Vibe coding for business: build or buy your next tool?

Learn more about AI implementation in Luxembourg.

"Vibe coding" was Collins Dictionary's word of the year for 2025, a term Andrej Karpathy, one of OpenAI's founding team, coined in February 2025 for building software by talking to an AI and accepting what it writes. A year and a half later the question has moved from developers to owners. I now hear it from managing directors: "one of our people built a quoting tool over the weekend; why are we paying for three SaaS subscriptions?"

It is a fair question with a two-part answer. Some of your software really can be replaced by a tool your own staff build in days. Some of it should never be, because the cost of a mistake lands on your clients, your auditor or the tax administration. This article gives you a test to tell the two apart, a realistic cost comparison and the rules I would put in place before anyone in the company ships a vibe-coded tool.

Building something that reads documents, classifies requests or drafts replies? Then it is an AI project, and SME Packages – AI may reimburse 70% of it. Check eligibility in 2 minutes.

What is vibe coding, and why is every SME talking about it?

Vibe coding tools turn a description ("a form where sales enters a client, picks three services and gets a PDF quote with our VAT rules") into a working application. The person writing the description does not need to read the code. Products in this space range from app builders aimed at non-developers to coding agents that work inside a developer's environment.

Two things made it a board-level topic in 2026. The tools got good enough that a capable non-developer can ship a working internal tool in a day or two. And the "SaaSpocalypse" debate, the argument that companies will replace subscriptions with software they generate themselves, reached the business press. The honest version of that debate is narrower than the headlines: vibe coding replaces weak, generic software well, and specialised, regulated software badly.

Which tools should an SME build, and which should it keep buying?

Here is the traffic-light test I use with clients. Put each tool you pay for, or want to build, through three questions: does it hold personal or financial data, does an outside party rely on its output (client, auditor, administration), and would an error cost more than the tool itself?

The red category is red for concrete reasons in Luxembourg. Payroll software has to follow automatic wage indexation and social security changes every year. E-invoicing will run over Peppol, where you connect through a certified service provider, not through something you wrote yourself; our Peppol ID guide explains how. Client identification under AML rules must be evidenced to a supervisor. A weekend tool cannot carry those obligations.

What does vibe coding really cost compared with a subscription?

The build is the cheap part. The cost that owners underestimate is everything after the first version works. A fair comparison has five lines:

A worked example. A 30-person firm pays for a quoting tool it uses lightly. A sales manager vibe-codes a replacement in two days. To be safe with client data it needs a day of engineering review, hosting in the EU and an owner. If the firm uses a professional for the review and hardening, that is a small project: our own quick-win projects start from €3,000 excluding VAT. Against a subscription of a few hundred euros a month, the build pays back within a year or two, if the tool stays simple. If the sales manager adds features every month, maintenance grows with every addition, and the comparison flips.

The rule of thumb that falls out: vibe coding wins for tools that are simple, stable and specific to how you work. Subscriptions win for tools that change because the law or the market changes. Our AI vs low-code decision guide covers the middle ground, where a low-code platform gives you the speed without owning all the code.

What are the real risks of vibe-coded software?

Four risks, in the order they usually show up:

1. Security flaws nobody sees. Veracode tested more than 100 language models on 80 coding tasks and found they chose the insecure option 45% of the time when a secure one was available (Veracode, July 2025). A non-developer cannot spot these flaws, because they do not read the code.
2. Personal data in the wrong place. Pasting client lists into a prompt, or a tool that stores data on a server outside the EU, can break the GDPR's requirements on security of processing (Article 32) and data protection by design (Article 25). Our guide to GDPR-compliant AI for Luxembourg SMEs covers the tool settings that matter.
3. Shadow IT. Tools built outside IT are not backed up, not in the access-rights review and not in anyone's inventory. They surface during an incident.
4. The leaver problem. The builder leaves, the tool breaks after an update, and nobody can fix it because nobody ever read the code.

One misconception to clear up: building a tool with an AI coding assistant does not make that tool an "AI system" under the EU AI Act. The Act starts to matter when the tool itself uses an AI model, for example to screen candidates or score clients. Then the usual classification applies.

Planning to replace a subscription, or to harden a tool your team already built? Send us what it does and who uses it, and we come back with a written estimate for a review or a professional rebuild. Ask on our contact page.

What rules should you set before staff vibe-code?

Eight rules, short enough to fit on one page of your IT policy:

1. Green tools are allowed; amber and red tools need approval using the traffic-light test above.
2. No real personal or client data in prompts for building or testing. Use invented sample data.
3. Company accounts only. No tools on personal subscriptions, where you control neither the data nor the access.
4. Hosting in the EU, behind company login, for anything that stores data.
5. Every tool has a named owner and a one-paragraph description in an inventory.
6. Engineer review before go-live for amber tools: authentication, data storage, input validation, dependencies.
7. Code in a company repository, so someone else can read and fix it.
8. A review date. After six months, keep it, hand it to IT, or retire it.

These rules cost almost nothing and remove most of the risk. They also make it easier to say yes, which is the point: the companies that gain most from vibe coding in 2027 will be the ones whose staff are allowed to build, within limits, rather than the ones that ban it and find it anyway.

Should a Luxembourg SME bet on vibe coding in 2027?

Bet on it for speed, not for savings. The best use we see is not replacing core software but closing the small gaps around it: the report your ERP cannot produce, the form that feeds your CRM, the prototype that shows a vendor exactly what you need. Those tools used to wait months for IT; now they take days.

Keep your core systems bought, maintained and supported. And when a vibe-coded tool turns out to matter, treat that as a success signal: it has earned a proper review and an owner. If you want help deciding which of your subscriptions are genuinely replaceable, our AI consulting service starts with that inventory. For where this fits in next year's plan, see the 7 AI moves for 2027.

Frequently asked questions

Is vibe coding safe for business use?

It is safe for internal tools without personal data. For tools that handle personal data, money or regulated records, it is safe only after an engineer reviews the code, because AI models often choose insecure coding patterns and the person who described the tool cannot see them.

Can vibe coding replace our SaaS subscriptions?

Some of them. Simple, stable tools specific to how you work are good candidates. Software that must follow changing law, such as payroll, accounting, e-invoicing or AML, is better bought from a vendor who maintains it.

Is a tool built with vibe coding covered by the EU AI Act?

Not because of how it was built. The AI Act applies to the tool if the tool itself uses AI, for example to screen candidates or evaluate clients. A plain form or dashboard written with AI help is ordinary software.