AI-built software in SMEs – turbo or ticking time bomb?

Tools like Claude Code, Lovable, or Cursor enable consultants, engineers, doctors, and law firms to build their own software solutions in just a few weeks—without writing a single line of code themselves. While prototypes impress, they quickly become a risk in real-world use: security vulnerabilities, missing compliance, and data ending up unnoticed with non-European providers. Stefan Kohl works precisely at this interface. The founder of AnvilStack, based in Graz, brings AI-built applications into production securely, in compliance with regulations, and on European infrastructure.

His path to this point led through game development and six and a half years as managing director of his own software development company in Taiwan, with up to 20 employees. Since 2019, he has lived in Taipei, combining Asian execution speed with European standards for data protection and digital sovereignty.

In the interview, he explains why AI solves the "how to build" but not the "how to do it legally," which regulations—from NIS2 to the AI Act—are coming for small businesses, why a server location in Frankfurt alone does not guarantee sovereignty, and why Europe should see its clear rules as a competitive advantage.

The conversation with Stefan Kohl shows: Digital sovereignty does not begin in Brussels or corporate headquarters, but with every single application a company puts into operation.

Silicon Valley Europe: Mr. Kohl, you started in app and game development, built a software company in Taiwan, and now support companies with AI-built applications through AnvilStack. How did this transition come about, and exactly how does AnvilStack help its customers?

Stefan Kohl: I began my career in game development. Games are a tough school: they must run stably on thousands of devices, and users forgive nothing. After that, I ran a software development company in Taiwan for about six and a half years, with up to 20 employees and projects for customers in Europe.

During this time, the way software is created fundamentally changed. Today, subject-matter experts build their own applications with AI tools in just a few weeks and then face the question: Can I even operate this with real customer data? That’s exactly where AnvilStack comes in. We turn an AI prototype into a secure, compliant production system on European infrastructure and also support operations after launch. The code and infrastructure belong to the customer. We ensure both run stably.

Silicon Valley Europe: Vibe coding is on everyone’s lips: subject-matter experts describe what they need in natural language, and AI writes the code. Are we witnessing the democratization of software development—or a dangerous illusion?

Stefan Kohl: Both. It's real democratization: A tax consultant or an engineer often knows much better than any agency which problem a piece of software needs to solve. The fact that these people can now tangibly implement their idea themselves is enormous progress. A functioning prototype is the best specification I’ve ever received.

The illusion begins where you confuse “works on my screen” with “ready for the market.” AI delivers visible results very quickly: interfaces, forms, logic. What you don’t see are rights management, encryption, backups, redundancy, logging, and maintainability. It’s like building a house: the façade is up in a week, but whether the foundation holds only becomes clear when someone moves in.

Silicon Valley Europe: According to studies, nearly half of AI-generated code contains security vulnerabilities. What typically causes AI prototypes to fail when deployed with real customers and real data?

Stefan Kohl: Mostly not due to the idea, but the invisible parts. Typical patterns include API keys ending up in the frontend, databases where every user can read all other users’ data, missing rights checks on the server, and login logic that the AI “invented” itself. Security vendors’ analyses of several thousand vibe-coded applications found well over a thousand vulnerabilities—many trivially exploitable.

Then there’s operations: no automated tests, no monitoring, no backups, and no one knows what happens if the server goes down at 3 a.m. AI optimizes for the application working now. Production readiness means it still works in a year—with ten times as many users and after the tenth security update.

Silicon Valley Europe: One of your guiding principles is: “AI solves the building. Not the permission.” NIS2, AI Act, Cyber Resilience Act, new accessibility obligations. Which regulations should small businesses and freelancers really keep an eye on, and where does management even face personal liability?

Stefan Kohl: AI can build you a customer portal in an afternoon. It won’t tell you whether you’re allowed to operate it. GDPR applies anyway to any application with personal data. Depending on industry and size, NIS2 implementation—directly affecting mid-sized and larger companies in critical sectors but increasingly their small service providers via the supply chain—also comes into play. The AI Act introduces transparency obligations as soon as AI functions interact with customers. The Data Act and Cyber Resilience Act change requirements for digital products, and many offerings to end customers now face accessibility obligations.

What is particularly underestimated is that NIS2 explicitly holds management accountable, including personal liability. My advice: Not every regulation affects every company, but you should have checked it before going live, not just when the first request from an authority or a major customer arrives.

Silicon Valley Europe: Digital sovereignty is one of the core topics of Silicon Valley Europe. What does sovereignty mean to you in concrete terms—not at the political level, but in the individual application of a small company?

Stefan Kohl: To me, sovereignty is first and foremost a capability, not an ideology: the ability to decide for yourself at any time. In concrete terms, this means three things for a single application. First: I know where my data is stored and who can legally access it. Second: I own the source code, the database, and the deployment scripts, meaning I can switch providers without starting from scratch. Third: I can change my infrastructure provider because everything runs on open standards. Dependencies rarely arise from a single major decision but through many small, convenient ones. One login service here, a database platform there. And after two years, you can no longer get out. Sovereignty begins with the first architectural decision.

Silicon Valley Europe: Many companies reassure themselves with the note that their data is stored in a data center in Frankfurt. Why is that not enough in your view, and what role does the US CLOUD Act play?

Stefan Kohl: Because the location of the data center does not determine which law applies, but who owns it. The US CLOUD Act obliges American providers to grant US authorities access to data under certain conditions, regardless of whether it is stored in Virginia or Frankfurt. The “Europe” region in the AWS, Azure, or Google console does not change that.

