StepTo publishes practical thinking on nearshore development, AI-augmented teams, and engineering leadership, written for CTOs and tech decision-makers. Every post carries the byline of someone at StepTo: Igor Gazivoda (Co-founder & CEO), Darja Gazivoda (Senior Engineer & Technical Writer), Ivan (Senior Engineer), or the StepTo Editorial team.
Cross-platform mobile stopped being a two-horse race. What changed with Kotlin Multiplatform, where Flutter and React Native still win, and how to decide.
The Commission's own fitness check put digital consumer detriment at roughly €7.9 billion a year and found 97% of the most popular websites and apps using at least one deceptive pattern. The proposal lands this quarter, and almost every obligation it contemplates is a change to code, not to a policy page.
Most vendors selling a 'RAG system' have only built the easy part, a chat interface wrapped around a model call. A buyer's framework for what to ask before you sign anything.
Zero shipped 1.0, TanStack DB added persistence, and CRDTs stopped eating memory. Instant UI and offline capability are now library decisions rather than distributed-systems projects, which means the cost has moved somewhere most teams are not looking.
Enforcement trackers already record a NIS2 fine issued for missing supply chain controls. Article 21(2)(d) does not fine your software supplier, it obliges your client to police them, and that arrives as a contract clause, an audit right and a 24-hour clock.
The European Health Data Space turns EHR interoperability into a shipped software component with a CE mark on it. The specs land in 2027, the obligations bite in 2029, and the build starts now.
Agents now run for hours, not seconds, and the runtimes they were deployed on assume a request finishes in milliseconds. The missing piece is not a better model, it is a state layer, and every major platform has now shipped one.
Outstaffing, outsourcing and staff augmentation get used as if they mean the same thing. They don't. The difference is who manages the work, and it changes your contract, your risk, and your invoice.
The timeline between signing and shipping is the question every buyer asks last and regrets not asking first. Here's what actually determines it, and where the real delays hide.
"We own everything you build for us" is not automatically true, in most jurisdictions it isn't true at all without a written assignment clause. Here's what the contract actually needs.
Postings for forward deployed engineers jumped roughly 800% in nine months and senior packages clear half a million dollars. The scarcity is not model talent. It is people who can land AI inside a real business.
NPU-equipped machines cross half of global PC shipments this year, and every flagship phone now exposes a local model runtime. Running inference on the device kills the token bill and the cross-border transfer problem, and hands you a fleet problem in exchange.
AI product gross margins average 52% against the 80-90% SaaS baseline. The gap does not close with a pricing page. It closes with metering, per-customer cost attribution and an outcome definition you can defend in a billing dispute.
European enterprises are being pushed off VMware by pricing and partner-programme decisions they did not choose. The platform swap is the easy part. The application archaeology underneath it is where the schedules die.
Truffle Security re-verified 10,616 publicly exposed AWS keys in August 2026 and 88% still authenticated. AI-assisted commits leak secrets at 3.2%, roughly double the platform-wide baseline. Credential hygiene has become an engineering discipline, not a security checkbox.
Enterprise buyers turned ISO/IEC 42001 into a supplier gate this year. Barely 350 organisations worldwide hold it, and the European Commission has said in writing that it does not meet the AI Act. Here is what the certificate proves, what it does not, and what to ask a development partner instead.
Belgium switched on in January, Poland in February, France on 1 September. Mandatory structured e-invoicing is filed as a tax project and staffed as a tax project. Every deliverable in it is systems integration with a statutory go-live date.
European teams spent 2026 planning around one AI Act. The rules that already bind software sold into the United States arrived one state at a time, and almost all of them are build tickets with dates attached.
From 12 January 2027 the EU Data Act bans cloud switching charges outright. The financial barrier to leaving disappears. The engineering barrier, which was always the real one, does not.
The 2024 default was a dedicated vector store bolted next to your database. In 2026 the benchmarks, the acquisitions and the erasure rules all point the other way.
Return-to-office mandates are usually argued as a culture question. For engineering organisations they are a talent question with measurable answers, and the measurements are not flattering.
Voice agents demo beautifully and break the moment a real person talks over them. The gap between a convincing demo and a production phone line is a real-time systems problem, and most teams staff it as a prompt-writing problem.
