AI Software Development: What AI Does for Code
· DigifyNow
At DigifyNow, AI software development means two things. First, a language model drafts code, tests and migrations, and a developer reviews every draft before it reaches the main branch. Second, we build AI features into software via API, with a fixed JSON schema for responses, human approval before consequential actions and protection against prompt injection. Ask any vendor who reads the generated code and who is responsible for dependencies, rights and operations.
How does DigifyNow approach AI software development?
With us, AI writes drafts, and a human stays responsible for the code. The model helps most with repetitive work: forms, database migrations, test cases, translating UI text and documentation. We don't let the model decide permission and role models, payment logic or architecture. Those are the areas where an unnoticed mistake costs the most. Here's how the workflow runs:
- The task is written up as a ticket with acceptance criteria before a model writes a single line.
- The model works in its own branch, never directly on the main branch.
- Every push triggers automated tests and a linter in the CI pipeline.
- A developer reads every diff in the pull request. Anything they can't explain doesn't get merged.
- We check every new dependency in the package registry: Does the package actually exist, is it maintained, and what license does it use?
There's also a legal question. Copyright protects works created by a human. Whether purely machine-generated code qualifies is not settled. That's one more reason a person should actually shape the code rather than just wave it through. Who receives the usage rights is something we spell out explicitly in the contract.
If your team uses AI tools, you are generally a deployer of an AI system under the EU AI Act. In its current, amended version, the regulation requires providers and deployers to take measures that support the development of AI literacy among their staff. It does not require the company to guarantee a specific level of competence for each individual. In practice, that means anyone working with a coding assistant should know the failure patterns in the next section. That's exactly what our AI coaching for teams covers.
Why does AI-generated code fail in practice?
AI-generated code usually looks plausible, and that's exactly what makes it dangerous. The bugs don't show up when you click around; they show up under load, during an attack or after the next update. These are the failure patterns we keep seeing in projects and code reviews:
- Made-up packages: The model references libraries that don't exist. Attackers deliberately register those names on npm or PyPI. This is called slopsquatting.
- Outdated APIs: Training data has a cutoff date. So the model uses methods that have already been removed in the current version of a library.
- Missing authorization: An endpoint checks whether someone is logged in, but not whether they're allowed to see this specific record. The OWASP API Security Top 10 lists this as Broken Object Level Authorization.
- Keys in the code: API keys in frontend code end up in every user's browser or app.
- Too little context: The model only sees a slice of the project. The same logic gets built twice and drifts apart over time.
These bugs hit hardest in apps that were fully generated and shipped without review. What that means for the App Store and for database rules is covered in our article Build an App with AI: What Works, What Doesn't.
How do you safely build AI features into your own software?
An AI feature is a call to a model through an API. The rest of the software has to be able to process the result, and free text isn't enough for that. Here's our technical approach:
- The output is defined by a JSON schema and validated on the server. An invalid response is discarded, not stored.
- Tools get only the permissions they need. Write actions such as sending, booking or deleting go through human approval.
- Content from emails, PDFs and web pages is treated as untrusted, because it can contain hidden instructions to the model. The OWASP Top 10 for LLM Applications lists this prompt injection as a risk of its own.
- Every model response is logged together with the model version so errors can be traced later.
- There's a fallback for API outages or unusable responses, such as routing the case to a staff member.
A model isn't worth it when the rule is clear-cut. If you can write the logic down as an if-then condition, regular code is deterministic, testable and doesn't cost a fee per call. How a single call turns into a workflow with multiple tools is explained in How to Build an AI Agent: Steps, Limits and Failure Points. For examples from sales and customer service, see AI Agent Examples: What Works for Small Businesses.
If your software generates text, images, audio or video for users, the transparency obligations of the EU AI Act come into play: synthetic content is supposed to be recognizable as artificially generated. For systems that were already on the market, the amended version provides a transition period, and the high-risk rules only kick in later, depending on the use case. On the technical side, we leave room in the architecture for labeling outputs, for example a metadata field and a notice in the interface. Whether your software is covered, which deadline applies to it and what labeling is sufficient is an individual legal question for your legal counsel to answer.
What does software development involve, in a nutshell?
Software development is the entire path from a business requirement to a program that runs in production and gets maintained. Programming is only one part of it. A typical project has these phases: requirements analysis, concept and data model, implementation in short sprints, testing, acceptance and operations. Under a German contract for work (Werkvertrag), acceptance carries legal weight: it usually triggers payment and starts the warranty period. Many clients underestimate ongoing operations. Apple and Google release new OS versions regularly, libraries get security updates, certificates expire. Software without maintenance becomes outdated even if nobody touches it. At DigifyNow, a project usually starts with an MVP, a first usable version that covers only the core workflow and can be built in weeks instead of months. How long your project takes depends on scope, integrations and the state of your data; we work that out in a free, no-obligation assessment of your project. One example from our work is the custom back office with CRM for Mundo Marketing. How phases, sprints and acceptance work in detail is covered in Custom Software Development: How a Project Runs.
What to look for in a software development agency in the Westerwald
Being nearby saves time for on-site workshops and process mapping. But it tells you nothing about code quality. DigifyNow is based at Grenzweg 9a in Unnau. Jesper Schmidt, Christian Schiebl and Miles Pandel work across Germany, with most projects in the Westerwald, Koblenz and the Siegerland. Whoever you talk to, any agency should be able to answer these questions:
- Who writes the code: their own team or a subcontractor the work gets passed on to?
- Where does the repository live, and what usage rights to the source code do you get on acceptance?
- How does the agency use AI, and who reviews the generated code before it's merged?
- Where is the software hosted, and who installs updates after launch?
- Are there published projects you can try out yourself?
For that last point, you can install our party game app Festino from the App Store and Google Play, a product of DigifyNow. The towns we serve in the region are listed under software development in the Westerwald. If an agency dodges the question about rights to the source code, that's a red flag, no matter how close by they are.
Frequently asked questions
Will AI replace software developers?
No. AI generates code faster than a human, but it doesn't check whether that code fits the task, is secure and works with the rest of the system. Clarifying requirements, defining the architecture, doing reviews and owning operations remains human work. What changes is the split: less typing, more reviewing and deciding.
Is it okay to paste company code or customer data into an AI chat?
That depends on the provider's terms of use. Some consumer versions may use your inputs for training; business plans often rule that out contractually. If personal data is sent to a model provider, you generally need a data processing agreement. Whether that's enough in a given case is something your company has to assess itself.
Who owns code written by AI?
Copyright protects works created by a human; whether purely machine-generated code qualifies is not settled. That's why the contract with the agency is what matters. It should state which usage rights you receive to the entire source code, whether it was written by hand or with AI.
Does AI-assisted development finish a software project faster?
Writing the code goes faster; coordination, testing and review take as long as before. AI saves the most time on forms, migrations and test cases, and hardly any on permission models or integrations with legacy systems. An MVP that covers only the core workflow is doable in weeks instead of months; a firm date only exists once scope, integrations and the data situation of a specific project are clear.