A client said this to us recently, and it's a perfectly fair thing to say. AI does a great deal of the work now, and anyone in our trade telling you otherwise is either behind the times or protecting their invoice.
So this isn't going to be an agency rubbishing the competition. The tools are good, they're getting better quickly, and for some jobs they are the right answer, which we'll say plainly further down. But there's a specific, well-documented gap between what they produce and what a business can safely run on, and the gap isn't where most people expect it to be. Here's the honest version, with the receipts.
What we're actually talking about
Three different things get lumped together, and the distinction matters a lot:
Site generators for non-technical users. Wix's AI builder, Squarespace Blueprint, Durable, Framer, GoDaddy Airo. You describe your business, you get a hosted website with pages, layout, copy and images. Free tiers exist, paid plans run from a few euro to about €30 a month.
Builders that write real code. Lovable, v0, Bolt, Replit. These generate an actual application, front end, database, logins, and you can usually take the code with you. Free tiers up to about €25 a month for the useful ones.
Assistants for people who already code. Claude Code, Cursor, GitHub Copilot. These don't replace knowing what you're doing, they make knowing what you're doing much faster, which is a different proposition entirely.
Lumping these together is how the conversation goes wrong. The first group is a finished product you rent. The second is a rough draft you own. The third is a power tool.
What they're good at, no hedging
Speed to a first draft is real. One reviewer built a complete Squarespace site in under ten minutes. That's not marketing, that's a stopwatch.
Design and layout are consistently strong. An independent audit of five AI-built business sites in April 2026 scored them 5 out of 5 for professional design, 5 out of 5 for responsive mobile layouts, and 5 out of 5 for logical navigation. Four of five had working contact forms.
They're often faster than what they replace. This is the finding that should give the sceptics pause: on real-world Core Web Vitals, Wix passes for about 75% of sites and Squarespace about 70%, while WordPress passes for about 46%. A modern AI builder will very likely give you a quicker site than a plugin-laden WordPress install. We've written before about when a page builder helps and when it costs you, and this is the same argument pointing somewhere we didn't expect.
Boilerplate is solved. Across 150-plus AI models, syntax correctness now exceeds 95%. The code compiles. It runs.
So if someone tells you AI builders produce rubbish, they haven't looked recently.
Where the actual problem is
Not the design. Not the speed. It's everything that doesn't announce itself.
The invisible layer is missing
That same audit of five AI-built sites found:
- Schema markup absent or broken on 5 out of 5. Interestingly, four of five had picked the right type of schema. It just wasn't correctly implemented. Chosen, not delivered.
- Broken heading hierarchy on 4 of 5
- Homepage titles written as branding statements rather than anything anyone searches for, on 4 of 5
- No robots.txt or a misconfigured one, on 4 of 5
- Missing or broken sitemap, on 4 of 5
- Duplicate pages getting indexed, on 4 of 5
The auditor's own summary is the best line written about this all year: "AI builds. It doesn't audit. And it doesn't tell you it hasn't."
That's a small sample, five sites, and worth saying so. But it matches what we see, and it matches a separate case where an AI-assisted rebuild quietly dropped page titles and meta descriptions across multiple pages, discovered only by someone checking systematically.
The site looks finished. Nothing is red. Nothing warns you. It's just not findable.
Accessibility, and this one is now the law in Ireland
WebAIM tests the top million homepages every year. In 2026, 95.9% had detectable accessibility failures, up from 94.8%. That's the first increase after six straight years of improvement, and WebAIM explicitly names increased reliance on frameworks and "AI-assisted coding practices" as a contributing factor. The average page now has 56 errors, up 10% in a year.
In fairness, the same report found Squarespace performs better than average and WordPress sites average slightly fewer errors than the norm. This isn't a simple "AI is worst" story. But the direction changed, and that's new.
The reason it matters more in Ireland than most places: the European Accessibility Act was transposed into Irish law and has applied since 28 June 2025. E-commerce is explicitly in scope. Penalties reach €60,000 on indictment, and company officers can be personally liable.
And you can't prompt your way out of it. In a June 2026 audit of two AI-generated shops, a carefully written expert prompt produced the same number of critical accessibility failures as a naive one. Same patterns both times: unlabelled dialogs, broken keyboard focus, form fields with no labels. (That audit was published by a company selling accessibility products, and it only covered two sites, so weigh it accordingly, but the finding is specific and checkable.)
Security, which is the properly serious one
Veracode tested over 150 AI models across 80 coding tasks. 45% of the code they generated contained a vulnerability from the OWASP Top 10 when no security guidance was given. For cross-site scripting specifically, only 15% of attempts were secure. And their update this year found the numbers had "barely budged" since 2025, so newer models are not fixing this.
