The businesses in this year's vibe-coding headlines didn't ignore the safety checks.

They didn't know the safety checks were there.

I've been called in more than five times to fix an application a business had already built.

Roughly two-thirds of the people now using AI to build software are not developers. They're producing real business systems — client portals, intake forms, billing workflows — with no programming background. And having the background doesn't settle it: 96% of developers say they don't fully trust AI-generated code to be correct, but only 48% always review it before committing (SonarSource).

One group never saw the gates. The other group can see them and walks past anyway.

Here's why.

Building software used to require a developer. The developer arrived with the standards already loaded — who's allowed to see what, where the data sits, what happens when it breaks, and usually the memory of an incident that taught them. You weren't buying a governance process. You were buying somebody who was one.

Take the developer out and you don't just remove the typing. You remove the checklist that came attached to them. Nobody notices, because nobody ever saw it.

There's a second layer under that one.

Building anything used to cost money and time. That meant a budget approval, a vendor conversation, a hire, a timeline. Every one of those was a review checkpoint wearing a different hat.

Nobody decided to skip governance. Governance was riding inside procurement — and procurement is what this actually eliminated.

The most-cited example is in consolidated federal litigation now, where plaintiffs allege the development practices were part of the failure. That's for the lawyers. The practical question is what the developer used to carry, whether or not anybody asked:

  1. Does it know the difference between a user and an administrator? Nobody prompts for permissions. Developers build them reflexively.
  2. Where does the data actually sit — and what happens if someone types the address directly? This is the one in the headlines.
  3. What did you agree to collect, and are you allowed to keep it? IDs, dates of birth, health information, anything biometric. Consent and retention aren't code problems, and they're where the regulatory exposure concentrates.
  4. When it breaks, does anyone find out? An application without monitoring doesn't fail loudly. It fails quietly, for months.
  5. Who signs off before it touches a customer, a dollar, or a record?
  6. Who owns it in eight months? The person who built it in an afternoon is not the person patching it later. Usually nobody has agreed to be that person.

The gates didn't disappear. The person carrying them did.

These six are the application-level questions. The readiness assessment asks the bigger one — whether your operation can hold what your team is already building. It takes about ten minutes, and it's free.