Offshore in 2026: with AI, the senior developer matters more than ever

Offshore development was long sold on volume. In 2026, AI produces that volume in a few seconds; it does not produce judgement: understanding the need, choosing an architecture, spotting the fix that passes the tests but is still wrong. Here is what that changes when choosing a partner: our measurements, six criteria and an evaluation scorecard.

What AI really speeds up, and what it does not

Standard tasks: a real, measured gain

For eight weeks, eight developers and one lead from our BUILD team worked on two client projects with a versioned catalogue of skills and five MCP servers, including read-only Postgres access (see the iones lab EXP-01 report):

The gain is clear, and it applies exactly to what “volume” offers used to sell: repetitive code that can be described in one sentence.

Need, architecture, edge cases: no measured gain

The same set-up produced no gain on understanding the need, architecture and edge cases. On complex tasks, the time even increased by 9% at first, until the team documented when not to use the agent.

Review comments fell on style (−41%), not on business logic: AI removed the easy remarks. The ones that prevent a production incident remain the responsibility of a human who knows the business.

What external studies say

Three external publications point in the same direction:

• METR (July 2025): in a controlled trial with 16 experienced open-source developers (246 tasks), AI tools made them 19% slower, whereas they believed they had gained about 20%. A snapshot of early-2025 capabilities, the authors point out. [1]
• DORA 2025 (Google Cloud): 90% of respondents use AI, 30% have little or no trust in generated code, and adoption is still associated with lower delivery stability. AI, the report sums up, amplifies what already exists. [2]
• Veracode (July 2025): on code generated by more than 100 models, 45% of samples failed security tests and introduced a vulnerability from the OWASP Top 10. [3]

The real risk: “functional but wrong” code

18 of 138 fixes passed the tests

In the iones lab EXP-06 report, two autonomous agents handled 412 real, anonymised tickets over six weeks. The triage is very good: 91% correctly qualified, priority identical to the lead’s in 87% of cases. Of 138 attempted fixes:

• 34% were accepted without changes;
• 22% were accepted after rework;
• 18 fixes were “technically functional but wrong”: they passed the tests without solving the real problem.

An automated check does not catch them, since the tests are green. Only a reviewer who understands the intent of the ticket and the client’s business spots them. Hence the protocol’s rule: no automatic merge, everything goes through a reviewed pull request. We detail these guardrails in our article on autonomous AI agents in production.

What a functional but wrong fix looks like

Typical example (illustrative, not taken from the experiment’s tickets): a ticket reports that a CSV export crashes when an order has no delivery address.

• “Functional but wrong” fix: the agent wraps the loop in a try/catch that ignores the rows in error. The test passes, but orders without an address (digital products) silently disappear from the accounting export.
• Correct fix: a senior understands that a missing address is a normal business case, makes the field optional and adds a test on a digital order.

The difference does not show up in CI. It shows up in the following month’s accounting close.

What changes in the offshore model

The end of the “low-cost volume” logic

The historical offshore model rested on a simple trade-off: a day of development costs less elsewhere, so you buy more days. When a tool produces a growing share of standard code, buying days of “code production” loses its meaning. What remains scarce is the ability to decide what to write, to review what has been generated and to take responsibility for it.

A provider that mostly sells poorly supervised juniors, equipped with AI assistants they do not control, is selling you risk at a discount.

What you now buy

Choosing an offshore development partner in 2026: 6 criteria

1. Real seniority and visible supervision

Ask for the anonymised CVs of the people who will actually work on your project. Check who reviews the code, how many developers each lead supervises and how architecture decisions are tracked. A 30-minute technical interview with the proposed lead tells you more than a brochure.

2. French language and time zone

A French-speaking partner reads your specifications and your clients’ remarks without loss of meaning. On working hours, be precise: Tunisia is on UTC+1 all year round, with no daylight saving time. [8] The iones team, based in Tunis, therefore keeps the same time as Paris in winter and is one hour behind in summer, which leaves an almost entirely shared working day.

3. Supervised AI tooling, not improvised

Ask which tools are authorised, with what data and what rules. A serious answer looks like this:

• a shared, versioned catalogue of instructions, rather than individual prompts;
• read-only access by default for agents (databases, ticketing tools);
• no client data sent to an external service without written agreement;
• no automatic merge: everything goes through a reviewed pull request;
• a written list of the cases where the agent must not be used.

Done well, the adoption cost stays modest: about three lead days and half a day per developer in EXP-01, paid back in under a month.

4. QA and code review as deliverables

Review and testing are not options, they are deliverables. Require a written test strategy, automated tests in CI, a static analysis tool (SonarQube, for example) and “done” criteria that include review. If the subject is critical, separate code production from its verification, for example with a distinct quality assurance and testing team.

5. Security and compliance: CRA, GDPR, NDA

• Cyber Resilience Act: since 11 September 2026, manufacturers of products with digital elements must report an actively exploited vulnerability to ENISA and the competent CSIRT: early warning within 24 hours, notification within 72 hours, final report no later than 14 days after a fix has been made available. [4] The rest of the regulation will apply on 11 December 2027. Your partner must know how to maintain an inventory of components (SBOM), keep watch and fix quickly (see our article on vulnerability reporting required by the CRA).
• GDPR: a provider that accesses personal data is a processor within the meaning of Article 28, which requires a specific contract (documented instructions, confidentiality, security, fate of the data, audits) and your written authorisation before any sub-processor is engaged. [5] Tunisia has no adequacy decision from the European Commission [6]: in practice, a transfer to a Tunisian team is covered by the standard contractual clauses of Decision 2021/914. [7] The simplest approach remains to work on anonymised data.
• NDA: it must bind the individuals involved, not just the company, and set the confidentiality period after the contract ends.

6. Transparent costs

Ask what is included (management, review, tests, on-call duty, AI licences), what is invoiced on top and how defects are handled after delivery. A serious partner shows you the total cost of a typical sprint.

Fixed price, time and materials or dedicated team: which engagement model?

For a web development project with a clear scope, a fixed price remains relevant. To reinforce a team, time and materials or dedicated developers are more flexible. Web agencies: see also how to absorb peaks in workload with a white label approach<!-- LIEN À ACTIVER LE 29/10/2026 : https://iones.io/blog/marque-blanche-agence-web-pics-de-charge/ -->.

Warning signs

Be wary of a partner that shows any of these symptoms:

• A quantified AI productivity gain, with no measurement method.
• No rule on the cases where AI must not be used.
• Pre-sales profiles that differ from those who arrive on the project.
• No code review, or a review done by the author of the code.
• Write access to production from day one.
• A contract that is silent on personal data, sub-processing and code ownership.
• No anonymised example of a review or delivery report to show.

Scorecard for evaluating an offshore partner

Score each criterion from 0 to 3, multiply by the weight, then compare the totals. Adapt the weights to your context: a white-label agency will give more weight to communication, an IT department to compliance.

A total below half the maximum (45 points here) should lead you not to sign, whatever the rate.

Frequently asked questions

From volume to judgement: where to start

AI has lowered the price of easy code, not the price of an architecture mistake, a forgotten edge case or a security flaw. Choosing an offshore development partner therefore means choosing people who can judge, review and take responsibility.

Go through the scorecard above with your current or prospective partners and ask them for the matching evidence. To reinforce your team with French-speaking seniors, discover our dedicated developers or our quality assurance and testing offer, then contact us: we reply within 48 to 72 hours, with no commitment, under NDA.