For decades, most organisations have bought their software rather than built it. A council buys a finance system. A hospital buys a patient records system. A small business pays a monthly fee for accounts, payroll or customer records. In this piece we call that proprietary software: off-the-shelf products that software companies build once and sell many times.
AI coding tools are starting to change the maths. They can write bespoke software, tailored to a single organisation’s needs, far faster and more cheaply than a team of programmers could a few years ago. If these tools keep improving, some buyers will ask why they are paying for a generic product when they could have one built for them.
At the same time, the UK government plans to examine whether software makers should carry more of the cost when their products are hacked. Put the two together and a hard question follows: could the firms that sell packaged software be squeezed from both sides?
This Analysis sets out what the evidence shows, what it does not, and what it could mean for Wales. Where we make a prediction, we say so.
1. Bespoke software on the fly
The newest AI coding tools do much more than suggest the next line of code. Anthropic describes its Claude Code tool as an agent that “builds entire features in natural language” and “writes the code, creates the tests, and opens the PR”, meaning it prepares a finished change for a human to review (Anthropic, Claude Code for enterprise). Similar tools include Cursor, GitHub Copilot, Devin and OpenAI’s Codex.
Companies using these tools report big gains. Anthropic says the payments firm Stripe used Claude Code to move about 10,000 lines of code from one programming language to another in four days, a job estimated to take about ten weeks by hand (Anthropic, Stripe customer story). These are customer stories published by the tool’s maker, so treat them with care.
The tools are real, and so are their limits.
Independent research is more measured. Field experiments covering 4,867 developers at Microsoft, Accenture and a Fortune 100 firm found that AI coding assistants raised completed tasks by about 26%, with bigger gains for less experienced developers (Cui et al., Management Science, 2025, background). But those trials mostly tested earlier, suggestion-style assistants, not today’s agents.
Other studies point the other way. In a controlled trial by the research group METR, 16 experienced developers working on large code bases they knew well were 19% slower when using early-2025 AI tools, even though they believed they were working faster (METR, July 2025, background). That does not prove AI fails on new projects. It does show that speed is not guaranteed on complex, mature systems.
The tools are real, and so are their limits. The biggest risk is security. A study of more than 300,000 AI-written changes across 6,299 public code projects found that 22.7% of the problems those changes introduced were still unfixed in the latest version. They included known security weaknesses, such as unsafe handling of file paths and database queries (arXiv 2603.28592, 2026).
Someone also has to own the result. Bespoke code written on the fly still needs testing, review and long-term care. In our view, today’s AI coding tools are best suited to internal tools, links between systems and new standalone applications. There is no solid evidence yet that they can safely replace large, complex systems, such as hospital records or council finance, without a lot of human oversight.
2. Why that puts pressure on off-the-shelf software
Every organisation faces a choice between building software and buying it. Buying has usually won, because building in-house was slow, costly and risky. AI coding tools lower the cost of building.
Investors have noticed. “The barriers to entry for creating software are so low now thanks to coding agents, that the build versus buy decision is shifting toward build in so many cases,” the investor Lex Zhao of One Way Ventures told TechCrunch in March 2026. The article, which uses the term “SaaS” for subscription software, described early-2026 falls in software share prices that some called the “SaaSpocalypse” (TechCrunch, 1 Mar 2026).
Even the threat of building in-house gives buyers a stronger hand at renewal time.
Buyers do not even need to build anything to benefit. Abdul Abdirahman of F-Prime told the same publication that even if customers do not build their own, this “creates downward pressure on contracts that SaaS vendors can secure during renewals” (TechCrunch).
Even the threat of building in-house gives buyers a stronger hand at renewal time. Charging per user, the standard model for most subscription software, also makes less sense when AI agents rather than people do more of the work.
There is a second pressure. Some buyers may stop buying software altogether and buy the finished work instead. The investment firm Sequoia argues that “For every dollar spent on software, six are spent on services”, and that “The next $1T company will be a software company masquerading as a services firm” (Sequoia, Services: The New Software, 5 Mar 2026). In that model, a business would neither buy accounts software nor hire an accountant. It would pay an AI-run service to close its books. That bypasses both bought-in licences and in-house code.
