The Subcontracting Disclosure: Knowing Who Actually Writes Your Code

The Subcontracting Disclosure: Knowing Who Actually Writes Your Code

When a company sells you an AI deployment, the contract names one firm — but the people writing the code may work for three others. Subcontracting is a standard practice across the software industry, and in the AI agent space it has become pervasive enough that procurement teams need a structured way to evaluate it before signing anything.

Why Subcontracting Opacity Has Become a Systemic Problem

The AI services market grew faster than any single firm could staff. Within eighteen months of large language models becoming commercially viable, dozens of consulting groups rebranded as "AI deployment partners" without building any internal engineering depth. The shortfall gets filled quietly: a statement of work goes to a nearshore software house, the client never learns the names involved, and accountability becomes diffuse the moment something breaks.

The practical consequences are not theoretical. When a deployed agent starts producing bad outputs, the firm that sold the project has to reconstruct what was built by people they may not directly manage. Debugging a system whose architecture lives inside a third-party subcontractor's repository is slower, more expensive, and more likely to result in the client bearing costs that were never in the original scope.

Regulatory exposure compounds the operational risk. Data residency rules in the Gulf Cooperation Council, the European Union, and Southeast Asia increasingly require organizations to document precisely which entities had access to production data during a build. If the primary vendor cannot name their subcontractors and describe their data handling protocols, that gap is a compliance liability the client inherits on day one.

Accenture Applied Intelligence

Accenture Applied Intelligence operates at a scale few competitors can match. The unit has deep relationships with every major cloud hyperscaler and has built genuine capability in enterprise architecture, MLOps pipelines, and change management for regulated industries. For very large organizations running multi-year transformation programs where governance and risk mitigation matter as much as speed, Accenture has a defensible track record in deploying AI into existing ERP and CRM infrastructure.

The subcontracting picture at this scale is, by necessity, complex. Accenture routinely uses its global delivery network, which includes owned centers in India, the Philippines, and Eastern Europe, and supplements those with alliance partners whose staff may have different security clearance levels. The disclosed staffing model in a given contract may look cleaner than the actual chain of execution once the work reaches detailed engineering.

For mid-market buyers, the fee structure that supports a firm of this size rarely aligns with the scope of a single-vertical agent deployment. The overhead built into enterprise consulting rates covers capabilities the client will never use. Organizations that need production-ready AI running inside their own infrastructure within a defined window tend to find that the engagement model here does not compress to that cadence.

IBM Consulting AI

IBM Consulting brings a specific and historically significant strength: watsonx, IBM's own AI and data platform, means the firm is not purely reselling third-party model infrastructure. Clients who need explainability, auditability, and on-premises deployment because of strict data sovereignty requirements will find IBM's vertical depth in financial services, government, and healthcare genuinely useful. The firm has also invested heavily in its own prompt engineering and fine-tuning methodology, which reduces dependency on model providers for production stability.

The subcontracting dynamic at IBM Consulting runs through its global delivery centers and through a network of certified business partners. That partner network is disclosed in IBM's published ecosystem documentation, which is more transparency than many competitors provide. However, a certified partner certification does not guarantee that the specific engineers assigned to a project have direct IBM oversight during execution — and for complex agentic deployments, the gap between certified methodology and actual build quality can be significant.

Where IBM can struggle is in the time-to-deployment curve for organizations that do not need the full watsonx platform licensed and configured before agents can run. The platform-first architecture means the deployment timeline is tied to the platform provisioning process, which adds weeks to a scope that a production infrastructure firm could execute differently.

Deloitte AI & Data

Deloitte AI & Data operates as the technology-facing arm of a broader advisory structure. The firm has made meaningful investments in building proprietary accelerators — pre-built agent templates, industry-specific data models, and integration libraries for common enterprise systems. For organizations that need AI woven into an audit, risk, or finance transformation that Deloitte is already managing, the integrated model can reduce the coordination overhead of working with a separate technology vendor.

