Vibe Coding Is Changing Who Can Build Software. But Who Is Governing What Gets Built?
AI is changing who can build software. Until recently, turning an idea into an application usually meant finding developers, translating business requirements into technical specifications and working through development cycles before anything useful reached the business.
Vibe coding changes that. At its simplest, it allows someone to describe what they want in natural language and use AI to help build the application for them. This is an incredibly powerful shift because the person who understands a business problem best may increasingly be able to turn that knowledge directly into a working solution, without needing to know how to code.
For governance, risk and compliance (GRC) teams, I think this opens up enormous possibilities. A risk professional could build an application around a particular assessment process. A compliance team could rapidly digitise an obligation-management workflow. A subject-matter expert could turn an idea for managing controls, incidents or policies into something tangible in a fraction of the time a traditional development project might take.
But there is an important distinction we need to make. Being able to build an application quickly does not automatically mean that application is ready to operate inside an enterprise. And that is where the GRC conversation gets interesting.
Building the application is becoming the easy part
When people see vibe coding for the first time, the application itself usually gets the attention. You describe what you want, AI builds it, you make a few changes and suddenly there is something working in front of you. But in a large organisation, the visible application is only part of the equation.
Behind it sits all the less visible work that enterprise software depends on: security, identity and access management, data architecture, integration with core systems, business rules, testing, change management and auditability. These capabilities are much harder to vibe code, yet they are essential if an application is going to operate reliably within an enterprise.
You might be able to create an impressive application in an afternoon, but if it is going to access sensitive information, update a risk register, trigger a workflow or inform a compliance decision, the questions become more significant. Who has access? What data can the application use or change? How are permissions enforced? Who approves changes? And can the organisation explain what happened months later? Ultimately, someone still has to own it.
For GRC leaders, this creates an interesting paradox. The people closest to the problem are becoming more capable of building the solution themselves, but the faster we make development, the easier it becomes for development to move ahead of governance.
Are we creating the next generation of legacy technology?
There is another risk I think organisations need to pay attention to. Many vibe-coded applications start with one person who has an idea, builds something useful and shares it with their team. Other people discover it, adoption grows and before long, something that began as an experiment becomes part of an operational process.
Then that person leaves. If the application is poorly documented and nobody else understands the prompts, dependencies, integrations or business rules underneath it, something that was created very quickly can become surprisingly difficult to maintain.
We have seen versions of this problem before. Most large organisations have encountered spreadsheets, databases, macros or bespoke applications that quietly became business-critical despite being understood by only one or two people. Vibe coding has the potential to accelerate that problem enormously. We could end up creating AI-generated legacy technology at AI speed.
When those applications sit inside risk, compliance or governance processes, this becomes more than an IT problem. If an application contributes to a risk assessment, interprets an obligation, recommends an action or helps determine how an incident should be managed, the organisation needs to understand how it operates and who remains accountable for the outcome. The question is not simply whether an application works today, but whether the organisation can govern, maintain and trust it tomorrow.
What we're hearing from risk leaders
Over the past several months, we have been bringing together senior risk, compliance and resilience leaders from major Australian organisations through the ReadiNow Executive Roundtable series. The conversations have covered everything from practical AI use cases and automation through to regulatory change, reporting, data quality, controls and the role AI should ultimately play inside GRC.
One thing has become very clear. The conversation is no longer simply about whether organisations should use AI. Most are already moving beyond that question. The harder discussion is how to use AI in a way that is controlled, repeatable and accountable.
A recurring theme throughout the roundtable series has been what we describe as AI governance debt. Much like technical debt, governance debt accumulates when organisations introduce new capabilities faster than they establish the controls, standards and accountability needed to manage them. AI adoption and experimentation are moving quickly, but governance capability is not always keeping pace.
That gap creates practical challenges around transparency, auditability, consistency and ownership. Organisations need to understand where AI is being used, particularly as experimentation spreads beyond centrally managed programmes. They also need to demonstrate where AI has contributed to a decision and retain sufficient evidence to explain that decision later.
