Abstract

AI-assisted software engineering and “vibe coding” are now widespread across enterprise environments. However, adoption is advancing faster than governance. This executive position paper argues that the central risk is not AI use itself, but ungoverned AI use: shadow AI, cognitive debt, technical debt, and false productivity signals that create the appearance of acceleration, while weakening long-term software quality and control. Synthesizing recent empirical benchmarks and analyses, we show that unrestricted reliance on AI reduces developers’ conceptual understanding, yields severe maintenance hurdles once scaffolding is removed, and introduces quality defects in over 15% of AI-related commits; security vulnerabilities persist across generated codebases. Furthermore, enterprise longitudinal data reveals that while top-down mandates can double raw pull request volume (2.09×), net throughput is bottlenecked downstream as review latency increases by 22% and substantive human review drops by nearly half.The paper’s core conclusion is that governance is the decisive variable. AI acts as an amplifier: it strengthens high-performing organizations and intensifies the weaknesses of poorly governed ones. Technology leaders should therefore shift attention away from volume-based indicators such as lines of code, story points, pull requests, or tokens spent, and toward value-based indicators of lead-time stability, security posture, and business outcomes. Sustainable advantage comes not from using more AI, but from governing it well.

Artificial Intelligence, or AI, is transforming how technical teams build software, but adoption is outpacing oversight. In most organizations, no one knows which AI tools are in use or when, a phenomenon now common enough to earn its own label: shadow AI. Engineering teams are using generative tools without visibility from security, risk, or leadership, quietly degrading software quality and developer skills. We argue that the difference between organizations that thrive and those that stall comes down to governance: oversight, insight and policy regarding AI are necessary to harness the productive potential of AI.

Cognitive Debt: Trading Speed for Understanding

AI is genuinely making some developers faster, but something is quietly going wrong. Ironically, research from Anthropic shows that developers are losing their capacity to understand the code they work with. Low-understanding AI users were slightly faster in the short term, confirming the trade-off between speed and depth of understanding (Shen & Tamkin, 2026). Yet this is not a zero-sum game. Specifically, guided AI use proved to be the second-fastest approach while preserving deep understanding. While the empirical study strictly measures learning outcomes across task conditions, we interpret these results as arguments for guardrails around AI usage rather than prohibition.

AI-assisted developers owned their code legally, but not cognitively. In a study on AI-scaffolded novice programming, unrestricted users showed patterns of relying on the Large Language Model (LLM) to understand the codebase for them, which we call cognitive outsourcing. When AI was removed, the unrestricted group suffered a 77% failure rate on subsequent maintenance tasks, compared with only 39% in the scaffolded group. Introducing metacognitive guardrails dropped their failure rate to 44% (Sankaranarayanan, 2026). The critical distinction is that cognitive offloading (delegating repetitive and unchallenging tasks) is not the same as cognitive outsourcing.

Technical Debt: The Last Few Percent

Unmonitored AI use also introduces quality issues into the codebase. A large-scale empirical study found that more than 15% of AI commits show at least one code-quality issue, and 22.7% of those issues remained in repositories (Liu, et al., 2026). Meanwhile, self-reported surveys show that 80% of developers report being more productive with AI (DevOps Research and Assessment, 2025); developers believe that they are shipping better code, but the data tells a different story.

Unfortunately, security research adds another layer of concern. In one large-scale analysis, 87.9% of AI-generated code was safe, 12.1% contained vulnerabilities, with rates varying meaningfully across contexts (Schreiber & Tippe, 2025). This seems like a high rate on paper, but the danger lies in that last few percent slipping through undetected into production. Even a single security vulnerability getting through is enough to suffer meaningful damage, such as intellectual property theft, sensitive data leaks and regulatory fines. Take the classic house analogy; if you secure 4 out of 5 doors, any thief can still freely walk into your house.

The Productivity Paradox

While top-down mandates and AI tooling can double the amount of pull requests being opened, empirical research shows us that these activity metrics create a false signal of productivity. In a longitudinal study of an enterprise AI mandate, rising code volume outran review capacity, causing AI-authored changes to take 22% longer in total cycle time and driving a severe downstream review bottleneck. To keep up, substantive human review was cut from 39% to 21% of PRs, as organizations shifted to more automatic bot reviews and silent approvals (He, et al., 2026). Additionally, Gartner warns that tokenmaxxing (maximizing AI output volume) does not equal productivity (Gartner, 2026). As we see it, this practice causes observable worsening of both quality and cycle time, not even considering the question of who is accountable for unreviewed AI-generated code in production.

Consequently, the perception of productivity gains does not match measured outcomes. According to the latest DevOps Research and Assessment (DORA) State of AI-assisted Software Development report, 80% of developers believe they are more productive when using AI, yet only 30% trust the code (DevOps Research and Assessment, 2025). Additionally, the organizational impact remains split. High-governance teams leverage AI to accelerate delivery, but ungoverned environments experience up to a doubling of downstream review queues, unverified code churn, and customer-facing instability (He, et al., 2026) (DevOps Research and Assessment, 2025). From our perspective, this suggests that simply using AI more does not determine the business outcome.

Governance as the Multiplier

We posit that the difference between these outcomes is not the tool, but how AI is structured and governed. The DORA study concludes that AI acts as an amplifier: it magnifies the strengths of high-performing organizations and the dysfunctions of struggling ones (DevOps Research and Assessment, 2025). As we see it, organizations therefore need a clear AI policy and management tooling. Gartner recommends concrete controls such as sandboxed environments, Zero-Trust architecture, and AI FinOps (Gartner, 2026).

