Three of your operating units built production software this year without IT involvement. The claims team deployed an artificial intelligence (AI)-powered triage tool that routes incoming notifications by predicted complexity. The underwriting team released a document summarisation application that processes broker submissions before they reach an underwriter. Finance wrote a reconciliation script using an agentic coding assistant; it has been running in production for four months. Each tool, assessed on its own, looks low-risk. What you do not have is an inventory of them or a data-handling assessment for any of them. The missing inventory is an operating model problem. The operating model still assumes only IT builds what runs in production, and agentic coding tools now let any operating unit do it. If your board asks who owns those tools, you cannot give a confident answer.
In Brief
- IT's order-taking operating model assumed only IT could build production software. That assumption fails once operating units have agentic coding tools.
- In McKinsey's 2026 State of AI survey, 32% of organisations had chosen not to buy at least one software product because they could build it in-house.
- Every quarter without a decision on build authority adds production applications that have no inventory entry and no data-handling assessment.
- Build authority can stay with IT or move to business units working to IT-defined standards, and each option gives the board a different answer on who owns what.
Shadow IT used to mean an operating unit sidestepping IT procurement to subscribe to a software-as-a-service tool. The response was clear: bring it inside the procurement framework or disable it. Operating units are now writing production applications themselves, so the build decision, once IT’s, is theirs.
Any team can build now
Building software required IT’s infrastructure and IT’s time, and that concentration of technical capability gave IT its authority over what could be built and when. The operating model that formed around it was coherent when building required IT’s involvement: business units submitted requirements; IT designed and built the solutions. When a finance analyst with an agentic coding assistant can produce a production application in an afternoon, IT no longer holds the only capacity to build.
McKinsey’s August 2026 State of AI survey found that 32% of organisations had already decided not to buy at least one software product (Tinkoff et al., 2026). They made that decision because their teams could build the product in-house. Agentic coding tools drove that shift: 41% of technology companies and 38% of professional services firms made the same decision. That 32% reflects organisations that decided on purpose whether to build or buy. Where operating units started building before anyone made that choice, build authority moved to them without governance.
A model is inefficient when it still produces the right outcome but takes longer or costs more than it should. IT’s order-taking model has a different failure: it is incoherent, because the condition it was designed around, that only IT could build production software, no longer exists. The governance frameworks organisations built around IT’s authority, procurement gates and architecture review boards, were designed for a world where building software required going through IT. They remain in place, but the build decisions they were set up to review are now made in operating units that never pass through them.
The shift went unnoticed because none of the individual build decisions were wrong. The claims and underwriting teams solved operational problems with the capability available to them. A finance developer wrote the most direct solution to a problem that had been sitting on the IT backlog for eight months. No one bypassed governance deliberately. The governance model was designed for a time when only IT could build software, so none of its steps applied to a team building its own tool.
Production is ahead of governance
The applications your teams built this year are running in production, and no governance process covered how they were built. If one touches regulated data in a way that creates a notification obligation, the obligation sits with the organisation. Its governance for technology that processes customer data was designed before anyone outside IT could build production applications.
An organisation without IT’s authority redesigned has no reliable mechanism for knowing what is being built or what has already been built. Each quarter the authority question stays open, more production applications accumulate outside any inventory. For organisations with regulatory reporting obligations, technology that processes customer data carries a notification obligation to a regulator. For them, that inventory gap is a potential compliance exposure that grows with every application the organisation adds. When an organisation investigates a governance incident involving one of those tools, it will find the tool is one of many built the same way. Each was built in good faith, and each was outside any process designed to assess what it does.
The board’s question, who owns the AI systems that touch our customer data and what standards govern them, has a clear answer while IT holds authority over build decisions. Once build authority has moved to operating units without a governance model, nobody in the organisation can give that answer with confidence.
Build authority needs an owner
Build authority now sits with whichever operating unit has an agentic coding tool and a problem to solve. The operating model has to state where it sits by design, and who is accountable when a tool fails or creates a compliance exposure.
Build authority may remain with IT. Or accountability may shift to business units operating under IT-defined standards: a redesign that keeps IT in the picture but changes where the authority sits. Each option produces different governance requirements and a different answer to the board’s question. The organisation must decide where authority over build decisions sits in the operating model, and it cannot defer this until the next governance incident makes it unavoidable.
The executive who settles where build authority sits before the board asks can tell the board who owns each production tool the business builds. The executive who first hears of a tool in a notification event has to build that inventory under regulator scrutiny. The decision on build authority is where the operating model conversation with ZXM begins.