The case that proprietary software survives
Some investors, and the firms that sell packaged software, reject the idea that their products are finished. “This isn’t the death of SaaS,” Aaron Holiday, a managing partner at the venture firm 645 Ventures, told TechCrunch. He said many new AI features “won’t stick”, and that enterprises will always need lasting software that meets compliance rules and supports audits (TechCrunch). Large vendors such as Oracle say they are using the same AI tools to build their own products faster (Reuters, 10 Mar 2026).
This is a strong argument. When an organisation buys software off the shelf, it buys more than code. It buys support, links to other systems, security certificates and a company to call when things go wrong. A few days of AI-written code cannot provide that. In our view, bespoke software will win first where the stakes are low and the needs are specific. Off-the-shelf software will hold on longest where regulation, liability and scale matter most. Its death is a prediction, not a fact.
3. The Budget and who pays for cyber breaches
A third pressure comes from the UK government. In the Budget on 28 October 2026, alongside plans to strengthen the UK’s cyber defences, the government said:
“Building on the Law Commission’s product liability consultation, the government will consult next year on how to tackle insecure technology at source and consider where liability for cyber breaches should sit.”
HM Treasury, Budget 2026, paragraph 4.131
It is a promise to consult, not a new law, and it does not say what the answer will be. Still, the question itself matters. Today, when software is hacked, the cost usually falls on the customer. Alexander Martin, a cyber security journalist at The Record, wrote that software makers are “largely shielded from the cost of their own software’s security flaws”, and that making them liable “would be the biggest shift in incentives for how software gets built in decades” (Alexander Martin on X, 28 Oct 2026). That is his opinion, but it explains why the Budget line caught attention.
It is a promise to consult, not a new law.
The Budget builds on separate work by the Law Commission, the body that reviews laws in England and Wales. On 8 October 2026 it opened a consultation on updating product liability law for the digital age. Among its proposals is that software and AI systems should count as “products”, which would bring them closer to the rules that already apply to physical goods (Law Commission, 8 Oct 2026).
Where this might go
Some see this as a step toward rules that would make software firms guarantee their products against cyber attack. That goes further than anything the government has said. No system can be made completely safe from attack. But if future rules did demand something close to a guarantee, backed by heavy penalties for breaches, selling software in the UK would become far more costly and risky. For vendors already losing ground to bespoke AI tools, that could be the final straw.
This is our reading of a possible direction, not an official plan. The consultation has not yet been published, and it may end with much lighter rules.
4. Leave the UK, or comply?
If liability rules tighten, would software firms stop selling in the UK? So far, no major vendor has said it would. We found no statement from Microsoft, Oracle, Amazon Web Services or Salesforce saying they would leave the UK or restrict sales if liability rules change.
What we did find is lobbying. The Business Software Alliance, whose members include Microsoft, Oracle and Amazon Web Services, “lobbied against such measures and argued that they would stifle innovation”, according to The Record (The Record, 28 Oct 2026).
Opposing a rule is not the same as leaving a market. The history of tech regulation suggests that large firms lobby hard, then comply. The UK is a big market, and the European Union is already moving the same way. Its Cyber Resilience Act lets regulators fine makers of insecure products up to €15 million or 2.5% of global turnover, whichever is higher, with its main duties starting in December 2027 (The Record). Any vendor selling across Europe will have to meet those rules anyway. That makes a UK-only exit by the largest suppliers unlikely.
Opposing a rule is not the same as leaving a market.
The risk is sharper for smaller firms. A start-up or niche supplier may not be able to afford the legal, audit and insurance costs that strict liability rules would bring. Some might choose not to enter the UK, or might pull out of parts of it. That is a plausible risk. It is not yet backed by evidence.
The case that regulation helps
There is also a strong case that liability rules would make software better. Today the market does a poor job of rewarding secure code, because buyers cannot easily judge security up front and the cost of a breach falls on the customer. Shifting liability to the maker is meant to fix that.
