What is changing
According to the analysis published by AI News Italia, vibe coding—which emerged in early 2025 as an informal way of programming by conversing with a model—has crossed the boundaries of developers and spread into the operational workflows of departments such as administration, procurement, sales and operations. Office workers can describe in words the application they need and obtain it without writing code.
However, this democratization of development produces a side effect: Shadow IT. Non-technical employees independently create applications and automations that touch real data and systems. The source asks a direct question: who is accountable if something goes wrong?
Risks and regulatory framework
The dangers cited are concrete: credentials copied into prompts or code, accidental data deletions, and overly broad permissions that allow confidential information to leave the corporate perimeter. To support the severity, the source cites Gartner: more than 40% of agentic AI projects are expected to be canceled by the end of 2027 due to rising costs, unclear business value or inadequate risk controls.
The problem is more acute in Italian SMEs, where a structured IT department rarely exists and processes live on fragmented spreadsheets or practices that have never been formalized. For these organizations, vibe coding is both an opportunity for rapid digitalization and a risk, because there is no one who understands and oversees security.
Governance as infrastructure
The argument put forward is that there is no need to curb those who develop: those who live a process every day often have the sensitivity to devise the tool that optimizes it. The critical issue is the absence of a governance perimeter. In SMEs, this safeguard cannot depend on a dedicated division: it must be native to the platform.
The model described envisages deterministic structures and granular permissions. The agent does not invent code for operations that matter and does not directly handle critical information; credentials for ERP and CRM systems remain isolated in encrypted gateways and do not end up in the language model. The agent assembles already-secure modules and interfaces, exposing only permitted functions, starting in read-only mode.
Two rules are presented as cornerstones: no generation of invented data, with screens and numbers taken from the infrastructure's actual data and calculations performed by code; and a Zero Rule whereby an action exists only if it produces autonomous and verifiable evidence. Every operation must also guarantee full traceability, the basis for meeting the requirements of the AI Act, the NIS2 Directive and the ISO/IEC 42001 standard, on which the source notes Memori's decision to certify.
According to the text, the vendor's role is not to build the agents on the company's behalf, but to provide the infrastructure so that the company can transfer its own business knowledge autonomously and securely. Verification remains open regarding the actual adoption of these models and their ability to contain the risks described.
The phenomenon also redefines the work of developers: code writing shrinks, while the role of system architects and quality guarantors grows. For junior profiles, training is evolving toward unambiguous specifications, reading and verifying code they did not write, and defining the limits of agents. The source concludes that the vibe coding destined to become established will not be the uncontrolled kind, but the kind with solid governance and the final say entrusted to a human being.
