Quirin Schlegel

Loading

Own use still counts — a third of organisations stopped buying software, and the AI Act stopped calling them the deployer

McKinsey's State of AI, published 25 August 2026, reports that 32 percent of 1,719 respondents in 97 nations decided against purchasing at least one software product or feature because they could build it in-house with agentic coding tools — near 50 percent among AI high performers against 31 percent for the rest. The obvious reading is a procurement story. The correction is that it is a role change: AI Act Article 3(3) makes the developer who puts a system into service under its own name the provider, and Article 3(11) defines putting into service to include supply "for own use in the Union", so an internal agent that is never sold still qualifies. That does not by itself trigger the high-risk regime; it invalidates the compliance file, because a deployer's obligations under Article 26 are not a provider's. CrowdStrike's Verified Agent designation of 31 August 2026 is the ecosystem version of the same confusion — it validates partner-built agents against unpublished vendor requirements and opens a marketplace, which is admission control rather than conformity assessment, and moves nobody's name off anything. Article 25(1) only converts third parties into providers for high-risk systems; below that threshold the flip runs through Article 3(3) directly, which is where most internal agents sit.

2 September 20265 verified claims4 sources

Thirty-two percent of organisations have decided against buying at least one software product because they could build it internally with agentic coding tools.

That is the procurement story. The compliance story is the one nobody put on the slide.

McKinsey's State of AI global survey, fielded 4 May to 8 June across 1,719 respondents in 97 nations and published 25 August, puts the figure at 32% — near 50% among the AI high performers, 31% for everyone else.

Buying an AI system makes you a deployer. Building one makes you a provider. AI Act Article 3(3): a provider develops an AI system and places it on the market or puts it into service under its own name or trademark. Article 3(11) defines putting into service as supply for first use "directly to the deployer or for own use in the Union". Own use. The internal tool counts. No sale, no customer, no marketplace listing required.

That does not drop you into the high-risk regime by itself. What it does is invalidate the file you already have. A deployer's file and a provider's file are not the same document, and if your AI governance work so far has been vendor questionnaires and DPAs, it is the wrong document for every agent your team wrote instead of bought.

CrowdStrike shipped the ecosystem version of this on 31 August: an AI Partner Specialization whose Verified Agent designation validates partner-built agents "against CrowdStrike requirements" and opens its Marketplace to them. Read the release for the criteria. None are published. A vendor badge is admission control, not conformity assessment, and it moves nobody's name off anything.

This week:

1. List every agent, script and internal tool your team built in the last twelve months that replaced something you would otherwise have bought. 2. Next to each, write provider or deployer. Name or trademark on it? Provider. 3. For anything in Annex III territory — HR, credit, critical infrastructure — note the date. The Digital Omnibus moved those obligations to 2 December 2027. That is runway, not exemption. 4. Check Article 50 separately. Transparency has applied since 2 August 2026 and does not wait for Annex III.

The licence you didn't buy was the cheap part.

How many AI systems does your organisation now provide, rather than use?

#EUAIAct #AgenticAI #AIGovernance #Compliance #SoftwareEngineering

Evidence

What this rests on

Every factual claim in the edition above, stated on its own and checked before publication. If one of these is wrong, the argument is wrong — so they are listed where you can check them.

Why it mattersIt is the first survey number that sizes the build-instead-of-buy shift specifically to agentic coding tools, and the comparator matters: this is not a niche of leaders, it is a third of everyone.
mckinsey2026state
Why it mattersThe two roles carry different obligation sets, and the dividing line is development plus own name, not sale.
euaiactexpl2026definitio
Why it matters"For own use" is the load-bearing phrase. An internally built agent that is never sold, licensed or listed is still put into service, which with Article 3(3) makes the building organisation its provider.
euaiactexpl2026definitio
Why it mattersArticle 25 is the clause most people cite for the role flip, and it only reaches high-risk systems. Below that threshold the flip runs through Article 3(3) directly, which is quieter and catches more internal agents.
euartificia2024responsib
Why it mattersA vendor designation that gates marketplace distribution is admission control. It is not a conformity assessment under the AI Act and it does not move provider status off the party whose name is on the agent.
crowdstrike2026crowdstri

Sources

CrowdStrikeprimary source
CrowdStrike Launches AI Partner Specialization
Original Archived PDFretrieved 2 September 2026 · published 31 August 2026
EU AI Act Explorersecondary
euaiactexpl2026definitio
Original Archived PDFretrieved 22 September 2026 · published 1 January 2026
EU Artificial Intelligence Actsecondary
Responsibilities along the AI value chain - Article 25
Original Archived PDFretrieved 5 September 2026 · published 12 July 2024
McKinseyprimary source
State of AI Global Survey 2026
Original Archived PDFretrieved 2 September 2026 · published 25 August 2026

Every source for this edition, as one PDF BibTeX — all editions

Corrections

What changed after publication

The aggregator feed dated Cloudflare Wallets to 31 August 2026; Cloudflare's own announcement and press release are dated 4 August 2026, so the item was dropped as outside the window. The same feed listed a NIST agent-identity paper as 31 August news; the NIST concept paper is an initial public draft from February 2026. Neither error reached the edition.