AI is noticeably changing software development. Vibe coding can turn ideas and prototypes into functional applications within a short period of time. At the same time, development teams are using Large Language Models specifically to analyze, enhance, or technologically modernize existing software more quickly.
Both approaches open up new possibilities. However, functional code alone does not constitute a robust software solution. At the latest, once applications are used in production or customer and company data is processed, clear rules, technical guardrails, and people who can professionally assess the results are required.
When Speed Needs to Become a Production-Ready Solution
Vibe coding lowers the barrier to software development. Business departments can create initial applications, interfaces, or process ideas without having to program every technical detail themselves. This can be particularly valuable for prototypes and clearly defined internal use cases.
Architecture, permissions, data storage, and operations are relevant from the outset for any production business application. With vibe coding, however, there is a particular risk that a rapidly created prototype may be put into production before these fundamentals have been sufficiently clarified and implemented.
Regardless of the development method, it therefore needs to be defined who may access which data, how changes are tested and approved, how backups and updates are managed, and who assumes long-term technical responsibility for the solution.
The same principles apply when an LLM is used within a professional development project. This does not necessarily mean building an entirely new application. AI often supports the development of individual components, the analysis of existing systems, or a technical migration. Here too, results may initially appear convincing while still failing to fit the existing architecture, interfaces, or business requirements.
AI-assisted development therefore requires defined requirements, development standards, testing and approval processes, and clear responsibilities, regardless of the specific approach.
Data and AI Environments Must Fit the Use Case
Particular attention is required whenever customer, project, or company information is processed. This is not limited to conventional production data. Source code, error messages, technical documentation, configurations, or repository structures may also contain confidential information.
In a current customer environment, AI systems specifically provided for that customer are therefore being used. These environments have been reviewed and approved with the heightened requirements for data protection and information security in mind. Sensitive information is therefore not transferred in an uncontrolled manner.
In addition to technical and contractual approval, model selection is also critical. The most powerful LLM is not automatically the best choice. The model needs to fit the specific task and deliver sufficiently good results for the particular use case.
A very large model may even be unnecessarily complex for a clearly defined task. A smaller model may deliver comparable quality while operating faster and generating lower token and operating costs. Meaningful model selection therefore considers output quality, runtime, costs, data protection, and the specific business purpose together.
Practical Example: Analyzing and Modernizing Existing Source Code with AI
Two current migration projects illustrate how far AI-assisted development can already go. The starting point is a set of extensive repositories for an existing integration solution, with development states distributed across several branches.
The first challenge was to download the repositories automatically and analyze their structure. The AI had to identify which components existed in which branches and where the respective current development state could be found. To do this, branches, commit timestamps, and the components they contained were systematically compared.
The resulting overview then had to be compared with the artifacts actually running in production. Only then was it possible to reliably determine which version should serve as the basis for the subsequent migration.
In the next step, the existing development results are converted into native Java source code. The LLM supports this process iteratively: it generates code, reviews results, makes corrections, and gradually improves the implementation.
This example in particular demonstrates why AI is not a substitute for engineering experience. The model can analyze large amounts of code and metadata more quickly and accelerate technical implementation. However, the generated results are continuously reviewed and professionally assessed by the responsible developers.
Human oversight already begins with the task definition. Without precise instructions, many models tend to generate unnecessarily complex solutions. It therefore needs to be clearly specified which requirements apply, which architectural patterns should be implemented, and how the generated code must fit into the existing solution. Only through this professional guidance, iterative review, and targeted refinement can an AI-generated proposal become a robust and maintainable solution.
Good Results Require Experience and Reliable Reviews
An LLM can generate code, analyze dependencies, and propose technical approaches. However, it does not automatically understand all business relationships, historical architectural decisions, or the impact a change may have on production operations.
Code reviews, testing, and controlled approvals therefore remain indispensable. AI-generated results must do more than work syntactically. They must also be understandable, maintainable, secure, and compatible with the existing system landscape.
This is where collaboration between colleagues with different levels of experience and different perspectives proves valuable. Technical expertise, architectural understanding, project experience, and confident use of new AI tools complement one another. This makes it possible to exploit new opportunities more quickly without losing sight of risks and their potential impact on production operations.
This combination already provides the basis for successfully developing solutions and operating them over the long term. AI expands the team's toolkit, but it replaces neither expertise nor responsibility.
Logging Makes AI Usage Measurable and Traceable
Clear structures do not end with development. The ongoing use of an LLM should also be technically traceable and measurable.
In another customer use case, the content of incoming emails is passed to a locally hosted LLM. The model creates a summary and returns predefined attributes in a structured JSON format. This information can then be processed automatically by the existing application.
For each request, the input sent to the LLM, the model's response, the number of tokens consumed, and the runtime are logged in an SQL table. This makes it possible to analyze model usage in detail using conventional SQL queries.
For example, average runtimes can be calculated, developments can be monitored over longer periods, or the length of the input can be compared with the corresponding token consumption. Unusual responses, exceptionally high token usage, or longer processing times can also be investigated specifically.
The business quality of the results is additionally assessed by service employees. Experience shows that human feedback can be biased without clear criteria, even when the AI delivers professionally sound or, in some cases, better results. Reliable evaluations therefore require clear standards, appropriate work instructions, and suitably prepared staff. Technical metrics and human feedback should always be considered together with the objectively correct results.
Logging therefore provides more than traceability when errors occur. It creates a foundation for evaluating the performance, costs, and output quality of AI usage and for adjusting the selected model where necessary.
Human expertise remains essential here as well. Specialists need to identify which deviations are relevant and how the logged information can be analyzed meaningfully. They can investigate the logs themselves using SQL and other analytics tools, or pass suitable extracts to an AI system for controlled analysis. AI can make patterns visible. The final assessment and any decisions about necessary measures remain with people.
Information Security as Part of the Development Process
As an ISO/IEC 27001-certified company, COViS operates within an established Information Security Management System (ISMS). We bring this experience into customer projects so that AI applications are not considered in isolation but embedded in a controlled organizational and technical framework. Having an ISMS does not replace legal or project-specific assessments, but it supports a structured approach to risks, responsibilities, and approvals.
For AI to be used securely in customer projects, technical capabilities and protection requirements need to be considered together from the outset. The decisive factor is not only which model is suitable from a functional perspective, but also what information is processed, how sensitive it is, and which AI environment is permitted for that purpose.
Information is first classified and the service to be used is selected based on that classification. Customer data and other particularly sensitive information require explicit approval as well as clear rules regarding access, storage, logging, and retention periods. Monitoring, protection of credentials, handling of security incidents, and long-term maintenance of the solution must also be defined before production use.
AI-Assisted Development Needs Clear Guardrails
Vibe coding and the professional use of LLMs can significantly accelerate development processes. AI can help create new applications faster, analyze complex repository structures, support technical migrations, and automate existing business processes.
Turning these capabilities into robust solutions, however, requires more than a powerful model. Clearly defined requirements, suitable architectural patterns, an appropriate and approved AI environment, and model selection that balances quality, speed, and cost are essential. Traceable logging and clear criteria for evaluating technical and business results are equally important.
People remain the decisive factor. Experienced developers need to guide AI precisely, continuously review its results, and recognize when unnecessary complexity or technically unsuitable solutions arise. Assessments by employees should also follow clear and consistent criteria and be compared with professionally validated reference results. This makes it possible to distinguish between feedback caused by an actual AI error and feedback based primarily on subjective judgment.
The combination of experience, emerging talent, and suitable AI tools creates the foundation for developing and enhancing software more quickly without losing sight of security, maintainability, and quality.
