AI for CTOs: coding agents that pay off, and AI in what you ship

Management wants to see that AI makes engineering measurably faster, at a cost you can explain. Software development is where IT leaders see the most AI potential: 83% in Lünendonk's 2026 study, ahead of cybersecurity (80%). Bitkom found in 2026 that 42% of companies already use AI in IT or in the work of IT specialists and 36% plan to, and Bitkom's president said: “KI kann Aufgaben übernehmen, die bislang etwa von Entwicklerinnen und Entwicklern erledigt wurden”, AI can take over tasks previously done by developers.

The mandate reaches beyond your own teams. In Bitkom's 2026 survey, 20% of AI users put AI into their own products and services, up from 12%. In Lünendonk's 2026 study of agentic AI, IT leaders expect agents to support legacy modernisation through automated analysis and documentation (98%), API layer creation (97%), test generation (96%), database migration (94%) and code migration (72%).

• A productivity gain that survives scrutiny, measured on merged changes rather than on surveys or token counts.
• Spend per team that is visible, capped and explained in a cost per merged change.
• Code and data that go only where your policy allows.
• Review load that does not eat the gain.
• AI features in your products that are tested before every release, on a platform your teams share.

These come from management, security, platform teams, your own engineers and engineering forums. GitHub's switch of Copilot to usage-based billing on 1 June 2026 made several of them more urgent.

• From admins in engineering forums: “Is your management aware that your company pays for each and every token used?”
• From management: “We rolled out GitHub Copilot. How do we prove it helps?”
• From security and legal: “Where does our code go during inference, and what is the data retention policy?”
• From platform teams: “Can we control which models each team uses? Can we set spending limits?”
• From senior engineers: “If you're spending more time reviewing and fixing AI code than you would have spent writing it yourself, what exactly is AI doing for you?”
• From peers in regulated industries: “How are regulated orgs actually letting engineers use Claude Code / Copilot?”

Take a baseline before you scale, and put the gateway in place before you measure across many teams. In this order, every decision can still be reversed until the data supports it.

• First, a baseline per team: cost, merged changes, review time, rework and CI failures, taken from your repositories and billing.
• Second, where code may go, per class of repository: a vendor service under written retention terms, models in your own cloud account such as Amazon Bedrock or Azure OpenAI, or open-weight models on your own servers for the most sensitive code.
• Third, one gateway for all agent traffic, such as LiteLLM: keys per team, allowed models per team, budgets, routing and logs of where each request went.
• Fourth, tools: one or several, chosen on evidence. Evaluate tools, models and settings on your own merged changes against hidden tests, rather than on vendor benchmarks.
• Fifth, the harness: the instructions, commands, permissions and checks that coding agents rely on, kept in version control and tested on typical tasks when they change.
• Sixth, rollout team by team, with branch protection, review rules for agent-written changes and training on your own repositories.

AI features in a product, such as an assistant on your documentation, search in a customer portal, an agent that prepares service cases or a voice interface on a machine, need the same discipline as any other release, plus tests for answers that can vary. Evals, repeatable tests of an AI system on fixed cases, set the quality bar before release and run again after every model, prompt or data change.

Underneath sits one platform for products and internal tools alike: the gateway, model serving on your own GPUs where volume or data requires it, retrieval with permissions, tracing, monitoring and CI/CD for prompts and models. From 2 August 2026, Article 50 of the AI Act requires telling users when they interact with an AI system. If a product screens or ranks job applicants or scores the creditworthiness of individuals, it is a high-risk system under Annex III of the AI Act, with duties from 2 December 2027 such as risk management, documentation and human oversight. We do not build such decisions to run without people.

• An acceptance threshold per feature, set with product management on cases from real users.
• A cost and latency budget per request, so a feature stays affordable at scale.
• Regression tests that block a release when quality drops after a model change.
• Serving that fits the volume: a provider API at first, your own GPUs when volume or data make it worthwhile.

Most of these risks show up first as a number: a bill, a review queue, a failed build. Each has a control that can be measured.

• Token bills that surprise finance. Budgets per team in the gateway, sensible model defaults, routing of simple tasks to cheaper models and caching, reported as a cost per merged change.
• Code leaving the company. Written retention terms from each vendor, models in your own cloud account or on your own servers for sensitive repositories, and gateway logs that show where each request went.
• Review becoming the bottleneck. Review time and rework are measured per team, tasks are cut smaller, and checks in the harness catch common errors before a person looks.
• Agents doing too much. Permissions in the harness, branch protection, secret scanning and sandboxed execution limit what an agent can touch.
• Tool and model updates that break workflows. New versions are replayed on recent merged changes before they reach the teams.
• Roles changing in your teams. 32% of companies expect AI to cut IT jobs, 61% expect routine tasks to disappear and 55% expect classic entry-level tasks to go (Bitkom, 2026). We report by team, task and model and never score individual people, and we do not rank engineers by token use.

Engineers ask it directly: “Can you please share how you measured that productivity gap that's real?” Ask any provider, including us, for evidence of this kind.

• Results on your own merged changes, checked against hidden tests.
• The cost and review effort of every accepted change, before and after.
• Written data retention and training terms for every model endpoint in use.
• Spending caps per team that are enforced technically, for example in a gateway.
• The harness, configuration and tests handed over in your version control, usable without the provider.
• For product AI, an eval report against an agreed threshold and the same evals running in CI.

Start with the free AI usage review. Send the usage and billing exports you choose from Copilot, Claude Code, Codex, Cursor or your gateway, and receive one page on where the spend goes, what to change first and what to measure next. It needs no access to your systems.

For one team, the coding agent cost review goes deeper, down to the cost per merged change before and after. For AI in your products or a shared platform, bring the use case to a free 30-minute call with an engineer.