Own use still counts — a third of organisations stopped buying software, and the AI Act stopped calling them the deployer

McKinsey's State of AI, published 25 August 2026, reports that 32 percent of 1,719 respondents in 97 nations decided against purchasing at least one software product or feature because they could build it in-house with agentic coding tools — near 50 percent among AI high performers against 31 percent for the rest. The obvious reading is a procurement story. The correction is that it is a role change: AI Act Article 3(3) makes the developer who puts a system into service under its own name the provider, and Article 3(11) defines putting into service to include supply "for own use in the Union", so an internal agent that is never sold still qualifies. That does not by itself trigger the high-risk regime; it invalidates the compliance file, because a deployer's obligations under Article 26 are not a provider's. CrowdStrike's Verified Agent designation of 31 August 2026 is the ecosystem version of the same confusion — it validates partner-built agents against unpublished vendor requirements and opens a marketplace, which is admission control rather than conformity assessment, and moves nobody's name off anything. Article 25(1) only converts third parties into providers for high-risk systems; below that threshold the flip runs through Article 3(3) directly, which is where most internal agents sit.

Post

Thirty-two percent of organisations have decided against buying at least one software product because they could build it internally with agentic coding tools.

That is the procurement story. The compliance story is the one nobody put on the slide.

McKinsey's State of AI global survey, fielded 4 May to 8 June across 1,719 respondents in 97 nations and published 25 August, puts the figure at 32% — near 50% among the AI high performers, 31% for everyone else.

Buying an AI system makes you a deployer. Building one makes you a provider. AI Act Article 3(3): a provider develops an AI system and places it on the market or puts it into service under its own name or trademark. Article 3(11) defines putting into service as supply for first use "directly to the deployer or for own use in the Union". Own use. The internal tool counts. No sale, no customer, no marketplace listing required.

That does not drop you into the high-risk regime by itself. What it does is invalidate the file you already have. A deployer's file and a provider's file are not the same document, and if your AI governance work so far has been vendor questionnaires and DPAs, it is the wrong document for every agent your team wrote instead of bought.

CrowdStrike shipped the ecosystem version of this on 31 August: an AI Partner Specialization whose Verified Agent designation validates partner-built agents "against CrowdStrike requirements" and opens its Marketplace to them. Read the release for the criteria. None are published. A vendor badge is admission control, not conformity assessment, and it moves nobody's name off anything.

This week:

  1. List every agent, script and internal tool your team built in the last twelve months that replaced something you would otherwise have bought.
  2. Next to each, write provider or deployer. Name or trademark on it? Provider.
  3. For anything in Annex III territory — HR, credit, critical infrastructure — note the date. The Digital Omnibus moved those obligations to 2 December 2027. That is runway, not exemption.
  4. Check Article 50 separately. Transparency has applied since 2 August 2026 and does not wait for Annex III.

The licence you didn't buy was the cheap part.

How many AI systems does your organisation now provide, rather than use?

#EUAIAct #AgenticAI #AIGovernance #Compliance #SoftwareEngineering

First comment

Sources, primary only:

McKinsey, The State of AI: Global Survey 2026 — the 32% figure, 1,719 respondents in 97 nations, fielded 4 May–8 June, published 25 August. https://www.mckinsey.com/capabilities/quantumblack/our-insights/the-state-of-ai

CrowdStrike's own release on the AI Partner Specialization and the Verified Agent designation, 31 August. https://www.crowdstrike.com/en-us/press-releases/crowdstrike-launches-ai-partner-specialization-for-the-agentic-era/

AI Act Article 3 — the definitions of "provider" (3), "deployer" (4) and "putting into service" (11), where "for own use in the Union" sits. https://artificialintelligenceact.eu/article/3/

AI Act Article 25 — responsibilities along the value chain; 25(1)(a) is the name-or-trademark trigger. https://artificialintelligenceact.eu/article/25/

One point cut for length: Article 25(1) only converts a third party into a provider for HIGH-RISK systems. For everything below that line the flip is not Article 25 at all — it is Article 3(3) reading directly, because you developed it and put it into service under your own name. That is the quieter route, and it is the one most internal agents take.

AI disclosure: the narration voice, the cover art and the brand ident animation in this video are AI-generated. The script, the claims and the source checks are mine.

Claims

Sources

Corrections

The aggregator feed dated Cloudflare Wallets to 31 August 2026; Cloudflare's own announcement and press release are dated 4 August 2026, so the item was dropped as outside the window. The same feed listed a NIST agent-identity paper as 31 August news; the NIST concept paper is an initial public draft from February 2026. Neither error reached the edition.

AI disclosure

The video for this edition contains AI-generated media: the narration is a synthetic voice and the cover art is generated. The script, the claims and the source verification are human-authored and human-checked. Assets carry IPTC DigitalSourceType and C2PA Content Credentials.