Software teams are delivering faster thanks to AI while controls around this work are lagging, according to Info-Tech Research Group research published July 20. The company reports that 94% of respondents saw significant productivity improvements from AI in the way software is planned, built, tested and delivered.
The gap is greater in a company of ten people than in a bank. You don’t have a compliance department to catch what the tools are missing, so whatever review habits you set this quarter are the only thing between rapid production and costly cleanup. AI governance sounds like business vocabulary, but it boils down to a single question: who verifies the work?
What the Info-Tech study actually measured
The research covers organizations adopting AI across the software delivery lifecycle. Info-Tech found that companies with greater AI maturity in the build phase were more likely to report greater developer productivity, suggesting that gains are not evenly distributed.
Maturity does some real work in this sentence. Teams that integrated AI into a defined step in their process performed better than teams that gave everyone a subscription and hoped for it. The tool is not the variable. The workflow around it is.
At the same time, the study reports that governance, security and review practices are lagging behind the pace of adoption. This is the part that founders tend to ignore, because nothing breaks on day one.
| Find | What it covers |
|---|---|
| 94% | Share of respondents reporting significant AI productivity gains |
| Construction phase | Stage where higher AI maturity comes with greater developer productivity |
| Late | Status of Governance, Security, and Review Practices Versus Adoption |
Why the Governance Gap Costs Founders Money
Speed without review shifts risk rather than removing it. Code shipped in half the time still contains the assumptions made by the model, and those assumptions surface later, usually in front of a customer.
For a young company, exposure is concentrated. A poorly managed ID or a dependency that no one looked at can cost you a lot in procurement as buyers now wonder how AI impacts your code base. This question appears in security questionnaires long before it appears during a breach.
There is also a spending dimension. Teams that can’t connect AI tools to an outcome keep paying for it anyway, which is the same pattern behind the Reality check on AI ROI faced by large companies. Unverified expenses and unverified code come from the same habit.
Create evaluation habits before evolving
Start by naming the steps through which AI output enters your product. Write them down, because most teams can’t list them accurately from memory, and you can’t govern what you haven’t mapped.
Then define one rule per step. A human reads each change generated by the AI which affects, for example, authentication, payments or customer data. This single rule solves a disproportionate share of real-world problems without slowing down routine work.
Free frameworks exist for the rest. THE NIST AI Risk Management Framework gives you vocabulary and structure that you can borrow instead of making up. Adapt the elements that fit a business of your size and ignore the rest.
Budgetary discipline falls under the same review. Track tool expenses as a share of revenue, just like you already do. small business cash flowand cancel anything you cannot link to the shipped work.
Signals to follow until the end of the year
Watch how buyers modify their surveys. Security reviews are the fastest mechanism for conveying governance expectations because a large customer can impose practices across a vendor’s entire business portfolio.
Then look at insurance. Cybersecurity policies are starting to ask questions about the use of AI in development, and bounties tend to follow disclosure requirements within a year or two.
Adoption itself is no longer a story. Homeowners have already resorted to these tools because the AI for Small Business research on trust has shown this, so the competitive advantage has shifted to whoever uses them carefully.
Questions asked by founders on AI governance
Do I need AI governance across ten employees? Yes, although it should fit on one page. A short written rule about what is subject to human review is sufficient at this size, and it scales better than a policy you write after an incident.
Will the review slow down my team? Not if you extend it. Reviewing every line defeats the purpose, so limit the required review to code affecting money, credentials, and customer data.
What should I document first? A list of AI tools used, who approved each one, and what stage of construction they touch on. Buyers are asking for exactly that, and most founders can’t produce it on demand.
Takeaways are tight. Productivity gains are real and widely reported, so they are no longer a differentiator, and the teams that advance this year will be the ones that can prove their speed is safe.
