You’ve used AI to build a piece of software for your business. Maybe it’s a customer portal, a booking system, an internal database or an application that has finally replaced those spreadsheets everyone relied on.
It works. Your team likes it. And what might once have taken months to develop was up and running in a matter of days or weeks.
That’s a considerable achievement.
But before you start relying on it too heavily, there’s a question worth asking: just because the software works, does that mean it’s safe?
At Evergreen Computing, we’ve spent more than 25 years developing, maintaining and improving bespoke business software. We know there’s a considerable difference between software that appears to work and software that’s been properly designed, tested and secured.
AI has made creating applications much more accessible. That’s a good thing. However, it hasn’t removed the need for the checks that experienced software developers carry out before a system becomes business-critical.
If you’ve already built something using ChatGPT, Claude, Cursor, Lovable or another AI coding tool, here are ten risks you should understand.
1. Is AI-generated code actually safe?
An application might perform every task you ask of it while containing security weaknesses, handling customer information incorrectly or failing when something unexpected happens. And these aren’t merely theoretical concerns.
In August 2025, TechRadar Pro reported on research by software security company Veracode (https://www.techradar.com/pro/nearly-half-of-all-code-generated-by-ai-found-to-contain-security-flaws-even-big-llms-affected ). The research found that 45% of the AI-generated code produced across its tested coding tasks contained security flaws.
That doesn’t mean 45% of business applications built using AI are insecure. The research tested particular coding tasks rather than complete business systems. It does, however, demonstrate why AI-generated code needs proper checking.
In March 2026, The Register reported on research identifying published security vulnerabilities linked to AI coding assistants (https://www.theregister.com/software/2026/03/26/using-ai-to-code-does-not-mean-your-code-is-more-secure/5219716 ). Researchers had identified 35 documented vulnerabilities by that point, including examples attributed to Claude Code, GitHub Copilot and other tools.
The message for business owners is straightforward: AI can write useful software, but it cannot guarantee that what it produces is safe.
2. Security weaknesses that aren’t immediately obvious
AI-generated software can contain security vulnerabilities even when every visible feature appears to work correctly. You might have built an application that requires staff to log in, displays the right information and produces accurate reports.
But has anyone checked whether someone could bypass the login process? Could an unauthorised person access information simply by changing part of a web address? Are passwords and other sensitive details being handled securely?
These are the sorts of questions a professional developer considers when reviewing an application.
Imagine you’ve built a customer portal. Each customer can log in and view their own invoices. Everything looks fine during testing because you’ve only ever accessed it through the normal login process.
What you haven’t discovered is that changing a number in the page address could reveal another customer’s invoices. The application works exactly as you intended, until someone uses it in a way you didn’t anticipate.
The commercial consequences could include a data breach, disruption, lost customer confidence and the cost of investigating and correcting the problem.
3. Customer data being exposed or mishandled
AI-built applications may store, transmit or expose personal information in ways that put your business at risk of breaching UK data protection law.
If your software handles customer names, addresses, financial details, employee records or other personal information, data protection needs to be considered from the outset.
The UK GDPR regulations require organisations to apply appropriate security measures when processing personal data. Those obligations don’t disappear because the software was developed using AI.
Consider a business that creates its own customer management system. It collects information correctly and allows staff to update customer records. However, nobody has checked where the information is stored, whether it is properly protected, how long it is retained or whether an external service can access it.
The business could find itself responsible for a data protection problem it didn’t even know existed.
The Information Commissioner’s Office guidance on data security (https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/security/a-guide-to-data-security/ ) explains the importance of protecting the confidentiality, integrity and availability of personal information.
It’s also worth remembering that a technical code review is only part of the picture. Your business may need to consider privacy notices, lawful processing, retention policies and contracts with third-party providers.
4. Software that fails when something unexpected happens
AI-generated code may work perfectly under normal conditions but fail when it encounters unusual information, increased demand or an unexpected sequence of events. When you’re developing software with AI, it’s natural to test whether it does what you asked. You enter some information, press a button and check the result. If it works, you move on.
Professional software testing goes much further. It asks what happens when things don’t go according to plan.
Suppose for example you’ve created a booking system for your business.
It works when one person makes a booking. But what happens when two customers try to book the same appointment at precisely the same moment?
Or when a customer closes their browser halfway through payment?
Or when the system receives incomplete information?
You might end up with duplicate bookings, missing records or payments that don’t match the orders.
These problems can be difficult to spot during initial testing because they only appear under particular circumstances. And once staff and customers depend on the system, fixing them becomes considerably more disruptive. That “free” software that you developed might just turn out to be a lot more costly than you first thought.
5. Incorrect calculations and unreliable business information
AI-generated software can produce plausible-looking results that are wrong, particularly when business rules are complicated or haven’t been fully specified. This is one of the more concerning risks because the software may not crash or display an error.
It simply gives you the wrong answer.
Imagine you’ve developed an application that calculates quotations based on labour, materials, delivery costs and customer discounts. It produces professional-looking quotations in seconds.