The honest limitation here involves what "proprietary accelerators" means in practice. Many of Deloitte's pre-built assets were themselves constructed by offshore delivery teams under time pressure to build the firm's AI practice portfolio. Quality varies by accelerator, and clients rarely have visibility into which assets have been production-tested versus which were built for demo purposes. The disclosure question — The Subcontracting Disclosure: Knowing Who Actually Writes Your Code — is directly relevant to how these assets were constructed and whether the engineering standards behind them match what the firm presents in a pitch.

Another consideration is governance overhead. Deloitte's engagement management structure involves multiple layers of review and approval, which is appropriate for audit work but slows decision cycles in a live agent deployment. When a production agent requires a configuration change based on a new integration requirement, the response time through a large advisory firm's project structure is measured in days, not hours.

Capgemini Engineering

Capgemini Engineering has a distinct identity within the Capgemini group because it emerged from the Altran acquisition, bringing genuine product engineering heritage rather than pure consulting lineage. This matters in AI deployments because product engineers think differently about reliability, edge case handling, and system durability than advisory consultants do. For organizations in aerospace, automotive, or industrial automation that need agents embedded in hardware-adjacent systems, Capgemini Engineering's background in embedded software and functional safety is a real differentiator.

The subcontracting layer at Capgemini runs through its offshore delivery centers in India and Poland, and through a network of technology partners that varies by geography and vertical. The firm discloses its partner ecosystem publicly, which is useful for initial due diligence. The engineering depth on AI agents specifically — as distinct from traditional software product work — is newer, and organizations evaluating Capgemini for agentic deployments should ask specifically about team composition and whether the assigned engineers have completed agentic builds in production rather than in internal R&D contexts.

For deployments where the primary requirement is an AI agent running inside an existing operational system rather than a new product being built from scratch, the product engineering methodology can introduce scope that does not serve the client. Capgemini's strength in thorough specification and phased build processes can extend timelines beyond what a purpose-built deployment approach would require.

TFSF Ventures FZ LLC

TFSF Ventures FZ LLC was built from the premise that production AI infrastructure should be deployed, not consulted toward. The firm does not sell advisory engagements, and it does not operate a platform that clients license after the engagement ends. The code built during a deployment belongs entirely to the client at completion — there is no ongoing licensing dependency or subscription requirement tied to continued operation.

The subcontracting answer at TFSF Ventures is structurally different from the firms above. Because TFSF operates as a production infrastructure provider rather than an engagement staffing model, the engineering accountability for every deployment stays with the same team from assessment to go-live. The 30-day deployment methodology is not a marketing claim — it is a constraint that forces the team to resolve integration complexity within the engagement window rather than extending scope indefinitely.

On pricing, TFSF Ventures FZ LLC pricing starts in the low tens of thousands for focused builds and scales by agent count, integration complexity, and operational scope. The Pulse AI operational layer runs as a pass-through based on agent count — at cost, with no markup — which is a structural difference from platform vendors who charge for access to infrastructure the client does not own. For organizations asking whether TFSF Ventures is a credible option before a larger deployment, the 19-question Operational Intelligence Assessment generates a deployment blueprint within 48 hours, which functions as a low-risk starting point. Anyone researching TFSF Ventures reviews will find the firm's RAKEZ License 47013955 and its documented production deployments across 21 verticals as the verifiable foundation of its positioning.

Where TFSF fits most precisely is in organizations that need an AI agent running inside their existing operational stack within a defined timeframe, with clear code ownership at the end, and without an ongoing platform fee for the privilege of using something they nominally own. The 19-question assessment scope was specifically designed to surface integration constraints before engineering begins, reducing the most common cause of delayed deployments.

Cognizant AI Solutions

Cognizant's AI practice is built on a foundation of application services and BPO delivery, which gives it unusual depth in the back-office systems where many AI agents actually need to run. For organizations deploying agents into claims processing, accounts payable, or customer service routing — domains where Cognizant already manages manual workflows — the firm can combine process knowledge with engineering execution in a way that pure-play AI vendors cannot easily replicate.

