On October 1, Mexico’s Digital Transformation Agency presented its AI Factory alongside figures from its Software Factory. Two weeks later, SOFTIC kicked off in Cartagena with a complementary discussion: how to evaluate whether AI actually generates value. Bridging the two is a question now facing every corporate board: if building in-house is cheaper than buying, cheaper according to which balance sheet?

Mexico's Digital Transformation and Telecommunications Agency reported on October 1 that its Software Factory—a team of 300 public university graduates—developed 279 digital products through July, delivering one every three days. According to the government, avoiding private enterprise contracts yielded savings of 14 billion pesos. That same day, it unveiled its AI Factory: 20 specialists who worked this year on models for customs clearance, fraudulent invoice detection, and patent processing at the Mexican Institute of Industrial Property (IMPI).

This is likely the region's largest and most documented case study of building over buying. It also illustrates, clearer than any survey, how the math is currently being calculated: savings are measured solely at the point of the purchase that never occurred.

McKinsey’s global survey released on August 25—encompassing 1,719 executives across 97 countries—found that 32% of organizations chose not to purchase at least one software product or feature because they could build it internally using agentic coding tools. The same study indicates that while 80% report improvements in individual productivity, only 37% attribute any bottom-line impact (EBIT) to AI—a figure completely unchanged from the previous year. That 32% figure reflects decisions to forgo a purchase; it does not measure active, production-grade systems or the ongoing operational cost of maintaining them. Moreover, these findings represent self-reported executive sentiment rather than an objective audit.

Retool, which sells a platform for building internal tools, surveyed 817 of its customers in late 2025: 35% had replaced at least one SaaS tool with a custom-built solution, and 60% had built something outside IT oversight within the preceding year. Furthermore, 37% of these organizations still lacked formal AI productivity metrics. While this sample skews heavily toward teams prone to custom development, it highlights the exact same blind spot.

None of this renders Mexico’s strategy an error. An in-house team delivering a product every three days holds real value, and sharing software through the National Repository of Public Technology prevents every state from paying for the exact same solution. The agency explicitly links its strategy to lower costs, code reuse, and reduced vendor lock-in.

However, the announced figure represents only avoided contract costs. What is entirely absent from public disclosures is the ongoing cost to maintain 279 products and operate risk models applied to customs and invoice detection: security patches, ongoing support, version updates, and continuous testing every time an underlying model changes. Furthermore, while sharing source code reduces procurement spending, it also multiplies the number of public institutions dependent on someone maintaining it long-term. A Mexican news outlet summarized the core vulnerability in just six words: it remains to be seen who reviews them. Their proposed solution is concrete: publish a technical specification sheet for every model within the very same repository where the government shares its source code.

SOFTIC 2026 opened on October 14 with a paradox. The Colombian software industry generated 46.3 trillion pesos in sales in 2025—an 18.1% increase over the previous year—yet a large portion of the broader business sector, particularly micro, small, and medium-sized enterprises (MSMEs), fails to capitalize on what that industry produces.

Fedesoft proposes evaluating this dynamic through a metric distinct from standard productivity: revenue per employee, which hovers around US$47,000 and grew 10% over the past year. According to its president, Ximena Duque, companies developing agentic AI products grow eight to nine percentage points faster than their peers. Duque also issued a warning familiar to any CIO: employees are already using unauthorized AI tools, exposing corporate data in the process. It is the Colombian manifestation of Retool's 60% finding.

The Cenisoft and Fedesoft survey, released on October 7, quantifies this unmeasured ground. Among surveyed tech firms, 32.7% already operate AI agents as digital employees, over half report moderate to high productivity gains, and 30.77% have yet to measure the actual business impact. The sample comprises roughly one hundred industry companies, and the reported responses are self-stated.

In a bank or an insurance company, choosing not to buy software does not eliminate obligations: it transfers them. Whichever organization builds internally becomes the vendor, assuming full responsibility for system continuity, security, traceability, and auditing—exactly as if it had contracted a third party.

The bill introduced in September in Colombia’s House of Representatives to prevent systemic risks from critical AI dependencies across financial, securities, and insurance operations applies this principle to AI used directly or through third parties. It mandates inventorying all dependencies—including sub-vendors—testing for failure scenarios and altered outputs, and maintaining fully validated continuity and exit strategies. Furthermore, it explicitly clarifies that utilizing foreign vendors or subcontractors does not shift regulatory accountability. It remains a bill, not enacted law, and establishes no new legal penalties.

On October 6, BBVA presented The Frame, its framework to create, deploy, and govern AI agents under unified security, oversight, and cost standards. The bank, which reports a 28% productivity boost among its developers, collaborates with vendors like OpenAI while custom-building the governance layer that controls deployments. This exemplifies the hybrid model: the true advantage lies not in what was avoided in procurement, but in what was standardized so teams never have to start from scratch.

1. The three-year total cost, not just the build cost. Maintenance, security, support, integration, and turnover among engineers who understand the architecture. Savings that exist only on the day of the procurement decision are not true savings.

2. Who holds accountability and who conducts reviews. Every custom-built system requires a designated owner by name and an independent technical review separate from whoever wrote the code—whether that author was a person or an AI agent.

3. What dependencies exist and how to execute an exit. Models, datasets, vendors, and sub-vendors—paired with an active, simulated test of what occurs if a component fails or key maintainers depart. A plan sitting in a document does not count.

4. The bottom-line financial impact. Saved hours do not automatically equal net profit. If the primary KPI is an avoided purchase, it measures an event that never occurred.

At Q-Vision, drawing on 22 years of experience in quality engineering, data, and AI—particularly across financial services and insurance—we facilitate this conversation from the less visible side: testing what is built, tracing underlying data and model dependencies, and measuring whether performance yields real business results. The decision to build versus buy rarely fails due to technology itself; it fails because it was made using only half the ledger.

Organizations currently celebrating what they avoided spending will, in a year or two, have to account for what it costs to maintain what they built. Those that have already calculated the second half of the bill will enter that conversation with the complete figure.