Product Owners - Considerations for your next project with suppliers

The risks of software development

There's always risks with building software, there are a lot of practices and tooling to minimize the risk and to be honest, the introduction of AI doesn't change too many of those risks. Finding an unreliable partner will be costly, but potentially because of AI it may be harder to spot reliability from the onset.

• Software can always contain bugs or be constrained to resources and spikes in demand
• Software can always regress over time, be rushed, under-developed or lack tooling and insights
• Software can always be affected by external sources, such as Apple or Android (Native development)
• Etc.

In truth not too much has actually changed, so in theory a lot of your current legal agreements and considerations are valid and will still largely cover you.

What this article strives to achieve is refreshing those considerations and also giving more insight into the AI aspects.

So what does AI change

The first and major risk is sensitive information being leaked, this could be API keys, .env variables etc. This can more commonly happen by simply providing the codebase as the context for a prompt or by drafting specification and legal documents using AI and real-world data.

1) Is AI being used? Where and how much? Is this provider also using AI to draft specification documents, architecture, legal documents etc? Could there be mistakes, sensitive information or other considerations?

Make sure you've protected yourself in regards to sensitive information and liability. If information is sent to the cloud for AI processing, make sure the liability and restrictions are clear and enforceable from the start.

So the next question to ask yourself is, if you're paying x amount an hour, but an AI is doing a lot of the work and also sharing potentially sensitive information to the cloud, is that worth it?

2) How much reliance does your provider have on AI? My advice here is to ask this critically in your calls and meetings, figure out how they're using AI, to what extent, and what exactly it is you're paying for.

Having some AI processing is actually a good thing, can speed things up, potentially reduce costs in the amount of hours needed, but over-reliance means you could be paying a premium for a black-box of potential risks and problems.

Some considerations to think about:

• AI cannot be used for critical parts of the infrastructure
• Remaining areas must be limited, scoped or protected
• Provider must have deep insight and knowledge of the project and must be able to share it
• Documents must be template drafted, then filled in manually with specifics and critical/sensitive information

This is similar to the current problem people have faced, of potentially developers being too reliant on external packages and software for too much of the project scope. Too many projects I have adopted have relied on dozens of external packages to solve small basic elements of the project, that caused issues with upgrades and maintenance.

But the added aspect is the reliance on AI to draft documents that may also contain sensitive information.

Ownership

Typically when you pay for a service, you're paying for a license to use the software made for you, or you have ownership of the source code and relating material.

If we look at image and design generation through tools like Midjourney, the copyright and ownership there is anything but straightforward.

• Images generated are in the public domain
• Images generated are trained on pre-existing copyright material

There are currently open lawsuits and international discussions on the legal impact of such tools, so if your provider is relying a lot on Midjourney for the design, without transformative changes that make it unique and specific, you open the door for others to use your design and you'll have no legal right to battle it (to my understanding).

• Ensure you include clauses on the correct and rightful transferring of ownership of the design and code

Bear in mind the design will use Fonts and Iconography in the public domain, maybe stock photos or assets with commercial licenses, Open source packages for core aspects of the technical foundation, all of which are perfectly normal.

However, if the design is 1-1 or largely from services like Midjourney and code largely written by AI, it opens up a ton of questions on ownership.

Finding a good technical partner

I wish I could provide a tool or guide that would make this a straightforward process so you can find the right partner for your needs. In truth, just like with finding any supplier, there's sometimes very little you can do other than check into their credentials and reputation.

Unlike with House maintenance here in the Netherlands, there's no registry or certificates for reliable software developers.

So, what can you do? Find transparent partners

The first thing is find a supplier that is transparent about its processes, tools, team, services etc. Any company that offers full transparency into their process, what considerations they make, is a great place to start.

If you hear them mentioning "Oh yeah we use co-pilot, it's great and allows us to develop fast and effective code" without mentioning the things they do to protect the code and information that may be considered sensitive, might be a red flag.

Ask meaningful questions

As a commercial person, knowing technical specifics shouldn't be required, but there's a line of questioning you can pursue to get some indicators:

• What about these technologies or libraries make you think they're best for our project?
• What do you expect to be the most challenging aspect of the project?
• What are your error margins or concerns with the project?

At Goldmund we'll always be open on all these details, sometimes what our customer thinks is complex "reporting", may not be what we find most complex "Data models" and by being transparent on those aspects we give our customers insight on our thinking and reasoning in the project.

Get a clean specification document Then when it comes to the technical scope document they provide, things you want to check for:

• Use of AI and AI services
• Error handling and monitoring
• Breakdown of hours/complexity on aspects of the project
• Considerations made to not go with other solutions or software
• Considerations for protecting data and information

The goal should be to see their thinking and reasoning behind the project. Is this just another template project? A project they'll solve as they go? A project they plan to use a lot of external services and AI for? etc.