Your Team Is Building With AI. That's Good. Here's What to Watch.

If you run a healthcare practice or a financial services firm, someone on your team has probably shown you something built with AI in the last few months. Maybe it's a scheduling tool. A client intake form. An internal dashboard that pulls data from three places and puts it on one screen. They built it in an afternoon using Claude, Cursor, or one of the other AI coding tools that have gotten remarkably capable in the past year.

And it probably works. That's the thing - these tools produce genuinely functional applications. Working UI, connected data, real logic. It's impressive, and your team is right to explore it.

Here's the part that doesn't come up in the demo.

The application your operations manager built to route patient referrals - does it have authentication? Is there an audit trail showing who accessed what and when? Are the API keys hardcoded in the source? Is patient data being processed in a way that satisfies your HIPAA obligations, or is it sitting in a SQLite file on someone's laptop?

The internal tracker your analyst built to manage client onboarding - does it validate inputs before writing them to a database? Does it separate development and production environments? If it went down tomorrow, is there a backup?

These aren't hypothetical questions. They're the exact issues we find in every application built quickly with AI tools, and they're the same issues that auditors, regulators, and breach investigators look for.

None of this means your team should stop building. What these tools make possible is real - teams that learn to use them well will move faster and do more. The risk isn't in the building - it's in the gap between "I made this" and "we're using this," when an internal tool quietly starts handling regulated data without anyone applying the same governance standards you'd expect from any other system in your environment.

The fix isn't complicated. Before any AI-built tool touches production data, patient records, or client information, it needs the same scrutiny you'd give anything else: proper authentication, access controls, audit logging, input validation, environment separation, and a backup plan. That's not a six-month project - for most of these tools, it's a focused review and a few weeks of hardening.

We've started including AI-built tools and shadow applications as part of the environment assessments we run for every client. If your team is experimenting - and they should be - it's worth knowing what's out there and whether it meets the standard your regulators expect.

If you want a quick gut check on where your environment stands, our free self-assessment takes a few minutes and covers the areas that matter most.