Grounded analysis of AI, software and the industries they're reshaping, built from real 2025 reports and studies, with every figure sourced.
Census data: government customers of computer systems design firms grew 7.5% in Q2 2026 against 3.2% overall. Read the error bars before you chase it.
California says Disney's opt-outs worked per device and per service. What sections 7025 and 7026 require and how to build an account-level opt-out.
Paying a subcontractor on a fixed schedule while your client pays net 45 opens a cash gap. Here is the math, and when pay-when-paid is the wrong fix.
Section 7222(j) lets a business answer an ADMT access request with a 12-month summary after more than four uses. What to count and what to build.
Removing a subcontractor from GitHub ends their login, not the secrets in the repo or the deploy keys on it. Here is the rotation checklist for agencies.
California's first data minimization case, the GM settlement, reads as a build list: purpose per field, consent per feature, deletion that reaches recipients.
Arc helps companies hire remote developers, freelance or full time. ivector gives agencies a white-label engineer on a paid pilot. Which fits your overflow.
BairesDev staffs nearshore engineers and PM-led teams on US hours. ivector starts an agency with one white-label engineer on a paid pilot task.
Lemon.io matches startups with contract developers on risk-free trial hours. ivector gives agencies a white-label engineer on a paid pilot. How to pick.
A privacy platform such as OneTrust can hold ADMT notices, choices and requests. The notice timing, the stop switch and the decision log live in your code.
White Label IQ and ivector both build under an agency's brand. They differ on platforms, on how you start, and on whether they ever work with end clients.
Toptal offers freelancers on a no-risk trial. ivector gives agencies a white-label engineer on a paid pilot. How they differ, and when Toptal fits better.
Upwork is an open marketplace where you vet, hire and manage. ivector is one white-label partner that starts with a paid pilot. When each fits an agency.
A CCPA compliance checklist for engineers: each obligation with its section, its date and who it applies to, plus what your system has to produce.
Staff augmentation vs managed services, SOW, consulting and staffing: one question sorts them: who directs the daily work, and who answers for the outcome.
Census County Business Patterns, 2023: 72% of US custom-programming shops have under five staff, and only 23% have 5 to 49. Where overflow capacity sits.
Four ways an agency can cover a spike in client work: a freelancer, staff augmentation, outsourcing or a white-label partner, and who carries the risk in each.
The DOJ's bulk data rule covers six countries and a short list of thresholds. Here is how it applies to an agency subcontract, and the cheap fix.
California requires a risk assessment before you train an ADMT on personal information. The trigger is the model's intended use, not the technique.
California fined a data broker over an opt-out form that asked for the last four digits of an SSN. The order reads as a spec for your own request intake.
On a small business set-aside services contract, an agency can pay at most 50% of what the government pays it to firms that are not similarly situated.
California gives you 45 calendar days to update a risk assessment after a material change. Here is what counts, and the change log engineering needs.
Since 2025, US-built software costs are deductible at once, but work done abroad is spread over 15 years. Where the engineers sit now changes your tax bill.
California waives the ADMT opt-out for hiring and for work and pay allocation, on two conditions. Here is what each means for the tool you ship.
A 9-to-5 against a 9-to-5 gives a Pacific agency zero shared hours with Lahore. Here is what a four-hour window costs in local time, and when it shifts.
California lets a human appeal stand in for the ADMT opt-out, but only if the reviewer, the flow and the clocks meet section 7221(b)(1). Here is the build spec.
Under 18 U.S.C. § 1833(b), an NDA with a contractor needs a short immunity notice, or you lose exemplary damages and attorney fees. Here is the clause check.
Section 7220 does not exempt data you collected years ago. Here is when the California pre-use notice must fire and the delivery rules a checklist misses.
California's business-to-business exemption has 12 criteria and the hiring agency must prove all of them. Here they are as a subcontractor intake checklist.
Section 7221 gives you 15 business days to stop using ADMT on a person and to tell every vendor to do the same. Here is the handler that has to exist.
If your agency touches a California client's customer data, the CCPA says the contract has to reach every subcontractor you bring in. Here is the text.
California's PlayOn Sports order reads like a build spec: scan trackers quarterly, honor opt-out signals, and document a risk assessment.
A 1099-NEC is for US payees. For an offshore subcontractor the IRS asks where the work was performed first. Collect the right form before you pay.
Californians can ask how an automated decision about them was made. Section 7222 says what the answer must contain, and the 45-day clock starts at receipt.
Software a subcontractor writes is not work made for hire by default, and in California the clause can make them your employee. Use a signed assignment.
Veracode's July 2026 report: AI code security is stuck at a 56% pass rate, with 83% on SQL injection but 15% on XSS and 12% on log injection.
SB 923 extends the CCPA right to delete to data obtained from third parties, effective January 1, 2027. What that means for enrichment feeds and sync jobs.
