An agency built your app with AI and didn't tell you. Now what?

It usually surfaces by accident. A new hire glances at the code. A different contractor quotes for a small change and goes quiet. Someone finally opens the folder the agency handed over. And the verdict comes back: most of this was generated by AI, and it shows.

If this has just happened to you, two things before anything else. First, you did nothing wrong. You outsourced in good faith, which businesses have done sensibly for decades, and nobody told you a machine would be doing the work. Second, your app is almost certainly salvageable. The panic you’re feeling is usually worse than the facts.

Here’s how to think about it, in order.

Why this happened (it’s economics, not malice)

An agency that quoted you three months of developer time can now produce something demo-ready in three weeks with AI tools, and the price you agreed didn’t change. Some agencies use these tools carefully, with senior engineers reviewing everything. The ones that caused this article do not. The incentive is to deliver something that passes your acceptance demo, invoice, and move to the next client before the corners they cut become visible.

The corners are real, though: AI-generated code tends to look finished while skipping the unglamorous parts that make software safe to run for years, namely security, error handling, performance under load, and any documentation a future maintainer would need.

This week: secure what you own

Before worrying about code quality, make sure you actually control your own system. This is the step people skip, and it’s the one that turns a nuisance into a crisis when a supplier vanishes for good.

Get the accounts. Hosting, domain name, database, email service, payment provider, code repository. Each should be owned by an account your business controls, not the agency’s. If any of them are in the supplier’s name, request transfers now, while relations are civil.

Get the code. You paid for it; make sure a complete, current copy exists somewhere you control. If the contract is vague about ownership, read it properly, and if the code only exists on the agency’s systems, treat that as urgent.

Check the backups. Ask where backups go, and ask when one was last actually restored. An untested backup is a hope, not a plan.

Write down who you’d call. If it broke tomorrow at 9am, who fixes it? If the honest answer is “nobody”, knowing that today is far better than finding out live.

This month: find out what you actually received

Resist the two extreme reactions. One is to assume it’s all junk and pay for a rewrite, which is what the next agency you ask will probably recommend, since rewrites are what they sell. The other is to assume that because it works today it will keep working, which is how the quiet failures get expensive.

The truth is nearly always in between. AI gets a fair amount right, and an independent review can tell you which parts those are: what’s genuinely at risk, what isn’t, what needs fixing first, and roughly what that should cost. Independent matters here. You want the verdict from someone who profits from telling you the truth, not from the size of the rebuild.

If the system handles payments or personal data, make the security part of that review a priority rather than a nice-to-have. Under UK GDPR, the data protection obligations sit with you, not with the supplier who wrote the code.

What about the agency?

You may have remedies, especially if the contract specified qualified developers or the deliverable falls short of what was promised. That’s a conversation for a solicitor, and it goes better when you arrive with an independent technical assessment in hand rather than a feeling.

But keep the two tracks separate. Pursuing the supplier is about recovering money; securing and understanding your system is about protecting your business. Do the second one first, whatever you decide about the first.

The reassuring part

We see systems like this regularly, and the endings are mostly undramatic. A repair plan, a few weeks of careful work on the parts that matter, and the business moves on with software it finally understands and controls. The expensive stories are almost always the ones where the discovery was ignored until something forced the issue.

You’ve made the discovery. That puts you ahead of most.