A widely cited MIT study published in July 2025, “The GenAI Divide: State of AI in Business 2025,” analyzed 300 public AI deployments alongside executive interviews and a survey of business leaders. Its headline finding was stark: 95% of AI pilots delivered no measurable financial impact. The more useful finding for a risk or compliance leader deciding how to actually build with AI was this: tools built with an external vendor succeeded roughly twice as often as tools built internally, with one analysis putting the gap at 67% deployment success for vendor partnerships versus 33% for internal builds.
That statistic should reframe a conversation a lot of banks are having right now about “vibe coding.”
The promise of vibe coding, and where it runs out inside a bank
AI can generate a working application faster than any team has ever been able to build one. In most industries, that’s a large part of the test: does it work? Ship it, see if it’s useful, iterate.
Inside a bank, “it works” is where the real work starts, not where it ends. Software that touches financial controls, SOX-relevant processes, customer data, or credit and risk decisioning has to withstand a cybersecurity review. It has to hold up under ITGC expectations and internal controls testing. It has to satisfy model and AI governance obligations regulators are actively sharpening right now, survive procurement and examiner scrutiny, maintain a real audit trail, and come with an actual commitment to ongoing support as the tool and the regulatory expectations around it both keep moving. None of that comes from a prompt, no matter how good the resulting code is.
This is exactly what the MIT numbers are pointing at, even though the study wasn’t written about banking specifically. An internally vibe-coded tool has working code and little else: no one has mapped it to a control framework, no one has built the access governance or change-tracking an examiner would expect to see, no one is contractually on the hook for keeping it running or patched. A vendor platform built for regulated financial environments has usually already been through some version of that gauntlet before it ever reaches a bank’s risk team, which is a large part of why it deploys successfully twice as often.
What “validated” actually buys a risk or compliance team that “it works” doesn’t
Code is one piece of the equation. What doesn’t come from an AI prompt, however capable the model, is accountability for that code, a documented governance framework, a real answer for an examiner asking who’s accountable when the tool is wrong, or the accumulated trust a risk function places in a platform that supports a controls-relevant process.
A validated vendor platform carries that weight so an internal team doesn’t have to reinvent it, control by control. Someone has already answered who’s accountable when something breaks. Someone has already built the audit trail, the access governance, the human-in-the-loop checkpoints, and the change documentation an examiner actually expects to see, built in from the start rather than retrofitted onto a tool that was never designed with an exam in mind.
AI versus validated software is the wrong frame
The interesting version of this isn’t AI replacing validated systems. It’s AI raising what a validated system is expected to deliver. A platform that combines AI-native speed with the governance, audit trail, and control mapping a bank actually requires is a higher bar than either a legacy compliance tool or a fast internal prototype clears on its own.
The real opportunity for banks isn’t replacing validated systems with AI-generated ones. It’s using AI to strip out the administrative burden inside controls testing and compliance work, speed up the genuinely mechanical parts of an access review or an audit trail check, and free risk and compliance staff to focus on the judgment calls that still need a human, all without giving up the controls that let the organization pass an exam.
The takeaway
The banks that win the next decade of this shift won’t be the ones that generate the most code the fastest. They’ll be the ones that combine AI’s speed with a platform actually built, and validated, to carry the weight of a controls-relevant process. AI is changing how software gets built. It isn’t changing what an examiner needs to see before trusting it.
Curious how an AI-native platform built for governed, audit-ready financial environments differs from an internally vibe-coded tool? Contact CIMCON to learn more.
