TALKING POINT
FIXING VIBE CODING’ S AI GOVERNANCE PROBLEM
Sid Bhatia, Area VP and General Manager for the Middle East, Turkey and Africa at Dataiku, explains why governance must be embedded into AIdriven development from the outset.
Vibe coding comes with an upside-dominant narrative. It is a time saver, with a lot of advocates. As of January 2026, 87 % of Fortune 500 companies had already experimented with it. But we have arguably moved too quickly from autocompletion to a completely automated development lifecycle that occurs without the raising of a single ticket – with an AI agent as the architect and builder of everything from data pipelines to end-user interfaces.
The non-deterministic nature of AI calls for tighter controls than what we are seeing in the market right now, where the vibe-coding governance gap is emerging across three dimensions.
1. Security
An estimated 24.7 % of AI-generated code brings security vulnerabilities with it. Where code reviews occur, are analysts
Sid Bhatia, Area VP and General Manager for the Middle East, Turkey and Africa at Dataiku trusting AI-generated code more than manually written code? Researchers suggest they are, because AI code looks polished. But its respectable veneer may hide prompt-injection vectors to ungoverned model calls.
2. Shadow IT
According to a Dataiku-Harris Poll study, more than half( 54 %) of CIOs have already uncovered unsanctioned AI running live in their organisation. And vibe coding is an accelerant for this trend since it has cut the prototyping phase from weeks to hours, leaving a vanishing window for governance.
3. Accountability
Vibe coding creates anonymous elements, without lineage, owners, or audit trails. Failures – including security or compliance violations – are difficult to investigate because inquiries tend to start with questions like,“ Who built this?” and what data was accessed and who approved each step.
Keeping up
We cannot rely on traditional governance where we have an expected outcome and can flag issues based on deviation from that expectation. AI agents, of which vibe coding is a type, do not work like that. Outputs change from one run cycle to the next and each run may produce another AI agent, which suffers from the same unpredictability. In vibe coding specifically, we should also allow for what is becoming known as“ comprehension debt”, where engineers struggle to grasp what AI-written code is doing because it is written so quickly. There is also the“ ghost code” problem, where AI coders keep old logic that has already been determined by them to be flawed, leading to escalating debugging costs.
The lesson, however, is not to abandon vibe coding. If we treat each AI-generated AI project as subject to governance from inception – assigning an owner, documenting all data access and model calls, and logging everything in an auditable format – then we take a huge step forward. We should brief AI on standards( naming conventions, approved data sources, model selection, security, and so on) and ensure that agents adopt these rules as part of their success criteria. And before an agent is deployed, it must undergo human review in a staging environment. Finally, human-in-the-loop checkpoints for production operation must be clearly defined so that accountability can reign.
As time goes on, organisations must continually review AI-built AI models for drift, just as they would for human-built models. If vibe coding is to add value for UAE enterprises, then we must apply the same adoption parameters to it as we did for its predecessors. And the greatest of these principles is that governance cannot be an add-on; it must be native to AI projects. •
18
INTELLIGENT CIO MIDDLE EAST www. intelligentcio. com