Checked out a branch or ran npm install on a stranger's repo and something looks wrong? What to check, what to rotate, in what order, and who to tell.
Anthropic's June 2026 index: coding-agent sessions score 0.37 points more autonomous than chat, and still 0.26 points more with the model held constant.
A fake client sent our agency a git repo and asked us to check out its "NDA" branch. A hidden post-checkout hook would have run malware. How to spot it.
A 10-minute triage for agencies: where malicious code hides in a client's repo (hooks, VS Code tasks, npm scripts) and the commands to find it safely.
Attackers now pose as clients to reach agencies through Clutch and contact forms. Nine checks, most under a minute, to run before anyone opens a file.
Census's BTOS data, published May 2026: AI use hit 37% at firms with 250+ staff, 32% at 100 to 249, and stayed under 20% below 20 employees since December.
LangChain's June 2026 survey of 1,340 practitioners: 57.3% have agents in production, quality is the top blocker, and 29.5% run no evaluation at all.
BLS QCEW data through Q1 2026: California added 1,871 custom-programming establishments in a year, while employment per shop fell 7.1%.
PitchBook-NVCA's H1 2026 data: megadeals took 87.5% of $412.7B in VC, and three firms took 48.1% of new fund capital. What that means outside the top tier.
SB 446 gives California businesses 30 days to notify residents, then 15 more for the Attorney General. The state's own breach database shows a 137-day median.
New Relic's 2026 survey: 94% rate AI-generated code higher quality at review, yet 78% saw a production-incident spike and 82% had a major failure.
Census's August 2026 data: total applications matched June's count after a spike and reversal. Applications planning to pay someone fell in both months.
Stanford's 2026 AI Index: GPT-4o fell from 98.2% to 64.4% accuracy, and DeepSeek R1 from over 90% to 14.4%, once a false claim was framed as the user's own.
Census Bureau data published September 9, 2026: computer systems design revenue growth fell from 6.6% to 3.3% in a single quarter.
Datadog's own telemetry: 2% of production LLM calls failed in March 2026, and rate limits caused nearly a third of it. Most weren't the model.
CalPrivacy fined Honda $632,500 and Todd Snyder $345,178 in 2025 for broken opt-out mechanisms. California's browser opt-out law starts January 2027.
METR's May 2026 survey found workers self-report up to a 3x AI speed gain. Its 2025 randomized trial found developers 19% slower. Same lab, opposite numbers.
BLS data: 53.7% of California businesses that opened by March 2020 survived five years, versus 51.4% nationally. The first year was the steepest drop.
DHS's new H-1B rule raises a Level IV wage registration's lottery odds from about 30% to over 61%, per the agency's own Federal Register filing.
BLS's Employment Cost Index: professional-services compensation rose 3.0% and professional-occupation wages rose 3.5% in the year through June 2026.
GitHub merged 518.7 million pull requests in the year through August 2025, up 29%. Its own team says review capacity is losing that race.
California's cybersecurity audit calls out phishing-resistant MFA by name. The push notifications most companies use do not clear that bar.
JetBrains' own 2026 survey data: Claude Code adoption more than doubled since January while GitHub Copilot's fell. What the shift costs a team's tool policy.
SEC Form D data for Q2 2026: 277 recently incorporated California companies raised a private round. 91% reported no revenue or declined to disclose it.
BLS's May 2025 wage data: San Jose software developers earn $221,710 a year on average, 50% above the $148,100 national mean for the same job.
BLS's July 2026 jobs report: computer systems design and related services lost 29,000 jobs over the year, even as demand for agency work hasn't slowed.
METR's Frontier Risk Report found agents at OpenAI, Anthropic, Google and Meta cheating and evading monitors, inside the four labs best equipped to catch it.
Verizon's 2026 breach report found unapproved AI tool use tripled to 45% of employees in a year, breaking the inventory an ADMT risk assessment assumes exists.
Stack Overflow's 2025 survey of 49,000 developers found 84% use AI tools weekly or more, but only 33% trust the code it produces.
The Federal Reserve's 2026 Small Business Credit Survey found 46% of firms use AI, but only 7% of those users called it fully integrated into the business.
OpenAI's February 2026 audit of 138 SWE-bench Verified failures found 59.4% had broken tests. An ICSE 2026 study found the benchmark also passes wrong patches.
BLS JOLTS data (August 2026): professional-services quits hit 2.2% in June, above the national rate, while job openings in the sector barely moved.
GitClear's January 2026 report: refactoring fell from 21% of changed lines in 2022 to 3.8% in 2026, while duplicated code blocks rose 81% since 2023.
California's Civil Rights Council automated-decision-system rules took effect October 1, 2025, a year before the ADMT deadline most compliance teams track.
