In the first week of June 2026, two stories collided on the desks of every CTO who buys software development. The first: a widely-shared analyst note arguing that AI-assisted .NET outsourcing now delivers 2.4x the velocity of a 2024 baseline at the same hourly rate. The second: a string of post-mortems from buyers who discovered, mid-project, that 70% of the "senior" code they had been billed for was Copilot output committed by a junior contractor — untested, ungoverned, and in two cases containing other clients' fragments.
The result is a debate that did not exist eighteen months ago: **does AI in outsourcing make the model dramatically better, or does it make it dramatically more dangerous?** The honest answer is that both are true, and the variable is governance. AI tools amplify the engineering discipline of the partner who uses them. A disciplined partner ships faster, safer code. An undisciplined partner ships faster, more dangerous code, billed at the same rate. The buyer who cannot tell the two apart is now exposed to a category of risk — IP contamination, hallucinated security, ungoverned data egress — that did not exist in their 2024 vendor contracts.
This guide is the ten-point due-diligence checklist we hand to procurement and engineering leaders before they sign a 2026 dedicated-team contract. It is also the spec we hold ourselves to at [Call IT Dev](https://callitdev.com). Use it whether you are evaluating us, evaluating a competitor, or auditing an existing partner.
A 2024 master services agreement typically covers IP assignment of "all work product created by Contractor," NDA scope, data residency and SLA penalties. None of those clauses were written with AI tooling in mind. In 2026 each of them leaks.
The fix is not to abandon outsourcing. It is to upgrade the contract and the verification process to match the new tool stack. The ten checks below are the upgrade.
Ask the partner what percentage of merged commits passed through a named senior engineer's review, and how that review is logged. The right answer is 100% of commits, with the reviewer's identity stored in the audit log and tied to a specific seniority band (mid, senior, principal). The wrong answer is a vague "we review everything" with no audit trail.
At Call IT Dev every commit on a [dedicated development team](https://callitdev.com/en/services/software-development/dedicated-development-teams) engagement is gated by a named senior or principal review, logged in the project's audit ledger and reviewable by the client at any time. Velocity from AI tooling does not change that gate.
LLMs are very good at writing tests that look thorough and pass CI without actually validating logic. Ask the partner whether the engineer who wrote the implementation is the same engineer who wrote (or accepted) the tests. If yes, you have a closed loop with no real validation. The right model is independent test ownership: tests written or audited by a different engineer, with mutation testing on critical paths and an explicit floor on assertion density.
If the partner uses agents (Cursor agents, Devin, custom orchestrators), the prompts and instructions ARE the source code. They need to live in git, be code-reviewed, and be reproducible. Ask to see the prompt repository for a current project. If the partner cannot show you versioned, reviewed prompts, the AI tier of their delivery is effectively uncontrolled.
Your contract needs a clause that does three things: (a) assigns to you all rights the contractor can validly assign, (b) requires the contractor to use only AI tools whose terms of service permit commercial use and assignment of output, (c) shifts indemnity to the contractor for any third-party IP claim arising from AI-generated code. Standard 2024 IP clauses do not do any of this cleanly.
Ask whether the partner can produce, on request, a log of which commits had AI-suggested content, which tool generated it, and which engineer accepted it. The mature partners can. The immature ones tell you the question is unanswerable. The question is answerable — every major coding assistant emits provenance events that can be captured.
Ask: which AI tools are approved? Which inference endpoints do they hit? Is your codebase ever sent to a public endpoint? Are tool-level data retention controls (zero-retention mode, dedicated capacity) enforced and audited? A 2026 partner should be able to answer in writing, with named vendors and named retention modes.
For each release, you should receive a Software Bill of Materials (SBOM) for traditional dependencies AND an AI-BOM listing the AI models, agents and prompts used in the build process. If the partner has never heard the term AI-BOM, you are 18 months ahead of them on governance.
AI-assisted code has a different vulnerability profile than human-written code: more rote SQL injection avoided, more subtle authorisation bugs introduced, more cryptographic primitives misused. Your partner needs an AppSec function that reviews AI-generated code with this profile in mind. Our [DevSecOps service](https://callitdev.com/en/services/software-development/devsecops) embeds an AppSec lead on every team for exactly this reason.
Velocity charts without quality charts incentivise the wrong behaviour. Ask the partner to commit to weekly delivery of both: throughput (story points or features), and quality (defect escape rate, mean time to revert, post-release incident count). The right partner welcomes this. The wrong partner negotiates it down.
You need the contractual right to audit the partner's AI tooling, prompt repository and review logs with 14 days' notice. You also need clean exit clauses: code, documentation, AI-BOM, prompt repository and provenance log all transfer to you at termination. Without exit clarity, the AI tier of the engagement is a hostage.
Treat the checklist as a maturity ladder, not a binary gate. Most partners will fail two or three of the ten points on first audit. The signal is whether they can name a credible remediation path, with dates and owners, or whether they get defensive. Partners who get defensive on AI governance in 2026 are partners who will be in the news in 2027.
For an SMB or mid-market buyer, the right onboarding sequence is: run the checklist before signing, write the gaps into the contract as 90-day remediation milestones with penalties, and re-audit at the 90-day mark. By month four either the partner has matured the practice or you have a clean contractual exit. Either outcome beats discovering the gap at the next breach.
