Key Takeaways
- Maintaining an AI-built app takes six separate jobs, and each needs a named owner.
- In a May 2026 study of 100 open-source repositories, humans made 83% of the follow-up commits on AI-generated files.
- The AI model inside your app has a retirement date. OpenAI lists a January 14, 2027 shutdown for several GPT-4o and GPT-4.1 versions.
- RedAccess found about 2,000 corporate apps on vibe-coding platforms exposing sensitive data with no authentication or audit trail.
- A governed platform such as Mendix moves the six jobs onto a calendar and into a model other people can read. It leaves your data, permissions, and business rules with you.
The app took an afternoon to build. Keeping it running takes six separate jobs.
Ask who owns them. The usual answer is the person who built it, in the gaps of their real job. That holds until they change roles, go on leave, or the AI model inside the app is retired.
What does maintaining an AI-built application involve?
Each of the six jobs has an owner, whether you named one or not.
| Job | What it involves | Self-hosted AI-built app | Governed platform (e.g., Mendix) |
|---|---|---|---|
| 1. Platform and runtime upkeep | Hosting, operating system and framework updates, uptime | Whoever set up the hosting | Platform vendor, under shared responsibility. You schedule upgrades. |
| 2. Dependencies and security | Libraries, known vulnerabilities, review of AI-written code | The builder, if they know to look | Platform flags known vulnerabilities. You review and fix your own app. |
| 3. The AI model underneath | Model retirements, changes in output | The builder. Vendors retire models on their own schedule. | You, with agent versioning, traces, and approval steps |
| 4. Changing business rules | New fields, approvals, process changes | The builder, if still around | Your team or a partner, in a model a non-author can open |
| 5. Access, audit, compliance | Who sees what, and the record of who did what | Often missing unless someone adds it | You configure it. The platform provides the controls. |
| 6. Knowing how it works | Documentation and a second person who understands it | The builder, alone | A readable model plus a named owner |
Every business application needs these. AI changes how fast the first version appears, and it adds job three, the model underneath.
Jason Lemkin, who runs SaaStr, built a dozen vibe-coded apps that have been used more than 800,000 times. In January 2026 he wrote that he maintains them every day, which takes him 30 to 60 minutes. He is a technical founder who chose that work. The person who built your app may not have.
Can the AI that built it keep maintaining it?
Partly. The best data we found is a May 2026 study of 100 popular open-source repositories. On files written by AI agents, humans made 83.21% of the follow-up commits over at least six months, and agents made 16.79%.
The same study found AI-written files needed less maintenance than human-written ones. In the first month they drew about half as many commits. That is good news, and it still leaves a person doing most of the work. These are open-source projects, not business applications, so read it as a signal. Veracode’s July 2026 report found AI-generated code passes security tests 56% of the time, essentially unchanged from last year.
What happens when the AI model inside your app is retired?
If your app calls an AI model, that model has a retirement date.
OpenAI’s deprecations page lists a January 14, 2027 shutdown for several GPT-4o and GPT-4.1 versions, announced October 14, 2026. Anthropic says it gives at least 60 days’ notice before retiring a public model.
Anthropic’s documentation says requests to a retired model fail. Someone has to read the notice, test the replacement, and switch before the date. If nobody owns the app, nobody reads the notice.
What happens when nobody owns the app?
It runs until something breaks, or until somebody else finds it.
RedAccess scanned more than 380,000 assets on vibe-coding platforms including Lovable, Replit, and Base44, and identified 5,000 built for corporate use. About 40% of those, roughly 2,000 apps, exposed sensitive data with no authentication, access controls, or audit trail. TechTarget reported that many sat on outside platforms and appeared in no company asset inventory.
We are not anti-vibe-coding. We use AI in our own build process every day. An app with no owner is the problem, whoever built it.
Who can own an AI-built application after launch?
Four answers work, in different situations.
| Owner | Fits when | Watch for |
|---|---|---|
| The builder | A small internal tool, low-risk data, and a builder with time | One person who understands it, and what happens when they change roles |
| Your internal IT team | IT has capacity and the app is registered with them | A queue, and a team that may not know the app’s model or business rules |
| A governed platform plus your team | The app touches regulated data or many users, and you have people to run it | The platform covers infrastructure. You still own data, permissions, and your app’s fixes. |
| A partner on a monthly plan | You lack internal capacity, or you want continuity past any one person | Choose one that stays after go-live and doesn’t require lock-in |
If you are still deciding whether to build at all, start with The Build vs. Buy Decision Every Operations Leader Will Face in 2027.
We partner, we don’t vanish. Our ongoing development plan runs month to month and doesn’t require lock-in.
How does a governed platform change who maintains what?
A governed platform moves the six jobs onto a calendar and into a model other people can read.
On Mendix, where VeilSun is a Gold Partner, Mendix manages the infrastructure, platform security, and network controls under its shared-responsibility model. You keep your data, permissions, compliance, and the fixes to your own app.
Picture a plant engineer who builds a work-order app, then moves to another site. On a platform, the next person opens the model, reads the logic, and keeps going. On a self-hosted AI-built app, they may be reading code nobody on the team has seen. (An illustration, not a client story.)
This is Structure Before AI in practice: foundation first, AI on top.
For more on the platform, see our posts on why Siemens is betting on Mendix and when Mendix App Store components aren’t enough, or our Mendix page.
What should you settle before an AI-built app goes live?
Answer these five in writing before launch.
- Who is the named owner, and who covers when they are out?
- Where does it run, and who patches it?
- Which AI model does it call, and when does that version retire?
- Who can see what, and is there an audit trail?
- Where is it documented so a second person can change it?
Every question without a name beside it is a gap. Send the list to whoever built the app and compare answers.
AI speeds the build. A named person makes it dependable. That is HI × AI = FIRE: human intelligence times AI.
Find out who owns your applications and what they need next
If you already run custom applications, AI-built or not, start with what you have. Our App Checkup reviews an existing application on Quickbase, Mendix, or custom code and ranks what to fix first. Bring the five questions above and we will work through them with you.
If you are earlier than that, a discovery call works too. We will talk through what you have built and what it needs.
Book a consultation
Frequently Asked Questions
Who maintains an AI-built application after it goes live?
Whoever is assigned to, and by default that is whoever built it. In a May 2026 study of 100 open-source repositories, humans made 83% of the follow-up commits on AI-generated files. Maintenance covers six jobs, from platform upkeep to knowing how the app works, and each needs a named owner.
Can AI maintain its own code?
In part. AI agents made about 17% of the follow-up commits on AI-generated files in that study, and AI-generated code passed security tests 56% of the time in Veracode’s July 2026 report. Treat AI-written changes like any unreviewed code, with a person reviewing them.
What happens when the AI model inside an app is retired?
Requests to a retired model fail, according to Anthropic’s documentation, so the feature stops working until someone switches it. OpenAI lists a January 14, 2027 shutdown for several GPT-4o and GPT-4.1 versions. Someone has to test the replacement and switch before the date.
What happens to AI-built apps nobody owns?
Many sit outside any company asset inventory. RedAccess scanned vibe-coding platforms and found about 2,000 corporate apps exposing sensitive data with no authentication, access controls, or audit trail, as TechTarget reported in June 2026.
Does a governed platform like Mendix remove the maintenance work?
No. Mendix manages the infrastructure, platform security, and network controls under its shared-responsibility model. You still own your data, permissions, compliance, and your application’s own fixes and business rules.