Unfortunately, there’s an error in the way it calculates discounts on certain combinations of products. You don’t notice because the majority of quotations are correct.
Three months later (or even worse later than that), you discover you’ve been undercharging a particular group of customers.
Similar problems can affect stock calculations, commission payments, financial reports and operational decisions.
The issue isn’t necessarily that AI has written poor code. It may have interpreted an incomplete instruction in a way that seemed reasonable but didn’t reflect how your business actually operates. In short, it doesn’t know what it doesn’t know.
A proper review needs to consider both the technical code and whether the software follows the business rules it’s supposed to support.
6. Hidden problems with third-party software and integrations
An AI-built application may depend on external components or services that introduce security, reliability or compatibility risks. Most modern applications aren’t written entirely from scratch.
They use existing software components, libraries, databases and connections to other systems. That’s normal and often sensible. The problem arises when nobody knows exactly what’s been included or whether it’s being maintained.
For example, your new application might connect to Xero, a payment provider or an existing CRM. The connection works today, but what happens when the provider changes its requirements? Or perhaps the AI has used an outdated software component with a known security vulnerability.
These dependencies can remain unnoticed until an update causes something to stop working.
For business-critical applications, it’s important to know which external services and components the software relies on, who is responsible for them and how updates will be managed.
7. Software that becomes difficult or expensive to maintain
AI-generated code can be difficult for another developer to understand, modify or support if it lacks a clear structure and adequate documentation. One of the attractions of AI coding is that you can keep asking it to make changes.
Add another field. Change the report. Introduce a new approval process. Connect another database. Initially, this can work extremely well.
But as an application grows, changes made in one area can begin to affect something completely different. You ask the AI to improve the customer dashboard, and suddenly the monthly reporting function stops working. You fix that problem, only to discover another issue elsewhere.
This is where the original speed advantage can start to disappear.
In September 2025, TechRadar Pro reported on research from Apiiro (https://www.techradar.com/pro/ai-is-creating-code-faster-but-this-also-means-more-potential-security-issues ), which found that AI-assisted developers could produce code significantly faster, while the research also identified increased security findings.
The findings underline an important point: producing code quickly doesn’t necessarily mean the resulting software will be cheaper to maintain. A professional review can establish whether the code is structured sensibly, whether unnecessary complexity has developed and whether another developer could take responsibility for it.
8. Nobody knowing how to fix it when something goes wrong
Business-critical software needs a clear support and maintenance plan, regardless of whether it was written by AI or a professional developer.
Imagine the person who created your application leaves the business. Or perhaps you built it yourself, but six months later you’ve forgotten exactly how some of it works.
Then something breaks.
Your team can’t process orders, access customer information or complete an important task.
Who do you call?
AI may help diagnose the problem, but it won’t necessarily have access to the original development decisions, hosting arrangements, database structure or previous changes. And if nobody has documented the system, an experienced developer may need to spend considerable time working out how it operates before making a safe repair.
This is particularly important for businesses that have developed useful internal applications without involving an IT specialist. An independent review can help establish what’s needed to support the application properly, including documentation, monitoring, backups and arrangements for future maintenance.
9. Inadequate backups and disaster recovery
An AI-generated application may have no reliable way to restore its data or resume operations after a serious failure. A working application isn’t necessarily a recoverable application.
Suppose your business has spent several months using an AI-built system to manage customer jobs. One morning, the database becomes corrupted.
You discover that backups were never configured properly, or that nobody has tested whether the information can actually be restored. You may have lost months of records.
Even where backups exist, restoring them can be difficult if the application depends on particular software versions, settings or external services.
For a business owner, the important questions are simple. How much information could we afford to lose? How long could we operate without this system? And do we know we can restore it?
The NCSC’s guidance on backing up business data (https://www.ncsc.gov.uk/collection/small-organisations-guide-to-cyber-security ) is a useful starting point.
A software review should also consider whether recovery arrangements are appropriate for the importance of the application.
10. Unexpected costs as the software becomes business-critical and legal liability when things go wrong
The initial cost of building software with AI can be very low, but hosting, maintenance, security, support and future development may cost considerably more than expected.
It’s easy to see why businesses are enthusiastic about AI coding. An application that might once have required a substantial development budget can now be prototyped for a fraction of the cost.
But the cost of creating the first working version isn’t necessarily the cost of owning the software.
You may subsequently need to pay for hosting, database storage, external services, security improvements, additional functionality and ongoing technical support. There may also be a cost associated with correcting problems in the original code.
Imagine a system that initially serves five employees but is eventually used by 50.
It might need significant changes to cope with the increased workload, more complex permissions and larger amounts of information. None of this means the original AI development was wasted.
In fact, you’ve already demonstrated that the application has a useful business purpose.
The sensible approach is to understand what you’ve built, what condition it’s in and what investment may be required before it becomes central to your operations.
