AI tools and your code

Most developers now use AI. The question isn't whether, it's how, and whether they'll tell you.

AI tools speed up legacy work enormously. They also create a new question for anyone who owns software: where does my code, and the data in it, actually go?

This guide explains the real risks in plain English, what good practice looks like, and a list of questions you can put to any developer, agency or supplier, including me.

Book a free conversation How I use AI

What can actually go wrong

Risk	What it means
Personal data in prompts	Customer records pasted into a tool are personal data being processed by a third party, often outside the UK
Credentials leaking	Passwords, API keys and database logins pasted into a tool, or sitting in code that is
Your code used for training	Some plans may use inputs to improve models unless that's switched off. Terms differ between plans and providers
Retention	Prompts and files may be stored for a period you don't control
Wrong answers acted on	AI can describe code confidently and be wrong. Unreviewed output becomes your bug
Intellectual property	Unclear terms about who owns generated output, or about licences of code it resembles
Contract breaches	Your own customers may forbid sending their code or data to third parties
No one accountable	"The AI wrote it" isn't an answer when something breaks

None of these is a reason to ban AI. They're reasons to have rules, and to know what they are.

What good practice looks like

A person reviews everything. AI output is a draft, and a named human is responsible for what's delivered.
No personal data in AI tools. Work is done on anonymised or synthetic data, or against your own systems.
No credentials, keys or secrets in AI tools, and none left in code that gets shared.
Business-appropriate plans and settings, chosen deliberately, with training on your inputs switched off and retention understood.
A written record of which tools are used, and what's put into them.
You can opt out, entirely or for parts of the system, and the supplier tells you honestly what that does to scope and price.
Your restrictions are respected. If your customers or regulator limit where code can go, the supplier follows that.
It's in the contract, not just the sales conversation.

Questions to ask your developer or agency

Ask for answers in writing.

Do you use AI tools on our code? Which ones, and on which plans?
Is any of our personal data, or our customers' data, ever put into them?
Do you ever paste passwords, keys or other secrets into them?
Can our code be used to train a model? How do you know?
How long do the providers keep what you send them?
Where is it processed? Inside or outside the UK?
Who reviews AI-generated code before it reaches us?
How do you test it?
Can we say no to AI on some or all of our system? What would that change?
Who owns what you deliver, including anything AI helped produce?
What happens if the provider has a breach?
Is this written into our contract or data processing agreement?

Green flags and red flags

Green flags	Red flags
Tells you which tools they use without being asked	"We don't use AI" (they almost certainly do) or "it's not an issue"
Clear rule: no personal data or credentials in AI tools	No rule, or "it depends"
Can say how training and retention are handled	Doesn't know
Human review is part of the process	"The AI handles it"
Offers an opt-out	Insists AI is non-negotiable
Puts it in writing	Verbal assurances only
Willing to be asked these questions	Defensive or vague

UK GDPR and personal data

If personal data from your systems is put into an AI tool, that's processing of personal data by a third party. It affects who the processor is, what contracts are needed and whether data leaves the UK. That's a legal question for your adviser, but the practical rule is simple: keep personal data out of AI tools in the first place.

I provide technical engineering and security remediation, not legal advice or Data Protection Officer services. Data protection and security

How I handle it

In summary, and set out in full in my published documents:

Personal data and credentials never go into AI tools.
Source code and technical information may, under business-appropriate terms and settings I choose.
Everything is reviewed and verified by me. AI output is a draft, never an authority.
You can opt out, entirely or in part, and I'll tell you how it changes scope and price.
It's written down: in the terms of engagement and my Data Protection Policy.
I tell you which tools I use, and if they change.

How I use AI

What to put in a contract

Ask for clauses covering:

Which AI tools may be used, and a right to be told about changes
A ban on personal data and credentials in AI tools
An opt-out right, in whole or part
Human review of all delivered work
Ownership of deliverables, including AI-assisted work
Confidentiality of your code and data
Breach notification, with a timescale
Deletion or return at the end

Frequently asked questions

Is it safe to let a developer use AI on my code?

It can be, with rules. The risks come from personal data, credentials and unreviewed output, not from AI itself. Ask the questions above.

Can I forbid it?

Yes. You can tell your supplier in writing. Expect it to take longer and cost more, and ask them to say how.

Will AI-written code be worse?

Not necessarily, but it must be reviewed. Quality depends on the person reading and testing it, not on whether a tool was involved.

Does this apply to me as an agency?

Yes. If you pass client code to a subcontractor, check their practices, and check what your own client contracts say.

Do you use AI on my code?

Yes, unless you ask me not to. How I use AI

Tell me what you've inherited.

Have a question about AI on your own systems? Ask me, or put these questions to your current supplier and see what they say.

Book a free conversation Legacy System Assessment, from £2,500