AI-generated code: risks for security, legality and compliance in companies

Nearly half of companies use AI-generated code in production

A Flux survey reveals that 48% of engineering organizations use AI-generated code in production environments, despite concerns about security, compliance, and legality. The majority of companies (95%) already employ AI in software development, with only 5% not planning adoptions within a year.

Quick Answer

Adoption varies based on task criticality

Organizations initially adopt AI for repetitive tasks such as documentation writing, unit test creation, and simple function implementation, where errors are easily detectable and correctable. Adoption decreases as the potential consequences of errors increase.

AI accelerates development but does not reduce errors

85% of current AI users report increased productivity and faster prototyping. However, only 30% of teams using AI-generated code observe a reduction in errors, despite nearly half of non-adopters expecting this benefit.

Overlapping layers of protection before production

Ted Julian, CEO of Flux, observes that between code generation and deployment, there is a pattern of adding multiple safeguards. More cautious organizations adopt code quality analysis tools (60%), software composition analysis (55%), and specific training (50%) more frequently. Production teams show more widespread use of automated code review.

The challenge of code review

Code review already consumes a third of developers' working time, with 10% dedicating over 40% of their time to this activity. AI-generated code, often structured differently from traditional code, further slows down the review process.

Problems of visibility and critical changes

While the majority of leaders (65%) claim to be able to track weekly changes, 30% admit having difficulties. The most dangerous changes—security modifications, dependency shifts, and performance impacts—are also the hardest to detect.

The impact on junior developer learning

42% of organizations report that AI use reduces learning opportunities for junior developers. This impact is more pronounced in organizations with fewer than 50 developers (31%) compared to larger ones (44-46%). Ted Julian emphasizes the importance of developing new skills to manage AI agents and keep traditional senior development skills relevant.

Investments in security and compliance tools

Companies are increasing investments in code quality analysis tools (45%), automated review (40%), static and interactive security testing (35%), and software composition analysis (30%). Over 80% of organizations have modified their development and release processes to adapt to the adoption of AI-generated code, primarily through new policies, mandatory training, and more rigorous code reviews.

The bet on AI to solve problems created by AI

65% of respondents believe that AI can outperform humans in code review in at least some aspects. 76% would appreciate tools that reduce the risk associated with AI-generated code. Organizations are heavily investing to discover if more AI can actually solve the problems created by the initial adoption of AI in software development.

Implications for security and compliance

The widespread adoption of AI-generated code presents significant challenges for security and compliance teams. The lack of visibility into critical changes and the potential reduction of learning opportunities for junior developers can compromise software security and compliance with industry standards.

Organizations must balance the productivity and speed benefits offered by AI with the implementation of robust safeguards and review processes. The ability to track and understand changes in the code, especially those related to security and performance, is crucial to preventing costly incidents.

At this point, companies are experimenting with different combinations of tools and processes to find the optimal balance. The future of AI-generated code appears promising, with experts predicting significant advances in the ability of AI tools to understand business context and generate code that not only works technically but also aligns with the organization's strategic goals.