The short answer
For most mid-market rebuilds, one senior CTO and a small AI-driven team now beats a large dev shop.
The bottleneck has moved. Typing code is cheap. Judgement, review and ownership are where projects now succeed or fail, so that is where the senior person needs to sit.
For twenty years the cost of custom software tracked headcount. A bigger system needed a bigger team, more layers of management and a longer timeline. AI coding tools have broken that link. A capable developer working with these tools can read an unfamiliar codebase, draft tests and produce documentation in a fraction of the time it used to take.
McKinsey reported that gen AI can deliver a 40 to 50 percent acceleration in tech modernisation timelines and a 40 percent reduction in costs derived from technology debt. In my experience that is realistic when a senior person is steering, and optimistic when nobody is.
What changes for CIOs and boards
Procurement
A quote built on 15 developers for 18 months is now a warning sign, not a sign of seriousness. Ask how the vendor uses AI tools and why the estimate still looks like it was built in 2019. A quote that is suspiciously cheap can be just as bad. It may mean nobody senior is checking the output.
Where the risk moves
Risk does not disappear. It moves from writing code to checking it. Veracode tested code from more than 100 language models and found that 45% of AI-generated code samples introduced an OWASP Top 10 vulnerability. The questions that matter are about review, automated tests, security checks and who owns the result. A team that generates code quickly but reviews it casually will produce a fast, fragile system.
Ownership
With fewer people involved, it is clearer who is accountable. That is a good thing. It also means the business must insist that the code, the cloud accounts and the documentation sit in its own name from day one. A small team should never become a single point of failure.
What does not change
AI tools do not decide whether you should rebuild a system or buy SaaS. They do not know which business rules your finance team relies on at month end. They will happily build on a data model that is wrong for the business.
Architecture, data design and the decision about what not to build still depend on experienced people. That is why I think the senior role has become more important, not less.
Questions to ask any vendor about their AI claims
Take these into your next vendor meeting. Each one should get a clear, specific answer.
- Who reviews every AI-generated change before it ships, and what is their experience?
- What automated tests run on every change, and can we see the coverage report?
- How do you check AI output for security issues such as exposed secrets or injection flaws?
- How much of your estimate assumes AI acceleration, and what happens if it does not materialise?
- Will the code, repositories and cloud accounts be in our name from the first week?
- Which AI tools touch our code or data, and where is that data processed?
If a vendor cannot answer these clearly, their use of AI is a cost saving for them, not a benefit for you.
Why governance matters more, not less
Faster delivery means mistakes reach production faster too. The answer is not to slow down. Put guard rails where the risk now sits:
- mandatory code review by a senior engineer
- tests that block a release when they fail
- security scanning on every build
- a clear record of which AI tools are approved for which data
Boards that already oversee cyber risk can apply the same discipline here with very little extra effort.
How we work
This is the model we now use for our legacy system modernisation and vibe code rescue work. One of our CTOs reviews the system, plans the rebuild and leads it from start to finish. A small team of AI-driven developers does the build, and every change goes through that CTO before it ships.
It is the same idea behind forward-deployed fractional leadership: senior judgement sitting right next to the work, not three layers away from it.
Common questions
Is a small AI-driven team better than a large development shop?
For most mid-market rebuilds and rescues, yes. One experienced CTO leading a small team of AI-driven developers can now deliver faster and with less risk, because typing code is cheap and the real work is judgement, review and ownership.
Does AI-generated code create security risk?
It can. Veracode found that 45% of AI-generated code samples introduced an OWASP Top 10 vulnerability. The risk moves from writing code to checking it, so senior code review, automated tests and security scanning on every change matter more than before.
What should we ask a software vendor about their use of AI?
Ask who reviews every AI-generated change, what automated tests run on each change, how they check for security issues, how much of the estimate assumes AI acceleration, whether the code and cloud accounts are in your name from week one, and which AI tools touch your code or data.
