Four of the industry’s largest research publications released their numbers over the past year: the Stack Overflow Developer Survey 2026, Google’s DORA 2025 report, Gartner’s strategic predictions for 2027, and GitHub’s Octoverse. None of them is speculation; they measure what companies are already doing with AI.
Read from a European office, the data tells a story the headlines mostly skip. The question for 2027 is no longer whether your company will use AI. It is which models, running where, under whose control, at what cost. That is an engineering and governance decision, and the companies that treat it as one will get more out of AI than the companies that treat it as a subscription.
As usual on this blog, this is practical guidance from an engineering perspective, not legal advice.
The Stack Overflow survey of more than 30,000 professionals found that 66% of those using AI now work with agents, tools that carry out multi-step tasks rather than suggesting snippets. Among users of AI assistants or agents, 73% use them every day. DORA, surveying about 5,000 professionals, puts overall AI adoption near 90%.
For a company, this means AI is already inside your workflows, whether or not it appears in any strategy document. Your staff uses it, your vendors embed it in their products, and your processes increasingly run through it. The real question has shifted from adoption to rules: which data may flow into which model, who approves consequential actions, and who is accountable for the output. We covered the security side of that shift in our piece on prompt injection; the governance side is this article.
DORA’s 2025 report contains the finding that boards should read twice: AI adoption correlates with higher throughput and with more instability in delivery. The comfortable assumption that extra speed would pay for the extra errors did not survive contact with the data.
DORA’s conclusion is that AI works as an amplifier. Organisations with solid processes get better; disorganised ones break faster. For European companies this lands with particular weight, because the EU has made process a legal requirement: the AI Act expects documented, controlled, supervised use of AI, with obligations phasing in through 2027. Amplifying a process you cannot describe is now a compliance problem as well as an engineering one. We walked through the timeline in our piece on the AI Act and existing systems.
Gartner predicts that by 2028, 60% of the world’s largest companies will run FinOps controls on AI inference, and warns of “cost exhaustion” attacks against public-facing AI applications. Stack Overflow’s data shows the discipline forming already: 38% of organisations impose usage limits, 28% review spending, and 27% deliberately use different models for different tasks.
That last number is the interesting one. Routing tasks to the cheapest model that does the job well is where real savings live, and it requires an architecture that can switch models, not a hard dependency on one provider’s API. Cost control and vendor independence turn out to be the same engineering decision.
Put those threads together: AI is in every workflow, regulation demands control, and cost demands flexibility. For European companies this converges on one decision: where does the model actually run?
There are three realistic routes.
Frontier APIs from US providers. The most capable models, the least control. Data crosses into another jurisdiction’s legal reach, a theme we covered in depth in our article on digital sovereignty. For many workloads this trade is fine. For some it is not, and knowing which is which is the work.
European hosting of major models. EU regions and sovereign-cloud offerings reduce the data residency problem without changing who controls the model itself.
Open-weight models on your own infrastructure. The option that has matured fastest. Models with downloadable weights can run in your data centre or your EU cloud tenant: data never leaves, costs are hardware instead of per-token, and the model version changes when you decide, not when a provider deprecates it. For document processing, internal assistants, classification and much day-to-day work, current open-weight models are more than capable.
Here is the part that deserves an honest label, and rarely gets one: most of today’s leading open-weight models are Chinese. Qwen (Alibaba) accounted for over half of global open-model downloads in 2026. DeepSeek, GLM (Zhipu) and Kimi (Moonshot) fill out most of the top of the leaderboard. The strongest European family is Mistral, and Meta’s Llama remains the main American line, but a company assembling a local AI stack today is very likely to be evaluating Chinese models.
Running a model locally means your data stays with you; the weights do not phone home. The origin still matters in ways a serious evaluation has to cover: licences differ (some are clean Apache 2.0 or MIT, others carry revenue conditions), the models were trained and aligned under another country’s norms and may carry its assumptions into answers, your roadmap depends on a foreign lab’s release decisions, and some boards and clients will simply ask the question, so you need a documented answer. None of this disqualifies these models. It means “which open model” is a due-diligence decision like any other supplier choice, tested against your use cases, not adopted from a leaderboard.
The most quietly important number in the Stack Overflow survey: 93% of professionals say they need source attribution to trust an AI answer. Generation became cheap; trust did not. In practice the human work shifts from producing to verifying, in code, in documents, in decisions.
This matches where European regulation is pointing: the AI Act’s transparency and human-oversight expectations assume someone competent is checking what the system produces. Companies should budget for that role rather than assuming AI removes it. Gartner’s related prediction, that by 2029 some 80% of new applications will be disposable, cuts the same way: cheap software multiplies, and the scarce skill becomes telling what deserves to live, be maintained and be trusted. Which, for the record, is a prediction from a consultancy, not a measurement.
The data points to four questions worth answering before the next budget cycle:
Answering them requires knowing your systems, your data flows and the regulation at the same time. That intersection, choosing where AI runs and building it in so the choice stays reversible, is the work Dink leads for companies in the Benelux. We are deliberately model-agnostic: we have built on the frontier APIs, on European hosting and on open-weight models running on client infrastructure, and the honest comparison between those routes is exactly what our technology assessment delivers. When the decision is made, we build and maintain the result as the models underneath keep changing.
What are the main enterprise AI trends for 2027?
Based on Stack Overflow, DORA, Gartner and GitHub data: AI agents in daily workflows, higher delivery speed paired with higher instability, AI cost management (FinOps) as a standard discipline, strategic choice of where models run, and human verification as the scarce skill.
Should our company run AI models locally?
For many workloads it is now realistic: document processing, internal assistants and classification run well on current open-weight models, keep data inside your infrastructure and convert per-token costs into predictable hardware costs. Frontier APIs still lead for the hardest tasks. Most companies end up with a mix, which is why switchable architecture matters more than any single model choice.
Are Chinese open-weight models safe for European companies?
Run locally, they do not send data anywhere; that risk is controlled by where you run them, not where they were made. What remains is supplier due diligence: licence terms, alignment and bias characteristics, roadmap dependency and stakeholder perception. Evaluate them against your use cases as you would any critical supplier, and document the decision. European (Mistral) and American (Llama, Gemma) open alternatives exist and belong in the same comparison.
What does the AI Act change for ordinary companies in 2027?
Transparency obligations for AI systems that interact with people apply from August 2026, and high-risk obligations phase in from late 2027 after the Digital Omnibus adjustments. The practical core is the same regardless of category: know where you use AI, control the data that reaches it, and keep humans supervising consequential output.
How do we control AI costs?
Treat cost per request as an architecture requirement: measure consumption per feature and per process, cache where possible, route tasks to the cheapest adequate model, and consider local models for high-volume workloads. Gartner expects FinOps for AI inference to be standard practice in large companies by 2028; mid-size companies get the same benefit sooner by designing for it now.
Deciding where AI should run in your organisation, or what your current setup would look like under AI Act scrutiny? Start with a fixed-scope technology assessment, or get in touch.
Anthropic's IPO prospectus reveals fast-growing revenue, hundreds of billions in obligations and no clear path to profitability. When liquidity dries up, repricing follows. The question every technology leader should ask now: how dependent are…
Read article
Any AI system that reads email, documents or web pages can be given instructions by whoever wrote them. Why prompt injection sits at the top of the OWASP risk list for LLM applications, and…
Read article
Modern systems depend on dozens of external providers, yet most processes are designed as if none of them will ever fail. What actually happens when one does, and how to design a process that…
Read article
Tell us about your platform — what it runs, what it costs, what worries you. We’ll get back to you with a scope proposal, no commitment beyond the conversation.
Book a technology assessment