This is not a theoretical problem. For example, a medical practice, law firm, or consulting company processing sensitive data faces a conflict with the GDPR that can only be resolved to a limited extent through contracts. The same applies to login services: Many small applications store their data properly in Europe but send every login via a US identity provider. That’s why we consistently rely on European providers without a US parent company and also manage user authentication ourselves using open-source software like Keycloak.

Silicon Valley Europe: European infrastructure is often considered less convenient and more expensive than AWS, Azure, or Google Cloud. Is sovereignty a luxury only corporations can afford?

Stefan Kohl: On the contrary, this is one of the most persistent myths. In terms of pure computing power and storage, European providers like Hetzner are often several times cheaper than the major US hyperscalers. The convenience of hyperscalers is real, but it comes at a price: proprietary services that are difficult to leave and bills that grow disproportionately with success.

What is true: sovereign infrastructure requires more expertise when setting it up. Monitoring, backups, certificates, user management—all of this must be built properly from scratch instead of being clicked together. This is exactly the work we take off our customers' hands. We rely on a standardized, proven stack with Kubernetes, open-source monitoring, and automated deployments. This makes sovereignty no longer a luxury but affordable for small companies and often more cost-effective in the long run than the supposedly convenient solution.

Silicon Valley Europe: With the ANVIL system, you have developed a fixed five-step process. What does the path from prototype to production system look like in practice—and why do you rebuild the application instead of repairing the existing code?

Stefan Kohl: ANVIL stands for five steps. We start with the analysis: we examine the prototype, code, infrastructure, and compliance situation and deliver a report with a prioritized roadmap and cost plan. This is followed by redesign, a documented blueprint with target architecture, data model, and interface that belongs to the customer. During validation, we quickly build a prototype using AI support, which real users test early on. In the implementation and hardening phase, the actual product is created with automated tests, security checks according to recognized standards, and a senior review. Finally, we launch and provide ongoing operations with monitoring and support.

Why rebuild from scratch? Because in practice, it is usually faster and cheaper than repairing AI-generated code line by line, the structure of which no one consciously designed. The prototype is not lost in the process: it is the most valuable requirements description there is. Whether it was created with Claude Code, Lovable, or another tool makes no difference to us.

Silicon Valley Europe: As domain experts increasingly build their own software, what role remains for professional developers? And how do you use AI in your daily work?

Stefan Kohl: The role is shifting from writing code to taking responsibility. Producing code has become almost free thanks to AI. What is scarce and valuable is judgment: an architecture that still holds up in three years, the knowledge of where security risks lie, and the experience of what can go wrong in operations. Senior developers are becoming more important, not less. What will become significantly harder in the future is pure implementation work without any independent judgment.

I personally work with AI agents daily, whether for programming, testing, or documentation. This has made us many times faster than just two years ago. For me, the limit is clear: the AI suggests, a human decides and signs off. Every feature that goes into production is reviewed by an experienced developer. The challenge is to combine this speed with this discipline.

Silicon Valley Europe: Professional implementation is a noticeable investment for small businesses. How do you respond to the objection that the working prototype is actually enough, and when do you advise against such a project?

Stefan Kohl: With a counter-question: What does it cost you if it goes wrong? A data leak in an application with customer or patient data means reporting obligations, possible fines, and above all a loss of trust that is almost impossible to repair. The costs for security and compliance are incurred anyway, either planned before launch or unplanned and significantly more expensive afterwards. That's why we work with fixed prices and predictable installments so that the risk for the customer remains manageable.

But I also advise against projects, more often than you might think. If an application is only used internally and does not process sensitive data, the prototype is often sufficient. And if it's not yet clear whether anyone will actually pay for the product, you should first validate the business model rather than perfect the infrastructure. I'd rather give an honest no in the initial discussion than take on a project that doesn't pay off for the customer.

Silicon Valley Europe: You've lived in Taiwan for many years, but your company is based in Graz. What can Europe learn from Asia's implementation pace, and where could the European approach with data protection and clear rules become a competitive advantage?

Stefan Kohl: In Taiwan, I learned how much pace is possible when you simply try things out. Decisions are made faster, prototypes reach real users earlier, and failure is less stigmatized. Europe could benefit from this attitude, especially in the SME sector, where projects often get stuck in coordination loops for months before the first line of code is written.

At the same time, from the outside, I see more clearly what makes Europe unique. Data protection and clear rules are often perceived here only as a brake. But globally, the demand for technology you can trust is growing. "Made in Europe" could become for digital products what it already is for machinery: a seal of quality. To achieve this, we need to stop treating regulation as mere administration and start selling security and sovereignty as product features. For me, the combination of Asian pace and European standards is the core of AnvilStack.

Silicon Valley Europe: If you look five years ahead: How will software development change in small and medium-sized enterprises? And what does Europe need to seize this opportunity instead of creating new dependencies?

Stefan Kohl: I am convinced that in five years, almost every small and medium-sized company will develop its own software, built by the people who have the expertise. The question is no longer whether a company has its own digital tools, but who owns them and where they run. Development will become a collaboration between subject-matter experts, AI, and experienced engineers who ensure stability and security.

For Europe to seize this opportunity, three things are needed: First, an awareness among senior management that every architectural decision is also a sovereignty decision. Second, European infrastructure that is as easy to use as that of the hyperscalers. We are closer to this than many believe. And third, the courage to not only regulate the tools of the future but to build them ourselves. Europe has the ideas and the know-how. Now it’s about bringing them into production.

Silicon Valley Europe: Many thanks for these clear words and a look behind the scenes of AI-built software. And of course, best regards to Taiwan.