Google Cloud's DORA research, based on nearly 5,000 technology professionals, found that 90% now use AI at work, spending a median of two hours a day with it, roughly a quarter of the working day. The same research found something less discussed: AI adoption lifts delivery throughput, but it also increases instability. More software gets shipped, less predictably.
That instability isn't abstract. Over the past 18 months, AI-generated software has caused well-documented production incidents at several prominent technology companies, from wiped databases to major outages, and none of it involved unskilled teams. What's actually going wrong?
The research points to the same answer from a different direction. The code is rarely the problem. What's missing is everything that turns working code into a system you can run in production and defend to a regulator.
The Standish Group's CHAOS research has consistently found that incomplete and changing requirements sit at the top of the list of reasons technology projects fail, with only around 31% delivered on time, within budget and matching the intended scope. AI does not change that arithmetic. A generalist model produces plausible-looking requirements and design just as easily as it produces plausible-looking code. If the starting direction is wrong, that error carries through design, into code, and into the test cases written to check it.
Stack Overflow's 2025 developer survey found 66% of developers name ‘AI solutions that are almost right, but not quite’ as their single biggest frustration, and 45% say debugging AI-generated code takes longer than writing it themselves. GitClear's research on AI-assisted code shows the trade-off in more detail: refactoring activity is down 70% and long-term legacy maintenance work is down 74% compared with 2022, while duplication and other markers of technical debt continue to rise.
Writing code was never the whole job. Owning the system, the requirements, architecture, security, testing, deployment and accountability that make it reliable, is the rest of it. AI increases a strong engineer's leverage. It doesn't inherit their responsibility.
The gap is more expensive in financial services. The Cambridge Centre for Alternative Finance's 2026 Global AI in Financial Services report found 78% of regulators rate explainability as critical or important to their objectives, while only around half of industry firms have adopted explainable AI methods. That gap between what regulators expect and what firms have built is exactly where AI-assisted projects tend to unravel. Governance added after the fact rarely holds up to the scrutiny a capital markets process demands.
Michael Kinloch, Xceptor's SVP of Engineering, set out the approach in CIO in September 2026: break the product development lifecycle into narrow-scope agents, one for requirements, one for design, one for test strategy, each with a human review gate before the work progresses. Agents run in read-only mode before they earn the authority to act. Confidence thresholds are set before any routing decision is automated, novel exceptions still need human sign-off, and every decision point carries a full audit trail. Governance built in, not bolted on.
The results are concrete. One connector build that would typically take around two weeks through a conventional engineering process took two days running through this model, agents generating requirements, design documentation, code and test strategies, with engineers reviewing and steering at each stage rather than producing from scratch. Total cost to build fell 83%, including AI token spend. The same discipline sits behind the trade confirmation extraction agents built for capital markets clients, pulling structured data out of confirmations that arrive as emails, PDFs and SWIFT messages across formats no two counterparties use the same way.
It's the same principle behind the platform: the IDC White Paper, commissioned by Xceptor and published in January 2026, found organisations using the Xceptor platform saw a 523% ROI over three years, with an eight-month payback period, achieved because AI and deterministic, rules-based processing work together rather than one replacing the other.
Large, well-capitalised institutions can and do build sophisticated internal platforms using AI and sizeable engineering teams. That's a genuine option for a narrow set of organisations with the resources to treat it as a permanent, dedicated function rather than a project with an end date.
For most, the harder and more expensive part isn't the build, it's everything that comes after: the governance, the maintenance, and the specialisation required to keep that platform safe indefinitely, long after the prototype impressed everyone in the room.
Before signing off on an internal build, however capable the prototype looks, work through six questions: Is this process business-critical or regulated? Does it need a complete, provable audit trail? Who owns it, and maintains it, three years from now? Can you match enterprise security standards without a dedicated security function? What else could this engineering time create instead? Would you rather own the outcome, or own the maintenance?
If those questions don't have confident answers, the build isn't finished. It just hasn't been tested yet.
about how Xceptor engineers AI into governed, auditable workflows built for capital markets operations.