Legal liability and responsibility when things go wrong
Using AI to create software doesn’t automatically transfer responsibility for the consequences of using that software away from your business. If your application exposes customer information, makes incorrect calculations or causes a service failure, you may still have contractual, regulatory or other legal responsibilities.
Exactly what those responsibilities are will depend on the circumstances.
Consider an AI-built application that automatically processes customer orders.
An error causes orders to be accepted at incorrect prices, while another fault exposes personal information. Your customers are unlikely to be particularly interested in which AI tool helped write the software. They will want to know what happened, what you’re doing about it and how you’ll prevent it happening again.
Depending on the incident, your business may also need to consider reporting obligations, contractual commitments and the potential involvement of insurers or regulators.
This is one reason why documenting development decisions, testing and independent checks is worthwhile.
A review won’t eliminate every possible liability. It can, however, help you identify risks, decide what action is needed and demonstrate that you’ve taken reasonable steps to assess the software before relying on it.
What should you do if your business is already using AI-generated software?
If your AI-built application is already in use, the sensible next step is to establish what risks it presents and whether any improvements are needed. You don’t necessarily need to stop using it or start again.
The level of concern should reflect what the application actually does.
A simple internal tool that reorganises non-sensitive information presents a different level of risk from a customer portal handling personal details or a system processing financial transactions.
Start by considering:
- What business activities depend on the application?
- What customer, employee or financial information does it handle?
- Who can access the software and its data?
- What happens if the application stops working?
- Who understands the code well enough to maintain it?
- Has anyone independently checked its security and reliability?
If you can’t answer some of those questions, that doesn’t automatically mean the software is unsafe. It means there are things worth investigating.
For applications handling sensitive data, payments or essential operations, we would recommend arranging a professional review rather than waiting for a problem to reveal itself.
What does an independent AI-generated code review involve?
An independent code review examines how your software has been built, identifies weaknesses and establishes whether it is suitable for its intended business use. At Evergreen Computing, we understand why businesses have embraced AI development. It can be a remarkably effective way to turn an idea into something useful. Our role isn’t to criticise the decision to use AI. It’s to apply the experience of professional software developers to the application you’ve created.
Depending on the system and the scope of the review, that can involve examining:
- Security and access controls
- How personal and commercially sensitive information is handled
- The quality and structure of the code
- External components and integrations
- Reliability and potential points of failure
- Testing, backups and recovery arrangements
- How easily the software can be maintained or extended
We can then explain what we’ve found in language you can understand, distinguish urgent problems from less significant improvements and recommend practical next steps.
Sometimes an application may need relatively modest changes. Other systems may require more substantial work before they’re suitable for business-critical use.
The important thing is to make that decision based on an informed assessment rather than an assumption.
You can find out more about our Independent AI-Generated Software Review and Code Audit here.
Frequently asked questions about AI-generated code
Yes. AI-generated code can be used safely in business applications when it has been appropriately designed, reviewed, tested and secured. The checks required depend on what the software does, the information it handles and the consequences if it fails.
Is software built using ChatGPT or Claude secure?
Not automatically. ChatGPT and Claude can produce useful, well-written code, but they can also introduce vulnerabilities or overlook important security requirements. An application should be assessed on its actual code, configuration and behaviour rather than the AI tool used to create it.
Does AI-generated software need a security audit?
Not every small application requires a comprehensive security audit. However, an independent review is particularly advisable when software handles personal data, payments, commercially sensitive information or important business operations. The scope should reflect the level of risk.
Can an experienced developer fix AI-generated code?
In many cases, yes. Professional developers can review AI-generated applications, identify weaknesses, improve security and make code easier to maintain. Whether changes are straightforward or extensive depends on the condition and complexity of the existing software.
Will I have to rebuild my AI-generated application from scratch?
Not necessarily. Some applications need only targeted improvements, while others may have deeper structural problems. A review helps establish whether the existing software can be improved economically or whether rebuilding particular components would be more sensible.
Who is responsible if AI-generated software causes a data breach?
Responsibility depends on the circumstances, including the organisation’s role under data protection law and its contractual arrangements. Using an AI coding tool does not automatically remove the organisation’s obligations. Businesses handling personal information should understand their responsibilities under UK GDPR and seek appropriate advice where necessary.
You’ve built something useful. Now make sure you can rely on it.
AI has opened up software development to businesses that might never previously have considered creating their own applications. We can see why for many that will be seen as a positive development.
But when software begins handling customer information, supports daily operations or influences financial decisions, it deserves the same professional scrutiny as any other business system.
If you’ve built an application using AI and you’re unsure what’s happening beneath the surface, we can help you find out.
Evergreen Computing provides independent reviews and code audits for AI-generated software, helping businesses understand the condition of their applications, identify potential problems and decide what needs attention.
Whether your software is already running or you’re preparing to launch it, we’re happy to have an initial conversation about what you’ve built and whether a review would be worthwhile.
Talk to Evergreen Computing before a hidden problem becomes a business problem.