team able to absorb the scope, and the gap between industries mostly measures the depth of that capability.

The broader financial context of the survey deserves to sit alongside it. The share of respondents attributing an EBIT effect to AI has not moved in a year, holding at 37%, even as 80% report gains in their own productivity. A gap that stable between individual perception and consolidated results argues for caution about any saving announced at team level. An avoided licence is visible in the software budget within the first quarter; the cost it displaces shows up elsewhere, later, and often without ever being traced back to the original decision.

The vocabulary of the buying decision

Coding agent: a system that takes an intent in natural language and produces code, tests and sometimes a full integration, chaining several steps without intervention at each one.

Total cost of ownership: the sum of every expense attached to a system over its lifetime, build included but above all operations, maintenance, security, compliance and retirement.

Run cost: the recurring portion of ownership cost, the part that lands every month whether the system is used or not.

Provider and deployer: the two distinct capacities defined by the EU AI Act. Using a purchased system makes you a deployer. Building it, or having it built on your behalf, makes you a provider, with a markedly heavier set of obligations.

The bill does not arrive in year one

Build cost is no longer the issue, and that is exactly what makes the decision treacherous. What changes is the shape of the code being produced, and therefore the price of owning it.

The most solid measurement available on this point comes from GitClear, which analysed 623 million code changes between 2023 and 2026 in a report published in June 2026. Eight maintainability signals degrade at once. Block duplication is up 81% against 2023, moving from 40.3 to 73.0 duplicated lines per million changed lines, its highest level on record. Refactoring, measured through moved lines, is down 70%. Function connectivity, meaning how often new code calls an existing function elsewhere, falls 35%, from 343 to 223 calls per thousand changed lines. And maintenance of older code, the share of changes touching code untouched for more than twelve months, drops 74%, from 1.7% to 0.46%.

The most telling reversal sits in one comparison. In 2022, the last year before assistants were widely adopted, developers moved code twice as often as they copied it. In 2026 they copy it roughly five times more often than they move it, with 15.7% copy-paste against 3.8% moved code. A duplicated block is not a fault in itself, it installs an obligation: the day one copy changes, somebody has to find the others, across files and domains they may not know, and decide whether the change must propagate. That obligation does not trigger at delivery. It triggers in year two, once the person who ran the agent has moved on.

Bar chart contrasting three declining reuse signals with four rising risk signals since 2023
Reuse signals and risk signals diverge over the same period as the share of assisted code rises.

The cost lines the licence used to cover for you

A licence price rarely buys software alone. It buys a vendor that fixes its own flaws, ships patches, keeps documentation current, staffs an on-call rotation, preserves backward compatibility and answers auditors when they show up. Walking away from the purchase transfers those charges inward, one by one.

Six lines deserve to be priced before the decision rather than after. Corrective and evolutive maintenance over the expected lifetime. On-call, with its direct cost and its retention cost. Security patching, which assumes active monitoring of the dependencies the agent selected, dependencies nobody chose explicitly. Audit documentation, in the form your auditors require rather than the form that suits you. Dependency debt, including the day one of them is abandoned. And continuity, meaning what happens when the person who knew what the agent produced and why walks out the door.

A seventh line changed in nature this summer, and it is routinely missing from the conversation. The EU AI Act separates the provider from the deployer, and that capacity is acquired by developing the system or having it developed on your behalf. A company buying a candidate screening tool was a deployer of it; the same company rebuilding it with its agents becomes a provider, with the risk management, data governance, technical documentation, record-keeping, human oversight and conformity assessment that come with the role.

The calendar has moved and needs reading correctly. Regulation (EU) 2026/1744, the Digital Omnibus on AI, was published in the Official Journal on 24 July 2026 and entered into force on 27 July, six days before the original deadline. It defers high-risk obligations for stand-alone Annex III systems, covering among others recruitment, credit scoring, education and critical infrastructure, to 2 December 2027, and those for Annex I systems embedded in already-regulated products to 2 August 2028. Both dates are fixed and no longer conditional on harmonized standards being published. The Article 50 transparency duties and the AI Office's enforcement powers over general-purpose models, by contrast, did take effect on 2 August 2026, with no deferral. The high-risk tier received a runway, not a pardon, and that runway is consumed during precisely the window in which systems built in-house today will reach production.

In the field, the breaking point is almost never technical. It comes when procurement removes the licence line from next year's budget while the matching run load has been written into no operating budget at all, because nobody priced it at the moment of the trade-off. The system works, the saving is real on paper, and the team maintaining it received neither budget nor headcount to do so.

A three-zone grid, and a twenty-four-month costing

The decision frames cleanly with two instruments. The first sorts scopes into three zones.

Building in-house fits when the scope is stable, when it touches a business specificity no vendor will ever cover properly, when it falls under neither Annex I nor Annex III of the EU regulation, and when a named team carries the operating load against an identified budget. Buying stays the right call when the scope is commoditized, when the regulatory obligation is heavy and a vendor carries it for you, when your system's conformity would engage your own liability as a provider, or when the subject is critical without being differentiating. Deferring applies to every case where you cannot answer, with numbers, the question of who pays for operations in year two and with what headcount.

The second instrument is a twenty-four-month run cost model, set against the price of the avoided licence, on the same page and in the same unit. Twenty-four months because the degradation GitClear measures shows up over that kind of horizon rather than over a quarter, and because a twelve-month comparison decides in favour of building every single time. The model does not need to be sophisticated. It needs to be written down, signed by the person who will carry the load, and reviewed by procurement before the licence line leaves the budget.

What to start this week

List the software purchases dropped over the last twelve months on the grounds that you could build the equivalent. The inventory fits on one page and it is almost always longer than engineering leadership estimates from memory, because the decision is rarely taken in committee.

For each one, write down the name of the person carrying the operating load today and the budget funding it. An empty cell there does not signal an administrative oversight, it signals a run cost that will be paid in incidents.

Measure duplication and function connectivity on the repositories concerned, and compare both values against an older repository in your estate. You are looking for a gap, not an absolute value, and the gap reads in an hour on tools your teams already have.

Run every in-house scope through the provider versus deployer test of the EU regulation, and flag the ones that would fall under Annex III. Those carry a dated deadline of 2 December 2027 and a documentation load better handled across two financial years than across one quarter.

Add the twenty-four-month run cost figure to your procurement process, as a mandatory part of the file alongside the quote from the vendor you turned down. A decision to build without that document is not a decision, it is a deferred invoice.

Conclusion

Skipping the purchase is no longer a weak signal, it is the behaviour of a third of the market and of nearly half the companies extracting the most value from their AI. What is missing is not the capacity to build, which is established and improving quickly; it is the accounting instrument that lets you compare a licence against an ownership load spread over two years, with the seriousness an investment committee applies to any other asset. Until that instrument exists, every avoided purchase produces a perfectly visible saving and a perfectly invisible commitment, and the gap between the two settles at the least convenient moment.

Sources: As of August 2026

Godwin AVODAGBE