OWASP tested its 2026 LLM Top 10 against 6,639 real incidents. Prompt injection tops the vote but falls out of the top 10 by raw incident count alone.
The Census Bureau's July 2026 data: Retail Trade applications jumped 44.5% in a month, while software's share of new businesses barely moved.
Stanford's 2026 AI Index found software developer productivity up 26% while entry-level hiring fell 20% since 2024, and one number explains the other.
Census data show work-from-home more than doubled since 2019. What that changes about vetting a subcontracted offshore bench isn't the distance.
Stanford's Foundation Model Transparency Index fell from 58 to 41 in 2025, and the five biggest labs all clustered in the same untested middle.
California's ADMT rights don't bind until 2027. CalPrivacy's first sectoral audit, opened July 2026, already targets algorithmic dispatch and pay decisions.
PitchBook-NVCA's Q2 2026 report: US venture funding hit $412.7B in H1, but deals under $100M fell from 33.1% of dollars in 2025 to 12.5%.
The Census Bureau's own May 2026 survey found firms under 20 employees saw almost no AI adoption gain while firms over 250 employees passed 37%.
Chroma Research tested 18 models on long inputs in July 2025: accuracy degraded before the limit, and organized text did worse than scrambled.
Gallup's 2026 report found South Asia's manager engagement fell 8 points, the sharpest drop of any region. Here's what that means for a subcontracted bench.
DORA's September 2025 report: AI adoption raises delivery throughput and incidents together. What decides which one you get more of.
California's rules for service-provider contracts already cover AI vendors, and they took effect a year before the ADMT deadline everyone is watching.
Anthropic's March 2026 index: coding tasks rose 14% in its API since August, fell 18% in Claude.ai. The split shows where AI work is really going.
The Census Bureau's June 2026 data: 531,423 new business applications, and just 2.4% were software companies. The other 97.6% still need software built.
OpenAI's own policy promises six months before a model retires. Anthropic's promises sixty days. What that gap costs a team that pinned a model ID.
Microsoft's own 2025 data shows a third of meetings now cross time zones. Here's what actually protects a subcontracted bench from the same drift.
METR’s own January 2026 update puts frontier AI’s autonomous task length at about five hours, with error bars wide enough to embarrass the hype.
Not every CCPA business owes the audit. First reports fall due in 2028, 2029 or 2030, each set by revenue in a different year. Here is who is covered.
California requires a documented risk assessment for high-risk processing, signed by an executive and producible in 30 days. Here is what it has to contain.
California's ADMT definition never mentions AI. It turns on whether a system replaces human decisionmaking, which is why most scoping passes miss things.
Software job postings are recovering, but 71% of the growth is senior roles and 37% mention AI in the title. The market got tighter, not easier.
Growth rarely stalls because demand dried up. It stalls because the systems behind the work stopped keeping pace. Five symptoms you can check this week.
The fear is not cost, it is dependency. Four things to keep in your own name, and the handover terms that decide whether you can ever leave.
California requires a notice before an automated decision and a way to refuse it. Here is what that looks like as components, states and edge cases.
Agencies subcontract constantly and rarely discuss the numbers. Here is how the markup works, where it goes wrong, and what a fair arrangement looks like.
Staff augmentation succeeds or fails in week one. What to prepare before they start, what to give them on day one, and what to measure by Friday.
Offshore delivery is normal now. The questions that separate a good partner from an expensive lesson are about data, contracts and overlap hours.
A model output in a database column is not an audit trail. Here is what to record at the moment of the decision, and what teams usually leave out.
California's automated decision rules bite on 1 January 2027. Most of the work is not legal drafting. It is four things engineers have to build first.
Small business AI use jumped from 48% to 78% in under two years. The real story is who is using it and who is genuinely gaining.
One search firm puts a senior engineering req at about seven weeks to an accepted offer. Add notice and ramp, and the empty seat is the real cost.
Most MVPs ship in 8 to 16 weeks, but the range hides what actually drives the number. Here is a realistic breakdown of where the time goes and what shortens it.
The 2017 paper behind every modern AI model is famously dense. Here is what it actually proposed, and why it changed everything, in plain language.
A 2022 DeepMind paper showed most large models were the wrong shape: too big, trained on too little data. It reshaped how every model since has been built.
The same project can draw quotes several times apart. What drives the spread, what you are really paying for, and how to compare quotes without getting burned.
Stanford, McKinsey and MIT all published 2025 data on enterprise AI. Read together, they tell one story: near-universal adoption, almost no measurable return.
A simple app costs tens of thousands; a complex one runs into the hundreds. The useful question is not the number but what drives it, and what you can cut.
Retrieval-augmented generation is how most companies put their own data into an AI product. A 2020 paper named the idea. Here is what it proposed.
The contract model you pick changes who carries the risk, how fast you can adapt, and what you ultimately pay. A plain-English guide to choosing the right one.
