The Bill for AI-Written Code

Code That Passes, Responsibility That Lets It Through

There is a scene that has become common at the development team of a mid-sized SI firm in Busan. A junior developer uses a Copilot-type tool to pull a function in 30 seconds. It works. It passes tests. So it gets merged. No one asks where that code came from, under what inputs it breaks, or whose license it brought along.

The problem is not code that doesn't work — it's code that does. Broken code gets caught at build time. But code that runs fine under normal conditions yet fails under specific inputs, code sourced from GPL repositories, code that reproduces vulnerability patterns patched three years ago — all of that passes. Since GitHub's 2023 analysis reported that a significant proportion of Copilot-written code contained known vulnerability patterns, that signal has not weakened. Stanford researchers observed that developers assisted by AI tend to be overconfident in the security of their own code. Productivity is measured; the debt that productivity drags in is not.

The Illusion That Fast-Following Is Enough

The foundation of Korea's software industry has been fast-following. Rapidly absorbing frameworks others built, transplanting proven architectures, precisely replicating references — these are blameless capabilities, and they genuinely brought us this far.

Generative coding amplifies this fast-following instinct to its extreme. There is no longer even a need to search for something to replicate — the model instantly produces statistically plausible code. The final step of fast-following, the step of finding the answer quickly, has been compressed to nearly zero seconds.

But the essence of frontier technology is that there are no right answers. Which library combinations will become vectors for supply chain attacks five years from now, which auto-generated patterns will become license time bombs as regulations change — these are not things you can know by searching quickly. They are things you can only know after accumulating them inside an organization through countless failures. The fast-following model assumes the answer already exists. But on the question of AI code accountability, there is no answer yet. We have to make one.

Debt Compounds Quietly

The counterargument is straightforward: as tools improve, verification will be automated too — and eventually AI can audit AI code. That is half right. Static analysis and SCA tools are advancing rapidly. But automating verification and automating accountability are different problems. When a vulnerability blows up in production, when a license dispute becomes a lawsuit, the accountable party is not the tool but the company that shipped the code. Automated auditing only lowers the cost of discovery; it does not move the location of responsibility.

The United States and Europe are enshrining this location of responsibility into law. The US has elevated the Software Bill of Materials — SBOM — to a government procurement requirement through executive order and NIST's SSDF. Europe's Cyber Resilience Act places manufacturer liability on defects in shipped software. These countries are not competing to produce code faster; they are building systems to trace code provenance and accountability as industrial infrastructure. They are doing a decade's work over a decade.

What about Korea? The Software Promotion Act and the security vulnerability diagnostic system exist, but the structure for tracking provenance and assigning accountability for AI-generated code is absent. Korea's strength — fast time to market — becomes a weakness here. The faster you ship, the faster untracked debt accumulates. Performance is measured by the quarter; debt compounds annually.

What Should We Accumulate?

What needs to be accumulated is not smarter code generation tools — those can be purchased. What needs to be accumulated is a supply chain accountability structure that traces provenance all the way through. There are three specific things.

First, a mandate for SBOM on all shipped software, with provenance metadata for AI-generated code embedded within it. Second, a system that ensures when vulnerability and license incidents occur, those failures are not discarded but preserved as a shared industry database. Today, when one company gets burned, that experience does not transfer to the next company. If failures do not accumulate as experience, twelve companies will each take on the same debt twelve separate times. Third, a redefinition of the core competency of senior engineers — not the ability to write code, but the ability to take responsibility for code, verify it, and judge its provenance. Generation is done by tools. Judgment is accumulated by people.

This is not a call for more regulation. It is a statement that clarifying the location of responsibility is the very foundation of an industry that produces trustworthy software.

In the age of fast-following, the country that found the right answer fastest won. Now that statistically plausible code is available in zero seconds, the ability to obtain answers quickly is no longer scarce. In the frontier age, the country that formulates the question first wins. Who is accountable for AI-generated code? The country that writes that question into law first will claim the next decade's software supply chain in the name of trust. Are we fast at solving other people's problems — or do we create the problems ourselves?