AI can build it. It can’t answer for it.

AI can explain UK, EU and US data protection rules in general terms. It can’t tell you what your product has to do about consent, retention or access, because that depends on your data, your users and your sector.

• It sounds just as confident when it’s wrong as when it’s right
• It leaves no record of why a decision was made, which is the first thing an auditor asks for
• We write compliance requirements into the specification, so they’re agreed before anything is built

AI-generated code often works and is still unsafe. It can skip the checks that stop the wrong person seeing the wrong data, and nothing on screen tells you.

• Plausible code can miss input validation, access controls and secure defaults
• Pasting sensitive information into public AI tools can put it outside your control
• We specify security requirements up front and have the result independently penetration tested

45%of AI-generated code samples tested introduced a known security flaw.Veracode, 2025 GenAI Code Security Report [1]

AI learns from the web as it is, and most of the web isn’t accessible. Left to its defaults, it reproduces the same failures.

• Keyboard navigation, focus order and screen reader behaviour are rarely handled unless someone specifies them
• For public sector services, accessibility is a legal requirement, not a nice-to-have
• WCAG 2.2 AA is written into every specification we produce and tested during design and build

94.8%of the top million home pages had detectable WCAG failures.WebAIM Million, 2025 [2]

Large platforms have dozens of requirements pulling against each other: integrations, permissions, reporting, performance and years of existing data. AI only sees the part of the problem it’s shown.

• It solves the part it’s asked about, not the system around it
• It can’t hold every business rule across every part of the platform at once
• Trade-offs need someone who understands your commercial priorities and can explain the choice to your stakeholders

A product isn’t finished at launch. Quickly generated code tends to be repetitive and loosely organised, which makes every later change slower, riskier and more expensive.

• Duplicated logic means fixing the same problem in several places
• Code nobody on your side understands is code nobody can safely change
• A clear specification gives every future developer something to work from

8×increase in duplicated blocks of code during 2024, as AI coding assistants became widespread.GitClear, AI Copilot Code Quality research, 2025 [3]

An AI tool with access to your systems can make sweeping changes in seconds, including ones nobody asked for. On the projects we run, these safeguards are in place:

• We never give AI tools unsupervised access to live systems or production data
• Every change we make is reviewed by a member of our team before it’s released
• We use version control, separate test environments and backups as standard
• Every change we release traces back to a requirement you’ve signed off