AI-generated code: which principles still apply to your software
A large share of code is no longer written by hand: AI agents write changes, open pull requests and fix bugs, often as “vibe coding” without close review. What does AI-generated code mean for a company commissioning a website or application?
What has changed
Reports from the open-source world say the number of code changes is rising sharply while the number of developers barely grows. A growing share of changes comes from agents, not people. Processes designed around a person carefully reading every line are reaching their limits.
In his October 2026 talk “Principles We Had to Abandon” (ITGorky conference), software architect Yegor Bugayenko described seven principles his team had to give up and what replaced them. We have summarised them and put them in context for clients.
The seven principles and what they mean for your project
| New rule instead of old principle | What this means for your project |
|---|---|
| 1. Comments in the code are unnecessary The code should explain itself, agents read it directly. | For your project, documentation remains essential. Whoever changes the application in three years must know what was built and why. |
| 2. Legacy code no longer exists Agents update dependencies and fix old bugs in a short time. | Helpful for maintenance and migration. For you it means a project still has to be updated regularly, otherwise security gaps appear. |
| 3. No human checks every change any more With hundreds of changes a day, checking becomes a formality. | For systems with customer data, invoices or payments, human sign-off remains necessary. It decides whether something is right, not just whether it runs. |
| 4. Politeness towards authors no longer applies Poor changes are rejected automatically. | Automatic limits, for example on the size of a change, make sense. But they do not replace your acceptance as the client. |
| 5. Tests become before-and-after snapshots Instead of readable test code, result files check inputs and outputs. | An advantage if your developer shows you these examples: you see concretely what has changed. |
| 6. Impact instead of lines You check what a change does, not the code itself. | Good for an overview. For login, payments and access to customer data, someone must still look at the code. |
| 7. The main branch may break Speed comes before stability, agents fix things quickly. | For a live website that is not acceptable. Development and live operation must be separate. |
How we work with it
We use AI assistants when writing code and take the benefits: faster delivery, less routine work. But the responsibility stays with us. Every change goes through version history, is checked before release and only then goes to the live site. We work the same way on our own website: development runs on a separate branch, and the live version is only built from a checked state. We review sensitive areas such as forms, login and data access by hand.
Four questions before you order
- Who checks the code? Name a person or a fixed process, not a phrase.
- Are there tests and backups? Without them you notice a fault only when the customer does.
- Who owns the source code? It must belong to you, with access to the version history.
- Who runs the software after handover? Settle this before the start, not afterwards.
Is AI-generated code secure?
Not automatically. It can contain bugs and security vulnerabilities just like hand-written code. What matters is human acceptance, testing and separate development and live environments, especially for forms, login and data access.
Discuss a web application
Are you planning your own application or a website? We explain the process, the review and the fixed price.