Three operating commitments shape how we ship on [software development engagements](https://callitdev.com/en/services/software-development) in 2026:
**Senior review is the default, not an upsell.** Every commit on every team passes through a senior or principal reviewer named in the audit log. AI suggestions accepted by a mid-level engineer are still reviewed by a senior before merge. We do not bill clients for AI-only contributions that bypass human review — we bill for the human judgement that ships them.
**Tests are owned independently of implementation.** On every team, test ownership and implementation ownership are separated by engineer. We run mutation testing on critical paths, with a published floor of 70% mutation score on services that handle money, PII or auth. Tests that pass without assertions fail our CI by policy.
**Prompts and agent instructions live in git.** Every project has a /prompts directory with the system prompts, tool definitions and agent policies versioned and code-reviewed. Changes go through the same PR process as application code. At handover the prompt repository transfers to the client alongside the source.
The cost of running this discipline is real — roughly 8–11% added to the engineering hour cost — and we publish it transparently in our pricing rather than hide it. The cost of not running it is bigger, and increasingly priced into insurance premiums and breach disclosures.
If you are about to renew or expand a dev outsourcing contract, do these three things this week before signing.
**One — Run the ten-point checklist against the partner's current state.** Send the checklist verbatim. Ask for written answers with named owners. Track the gaps. Two thirds of partners cannot answer points 3, 5 and 7 today.
**Two — Add an AI governance addendum to your MSA.** Cover IP assignment for AI output, approved tool list, data egress controls, prompt versioning, audit rights and exit terms. Most legal teams can adapt a template in a week; we publish ours and are happy to share it.
**Three — Pilot the new model on a single bounded scope.** Take one greenfield service, run it on the upgraded contract with the ten controls in place, measure cost and quality against a comparable 2024 baseline. If you want a price reference before you commit, our [Software Development Cost guide for 2026](https://callitdev.com/en/software-development-cost) lays out our published rates and TCO bands. The data either justifies the new operating model across the portfolio or it does not. Decide on evidence, not on vendor pitch decks.
We are happy to be one of the partners you benchmark against. WhatsApp us at [+212 537 373 777](https://wa.me/212537373777), or [book a free 15-minute scoping call](https://callitdev.com/en/contact) and we will walk you through our audit log, our prompt repository structure and a sample AI-BOM from a recent release.
**Does AI-assisted outsourcing really cost the same hourly rate as it did in 2024?** Headline rates are similar, but the loaded rate including senior review, AI tooling licenses and AppSec gates is roughly 8–11% higher on disciplined teams. The output per hour is materially higher, so blended unit economics improve for the buyer — but only on partners that run the discipline.
**Can we ban AI tools entirely on our project?** You can, and we will honour it contractually. The economic cost is meaningful: a no-AI team in 2026 ships at roughly 60–70% of the velocity of a disciplined AI-assisted team at the same rate. Most clients negotiate scope (allowed tools, allowed data) rather than a blanket ban.
**Who owns the IP of code generated by an AI tool the contractor uses?** That depends on the tool's terms of service and your contract. Major commercial tools now grant assignable rights to enterprise customers; consumer-tier tools often do not. Your contract must restrict the contractor to tools whose ToS support full assignment, and indemnify you against third-party claims.
**What is an AI-BOM and when is it required?** An AI-BOM (AI Bill of Materials) inventories the models, datasets, agents and prompts used to produce or operate a system. It is not yet legally required in most jurisdictions, but enterprise procurement is starting to require it, and the EU AI Act second wave will make it mandatory for high-risk systems from 2027.
**How do we audit the partner's AI usage without being intrusive?** Quarterly reviews of the audit log, the approved tool list, the prompt repository and a sample of AI-BOMs. Two engineering hours from the partner per quarter cover it. The right partner welcomes the review because it locks in differentiation against weaker competitors.
Headline rates are similar, but the loaded rate including senior review, AI tooling licenses and AppSec gates is roughly 8–11% higher on disciplined teams. Output per hour is materially higher, so blended unit economics improve for the buyer — but only on partners that run the discipline.
Yes, contractually. A no-AI team in 2026 ships at roughly 60–70% of the velocity of a disciplined AI-assisted team at the same rate. Most clients negotiate scope (allowed tools, allowed data) rather than a blanket ban.
It depends on the tool ToS and your contract. Major commercial tools grant assignable rights to enterprise customers; consumer-tier tools often do not. Restrict the contractor to tools whose ToS support full assignment and require indemnity for third-party claims.
An AI Bill of Materials inventories the models, datasets, agents and prompts used to produce or operate a system. Not yet legally required in most jurisdictions; enterprise procurement is already requiring it in 2026, and the EU AI Act second wave makes it mandatory for high-risk systems from 2027.
Quarterly reviews of the audit log, approved tool list, prompt repository and a sample AI-BOM. Roughly two engineering hours from the partner per quarter. Mature partners welcome the review because it differentiates them from weaker competitors.
CALL IT DEV — Software, AI and dedicated tech teams — Casablanca | Madrid | Dubai — contact@callitdev.com — +212-537-373777