FCA authorised · FRN 724952 0117 325 0027Quote & buy →
Aipedia: IT consultants and developers
Vibe coding a client app is not unlawful, but if you cannot explain or maintain what you shipped, meeting the reasonably competent developer standard becomes hard to show. That standard is what a client claim, and your PI insurer, will test.
Part of: AI in IT consultants and developers
In short
"Vibe coding" means building software mostly by describing what you want to an AI tool and accepting what it produces, with limited reading of the code. For prototypes it can be efficient. For paid client work, it creates risk: hidden security flaws, code nobody can maintain, and a weak position if the client alleges negligence. BCS clauses 2.1, 2.2 and 3.3 still apply, and the Software Security Code expects secure delivery. Technology PI usually responds to negligent work regardless of method, subject to the wording, but a defence is harder if you cannot explain your own deliverable.
A freelancer or small studio takes a brief for a booking app, internal dashboard or customer portal and builds it largely by prompting an AI tool, iterating on what appears on screen rather than on the code underneath. Delivery is fast and the demo looks good. The client pays, goes live and assumes the app was built in the normal way. The difference only becomes visible when something breaks, when another developer has to maintain it, or when a security review is done.
In a negligence claim, the question is whether you exercised the skill and care of a reasonably competent developer. No UK court decision has yet been found on liability for AI-generated code, so the standard will be argued from general principles and expert evidence. An expert is likely to ask whether you understood the architecture, whether input handling and authentication were reviewed, and whether you tested beyond the happy path.
The BCS Code of Conduct is directly relevant for members: 2.1 (only take on work within your competence), 2.2 (do not claim competence you lack) and 3.3 (accept responsibility for your own work). Offering a production app you could not have built or reviewed yourself sits awkwardly with all three. The voluntary Software Security Code of Practice sets 14 principles for software vendors and gives no exemption for AI-built software.
Illustrative scenario: a sole trader builds a membership app for a client by prompting an AI tool over a few weekends. It stores member details and takes card payments through a third-party provider. Access control was generated but never reviewed, and any logged-in user can view other members' records by changing an ID in the address bar. A member reports it. The client has to notify, rebuild and handle complaints, then claims the cost and lost revenue from the developer.
Even without a breach, maintainability can be the problem. If the client hires another firm that finds the code unworkable, the client may claim the cost of a rewrite as damages for defective work. See our guide to AI-generated code and coding assistant errors for the closely related issue of individual AI suggestions.
Technology PI policies are usually triggered by claims alleging negligence or breach of professional duty in your services, and most do not ask how code was written. A vibe-coded app is therefore not automatically excluded. The difficulty is evidential: a policy pays defence costs and damages if you are liable, but insurers and lawyers will need to understand what you built, and that is harder when the developer cannot explain it either.
Watch for exclusions around contractual guarantees, fitness for purpose and cyber events, which may apply where you promised a "secure" app. Answer proposal questions about your services accurately; if building apps for clients through AI tools is a material part of your work, tell your insurer. For a wider view, see does tech PI cover AI failures? and do web developers need PI?.
Apex arranges PI for developers and IT consultants. A broker reviews your cover and how your policy treats software built largely with AI tools. See our overview of AI in IT consulting.
Not in itself. Negligence depends on whether the result and your process met the standard of a reasonably competent developer. Shipping code nobody reviewed or understands, especially around security and data, makes that much harder to show. No UK court decision on this point has yet been found.
Usually the method of building does not by itself remove cover, as tech PI responds to negligent professional services subject to the wording. Exclusions for contractual guarantees or cyber events may still apply, and you should describe your services accurately to insurers.
Review and understand the security-critical parts yourself, run automated scanning and a basic penetration test, and document the architecture. Agree with the client what you are delivering and how it was built, and avoid promising that the app is secure or fully tested.
The BCS Code of Conduct does not mention AI. It does require members to take on work only within their competence (2.1), not claim competence they lack (2.2) and accept responsibility for their own work (3.3), which applies however the code was produced.
Tell us about your firm and the work you do. A broker will review how your current PI treats AI-assisted work, or arrange new cover. No fee for a quote. Or call 0117 325 0027.
Start a PI quote Request a callbackApex Insurance Brokers Limited is authorised and regulated by the Financial Conduct Authority. Registered in England and Wales, company number 07014570. This page is general information about how AI is used in the profession and how insurance may respond. It is not legal, regulatory or insurance advice on your circumstances, and it does not guarantee that cover will be available or on what terms.
