For the past two years, the enterprise AI conversation around software development has centred on how much code AI can generate and how quickly. That focus is now shifting:
As coding assistants become more capable, the bigger question is whether organisations can trust what they produce.
Discussing these concerns with iTNews Asia, Marcus Low, Corporate Vice President, APJ at Sonar said code generation is rapidly becoming commoditised. In an agent-driven development environment, he added, the differentiator will be “engineered trust” using zero-trust principles and multi-layer verification to establish that software is safe and compliant.
For enterprises, that means having a quality control measure, and in particular verification as part of the development process rather than leaving it as a final checkpoint.
Verification can bottleneck your development
AI can generate software in seconds, but if verification continues to take hours or days, enterprises have not eliminated the development bottleneck. “That’s why we advocate for continuous, automated verification inside the agentic loop,” Low said.
For instance, he said Sonar has built an Agent Centric Development Cycle (AC/DC) framework that guides agents with “the right architectural, security, and project-specific context before they write,” followed by independent verification of every output and rapid resolution of issues.
“That’s how teams translate AI speed into shipped, reliable outcomes they can trust,” he added.
As AI becomes embedded across software development, the distinction between human and AI-generated code could eventually become irrelevant. For engineering teams, the differentiator will be how verification is embedded into the development process.
“Teams that treat verification as an inherent part of how they build will ship faster and safer,” he said.
More AI tools also mean more governance complexity
Enterprises are increasingly using several coding assistants, including GitHub Copilot, Cursor and Claude Code. While this gives developers flexibility, it also creates a fragmented environment with different models, defaults and behaviours.
“Running different coding assistants side by side can fragment the stack and complicate governance, but it’s manageable with centralised policy and verification in pull request (PR) and continuous integration (CI) workflow,” Low said.
He pointed to the organisation’s own LLM Leaderboard evaluations, where Anthropic’s Claude Opus 5 recorded an 88.6 percent functional pass rate, up from 82.9 percent for Opus 4.8. However, the newer model also “writes more code (2.3 times), meaning more issues (2.6 times the figure for Opus 4.8).”
“This is why applying a verification and governance layer throughout the agentic loop is critical, no matter the coding assistant,” Low explained.
Verification cannot be left to the model that wrote the code
Low also rejects the notion that coding assistants should be relied upon to review their own output. The model that generates the code carries the same blind spots, probabilistic tendencies and gaps in organisational context into the review process.
Asking it to assess its own work does not provide the independence required for enterprise-grade verification.
Instead, Low argues that a separation between generation and verification is necessary, with results that are deterministic, auditable and repeatable.
AI code review can add another reasoning-based layer, identifying problems with logic and intent that traditional checks may miss.
- Marcus Low, Corporate Vice President, APJ, Sonar
The combination, he emphasises, is what makes verification suitable for enterprise environments.
Regulation is also raising the stakes
For highly regulated industries, independent verification may sound like a future governance requirement. Low argues that, in practice, the direction is already clear.
In the Asia-Pacific Japan region, regulators including the Monetary Authority of Singapore, Australian Prudential Regulation Authority and Japan's Financial Services Agency have increased scrutiny around software risk management and operational resilience in financial services.
APRA's CPS 230 operational risk standard and MAS's Technology Risk Management guidelines point towards a broader expectation for documented and auditable controls.
Global requirements including SOX, PCI-DSS, DORA, HIPAA and the Cyber Resilience Act reinforce the same direction.
Low warned that simply claiming that a model reviewed its own output is unlikely to satisfy regulators. He added that organisations must increasingly demonstrate what was checked, what was found, what was fixed and who approved the final result.
AI can accelerate existing risks
AI does not necessarily create entirely new software risks. It accelerates existing ones including security and compliance failures. That is particularly significant for APJ enterprises modernising legacy applications.
For organisations already dealing with complex legacy codebases, unverified AI-generated code can add new debt to old, making systems progressively harder for both developers and AI agents to understand.
Verification is therefore not simply a quality-control mechanism. It becomes a way of preserving the productivity gains from AI without allowing the underlying codebase to deteriorate.
The next bottleneck: remediation
If verification becomes continuous, however, another bottleneck emerges. The next constraint may not be finding problems, but fixing them.
When issues are identified at agent speed, organisations need to remediate them just as quickly without constantly pulling developers away from new work. Otherwise, verification can simply create a much larger backlog of identified problems.
Low describes automated, closed-loop remediation as the next step: systems that can identify an issue, generate a fix and then verify that fix before it reaches production.
For example, he said Sonar's Remediation Agent was built on technology acquired from the National University of Singapore and developed with IMDA as a design partner. The agent automatically resolves issues identified during verification and open individual pull requests for developers to review and merge.
The goal is to connect generation, verification and remediation into a continuous development cycle.
From AI speed to trustworthy velocity
Low's key advice to enterprise leaders is not to assume that better models will eventually solve software quality on their own.
As AI touches an increasing share of software development, “AI-generated” may eventually cease to be a meaningful distinction. What will matter is whether organisations can prove that the software they produce is secure, reliable and compliant.
For enterprises, Low said the next phase of AI-assisted development is less about generating more code and more about building the systems that verify and remediate it at the same speed. “The competitive advantage will belong to organisations that can make AI move faster without allowing risk and technical debt to move faster with it,” he said.