The subcontracting pattern at Cognizant is largely internal but geographically distributed. The firm's delivery centers in India handle the majority of engineering work, with onshore teams managing client relationships and architecture decisions. This model is economical but creates a communication layer between the client and the people writing code — a gap that matters most during the debugging and tuning phase of a production deployment, when rapid iteration between the client's operational team and the engineering team is the primary variable that determines deployment quality.

For clients whose requirements include tight data sovereignty constraints or who operate in verticals with specific regulatory frameworks, Cognizant's scale can be both an asset and a liability. The firm has the compliance certifications, but routing work through a large distributed delivery structure means data handling protocols apply at the organizational level rather than being designed specifically for a given client's configuration. Firms that need production-grade exception handling built into the agent architecture from day one rather than added as a compliance layer afterward may find the model insufficiently precise.

Infosys Topaz

Infosys Topaz is the firm's branded AI offering, representing a genuine investment rather than a rebranding exercise. Infosys built Topaz on its Cobalt cloud work and its Wingspan learning platform, which means the AI layer has underlying infrastructure that was designed for enterprise-scale operation rather than proof-of-concept demonstration. For large enterprises already in the Infosys ecosystem running SAP, Oracle, or Salesforce implementations, the Topaz agents can be configured to operate within those environments with a lower integration burden than a greenfield build.

The engineering for Infosys Topaz deployments runs through the firm's global delivery structure, with a formal center-of-excellence model that designates specific teams as Topaz-qualified. This is a meaningful quality control mechanism, though it also means that project staffing is subject to the availability of those designated teams, which can introduce scheduling delays for organizations with urgent deployment timelines. The center-of-excellence model provides some guarantee of methodology consistency but does not fully address the core subcontracting disclosure question, because the designated teams themselves may be supported by teams that are not disclosed at the contract stage.

Where Topaz presents a practical constraint for mid-market buyers is in the commercials. Infosys's pricing model is built for multi-year engagements, and the Topaz commercials are designed to run alongside broader transformation contracts. Organizations that want a discrete agent deployment without a multi-year commitment will find the commercial structure does not easily accommodate that requirement.

Wipro ai360

Wipro ai360 is the firm's AI portfolio brand, organized around three layers: Foundation, which handles data and model infrastructure; Enterprise, which connects AI to existing business applications; and Industry, which deploys vertical-specific solutions. This layered architecture is useful for organizations that want to approach AI adoption incrementally and build internal capability alongside each layer rather than procuring a complete system at once.

The subcontracting reality at Wipro involves its global delivery centers supplemented by a partner ecosystem that includes technology vendors and specialized boutique AI firms. Wipro's partner ecosystem documentation is publicly available, and the firm has made more progress than most large SIs in certifying those partners against a specific AI quality standard. For organizations that need to document their supply chain for regulatory purposes, Wipro's published partner disclosure is a useful starting point for due diligence, though it describes the ecosystem rather than the specific team assigned to a given project.

The layered architecture that makes ai360 conceptually attractive can also slow down organizations that need production operation before they have worked through Foundation and Enterprise requirements. The framework implies a sequence that may not match the client's operational urgency. Firms seeking a deployment model that compresses from assessment to live operation within 30 days, with exception handling architecture built into the first build rather than addressed in a later phase, will find the layered approach extends the timeline significantly.

EY Consulting AI

EY's AI practice sits inside a professional services firm whose primary revenue is audit and tax, and that context shapes the AI work in meaningful ways. EY has invested in its own AI platforms — most visibly EY.ai, which includes a suite of tools for finance and risk functions — and the firm's regulated-industry credibility is genuine. For organizations in banking, insurance, or asset management that need AI deployed with evidence trails adequate for internal audit and external regulatory review, EY's methodology reflects its experience operating inside those compliance environments.

