Why the rise of vibe-coded NDIS software worries me

I actually think AI-assisted development is one of the most exciting things happening in software. You can build faster, prototype ideas faster and spend far less time writing repetitive code. AI is going to make good developers much more productive.

The issue isn’t using AI to write code. The issue is building something you don’t fully understand, getting it to a point where it looks like it works, and then putting real customers and real data through it.

That is very different.

If you’re building a little side project and something breaks, it might be annoying. If you’re building NDIS software, you could be dealing with participant records, incident reports, medication information, staff information, invoices, funding, payroll, case notes and highly sensitive documents.

That changes the level of responsibility completely.

This is probably what concerns me the most. Software can look completely finished on the outside while having serious problems underneath.

The dashboard can look great. The participant profile can load perfectly. The roster can save. The invoice can generate.

But none of that tells you whether the system has been built securely.

1. 01Does the software properly check that someone from Organisation A can never access Organisation B’s participants?
2. 02Are permissions enforced on the server, or is the app simply hiding buttons from users who shouldn’t see them?
3. 03Are uploaded documents private?
4. 04Are backups actually happening?
5. 05Can staff at the software company access customer data?
6. 06Is sensitive information being written into logs?
7. 07What happens if someone’s account is compromised?

These are not things you can judge from a polished demo.

And AI makes it easier than ever to create software that looks incredibly mature before the systems behind it actually are.

Then there is the actual NDIS side of it. Anyone who has spent time building software for this industry knows how quickly something that sounds simple becomes complicated.

Take rostering. At first it sounds straightforward. Staff member, participant, start time, finish time.

Then you start dealing with sleepovers, broken shifts, overtime, allowances, public holidays, minimum engagements, cancellations and SCHADS.

Or take invoicing. It isn’t simply creating an invoice. You have support items, funding categories, price limits, travel, claiming rules, plan dates, participant agreements and all the strange edge cases that come with real providers operating every day.

AI can generate code that calculates these things. That doesn’t mean the calculation is correct.

And sometimes incorrect software is more dangerous when it looks correct.

This is something I think we’re going to see a lot more of.

AI has made building the first 80% of a SaaS product dramatically easier. You can create authentication, dashboards, tables, forms, notifications, AI assistants, reports and integrations remarkably quickly now.

But the final 20% is where a huge amount of the real work is. It’s all the boring stuff nobody puts on a landing page.

• Permissions.
• Audit logs.
• Backups.
• Monitoring.
• Data migrations.
• Retries when integrations fail.
• Preventing duplicate payments or invoices.
• Handling timezones correctly.
• Race conditions.
• Security testing.
• Recovery when something goes wrong.
• Making sure an update doesn’t quietly break something that worked six months ago.

Building that maturity takes time. It usually comes from years of finding weird edge cases, fixing mistakes and watching how real customers actually use the product.

I don’t want this to sound like I’m against AI-generated code, because I’m not. I use AI. I think developers who refuse to use it are going to be at a disadvantage.

My concern is when AI becomes a replacement for understanding.

If AI writes your authentication system, somebody still needs to understand authentication. If AI designs your database, somebody still needs to understand databases. If AI writes your SCHADS calculations, somebody needs to understand SCHADS well enough to verify them. If your software stores sensitive participant information, somebody needs to understand exactly how that information is protected.

You can’t outsource that responsibility to the model that generated the code.

When choosing software, it is easy to focus on features.

Does it roster? Does it integrate with Xero? Can I write shift notes? Does it have an app? How much does it cost?

Those questions still matter, but I think providers increasingly need to ask what sits underneath the product too.

1. 01Who actually builds and maintains the software?
2. 02How is customer data separated?
3. 03Where is the data stored?
4. 04How are permissions enforced?
5. 05How often are backups performed?
6. 06What happens during an outage?
7. 07How are releases tested?
8. 08Has the platform undergone security testing?
9. 09Who inside the company can access production data?
10. 10Can customers export all of their information if they decide to leave?
11. 11How are payroll and NDIS calculations verified?

These aren’t particularly exciting questions. But I think they’re becoming much more important.

This is probably one of the biggest changes AI is going to bring to software.

A few years ago, getting a SaaS product to the point where it looked genuinely polished took a fair amount of time and engineering effort. That was never proof that the software underneath was good, but there was at least some barrier to getting there.

That barrier is disappearing very quickly. Today someone can build something in weeks that visually looks like a product that has existed for years.

That is amazing.

But it also means we need to stop judging software maturity by how impressive the interface looks. A beautiful dashboard and a slick website tell you almost nothing about what is happening underneath them.

I don’t think the answer is less competition. Quite the opposite.

There is a lot of NDIS software that desperately needs improving. Providers still deal with clunky systems, duplicated administration and processes that should have been automated years ago.

I would love to see more people come into the industry and build better products. AI is going to make that easier, and I think that is a good thing.

But lowering the barrier to building software shouldn’t mean lowering the standard we expect from software that manages sensitive information and critical parts of an organisation.

That is the part that concerns me.

Because NDIS software isn’t just another SaaS dashboard. There are real participants behind those records. There are real support workers behind those timesheets. There is real money moving through those invoices.

And when software becomes responsible for all of that, “it seems to work” isn’t good enough.