GitLab Research Reveals Organizations Are Generating AI Code Faster Than They Can Control It

GitLab Inc., the intelligent orchestration platform for DevSecOps, released its AI Accountability Report. Conducted by The Harris Poll, the survey of 1,528 developers and technology buyers across six countries finds that as AI coding tools become standard infrastructure, the conversation is shifting from how fast teams can generate code to whether they can actually control what they are shipping.

Also Read: CIO Influence Interview with Hugo Dozois-Caouette, CTO and Co-founder at MaintainX

The report defines AI accountability as the organizational and technical capability to answer three questions about any line of AI-generated code: where did it come from, what was it meant to do, and who is responsible for it once it’s in production? Most organizations cannot answer those questions today.

AI coding adoption and ROI are strong. 91% of organizations have two or more AI coding tools in active use and 78% report that developers are writing and committing code faster since adopting AI tools. But speed is running ahead of control, with 43% of respondents reporting that they cannot reliably distinguish AI-generated code from human-written code in their own codebase. This comes with a forward-looking concern. 73% of respondents are concerned about the maintainability of AI-generated code in their organization’s codebase, and 82% say it risks creating a new form of technical debt their organization is not yet prepared to manage.

Key findings:

Agentic AI delivering speed and control is the next frontier

• 91% of organizations have two or more AI coding tools in active use; 54% have three or more
• 60% say AI coding ROI has exceeded expectations; 78% report faster code output; 73% say overall code quality has improved
• 79% agree that individual developer productivity has improved with AI, but the overall software delivery process has not accelerated at the same pace. This is defined as the “AI Paradox”
• 82% say AI-generated code risks creating a new form of technical debt organizations are not prepared to manage
• 85% agree AI has shifted the bottleneck from writing code to reviewing and validating it
• 84% agree the biggest challenge with AI-generated code is governing what happens to it after it’s created

Traceability gaps leave organizations exposed

• 87% are confident their team could determine within 24 hours whether AI-generated code contributed to a production incident, yet 34% of organizations that experienced an incident in the past year could not actually make that determination
• The top barriers to control and traceability are structural: difficulty distinguishing AI-generated from human-written code (43%), fragmented toolchains (40%), and systems that don’t track code origin (39%)
• Only 28% say their software development lifecycle tools are fully integrated with shared data and workflows

Governance is the missing layer

• 92% report some form of governance challenge with AI-generated code
• 80% agree their organization adopted AI tools faster than it developed policies to govern them
• 83% of organizations identify AI-generated code accumulation as a risk to manage now, with 44% calling it a top technology risk
• 91% are likely to invest in AI code governance tools in the next 12 months; 98% have already allocated or expect to allocate budget
• 85% agree the next phase of AI in software will focus less on generating code and more on governing it

“AI coding tools have delivered on their promise of speed. But the events of the past few months, including supply chain attacks, reliability issues, and regulators tightening expectations around AI traceability and provenance are making clear that speed without control is a liability, not an advantage,” said Manav Khurana, Chief Product and Marketing Officer at GitLab. “The teams thinking ahead are already asking the harder question: can we actually control all the code we’re generating? The organizations that will ship trusted software faster are the ones building the foundations of accountability with context, traceability, and governance baked into the platform, not just bolted on after the fact.”