{"slug": "engineers-lose-17-days-a-year-to-ai-rework", "title": "Engineers lose 17+ days a year to AI rework", "summary": "An ActiveState survey of more than 300 security, governance, platform and engineering leaders at organizations with 1,000+ employees in North America and Western Europe found that 43% say at least 10% of an engineer's time goes to fixing or revisiting AI-assisted code, a floor of 139 hours per engineer per year — more than 17 working days, or roughly the annual capacity of seven engineers for a 100-person org. The report also found 94% of respondents say AI has increased open-source consumption and 96% say it has increased dependency growth, while half say new dependencies can reach production with no prior review; 76% had a release delayed by unmanaged open-source dependencies in the past year, 58% received a compliance or audit finding tied to open-source governance, and 32% confirmed a security incident traceable to an unmanaged dependency in the past two years. Only 31% have formally quantified the cost of unmanaged open-source risk.", "body_md": "This is your last article that you can read this month before you need to [register](https://leaddev.com/register) a free LeadDev.com account.\n\nEstimated reading time: 3 minutes\n\n**Key takeaways:**\n\n- AI rework costs engineers **at least 139 hours a year** , and the rest of the bill lands in other teams’ budgets.\n- **Dependencies outrun review:** half of organizations say new dependencies can reach production unchecked.\n- **Shift effort upstream** . Make the approved dependency path the fastest one and track AI rework as its own category.\n\nYour team is [shipping faster with AI,](https://leaddev.com/ai/as-ai-helps-us-write-more-code-whos-catching-the-bugs) yet ActiveState’s new survey finds the gains are offset by rework, delayed releases, and dependencies that reach production before anyone reviews them.\n\n[The survey](https://go.activestate.com/ai-remediation-bill) polled over 300 security, governance, platform, and engineering leaders at organizations with 1,000+ employees in North America and Western Europe. Almost half (43%) say at least 10% of an engineer’s time goes on fixing or revisiting [AI-assisted code](https://leaddev.com/ai/best-ai-coding-assistants).\n\nCounting every respondent at the bottom of their range, the report calculates a floor of 139 hours per engineer a year, more than 17 working days. For a 100-person engineering org, that’s roughly the annual capacity of seven engineers.\n\nIf you’ve ever fought to get headcount approved for two engineers, let alone seven, you’ll know how much that number stings.\n\n## Your inbox, upgraded.\n\nReceive weekly engineering insights to level up your leadership approach.\n\n## AI-assisted code doesn’t mean faster delivery\n\nThe report draws on outside research that shows the same pattern. [Google’s 2024 DORA report](https://cloud.google.com/blog/products/devops-sre/announcing-the-2024-dora-report) linked greater AI adoption to better code quality and faster [code review](https://leaddev.com/culture/build-a-productive-code-review-culture), alongside lower delivery throughput and stability.\n\nAn academic study of GitHub Copilot adoption found productivity gains alongside a 41.6% increase in integration time. As one platform engineering director interviewed for the report put it, individual teams get more productive while other parts of the organization turn into bottlenecks.\n\n## The AI rework cost is spread too thin\n\nEngineering’s 139 hours are only part of the bill and the rest lands in other teams’ [budgets](https://leaddev.com/career-development/rethinking-your-engineering-budget-during-downturn):\n\n- **Operations:** 76% had a software release delayed by unmanaged open-source dependencies in the past year.\n- **Compliance:** 58% received a compliance or audit finding tied to open-source governance.\n- **Security:** 32% confirmed a security incident traceable to an unmanaged dependency in the past two years.\n\nOnly 31% have formally quantified the cost of unmanaged [open-source risk](https://leaddev.com/technical-direction/be-careful-open-source-ai). Another 47% have an informal estimate, which in most companies means a number somebody said once in a meeting and nobody wrote down.\n\nFor [engineering managers](https://leaddev.com/career-development/the-reality-of-being-an-engineering-manager), the gains show up in velocity metrics while the rework hides in sprint carryover and unplanned tickets. Leadership sees the speed and rarely the full price.\n\n## Dependencies arrive faster than anyone can review them\n\nNearly every respondent says [AI](https://leaddev.com/ai/your-ai-coding-tools-buying-checklist-for-2026) has increased open-source consumption (94%) and dependency growth (96%). Governance mostly happens after the fact: 63% deal with vulnerabilities only once a scanner flags them, and half say new dependencies can reach production with no prior review.\n\nIn the [TeamPCP attack](https://unit42.paloaltonetworks.com/teampcp-supply-chain-attacks/) the report cites, a compromised LiteLLM package reached a developer as the dependency of a dependency of a plugin. Nobody on the team chose it, and neither did the assistant in any meaningful sense. It arrived several levels down the tree, and then it became somebody’s incident.\n\nJim Mercer, program VP, software development, DevOps, and DevSecOps at IDC, argues that when an assistant can suggest a package, write the code that calls it, and push it toward production in minutes, scanning after the fact “will always be a step behind.”\n\nBeing able to control what enters the pipeline is key to enabling organizations to [scale AI-assisted development](https://leaddev.com/technical-direction/how-to-build-trust-into-your-ai-agents), he adds.\n\n## More like this\n\n## Half of open-source policies are followed inconsistently\n\nMost organizations (92%) have a formal open-source policy, but only 52% say it’s consistently followed.\n\nWhen the governed path is slow and development is fast, developers ship. If you’re setting AI norms for your team without a company playbook, that gap matters more than the policy document.\n\n## Prevention is where the hours come back\n\nOf all the effort organizations spend managing open-source risk, only 26% goes into stopping problems before code ships. The rest goes on finding and fixing them afterward.\n\nRespondents say prevention should be closer to 37%, and much of that shift sits inside workflows you already control:\n\n**Berlin** • **November 9 & 10, 2026**\n\nClose the gap between what leadership expects and what’s actually possible at **LeadDev Berlin**.\n\n- Make the approved path for adding a dependency the fastest one.\n- Treat dependency review as part of [code review](https://leaddev.com/culture/how-to-kill-the-code-review) , including for AI-generated pull requests.\n- Track rework on AI-assisted work as its own category, so the 139 hours stops hiding in sprint carryover.\n\nMost respondents (83%) admit [developer productivity](https://leaddev.com/reporting/developer-productivity-20-2) is outpacing their governance, yet 71% believe their existing approach can scale.\n\nWhen that gap catches up with an organization, engineering teams do the cleanup.", "url": "https://wpnews.pro/news/engineers-lose-17-days-a-year-to-ai-rework", "canonical_source": "https://leaddev.com/ai/engineers-lose-17-days-a-year-to-ai-rework?utm_source=leaddev&utm_medium=RSS", "published_at": "2026-10-20 13:01:34+00:00", "updated_at": "2026-10-20 13:16:39.401335+00:00", "lang": "en", "topics": ["artificial-intelligence", "ai-tools", "developer-tools", "ai-safety"], "entities": ["ActiveState", "LeadDev", "Google", "GitHub Copilot", "LiteLLM", "TeamPCP"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/engineers-lose-17-days-a-year-to-ai-rework", "markdown": "https://wpnews.pro/news/engineers-lose-17-days-a-year-to-ai-rework.md", "text": "https://wpnews.pro/news/engineers-lose-17-days-a-year-to-ai-rework.txt", "jsonld": "https://wpnews.pro/news/engineers-lose-17-days-a-year-to-ai-rework.jsonld"}}