At enterprise scale, one security firm tracked thousands of developers across tens of thousands of repositories: AI-assisted developers wrote 3 to 4 times more code and generated 10 times more security findings. Their researcher's line: "AI is fixing the typos but creating the timebombs."
Then there's what actually happens in the wild. Someone crawled 65,000 URLs and found over a thousand live apps built with these tools. 98% had at least one security flaw. 172 allowed unauthenticated deletion of data. 39 exposed their entire database for reading. Separately, in May 2026 an Israeli security firm found around 380,000 publicly accessible AI-built apps and databases, roughly 5,000 containing sensitive corporate information, including hospital patient summaries and bank records. Axios and Wired verified it.
Both of those studies came from companies that sell security tooling, which you should factor in. The underlying cause is not disputed, though: default settings that leave things public, and nobody in the loop who knows to check.
And when it breaks
Two stories, because they're clearer than any statistic.
In March 2025 a founder announced he'd built a lead-generation product entirely with AI, zero hand-written code. It shipped with API keys visible in the browser, no authentication, an unprotected database and a paywall enforced only in JavaScript, which means anyone could switch it off. Attackers found it within two days. When he asked the AI to fix it, it "kept breaking other parts of the code," and he didn't have the knowledge to intervene by hand. He shut it down permanently within a week.
In July 2025, Replit's AI agent deleted a founder's production database during an explicitly declared code freeze, then told him the data was unrecoverable and that rollback wasn't supported. Both claims were false. The rollback worked. Replit called it "a catastrophic error of judgement."
This is the actual risk. Not that AI writes bad code. That it writes code nobody on your side can read, so when something goes wrong you have no way to tell whether you're being told the truth.
What professionals actually report
The Stack Overflow survey asked 33,000 developers. 84% use AI tools. Only 3.1% highly trust their accuracy, and more distrust it than trust it. The single biggest frustration, cited by 66%: "AI solutions that are almost right, but not quite."
Google's DORA research is the most balanced framing we've found. 90% of technology professionals use AI, over 80% report productivity gains, and higher adoption is associated with increased throughput and increased delivery instability at the same time. Their conclusion is that AI is an amplifier: it makes good teams faster and makes struggling teams break things faster.
And lest this look like consumer tools being sloppy while professional ones are safe: researchers at Georgia Tech tracking security holes introduced by AI coding tools found that Claude Code, a tool built for professional developers, accounted for the most reported cases. No tool is exempt. What keeps generated code safe is the review process around it, and that is a person's job, not the tool's.
So when is an AI builder the right answer?
More often than you'd think. Use one if:
- It's a few pages, a contact form, no transactions
- Getting live this week matters more than standing out
- The budget honestly rules out custom work, in which case a well-made AI site beats no site and beats a bad cheap site
- It's a prototype, a pitch, or something to test whether the idea has legs
We'd tell a client that, and we have.
And when does it stop being the right answer?
There are five clear lines, and they're checkable rather than a matter of opinion:
- You take payments or handle personal data. E-commerce is in scope for the accessibility regulations, and it's where the exposed-database stories come from.
- You have accessibility obligations. Better prompting demonstrably doesn't fix it.
- Search is a real channel for you. Schema was broken on every audited site. You won't notice, and neither will the tool.
- You need real integrations, logins, or unusual logic. This is where every one of these tools hits a wall.
- Nobody on your side can read the code. If the answer to "what do we do when it breaks" is "ask the AI again", you don't have a website, you have a bet.
The honest verdict
AI doesn't do all the work. It does the visible work, very well and very fast, and it leaves the invisible work undone without telling you. Design, layout, responsiveness, copy, first draft: it's good, and on speed it can beat a badly built professional site.
What it doesn't do is audit itself, know Irish accessibility law, notice that your schema is broken, ask whether your enquiry emails are arriving, or tell you the truth when it has broken something.
One last thing worth saying, since we can't prove the opposite either: there is no credible study comparing conversion rates of AI-built and professionally built websites. Anyone quoting you a figure on that has made it up. We looked specifically, and it isn't there.
So the job changed rather than disappeared. Less time typing, more time on the things nobody sees until they cost you: structure, findability, accessibility, security, and being able to ring someone who understands what's actually running.
If you've built something with AI and you want an honest opinion on whether it's ready for real customers, that's precisely what a Website NCT tells you, and we'll happily conclude that it's fine. Or have a chat, no hard sell.
Figures and prices in this area change monthly, so check anything you plan to rely on before you act on it.