AI is changing how software is developed. Tools can suggest code, explain unfamiliar systems, investigate defects and help developers work through tasks that would otherwise require considerable manual effort.
That creates opportunities, alongside questions about quality, security and accountability.
Our position is one of practical curiosity. Emerging technologies deserve investigation, and their value needs to be demonstrated through reliable results. Healthy scepticism helps us ask better questions, test assumptions and understand where a tool earns its place in the development process.
The aim is to use AI where it helps, with experienced people responsible for the decisions and the software delivered.
The opportunity: supporting more of the development process
AI-assisted development now extends well beyond code completion.
Tools such as GitHub Copilot provide assistance within established development workflows. Cursor offers capabilities for understanding a codebase, planning changes, fixing defects and reviewing work. Claude Code can work with project files and development tools to carry out broader coding tasks. Cursor documentation, Claude Code documentation.
These capabilities can support several parts of a project: exploring an unfamiliar area of code, drafting a routine implementation, suggesting test cases or preparing documentation.
For a developer, this can provide a useful starting point and reduce repetitive effort. It can also make it easier to investigate alternative approaches before committing to a design.
The benefit depends on the task, the context available to the tool and the effort needed to verify its output. A quick first draft only saves time if the resulting work is correct, understandable and maintainable.
The challenge: convincing output still needs verification
AI-generated code can look plausible while misunderstanding the requirement.
A suggested change might work for a simple example but fail when it encounters account permissions, unusual data or an established business rule. It may introduce unnecessary complexity, use an unsuitable dependency or overlook a security concern.
AI-assisted reviews have limitations too. GitHub’s responsible-use guidance identifies the possibility of inaccurate suggestions and recommends reviewing generated findings before acting on them. GitHub’s guidance on responsible use of agentic features.
This is where scepticism becomes useful. Developers need to challenge the assumptions behind an answer, inspect the changes and establish whether the behaviour matches the requirement.
Confidence in the wording of a response is not evidence that the implementation is correct.
Human oversight: understanding what is being delivered
Effective oversight starts before code is generated.
People still need to establish the business requirement, choose an appropriate architecture and decide what a successful result looks like. Clear instructions help a tool work within those decisions, but they do not transfer responsibility for them.
Once changes are proposed, developers need to understand how they work and how they affect the wider system. Review should cover maintainability, security, integration behaviour and the relevant business rules.
Testing remains essential. AI can help draft tests, but those tests also need scrutiny. If an implementation and its tests share the same mistaken assumption, passing tests can give false reassurance.
Validation should therefore draw on agreed requirements, existing regression checks and realistic scenarios. Someone must be able to explain why the change is appropriate and what evidence supports releasing it.
Governance: giving teams clear boundaries
Proper governance turns individual experimentation into a controlled development practice.
Teams need to know which tools are approved, what information can be shared with them and what actions they are permitted to perform. That includes understanding how a provider handles submitted code and data, along with the settings and contractual arrangements that apply.
Access also needs to reflect the task. A tool assisting with a code change should have only the permissions it requires, with clear approval points for consequential actions.
Changes should remain traceable through version control, review and release processes. Responsibility for accepting the work should be explicit, including when AI has contributed to its implementation or review.
These controls support informed use of the technology. NIST’s AI Risk Management Framework provides a useful reference for governing, assessing and managing AI-related risks. NIST AI Risk Management Framework.
Evaluating emerging tools in practice
A sensible approach is to begin with bounded tasks whose results can be inspected and tested.
Documentation, focused refactoring and clearly defined fixes can provide opportunities to assess how a tool performs within an existing workflow.
Evaluation should consider the whole task: time spent providing context, reviewing changes, correcting mistakes and confirming the result. Quality and maintainability matter alongside speed.
Tools should also be reassessed as they evolve. New capabilities may create useful opportunities, while changes in behaviour, permissions or data handling may require different controls.
A willingness to experiment works best when paired with a willingness to reject an approach that does not meet the required standard.
What this enables
Used thoughtfully, AI assistance can reduce routine effort, support investigation and help developers explore solutions.
Its value depends on the development practice around it: clear requirements, experienced judgement, meaningful testing and accountable decisions.
We remain open to emerging technologies because they may improve how we deliver software. We remain sceptical because those improvements need evidence.
That balance provides a practical route forward: pursue useful tools, understand their limitations and keep people responsible for the quality of the result.