McKinsey published its 2026 State of AI survey on August 25. In it, 32% of respondents say their organization turned down at least one software purchase because coding agents could build the thing in-house. That’s a budget story, and it’s also this. Every approval workflow, security review and contract clause your company owns fires on a purchase, and these companies just skipped one.
Why It Matters
Think about what starts a software review where you work. A request, a quote, an invoice, a renewal date. Every one of those is a spend event, and that was a fine trigger for as long as software you didn’t build was software you bought. A tool can get built in an afternoon and hold customer records by Thursday without producing a single thing your controls were built to notice. And it isn’t shadow IT. Shadow IT is unsanctioned buying, so a card gets charged and a gate can catch it. What’s happening here is unsanctioned building, with no charge to catch. McKinsey counted the skipped purchases, not what happened next.
The Decision
So the question worth putting to your team is what should start a review. Money leaving the company is a clean trigger: objective, and nobody argues with an invoice. The business coming to depend on something catches more and costs more to run, because somebody has to judge what counts.
What To Do This Week
- Ask whoever approves software spend what starts a review. If every answer is an invoice, a purchase order or a renewal date, you’ve found your trigger.
- Ask your ops or tech lead which tools built this year sit in a workflow that would stop without them, or hold customer data. Just the ones with something at stake.
- Pick one and ask who signed off on it. If the answer is nobody, that’s your gate failing to fire.
What Not To Do
Don’t answer this with a rule against building, because the economics behind that 32% are real. Don’t hand it to whoever hunts unapproved SaaS: they’re looking for a charge and there isn’t one. And don’t assume your platform settles it. If identity, logging and lifecycle are configured once and every internal build inherits them, that answers most of this, but only where somebody decided it.
Signal Boost
McKinsey, The state of AI in 2026: On the road to ROI - the survey behind the 32%, with the size and cost exhibits this issue didn’t use. Worth it for what it doesn’t measure: it counted the purchases that never happened, and nobody counted what got built instead.