But this cuts both ways. As the research in section 1 shows, AI-written code carries its own security flaws. If liability sits with whoever builds the system, a council or business that writes its own software with AI takes that risk on itself. Many buyers may decide it is safer to keep buying from a vendor that carries the liability for them.
5. What it means for Wales
Wales has a large stake in this shift, both as a buyer of software and as an employer.
Start with public services. Across 2023-24 and 2024-25, 11 of the 12 NHS bodies in Wales reported spending a combined average of about £216 million a year on their own digital technology and services (Audit Wales). Digital Health and Care Wales, the national NHS technology body, spent more on top of that, though part of its budget is charged back to those same NHS bodies.
According to Audit Wales, most of that money keeps existing systems running rather than paying for new ones. Welsh councils also share a framework for buying technology and related services worth about £200 million, led by Caerphilly and reported in January 2025 to run until July 2026 (PublicTechnology, January 2025, background). Much of this public money goes on vendor software and the support contracts around it. If AI coding tools make custom systems cheaper and safer to build, Welsh public bodies could in time get more from those budgets.
Most of that money keeps existing systems running.
Then there are jobs. At the March 2021 census, 19,380 people living in Wales said their main job was in computer programming, consultancy and related activities, about 1.4% of everyone in work (Nomis, Census 2021, TS060 Industry). That is the closest official count of people who build and support software in Wales. It counts where people live, not where their employer is based, and it is now more than five years old.
The wider tech and advisory economy is bigger. In June 2026, Wales had about 29,000 workforce jobs in the whole information and communication sector, which also includes telecoms, publishing and broadcasting. It had about 85,000 in professional, scientific and technical activities, which covers consultancy, law, accountancy and other advisory work (Nomis, Labour Market Profile: Wales). These are whole sectors, not software jobs, and they come from a different survey from the census. But many people in them sell, install, customise or advise on packaged software.
Three possible futures
What happens to those jobs is a prediction. We cannot put a reliable figure on how many roles are at risk, and we have not tried to. We see three broad paths.
- Firms become AI enablers. In our view, this is the most likely outcome. Welsh software firms and consultancies would shift from selling or supporting off-the-shelf products to helping councils, health boards and businesses build, test and secure custom software with AI. Many of the same people would do different work. If liability rules tighten, demand for code checking and security testing could grow.
- Jobs are lost. If AI tools and AI-run services replace both off-the-shelf software and the people who install and maintain it, some Welsh tech and consultancy roles could go. Routine work, such as setting up standard software packages or writing basic code, faces the highest risk. Even so, the large, complex systems that Welsh health boards and councils rely on make a sudden collapse in demand unlikely.
- Firms sell outcomes. Some firms could follow the Sequoia model and sell finished work, such as processed claims or completed accounts, delivered by AI and checked by people. Welsh firms could win that business, or lose it to providers outside Wales.
Firms that adapt early are best placed for the first and third paths. Those that wait face the greatest risk of the second. None of these shifts is yet visible in the Welsh data.
6. What to watch next
Several dates will show which way this goes.
- 14 January 2027: the Law Commission’s product liability consultation closes. Final recommendations are expected in late 2027 (Law Commission).
- 2027: the government’s consultation on where liability for cyber breaches should sit is due “next year” (Budget 2026). The key test is whether it proposes firm legal duties for software makers, and how far those duties reach.
- December 2027: the main duties of the EU Cyber Resilience Act take effect (The Record).
- Contract renewals: watch whether Welsh councils and health boards renew major software contracts on the same terms, push for bigger discounts or start building more tools in-house.
- Vendor statements: if any major software vendor says it will limit or stop UK sales because of liability rules, that would change this analysis.
The direction of travel is clear even if the destination is not. AI makes custom software cheaper to build. That weakens the case for buying the same off-the-shelf product as everyone else. New liability rules could raise the cost of selling software in the UK. Whether that ends proprietary software, or simply forces it to get better and cheaper, is still an open question.