You are about to sign with an agency or development partner to build or rebuild your site. Some meaningful share of what they deliver will be written by a model, and nothing in a standard statement of work obliges them to tell you which parts. That is the practical case for AI-assisted web development vendor requirements being written into the agreement rather than discovered afterwards.

The Gap Between What Ships and What Is Declared

Two independent measurements make the point, and they are worth reading carefully because they do not measure the same thing.

On the production side, CloudBees surveyed more than 200 enterprise technology leaders for its 2026 State of Code Abundance report, published in May. It found that AI now generates or assists in writing 61 percent of the average enterprise codebase. CloudBees sells software delivery governance, so it has a commercial interest in that number being large, which is worth holding in mind. The more useful figure in the same report is an internal contradiction that no vendor benefits from: 92 percent of leaders expressed confidence in the production readiness of AI-generated code, while 81 percent reported an increase in production issues tied to it.

On the declaration side, an independent analysis published on 6 August 2026 scanned 5,682 repositories behind the most-depended-on packages across sixteen registries, covering 589,798 commits in the year to 29 July 2026. It looked for explicit markers of machine authorship, the kind a tool writes into a commit trailer. It found them on 2.93 percent of commits, rising from 0.48 percent in August 2025 to 5.32 percent by July 2026.

Resist the temptation to subtract one number from the other. They cover different populations, enterprise codebases against open-source packages, and different definitions, generated-or-assisted against explicitly declared. What they support jointly is narrower and still decisive: machine-written code is ordinary now, and the habit of recording that fact is not. A separate replication in the same analysis found declaration rates of 0.54 percent across a sample of fifteen large projects.

Why the Contract Is the Only Reliable Instrument

The instinct is to solve this in code review. It does not work, for a reason that has nothing to do with reviewer skill.

Review inspects the artifact in front of it. Provenance, meaning a defensible record of where a piece of work came from and who holds rights to it, is not a property you can read off the artifact. Reviewed code and unreviewed code look identical on this axis, which is why the declaration rate can sit near three percent while the production rate sits far higher. Nobody is hiding anything. There is simply no moment in the process where the fact gets written down.

A contract creates that moment, because it makes the record a deliverable. This is the same argument our piece on AI code provenance makes about your own engineers, applied to the case where the work is done by someone you cannot manage directly. It is also the enforcement half of the standards framework: standards you cannot verify on delivery are preferences.

Five Clauses to Require From an AI-Assisted Web Vendor

None of these is exotic and none of them should raise the price a vendor quotes. A partner who objects to all five is telling you something useful.

Five contract clauses for an AI-assisted web build: disclosure at authorship, provenance warranty, conformance as artifact, gate in the pipeline, and handover of checks.
Figure 1: The five clauses. Source: Stable Solutions.
  1. Disclosure at authorship. Machine-assisted work is marked when it is written, using a commit trailer, which is a structured line appended to a commit message. Not a summary at the end of the engagement, which is reconstruction and will be wrong.
  2. A provenance warranty. The vendor warrants it holds and can transfer the rights to everything it delivers, whatever tooling produced it. This is the clause that survives the open question of who owns model output, because it puts the risk with the party that chose the tool.
  3. Conformance as an artifact. Accessibility and performance conformance arrive as dated evidence tied to a specific build, not as an assertion in a status report. If your obligations are regulatory, a claim is not a defence and a scan from one afternoon is not a record.
  4. The gate runs in their pipeline. Whatever standards you agreed are enforced automatically on the vendor side, and a failure blocks delivery rather than generating a comment. A standard enforced by human diligence decays the week the schedule slips.
  5. Handover of the checks, not just the site. You receive the pipeline configuration and the test suite along with the code. Without it you cannot re-verify anything after the engagement ends, which is precisely when you will need to.

How to Verify Each One at Acceptance

A clause nobody tests is decoration. Each of the five has a check that takes minutes.

  • Disclosure: ask for the commit log and count the markers yourself. A repository with none at all, on a 2026 delivery, is not evidence of hand-written code. It is evidence the clause was ignored.
  • Warranty: confirm it survives termination and assignment. A warranty that lapses when the contract ends protects nobody.
  • Conformance: check that the evidence names a build identifier and a date. Undated evidence cannot be tied to what you actually received.
  • The gate: ask them to show you a failing run. A pipeline that has never blocked anything is usually a pipeline with the check disabled.
  • Handover: run the suite yourself, on your own infrastructure, before final payment. This is the only one of the five that cannot be faked in a slide.

Note what this list does not ask for. It does not ask the vendor to avoid AI, which would be both unenforceable and against your interest given what it does to delivery speed. It asks them to leave a record, which costs nothing at the time and is unrecoverable later.

Sources

  1. CloudBees, "The 2026 State of Code Abundance Report: Exposing the Enterprise AI Readiness Gap," 2026. Link.
  2. Andrew Nesbitt, "A year of AI disclosure in critical packages," 2026. Link.

Next Steps

If you are selecting a partner this quarter, these five clauses are cheaper to negotiate now than to retrofit at handover. Stable Solutions builds to them as a matter of course and will review a draft statement of work against them. Explore our App and Web Development or contact our team to have your vendor agreement reviewed before you sign.