Vibe coding has quickly evolved from an experimental process to a mainstream trend, becoming Collins Dictionary Word of the Year in 2025. In fact, 41% of all global code is now AI-generated, and will reach 60% by the end of 2026 – and 84% of developers now use or plan to use AI coding tools.
High potential across industries
Vibe coding shows promise across already delivering across many core industries. This spans right the way from healthcare providers using vibe coding to accelerate the design of patient portals, claims systems and wellness apps, to financial services organisations exploring use cases for risk reporting, onboarding systems and compliance tasks.
The appeal is clear. Delivery cycles are much faster as AI can handle the bulk of the initial implementation. Developers can focus on higher-value tasks such as system architecture, product strategy and creative problem-solving. Costs fall because teams can move from concept to prototype more quickly.
For employees, vibe coding opens the doors for different teams to unleash ideas and innovate faster. This means software engineering teams don’t always need to be involved. Almost two-thirds of vibe coding users are non-developers, with platforms like Replit noting that 75% of their users never write a single line of code.
This democratization is driving a shift from the traditional Software Development Life Cycle (SDLC) to an Agentic Development Life Cycle (ADLC), where AI agents dynamically generate, edit, and deploy code in fluid environments. Yet the speed of this shift has created pressure for enterprises, as vibe coding is not inherently enterprise-ready. While enthusiasm is high, maturity is not.
Anticipating the risks
Vibe coding can introduce serious risks around quality, security and maintainability. AI-generated code may contain hidden bugs, inefficient logic or patterns that don’t align with organisational policies. It can also introduce security vulnerabilities stemming from hallucinations, outdated libraries or missing validation steps.
Prompts that aren’t tightly controlled may even expose user login credentials or other sensitive information, as some AI agents routinely hardcode API keys and database passwords directly into source code. The operational stakes are remarkably high; in July 2025, an AI agent deleted a company’s entire production database containing thousands of records during a code freeze, then fabricated test results to cover the loss. Generating applications without understanding the underlying code creates immense compliance and data protection risks under frameworks like UK GDPR, particularly if data is handled without proper privacy-by-design principles or access controls.
Organisations need an approach grounded in governance and solid engineering principles. Four steps are now emerging as the basis for an enterprise-ready vibe coding model.
- Begin with clarity and structure
Vibe coding begins with well-defined intent. The quality of the prompt is closely tied to the output it generates. Organisations should avoid asking models for everything at once. Instead, they should define the purpose of the code, the users it will serve, the constraints it must follow and the use cases it will handle. Breaking tasks into smaller increments also helps to ensure the AI generates more accurate code outputs.
Prompts should therefore be viewed as concise engineering briefs, containing relevant context, constraints and examples. To ensure maintainability, enterprises should treat these natural language specifications as durable, versioned source code, effectively “compiling” them down into implementation code via AI agents. Before deploying an agent, organizations should also establish clear “Digital Job Descriptions” that define its exact authorized actions, data sources, and decision boundaries.
- Iterate deliberately and refine through feedback
When treated as an iterative process, vibe coding is far more efficient. Users shouldn’t expect a perfect result on their first attempt. Rapid feedback loops enable users to review early outputs, test their assumptions and redefine constraints as necessary. This pattern creates reliable, reusable, repeatable prompts and templates. It also identifies where AI models perform best and when stronger human intervention is needed.
. A crucial element of this refinement is embracing a multi-generational workforce; younger developers excel at rapid AI prompting and adapting to new workflows, while senior developers must be integrated to provide the essential security, architectural, and governance expertise needed to safely scale these outputs.
- Keep humans in the loop
Humans are an essential part of the process. Vibe coding doesn’t negate the need for developer expertise. Developers should therefore treat AI outputs the same as work produced by a junior team member. To achieve this at scale, organizations should implement formal, tiered oversight models: Human-in-the-Loop (HITL) to explicitly approve critical decisions (like database changes or financial transactions), and Human-on-the-Loop (HOTL) for monitoring routine, lower-risk tasks where the agent operates autonomously but can be interrupted. Careful documentation of the codebase is critical to ensuring future teams can understand the logic behind AI-generated outputs.
Keeping humans in the loop will be vital as vibe coding continues outside of IT. There must be clear pathways for reviewing work from non-technical innovators, ensuring it’s integrated into production safely. Without this approach, organisations risk a sprawl of ungoverned applications that are difficult to support.
- Embed engineering discipline and governance
Vibe coding must be embedded within existing engineering and governance frameworks, with AI-generated code filtering through the same pipelines as human-written code. Built-in security and validation are vital alongside manual checks. This must include implementing robust Identity and Access Management (IAM) with dynamic, ephemeral credentials specifically designed for autonomous AI systems, as well as emergency “kill switches” and rollback capabilities to immediately halt rogue agents. Enterprises also need robust version control, continuous integration and continuous delivery (CI/CD) pipelines, automated tests, static analysis, and real-time observability.
Governance and engineering disciplines must also be extended to include prompts and data used for code generation. When evaluating coding platforms, enterprises should prioritize tools equipped with comprehensive AI governance, such as those carrying ISO/IEC 42001 certification, to ensure regulatory compliance.
Becoming an enterprise-ready component
Vibe coding is moving quickly: some startups have codebases that are almost entirely AI-generated, while larger enterprises will follow a more gradual path. Enterprises just need to balance speed and immediacy with the necessary discipline and governance: clear prompts, iterative refinement and human oversight. Starting with low-risk projects gives businesses room to learn, deliver safe, quick wins and pave the way for broader, enterprise-ready adoption. As confidence grows, vibe coding can scale safely into more critical workloads and become part of modern software development.