Drawing on our previous research into agile software assurance benchmarks and digital security control validation, we identify at least three mechanisms that make this concrete. First, Zero-Trust translates governance into discipline, eliminating implicit trust, enforcing the principle of least privilege, continuously verifying access and micro-segmenting critical assets (Derksen & Bobbert, 2026). The closely related Security by Design ensures that these controls and policies are woven into development from day one, rather than as an afterthought; AI should not be treated any differently. Additionally, the Knowing-Doing Gap teaches us that governance often fails in practice due to a prevalent gap between understanding and action; organizations know the risks, yet they often fail to validate controls or enforce policy (Bobbert & Derksen, 2025). We see this as more reason to roll out clear controls and policy regarding AI usage across engineering teams; simply knowing the risks is not enough.

Governance, in other words, creates a genuine competitive edge, ensuring that speed does not come at the cost of stability; while ungoverned teams eventually stall under the weight of AI-generated cognitive- and technical debt, well-governed organizations maintain a high release velocity with a clean, auditable and secure codebase that requires far less expensive remediation.

Speed is a liability if you are moving in the wrong direction.

From AI Experimentation to Value Creation

For technology leaders, specifically Chief Technology Officers (CTOs), VPs of Engineering and Chief Information Officers (CIOs) who establish engineering policy and manage development risk, the real question is no longer whether teams use AI, but how AI use creates measurable business value.

We argue that the leaders who win with AI will therefore shift from monitoring output volume to managing value creation. To us, value creation is not the sheer volume of code produced, but the net gain across a few key dimensions. Specifically, accelerated DevOps cycle times, reduced defect and security risk, cognitive comprehension of the codebase and most importantly, customer impact.

This starts with a small number of disciplined practices. First, actually measure business outcomes rather than code artifacts, tracking customer impact, cycle-time improvement, defect escape rates, and operational stability indicators like Mean Time to Restore, rather than volume-based metrics. Ensure that new projects taken on due to AI usage deliver verified customer value, rather than simply inflating throughput. Second, keep developers cognitively engaged by enforcing cognitive scaffolding, ensuring that developers do not lose code comprehension. AI should support judgment, not replace understanding. Third, govern AI use as a standard operating model, not as a side experiment. This means containing shadow AI via an approved toolchain, keeping a clear AI inventory up to date with enterprise-grade controls, evidence collection, and security controls. Fourth, treat AI as an amplifier of organizational quality; as argued, AI magnifies the strengths of high-performing organizations and the dysfunctions of weaker ones, which means AI returns depend less on tool adoption alone than on leadership, policy, and engineering maturity.

To test whether this is working, technology leaders should ask themselves five questions:

1. Are we shipping better outcomes for customers?
2. Are our engineers still understanding the systems they build?
3. Are we reducing risk while increasing speed?
4. Are we learning where AI helps and where it creates waste?
5. And are we building a work system that scales responsibly?

If the answer is yes to all these questions, AI is creating value. If not, the practices outlined above are where to start. Our takeaway is that AI should not be managed as a catch-all productivity miracle, but as a tool like any other. The organizations that lead will be the ones that replace vanity metrics with value metrics, and replace uncontrolled experimentation with governed, responsible adoption. In that model, AI becomes not a source of waste, but a force multiplier for teams that already know how to build well, govern well, and lead well.

Bibliography

Bobbert, Y., & Derksen, B. (2025). The Knowing-Doing Gap in Digital Security: The Silent Risks of Not Validating Your Security Controls Regularly. Opgeroepen op August 2026, van ISACA Netherlands Chapter: https://isaca.nl/the-knowing-doing-gap-in-digital-security/

Derksen, B., & Bobbert, Y. (2026). Zero Trust in Agile Development: Results of an Agile Software Assurance Benchmark Related to Zero Trust. Opgeroepen op August 2026, van Springer: https://doi.org/10.1007/978-3-032-26211-0_14

DevOps Research and Assessment. (2025). 2025 DORA Report: State of AI-Assisted Software Development. Opgeroepen op August 2026, van dora.dev: https://dora.dev/research/2025/dora-report/

Gartner. (2026). Software Engineering AI Briefing: Tokenmaxxing and the AI Software Factory. Opgehaald van Gartner Research (Report No. G00854073): https://www.gartner.com/document/G00854073

He, H., Agarwal, S., Denisov-Blanch, Y., Azaletskiy, P., Koyejo, S., & Vasilescu, B. (2026). AI Writes Faster Than Humans Can Review: A Longitudinal Study of an Enterprise “2×” Mandate. Opgeroepen op August 2026, van arXiv:2607.01904: https://doi.org/10.48550/arXiv.2607.01904

Liu, Y., Widyasari, R., Zhao, Y., Irsan, I. C., Chen, J., & Lo, D. (2026). Debt Behind the AI Boom: A Large-Scale Empirical Study of AI-Generated Code in the Wild. Opgeroepen op August 2026, van arXiv:2603.28592: https://doi.org/10.48550/arXiv.2603.28592

Sankaranarayanan, S. (2026). Mitigating “Epistemic Debt” in Generative AI-Scaffolded Novice Programming using Metacognitive Scripts. Opgeroepen op August 2026, van arXiv:2602.20206: https://doi.org/10.48550/arXiv.2602.20206

Schreiber, M., & Tippe, P. (2025). Security Vulnerabilities in AI-Generated Code: A Large-Scale Analysis of Public GitHub Repositories. Opgeroepen op August 2026, van Springer / arXiv:2510.26103: https://doi.org/10.1007/978-981-95-3537-8_9

Shen, J. H., & Tamkin, A. (2026). How AI Impacts Skill Formation. Opgeroepen op August 2026, van arXiv:2601.20245: https://doi.org/10.48550/arXiv.2601.20245