How enterprise CIOs can scale AI coding without losing control

How fast should we go with AI?

That’s the bottom line of many discussions around AI in 2025, whether among politicians, academics or business leaders. It’s also the question we’re asking on the front lines, where AI is being woven into real-world software development workflows with the new wave of AI coding assistants.

Many of the world’s largest software companies expect 30 percent or more of their code to be AI-generated in the future using these tools. They could, in theory, add $3 trillion to global GDP if they could double developer productivity. Speak to developers and they’ll sing the praises of these tools and, much like with prominent generative AI models, it’s now hard to remember what work was like without them.

It’s no wonder, then, that CIOs, CTOs and CAIOs are under intense pressure to embrace AI-assisted coding — and fast. In fact, most already are, and few are looking back: Recent IDC research found that over 60% of organizations report widespread use of AI coding assistance and fewer than 1 in 50 organizations plan to reduce their use over the next 12 months.

While this enthusiasm is deserved, we risk getting ahead of ourselves. Many are now experiencing some variation of an “acceleration trap” — where fast adoption without the proper trusted guardrails can create a net negative outcome.

The real task for technology leaders in the AI age will be building the guardrails that allow your organization to accelerate over time — instead of crashing out after a fast start. As these tools become widespread, we believe the edge in AI-powered software development will be in the systems designed around the tools, which ensure security, privacy and reliability, rather than the tools themselves. Nowhere will this be truer than in the future AI-powered enterprise.

Why we’re feeling the ‘vibe’

It may surprise some readers the extent to which the global EY organization is in the software business. Of our more than 400,000 professionals worldwide, over 70,000 are involved in software, AI and data, whether building digital products for clients or advancing our own internal transformation program known as Client Zero. Suffice to say, any tools that promise to revolutionize these kinds of roles are of major significance to our business. It’s also a core part of being a Frontier Firm in AI.

Since the initial release of GenAI models, the firm has been piloting the ‘vibe coding’ approach with the full gamut of AI coding assistants — from the most widely-usedenterprise standards to emerging startups. Each tool goes through a rigorous evaluation: small-scale pilots, developer feedback, certification for compliance and data security, then scaled testing across hundreds or even thousands of engineers.

The benefits are already showing in pilots we are doing. We’ve seen developers who once relied on senior peers for close collaboration (i.e., peer programming) now tackle complex builds mostly independently with review at the end. Test generation, a task that often slips down the priority list, can be completed far more comprehensively as it’s easier to do and there’s more time to do it. Lower-priority bug fixes that used to linger can be handled quickly, leaving engineers free to focus on design and architecture.

Across our software development lifecycle (SDLC), from requirements gathering and design to testing and deployment, we can see consistent productivity gains in these pilots. Tasks that would have taken days are done in hours, features that would have taken hours can be done in minutes. As one EY engineer put it, “once you’ve worked with one of these tools, you don’t want to go back — it’s like having a brilliant junior sitting beside you who never gets tired.” IDC’s latest enterprise survey told the same story, with 89 percent of developers reporting tangible productivity boosts and a 35 percent average increase in output.

The ‘acceleration trap’

But as with most breakthroughs, there’s a catch. The same tools that are redefining how we build software can also introduce major new risks. Any engineers who have used these tools will know what I mean, but a raft of new research comprehensively makes the case.

For example, in large-scale field studies, teams using AI support completed tasks 25 percent faster and produced 40 percent higher-quality output — but only when they were working inside what the researchers call the model’s “frontier” (i.e., the scope of tasks where it is effective). Step outside that comfort zone (e.g., into unstructured, high-context or novel problems) and performance actually decreased. It’s a “jagged frontier,” where knowing when and how to lean on AI becomes as crucial as knowing how to code.

Another study also proved the point: participants using coding assistants wrote less secure code in 80 percent of tasks, yet were 3.5 times more likely to believe it was secure.

Enterprises aren’t startups and guardrails aren’t friction

The stakes are higher in the enterprise than the startup. When we hear that a quarter of Y Combinator’s latest crop of startups have almost entirely AI-generated codebases, we shouldn’t think this is achievable, or even desirable, for a more mature organization. For the enterprise, guardrails aren’t friction — they’re the new accelerators.

Think of it like self-driving cars. You wouldn’t test one for the first time in the middle of San Francisco’s rush-hour traffic. You’d start it on a quiet street, with a human at the wheel, learning its limits before scaling to highways and city grids. The same logic applies to AI assistants inside an enterprise like EY — complex systems, legacy code, compliance frameworks and global data obligations mean the stakes are higher and the obligations more complex.

