Not long ago, building a software application or automating a process required technical expertise, development skills, careful planning, and coordination across teams.
Today, it might just take a well-crafted prompt into an artificial intelligence (AI) platform.
What once required specialized knowledge is now accessible to almost anyone, and while that's exciting, it also raises an important question:
What happens when people start building solutions without fully understanding how they work or the risks they present?
For financial institutions, this is a critical question if the system accesses, transmits, stores, or shares regulated data (e.g., GLBA-protected data). Let's take a look at the rise of vibe coding and AI citizen developers, as well as steps you can take to protect your business and your information.
For some of us, we remember what it was like when the internet took off, and for those who were born with an iPhone in hand, here is a quick history lesson.
When the internet was just beginning, organizations realized they needed websites. There was urgency to get online and fast. So, what happened?
Many organizations hired whoever could build something quickly. Which sometimes meant:
The result? Websites that looked functional, but were wide open to compromise.
We're seeing a similar pattern today with vibe coding and citizen developers, except now it's happening at machine speed and often without oversight.
With AI, you don't need a background in software development to build tools or even create full applications. You just need a good prompt and an AI coding assistant (e.g., Claude Code, ChatGPT Codex, Github Copilot). This has led to a growing trend often called "vibe coding."
Vibe coding occurs when someone:
No formal design. No structured testing. No security validation. Just vibes. ✨
While this kind of approach may be fine for personal experimentation, for community financial institutions, vibe coding introduces significant risks that cannot be overlooked.
Quick Disclaimer: When we're talking about vibe coding, we're not talking about using AI to write a simple Excel formula or a small macro. This is about using AI to build tools, connect systems, or automate processes that interact with real data and support day to day operations.
A citizen developer is an individual who uses AI tools to generate, debug, and optimize software without formal training in software development, security, or system design.
There might be a lot of terms that fall under this category like:
These individuals are not authorized developers. They are not usually security experts. But they are building things that can directly impact your systems, data, and operations. Often, they do it with the best intentions (trying to work faster, automate tasks, or solve everyday problems), which is part of what makes this risk so tricky.
Vibe coding and citizen development introduce real risks for community financial institutions because they move software creation outside of established governance, security, and operational risk management practices.
AI-driven development often bypasses the institution's established system development life cycle (SDLC), which is expected under FFIEC guidance. Instead of progressing through defined stages (i.e., initiation, development, testing, implementation, maintenance, and sunset), vibe coded solutions may move directly from prompt to production.
This lack of structure weakens foundational governance controls such as approval workflows, documentation standards, change management, and segregation of duties. It also expands shadow IT, as employees independently build automations, applications, and integrations outside of IT visibility.
In some cases, these tools are deployed directly into production environments without staging, version control, or formal rollback procedures, increasing the institution's exposure to unmanaged change.
AI-generated code can introduce security and data protection weaknesses even when it appears to function correctly. Common issues include missing input validation, weak authentication controls, and insecure API management.
There is also a significant risk of data leakage. Users may test or validate solutions using proprietary or nonpublic data, which can then be inadvertently exposed through insecure storage, plain-text logging, or being shared with unintended recipients.
In addition, AI-generated solutions frequently rely on external APIs, third-party services, or open-source components that have not been formally reviewed. These dependencies can introduce unauthorized third-party relationships and create hidden data flows outside of established vendor management processes.
When AI-generated solutions are deployed without structured testing or oversight, even minor issues can create operational disruption. Common gaps include missing edge cases, limited logging, and inadequate error handling.
In addition, systems may produce inaccurate or misleading outputs that are not immediately apparent, particularly when results appear plausible on the surface.
Without proper controls, failures may surface directly in production and be difficult to detect or resolve quickly. When outputs inform important decisions, even subtle inaccuracies can lead to significant downstream costs. Over time, this increases the likelihood of service interruptions, breaks down trust in system outputs, and reduces the institution's ability to respond effectively when issues occur.
The goal of managing "vibe coding" and citizen development is not necessarily to eliminate the use of AI or to restrict innovation. Instead, it is about ensuring AI is used with the right level of expertise, oversight, and control.
Two quick notes here:
Learn more about secure development practices in the FFIEC IT Examination Handbook, Development, Acquisition, and Maintenance Booklet.
Governance controls help ensure AI-assisted development remains under the institution's oversight.
Security controls help prevent data exposure and ensure AI-generated code does not introduce vulnerabilities.
Operational controls help ensure AI-generated code is stable and resilient.
AI already has and will continue to expand how work gets done across financial institutions, including how software is built. As that happens, the expectations around governance, security, and operational controls do not change. What does change is who has the ability to create and deploy solutions. Institutions who recognize this shift early, and extend controls accordingly, will be better positioned to take advantage of the opportunities AI presents while managing the risk.
Download Tandem's Artificial Intelligence Risk Management Workbook to learn more about how your financial institution can securely use and manage the risks associated with AI.
Q: What should banks and credit unions watch for in AI-generated code?
A: AI-generated code often looks clean and functional, but developers should still review with a critical eye, looking for things like input validation gaps, hardcoded secrets, authentication issues, error handling, and logging gaps.
Q: Is my bank or credit union allowed to use AI-generated code?
A: Yes, but the same rules should apply that you'd require for human-authored code. AI-generated code should follow standard development, testing, and approval processes, and the AI tools used to generate it should go through your vendor management program before employees start using them.
Q: What does financial industry regulatory guidance say about AI citizen developers?
A: There is no specific guidance on AI citizen developers, but existing expectations around secure development, vendor management, and information security still apply. Regulators expect financial institutions to manage risk regardless of how the code is created.
Q: What controls will examiners expect to see around AI-generated code?
A: Examiners will expect to see that AI-generated code is governed by existing controls, including testing, access restrictions, monitoring, and oversight. They may also look for how the financial institution is managing data exposure and third-party risk.
Q: How can I know if we have AI citizen developers at my bank or credit union?
A: Start by asking. Direct conversations with employees about how they're using AI in their day-to-day work can surface more than formal reporting ever will. From there, look for signs of informal development activity, such as scripts, automations, or system integrations being built outside of established processes.
Q: How does AI-generated code increase risk for financial institutions?
A: AI-generated code may introduce vulnerabilities, expose sensitive data, or disrupt operations if it's not properly reviewed and tested.
Q: How should banks and credit unions control the use of AI-generated code?
A: Institutions should establish clear guardrails and ensure that any AI-assisted development follows the same system development life cycle (SDLC) as traditional development. This includes requirements for testing, code review, approval, and controlled deployment. In practice, this also means limiting use to approved tools and environments, restricting the use of sensitive data, and maintaining visibility into who is building and deploying solutions.
Q: Can AI-generated code introduce third-party risk?
A: Yes, AI-generated solutions may include external APIs, libraries, or services that function like vendors without going through due diligence. These should be identified and managed through existing vendor management processes.
Q: How do we reduce the risk of data leakage when using AI tools?
A: Avoid using sensitive data in AI tools without approval and ensure data is handled in controlled environments. Organizations should also monitor how data is stored, transmitted, and shared in AI-generated solutions.