Iceberg v3 shipped and Polaris graduated, so the open table format argument is over. The bottleneck moved up a layer to catalogs, compaction and pipelines, which is exactly where AI projects are quietly dying.
The EU registry went live in July 2026 and the first hard deadline is 18 February 2027. A product passport is not a compliance document, it is a distributed system with a ten-year uptime commitment.
Only 39% of SAP's ECC customers had moved by the end of 2024. With mainstream support ending in 2027, the deadline is now a staffing problem, and a large part of the work does not need an SAP specialist.
Europe deferred the high-risk AI rules to December 2027, and most engineering teams heard 'the deadline moved.' Article 50 transparency obligations went live on 2 August 2026 exactly as scheduled, and they are a build task, not a policy memo.
curl shut its bug bounty, Ghostty banned drive-by AI pull requests, tldraw auto-closes external contributions. Meanwhile 93% of commercial codebases contain components nobody has touched in two years. These two facts are the same fact.
36% of organisations will spend over $1M on observability this year, and AI workloads emit an order of magnitude more telemetry than the services they replaced. The cost driver is cardinality, and sampling is the wrong fix.
All 27 member states must ship a digital identity wallet by the end of 2026, and regulated sectors must accept one by December 2027. It is not an SSO integration, and the parts that break are in your data model.
Average GPU utilisation across tens of thousands of Kubernetes clusters is 5%, and 93% of enterprises are revisiting where AI runs. The answer is a utilisation number per workload, not a strategy slide.
Computer-use agents now beat the human baseline on OSWorld. That says almost nothing about whether one should be driving your ERP, and the gap between the two is where the money goes.
AI SRE agents are cutting time-to-root-cause by up to 87% in published case studies. That is not the same metric as time-to-restore, and the gap between them is where your on-call engineers still live.
CISA's memory safety roadmap date was January 1, 2026. It was never legally binding, but it has arrived in procurement questionnaires anyway, and most C and C++ teams have nothing to send back.
Technical diligence has moved to the front of the deal and it now moves the price. Much of the code being bought is machine-written, and the signals buyers have relied on for twenty years no longer mean what they used to.
AI-referred traffic to retail sites rose 393% year over year and now converts 54% better than every other channel. 73% of merchants are not agent-ready, and the gap is backend work, not marketing.
AI-generated code carries 1.7x the defects and 81% more duplication, while QA ratios move from 1:4 to 1:9. The bill for that trade arrives about two quarters later.
The same agent returns very different value on a clean service than on a decade-old repo. The variable isn't the model. It's whether your codebase is agent-ready.
A $100,000 H-1B fee arrived, then a court struck it down. A wage-weighted lottery quietly closed the entry-level pipeline. How to staff when it's unplannable.
If your outsourcing contract prices developer-hours, AI has quietly changed what you're buying without changing what you pay. How to tell if you're overpaying.
Hiring a developer abroad as a contractor looks simple. It creates two liabilities most companies never price: permanent establishment and misclassification.
Published attrition rates at major IT services firms run 13-15% a year, a coin-flip chance of losing someone in year one. Most contracts say nothing about it.
Almost every outsourced engineering team touches real customer data without anyone deciding they should. What GDPR requires, and your fine-tier exposure.
The revised EU Product Liability Directive hits software sold after 9 December 2026, no-fault liability, forced source disclosure, 25-year liability tail.
European sovereign cloud spending rises 83% in 2026 as CADA turns sovereignty into law on August 4, requirements land on architecture, not procurement.
Gartner expects AI evaluation platform adoption to more than triple by 2028. Teams stuck in pilot purgatory aren't short of models. They're short of evals.
Your business logic now lives in prompts, tool schemas and embeddings tuned to one provider. Gartner expects 60% of organisations to face significant migration costs by 2027. Portability is an architecture, not a procurement clause.
The EU Cyber Resilience Act's 24-hour reporting duty begins September 11, 2026, years before the full deadline. Outsourcing doesn't transfer the obligation.
Agentjacking needs only a public Sentry DSN and an HTTP client, no stolen credentials, and hit 85% code-execution across Claude Code, Cursor, and Codex.
The agent frameworks are Python-native. Your product is TypeScript. Most production systems run both, and the only question that matters is where you draw the line between them.
Your margin is consumed within months of shipping. Your security update obligation runs at least five years. The Cyber Resilience Act just made that asymmetry a legal requirement rather than a business choice.