That’s why our approach to ‘vibe coding’ starts with guardrails before the gas pedal. It’s not about slowing innovation, it’s about scaling it responsibly — and ensuring we can sustainably move at speed. Every pilot embeds governance and human oversight from the start. AI may generate the code, but humans architect the intent, validate the logic and decide when it’s fit to ship.

• Prompt hygiene and engineering: Developers are trained to write precise, secure prompts, guiding the AI to generate compliant, context-aware code rather than plausible guesses. Prompt playbooks are emerging too: standardized libraries of proven prompt patterns that embed security and quality checks directly into the request. Just as important, pilots enforce strict rules on what data can be included in prompts. These measures ensure consistency and protect confidentiality across teams and geographies, a critical factor when hundreds of engineers are prompting in parallel.
• Data governance: Every interaction between a developer and an AI tool must respect encryption, privacy and explicit consent rules. Enterprise-grade AI coding needs to be fully compliant. This isn’t just best practice, it’s an imperative in large enterprises.
• Upskilling and educating teams: Many users, even experienced developers, can underestimate the risks of using these tools. Industry-wide, this has led to outages, compliance breaches and costly rework. Bridging that gap requires training, validation and cultural change. Developers must learn to treat AI not as a substitute for engineering judgment, but as an amplifier of it.

And increasingly, AI itself is helping us build these guardrails. For example, enterprise-grade copilots can enforce rules automatically: If AI is developing a feature, it only touches the files associated with that feature, never critical components. They can also require that every new piece of code comes with unit tests, reducing the risk of untested changes slipping through. Even naming conventions and framework standards can be embedded into the AI’s instructions, ensuring consistency across large, distributed teams.

What an engineer looks like in 2030

AI coding assistants aren’t a novelty anymore, they’re set to reshape how teams work, learn and collaborate. Tasks that once required long pair-programming sessions between junior and senior developers could now be handled by a developer working with an AI assistant. The result is a more democratized kind of engineering. Mid-level developers can now prototype ideas or debug issues that once required senior time. It’s not replacing expertise, but it is redistributing it.

Still, this kind of human–AI collaboration comes with trade-offs. Overreliance on AI can dull the fundamentals you can only learn when writing code by hand. “You can lose your skills if you use AI too much,” one of our developers admitted. “You get a bit rusty.” But on the flip side, engineers who might once have been blocked for weeks by a technical barrier can now solve problems in hours. “It’s an enabler – you’re no longer stuck. You can ship something yourself instead of waiting for your manager or a senior engineer.”

Clients are already asking the next question: what does the software engineer of the future look like? The broader community is working through that question. We think the future engineer is more like a generalist orchestrator: someone who understands business context and design principles as well as code.

The rise of vibe coding will make software creation more intuitive, more accessible and more creative. It’s a historical shift, like the arrival of high-level languages or the cloud – one that will make us more efficient, even if it forces us to redefine what being a software engineer means. The challenge for a firm like EY, and for every enterprise, will be ensuring that as AI becomes more capable, we ensure it stays “on the rails”.

3 takeaways

If you’re deciding how to scale AI coding in your organization, here are three principles that matter:

1. Map out the “jagged frontier.” AI is powerful, but not everywhere. It excels at routine, well-defined tasks and struggles with complex, ambiguous ones. CIOs need to map where AI adds value and where human judgment remains critical. The winners will be those who build processes that combine both, and letting AI handle repetitive work while humans focus on strategy, architecture and innovation.
2. Guardrails are an accelerator. In the enterprise, governance isn’t bureaucracy, it’s what keeps AI on track. Clear guardrails mean fewer surprises, less rework and faster scaling. Think of them as the rules of the road that allow you to drive faster without crashing. Invest early in standards, oversight and education, and you’ll unlock sustainable velocity instead of short-lived gains.
3. AI is a marathon, not a sprint. The question “How fast should we go?” is really about endurance. A sprint approach (rushing adoption without trusted guardrails) leads to long-term risk. A marathon mindset means pacing your rollout, embedding governance and building cultural readiness. The goal isn’t just early wins, it’s compounding gains over years.

The rise of vibe coding is more than a technological trend, it’s a leadership challenge. AI will change how software is built, who builds it and how fast organizations can innovate. But speed without trust is a false economy. The CIOs and CTOs who win this race will be those who combine ambition with discipline, building systems where human judgment and AI capability reinforce each other.

The views reflected in this article are the views of the author and do not necessarily reflect the views of the global EY organization or its member firms.

This article is published as part of the Foundry Expert Contributor Network.
Want to join?