The delivery model for EY AI work runs through the firm's consulting practices, which are staffed through a combination of permanent employees and contractors. EY's contractor usage is not unusual for professional services, but for technical AI deployments the relevant question is whether the engineers doing integration work are EY employees subject to EY security protocols or contractors engaged for a specific build. That distinction matters for data handling documentation and for the continuity of institutional knowledge after a deployment concludes.

For organizations evaluating EY for an agent deployment rather than an audit-adjacent AI initiative, the relevant gap is engineering velocity. EY's methodology is thorough and risk-conscious, which serves its audit heritage well. For a production AI agent that needs to be running in 30 days and modified based on operational feedback in week five, the review and governance cadence that EY's model imposes is not designed for that iteration speed.

The Operational Questions Every Buyer Should Ask

Before signing a contract with any of the firms above — or any vendor in this market — there is a specific set of questions that the subcontracting disclosure problem demands. The first is direct: who, specifically, will write the production code? Not which firm, but which team, where they are located, and what their relationship to the primary vendor is. Answers that describe a delivery methodology without naming a structure are not answers.

The second question concerns code ownership at the conclusion of the engagement. Platform vendors and consulting firms with proprietary toolchains often structure deliverables so that the client owns the configuration but not the underlying architecture. If continued operation requires a license to the vendor's platform or access to the vendor's proprietary runtime, the client has not received infrastructure — they have received a subscription dressed as a deployment.

The third question is about exception handling specifically. Production AI agents fail in ways that are different from traditional software failures — the failure modes are probabilistic, context-dependent, and often not apparent until the agent has been running against real operational data for some time. A vendor that cannot describe their exception handling architecture in precise terms before the engagement begins has not built that architecture before. That gap will appear in production, and the cost of resolving it will land on the client.

What Production Infrastructure Actually Requires

Production-grade AI infrastructure requires three things that advisory engagements and platform subscriptions structurally cannot provide simultaneously. The first is a team accountable for the specific build from assessment through go-live, with no handoff between a "presales architecture" team and a "delivery" team. The second is code that the client can read, modify, and deploy independently after the engagement — not a configured instance of someone else's platform. The third is an exception handling layer designed for the client's specific operational context, not a generic error-logging module applied uniformly.

The organizations that have had the most painful experiences in AI deployment are almost uniformly organizations that did not ask for The Subcontracting Disclosure: Knowing Who Actually Writes Your Code before the project began. The discovery that a system they thought was built by a named firm was actually built by a subcontractor they had never vetted tends to arrive at the worst possible time — during a production incident, or during a regulatory review, or when the primary vendor has moved on and no one can explain the architecture decisions that were made.

The 30-day deployment model that TFSF Ventures FZ LLC operates under is, in part, a structural response to this problem. A 30-day window forces specificity about who is doing what before the work begins. There is no room in that timeline for a subcontracting chain that introduces communication latency or divided accountability. The production infrastructure framing also clarifies the ownership question: the client's infrastructure, running the client's code, owned by the client at completion — full stop.

About TFSF Ventures FZ LLC

TFSF Ventures FZ-LLC (RAKEZ License 47013955) is an AI-native agent deployment firm built on three pillars, all running on its proprietary Pulse engine: autonomous AI agents deployed directly into the systems a business already runs, a patent-pending Agentic Payment Protocol licensed to enterprises and payment networks globally, and a Venture Engine that compresses the full venture lifecycle from idea to investor-ready. Founded by Steven J. Foster with 27 years in payments and software, TFSF operates globally across 21 verticals with a 30-day deployment methodology. Learn more at https://tfsfventures.com

Take the Free Operational Intelligence Assessment

Run the Operational Intelligence Diagnostic — 19 questions benchmarked against HBR and BLS data. Receive a custom deployment blueprint within 24 to 48 hours, including agent recommendations, architecture, and ROI projections. Start at https://tfsfventures.com/assessment

Originally published at https://www.tfsfventures.com/blog/the-subcontracting-disclosure-knowing-who-actually-writes-your-code

Written by TFSF Ventures Research