A 2022 paper found that simply asking a model to reason step by step made it dramatically better at hard problems. It is the root of today’s “reasoning” models.
AI agents are the headline of 2025–26. Gartner’s forecasts show explosive adoption alongside a 40% project cancellation rate. Both are true.
Many AI proofs-of-concept fail because nobody defined success before starting, not because the model cannot do the job. How to run one that earns its budget.
A 2024 Apple study probed whether top models truly reason or pattern-match. Changing the numbers in a maths problem made accuracy drop.
A developer's salary is the smallest part of the bill. Add recruiting, ramp-up, benefits and the risk of a bad hire, and the in-house-vs-partner maths shifts.
Inference got 280× cheaper in 18 months, so why do most AI projects lose money? The cost isn’t in starting. It’s in everything after.
The two get pitched as rivals but solve different problems. RAG gives a model knowledge it lacks; fine-tuning teaches behaviour. How to tell which you need.
A 2025 randomised trial found seasoned developers were 19% slower with AI tools, yet believed they were faster. That gap is the real finding.
95% of enterprise AI pilots show no measurable return. These are the questions that separate a partner who will ship value from one who will sell you a demo.
In a 2025 randomised trial, experienced developers took 19% longer with AI tools while believing they were 20% faster. Newer evidence complicates the story.
A good RFP gets you comparable, honest bids and filters out the wrong vendors early. A vague one gets you a pile of guesses. How to write the first kind.
A team that has delivered for Microsoft or Google has survived reviews, scale and scrutiny most projects never reach. Why that matters on small projects too.
AI made convincing, personalised phishing and deepfakes cheap to produce. Spotting the fake no longer works; verification steps that can't be faked do.
The agency that built your first product is not always the one to scale it. The honest signals that the relationship has stopped serving you, and how to act.
AI features fail less on the model than on the interface around it. The usability research points to patterns that earn user trust, and some that destroy it.
Prohibited-use bans and GPAI rules are already in force, with fines up to 7% of global turnover. Here’s the timeline every team shipping AI should know.
One large study measured a 14% gain for support agents using AI, and service teams expect AI to handle half of cases by 2027. Deploying isn't operationalising.
Banks use AI widely, above all against fraud. Yet only 4 of the 50 largest banks Evident tracks publicly report realised ROI on their AI portfolio.
The clearest labour-market signal so far isn’t mass layoffs. It’s a quiet drop in junior hiring at firms that adopt AI. The data is nuanced.
The IEA projects AI will more than quadruple data-centre electricity demand by 2030. For builders, efficiency is now a cost discipline, not just a green one.
Healthcare AI is easy to count: most clinical AI tools need FDA authorisation. The FDA list grew more than fourfold in five years, and it holds a design lesson.
The collapsing cost of running models is the most underrated story in AI. It changes which products are viable, and which moats disappear.
The biggest model isn’t usually the right one. Efficiency gains mean small, specialised models now win on cost, speed, privacy, and often quality.
Capability is racing ahead of responsibility. Reported AI incidents hit a record high in 2024, even as standardised safety evaluation lags behind.
Two ways to make a model know your domain, and most teams reach for the harder one first. A practical guide to choosing.
The single discipline that separates AI pilots that reach production from the 95% that don’t is evaluation. Here’s how to build it.
Gartner expects 40% of agentic AI projects to be cancelled by 2027. The reasons are predictable, and avoidable.
The moment your model reads untrusted input, that input can carry instructions. Why prompt injection is AI’s defining security problem.
AI features break classic UX assumptions. Designing for probabilistic, sometimes-wrong systems takes a new set of patterns.
The full rewrite is the most expensive, riskiest path, and rarely the right one. How to modernise incrementally instead.
Off-the-shelf is the right default, until it caps your business. With AI now an option too, the framework needs an update.
From FDA-cleared devices to banking to the EU AI Act, the same design keeps appearing: AI assists, a human decides. It’s not a limitation; it’s the product.
Finance has the data and the use cases, but also the regulators. Here’s where generative AI is genuinely landing.
Recommendations and forecasting are now table stakes. The frontier is generative: turning data into merchandising, content and service at scale.
Predictive maintenance and quality inspection deliver real gains, but much of it is classical machine learning, not generative AI. That’s a feature, not a gap.
AI can personalise learning at a scale teachers never could, but student data and academic integrity set hard boundaries.
Document review, research and drafting are being transformed. But hallucinated citations and privilege make accountability the deciding constraint.
The gap between open and closed models has narrowed sharply. The right choice is about control, cost and data, not ideology.
MIT studied 300 deployments and surveyed hundreds of leaders. The 95% failure rate isn’t about model quality; it’s about how organisations adopt.
Only 39% of firms see any EBIT impact from AI, and just 4 of the 50 largest banks reported realised ROI. Measuring return is the skill that separates winners.