Consistency is another concern. One discussion we have returned to is the example of two people using AI to assess the same risk. If they ask the question differently, they may receive different answers. That is manageable when AI is assisting an individual, but it becomes much more significant when AI is helping build the applications and workflows through which those decisions are made.
Two teams could identify the same business problem and build two different solutions, using different prompts, rules, data and decision logic. Both might work, but are they applying the same policy and controls? Will they produce consistent outcomes? Can the organisation explain why one behaves differently from another? That is where something that initially looks like a development question becomes an enterprise governance question.
AI adoption is moving faster than governance confidence
The polling from our Executive Roundtables has reflected the same broader pattern. In one session, 50% of participants told us AI was already being used in at least some GRC activities, including 37.5% who said it was part of several everyday processes. Another 25% were testing one or two ideas, while the remaining 25% were discussing potential uses but had not yet taken action. Nobody indicated that they had not started looking at AI.
However, when we asked how confident participants would be explaining how an AI-assisted GRC decision had been reached, the picture changed significantly. Not a single participant selected "very confident". Around 57% said they were somewhat confident but that controls still needed strengthening, while approximately 43% were unsure because they had not yet tested this sufficiently.
It was a small pulse survey rather than a market-wide study, but it reflected what we were consistently hearing around the table. There is enthusiasm, experimentation and genuine progress towards practical AI use cases, yet governance maturity has not always caught up.
Vibe coding has the potential to widen that gap because it moves AI from assisting people with work to helping them create the applications through which that work is performed. As the number of AI-generated applications grows, so does the challenge of ensuring they operate within consistent governance frameworks.
The answer is not to stop people building
I do not think the solution is to create another barrier to innovation. The opportunity here is too significant, and people who understand business problems should be empowered to solve them. The challenge is giving them the right foundation to build on.
For us at ReadiNow, that means doing the difficult enterprise work underneath the application first. The platform provides a connected data foundation, security, access controls, integration and workflow capabilities that sit beneath what people build. Governance does not need to be recreated from scratch for every new application; it can be embedded in the environment in which applications and AI agents operate.
From a GRC perspective, that means keeping AI connected to the broader operating model around it. Applications and agents should not exist in isolation from risks, controls, policies, obligations, incidents, approvals and evidence. They should operate within a shared, governed environment where business rules, permissions and accountability can be consistently applied.
This becomes even more important as organisations move beyond AI that simply provides information towards agents capable of taking action. When an AI agent updates a control, initiates an incident workflow or supports a compliance decision, the organisation needs the same visibility, oversight and auditability it would expect from any other enterprise process.
That is where I see the biggest opportunity. Not AI replacing governance or governance slowing AI down, but creating an environment where people can innovate quickly because the governance foundation is already there.
The real advantage will be governing what gets built
Vibe coding is going to make building software easier, but I think the bigger shift is what happens when application development is no longer limited to traditional development teams. Organisations could find themselves with far more applications, workflows and AI agents than they have ever had to manage before.
Some will deliver enormous value. Others may introduce duplication, inconsistent processes or risks that are difficult to identify until something goes wrong. The organisations that benefit most will not necessarily be those that build the greatest number of applications, but those that can turn rapid experimentation into sustainable enterprise capability.
For GRC leaders, this creates an opportunity to move governance beyond reviewing what has already been built and towards shaping the environment in which innovation happens. The future is not about choosing between innovation and governance. It is about making governance part of what enables innovation.
AI is changing who can build software. Now we need to make sure organisations can govern what gets built.
Join the conversation
These are exactly the kinds of questions we are continuing to explore through the ReadiNow Executive Roundtable series. We bring together senior risk, compliance, governance and resilience leaders to share practical experiences, explore where AI is creating value and discuss the governance challenges that emerge as organisations move from experimentation into operational use.
The sessions are deliberately discussion-led, with the value coming from hearing what peers are trying, what is working, what is not and which questions organisations are still trying to solve.
If you would like to participate in an upcoming ReadiNow Executive Roundtable, register your expression of interest below.
Register your interest in a future Executive Roundtable
.jpeg)
