AI built my website without coding! Yes, but...
5 minutes read · 12 September 2026You described your idea to an AI and, over two evenings, you got a website that displays, responds to clicks and genuinely looks like your project. That isn't an illusion: it works. The problem lies elsewhere, in everything a demo never shows.
Think of a house. The walls went up in two days and they are standing. Nobody has yet checked the foundations, the wiring, or the building permit. As long as no one lives in it, everything looks fine.
To be clear: I use AI every day, like 90% of developers according to Google Cloud's 2025 DORA report. So the question was never "a developer or an AI". It is: what happens the day your first customer types in their card number?
AI writes code. It doesn't sign off on the result.
What the measurements show
In 2025, security firm Veracode asked more than 100 different AIs to write the same kind of program. In 45% of cases, the result contained a security flaw that was already well known. The trend is the most revealing part: since 2023, the share of code that works correctly has risen from roughly 50% to 95%, while the share of genuinely safe code has not moved, staying around 50%. The AIs learned how to make things work, not how to protect them.
The same pattern shows up on speed: teams adopting AI deliver faster, but their outages increase. The report's conclusion is worth remembering: AI is an amplifier. It amplifies the rigour of an organisation that has some, and the gaps of one that doesn't.
The four risks a demo never reveals
1. Nobody is accountable
When you pay a professional, you buy two things: the work, and responsibility for that work. A quote, a warranty, insurance, someone to call. The terms of service of AI tools say the opposite, in plain sight: the output is provided as is, with no warranty, and using it is at your own risk. The most honest test: Saturday, 3 a.m., your data is no longer accessible. Who picks up the phone? Who gets the system running again?
2. Doors are left open
A generated prototype almost always works, and almost always leaves doors open. The password that unlocks your data is sometimes written in plain text inside the page, readable by any curious visitor. Or the "delete" button is hidden from customers, but the door behind it isn't locked: you only need to know its address. In 2026, a security firm catalogued close to 5,000 publicly accessible spaces built with these tools that held confidential data. None had been hacked: the data was in plain view for anyone who looked.
3. The fifth screen costs more than the first four
An AI handles the request it is given, screen by screen. It doesn't know your business as a whole: nobody described it. Take a booking system, the form works. But what happens if two customers book the same slot in the same second? If payment fails after the confirmation was sent? Those aren't technical questions, they are your operating rules. You settle them once at the start, or you pay for them later, with every addition.
4. The real cost starts after go-live
Writing the first version is the shortest and cheapest part. A website rests on hundreds of building blocks supplied by others, which need updating like the operating system on your phone. A project left for a year without maintenance isn't "stable": it is behind, and catching up gets billed. Then comes compliance: since 28 June 2025, European accessibility rules apply to online retail and booking services. Very small businesses have a reprieve until 2030, not an exemption.
Why I still work with AI
Rejecting AI would be the opposite mistake, and just as costly. In the hands of someone who can review the output, it changes a project's economics: testing an idea in two hours instead of two weeks, or documenting a project you have taken over. AI is an excellent doer and a poor adviser. It will never tell you "this feature is pointless".
The real comparison isn't "a developer versus an AI", it's "a professional using AI" versus "an AI nobody reviews".
Three situations, three right answers
- Throwaway mock-up, internal demo, no real data: AI alone, without hesitation. Don't pay anyone for that.
- Internal tool with no sensitive data, used by a team that can work around a problem: AI, then one day of technical review.
- Website exposed to your customers, with payments, personal data or part of your revenue: a professional who takes responsibility for the result.
Four questions to ask before going live
- "If the database disappears tonight, what do we recover and how long does it take?" Have a backup actually restored in front of you.
- "Can one customer see another customer's data?" Ask for a demonstration with two test accounts.
- "What gets checked automatically on every change?" If the answer is "nothing", every future fix is a gamble.
- "What if you are no longer available in a year?" Ask where the code lives, who has access, and what is documented.
AI removed the cost of the first draft, and that is good news, including for me. It removed nothing of what comes after: the trade-offs only you can make, the security nobody notices while it holds, the compliance, and accountability for all of it. If you're hesitating to put your prototype in front of customers, have it checked before the first incident.