New study finds each engineer spends at least 139 hours per year fixing or revisiting AI-assisted development, while the costs of release delays, audit findings, and security incidents can fall into separate budgets.

VANCOUVER, BC, Oct. 20, 2026 /PRNewswire/ — ActiveState today released The AI Remediation Bill, a study of 307 enterprise security, governance, platform, and engineering leaders in North America and Western Europe. The research finds that the downstream cost of AI-assisted development is spread across engineering, operations, compliance, and security, with each team absorbing its share in its own budget. Only 31% of organizations have formally quantified the total cost of unmanaged open source risk, so most enterprises are paying a bill they have never seen in full.

AI-assisted development is delivering real gains, with 93% of respondents reporting higher engineering productivity. But those gains come with a hidden cost. Engineers spend at least 139 hours a year, equivalent to more than 17 working days, fixing or revisiting AI-assisted development. For an organization with 100 engineers, that adds up to at least 13,900 hours annually, equivalent to the annual working capacity of roughly seven full-time employees. The study surveyed engineers at organizations with engineering teams of 100 or more, highlighting the potential scale of this challenge in larger organizations. Meanwhile, governance is struggling to keep pace. While 83% of respondents acknowledge that developer productivity is outpacing their governance capabilities, 71% still believe their existing approach can scale.

“AI is becoming a permanent part of how software gets built,” said Abby Kearns, CEO of ActiveState. “But our research found engineers spend at least 139 hours a year, more than 17 working days, fixing or revisiting AI-assisted work. That’s only engineering’s share. Security, compliance, and operations pay the rest out of their own budgets, so the full bill stays hidden. The way to keep the gains is to govern open source as it enters the codebase.”

The remediation bill lands in a different budget every time

Those 139 hours cover engineering time alone. AI is also adding pressure to open source governance, which was already costly, and those costs arrive elsewhere, each with a different owner:

• Operations: 76% had a software release delayed by unmanaged open source dependencies in the past year.
• Compliance: 58% received a compliance or audit finding related to open source governance.
• Security: 32% confirmed a security incident traceable to an unmanaged dependency in the past 2 years.
• Across teams: 83% say the overall cost of managing open source risk is rising.

Because each charge is recorded in a different system, few organizations see the total. 31% have formally quantified the cost of unmanaged open source risk, and another 47% have only an informal estimate.

AI is moving open source into production faster than governance can follow

AI is accelerating how fast open source enters the development flow: 94% of respondents say AI has increased open source consumption. Yet most governance still happens after components arrive. 63% address open source vulnerabilities only after scanners or security tools identify them, and half say new dependencies can reach production without prior review or approval. Recent incidents such as the Axios software supply chain attack show how risk can enter through a transitive dependency no team chose.

Respondents know the balance is wrong. Today they devote 26% of open source governance effort to prevention before deployment, and they say it should be 37%.

Jim Mercer, Program Vice President, Software Development, DevOps, and DevSecOps at IDC, built the firm’s DevSecOps research practice and has watched security move steadily closer to the developer. AI is speeding that shift up. “When an assistant can suggest a secure package, write the code that calls it, and push it toward production in minutes, governance built on static scanning after the fact will always be a step behind,” said Mercer. “Being able to control what enters the pipeline is key to enabling organizations to scale AI-assisted development.”

The full report shows how to add up the bill and reduce it

The AI Remediation Bill itemizes each charge with the method behind it, identifies the enterprises hitting the limits of today’s governance model first, and sets out a five-step path that starts with quantifying the bill across teams. Download The AI Remediation Bill.

About the research

The AI Remediation Bill is based on a quantitative survey of 307 security, governance, platform, and engineering leaders at organizations with 1,000 or more employees in North America and Western Europe, plus 10 in-depth practitioner interviews, conducted in July and August 2026. The research was commissioned by ActiveState and carried out by Moving Horizon.

About ActiveState

ActiveState secures the software supply chain at the source for the AI coding era. With the ActiveState Curated Catalog, a private, vetted repository of open source components, security teams decide what gets into enterprise software before developers or AI coding assistants pull it in. Security gets control, and engineering keeps its speed. The Curated Catalog works with the artifact repositories, scanners, and AI coding assistants that teams already use. Learn more at activestate.com.

View original content to download multimedia:https://www.prnewswire.com/news-releases/activestate-research-finds-ai-assisted-development-could-consume-13-900-engineering-hours-annually-at-enterprises-302911624.html

SOURCE ActiveState