GitHub Copilot's June 2026 shift to usage-based billing had developers projecting $29 bills at $750, a symptom of costs becoming impossible to forecast.
Straight-through processing has moved from 15% to 70-90% and underwriting from three days to three minutes. The same systems delivering that are classified high-risk under the EU AI Act, with obligations landing in August 2026.
You are paying full rate from day one for output that arrives in week eight. Everything that determines whether that gap is six weeks or twelve happens before the engineer writes a line of code.
A €28 hour and a €50 hour are not competing on price. They are competing on how much of the real cost each one hides. Here is the model that makes them comparable, with the arithmetic worked through.
Poland has 400,000-600,000 developers depending on the count and premium pricing. Romania is the cheapest EU option. Serbia is the lowest-rate senior market in Europe and is not in the EU. Which trade-off you can absorb is the whole decision.
180ms versus 3.8 seconds to first request. 68MB versus 412MB under load. When compute got expensive, runtime footprint stopped being a benchmark curiosity and became a line item.
North Korean IT worker fraud rose 220% in a year, deepfakes now pass live interviews, and the scheme reached Serbia. Why verified hiring is a security control.
Laravel sits at 64% framework adoption against Symfony's 23%. That gap tells you about hiring speed, not about which one survives a decade in your business. Here is the decision as it actually is.
Build quotes for an iOS app run $30K to $250K. The build is the part everyone prices. Apple's April 2026 SDK mandate, DMA distribution, age assurance and the maintenance curve are the parts nobody does.
Server DRAM contract prices roughly doubled in 2026 and memory now eats 30% of hyperscaler capex. Cloud passthrough is 5-10%. Here's what that repriced in your architecture.
Custom AI runs $5K for focused automation to $250K+ for multi-system workflows. What each tier costs, what drives prices up, and how to spot a real quote.
McKinsey calls humans working beside AI agents the biggest operating-model shift since the digital revolution. What it changes about building software.
31% of outsourced software projects fail before delivery. Vetting questions, red flags, and how to structure a paid pilot before you sign a long-term contract.
Gartner: 40%+ of agentic AI projects will be canceled by 2027. The cascading failure problem behind broken automations, and what production-grade needs.
60% of workers now have sanctioned AI tools; only 34% of companies have redesigned anything around them. You have an integration problem, not an AI problem.
Bolt, Lovable, and Cursor make software look effortless. When AI tools are the right call for your business, and when production reality says otherwise.
Outsourced builds usually fail at selection, not execution. A due diligence framework for non-technical buyers: red flags, green flags, and the right questions.
A first-pass vetting framework for choosing a software or AI development agency in 2026: five questions, five red flags, and what good partnership looks like.
McKinsey: 88% of enterprises use AI, just 39% see any enterprise-level EBIT impact. It's a measurement failure, here's how value-capturing teams differ.
SaaS churn is accelerating as AI agents replace whole tool categories. A CTO framework for which subscriptions to cancel, and which replacements backfire.
AI writes 80%+ of code at high-adoption teams, yet working engagements are getting smaller, more senior, and pricier per head. The economics explained.
Reddit killed r/all and r/programming banned LLM posts in the same week. The open web's engineering knowledge layer has fractured, what CTOs should do.
81% of enterprise leaders worry about AI vendor dependency yet deepen it quarterly. What Big Three lock-in means for your architecture and exit options.
Gartner logged a 1,445% surge in multi-agent inquiries. In production, coordinated agents behave like distributed systems, plan for those failure modes.
84% of developers use AI but only 33% trust it, and fewer than half always verify it before committing. Inside Stack Overflow's adoption-trust paradox.
77% of employees paste data into GenAI prompts, most of it from unmanaged accounts. Shadow AI, prompt injection, RAG poisoning, and the governance that works.
A step-by-step playbook for building a dedicated remote software team: geography, vendor vetting, interviews, real cost benchmarks, and the first 90 days.
45% of AI code-generation tasks introduce a security flaw, and experienced devs took 19% longer with AI. What the vibe coding research actually says for 2026.
Want senior engineers who move work forward, not just tickets?
Work with accountable, English-fluent professionals who communicate clearly, protect quality, and deliver with a steady operating rhythm. Cost efficiency matters, but performance is why clients stay with us.
