Vibe Coding for the Mittelstand: When Your Finance Team Suddenly Ships Software

Last quarter your controller built a forecasting tool in Lovable. A salesperson wired up a quote calculator in Cursor over a weekend. Someone in QM used Microsoft Copilot to generate a Power App that now schedules audits. None of these people can read the code that actually runs. None of them filed a ticket with IT. All of them are happier than they have been in years.

Welcome to vibe coding. The term entered the lexicon in February 2025 when AI researcher Andrej Karpathy described a new way of working: describe what you want, accept what the model produces, ship before you understand it¹. Twelve months later, 92 percent of US developers reported using some form of vibe coding in their workflow²⁴. Gartner forecasts that by 2026, 80 percent of low-code and AI-assisted development tool users will sit outside formal IT departments⁹.

For the German Mittelstand this is the most disruptive shift in internal software since SAP. It is not a question of whether your business teams will start building their own software - they already are. The question is whether your IT department leads the wave or gets buried by it. This guide is the operating model for the second option turning into the first.

The Vibe Coding Wave Has Arrived in the Mittelstand

Most German IT leaders still talk about citizen development as something on the horizon. The data says otherwise. The shift has already happened, mostly without IT noticing.

• 80 percent of low-code users non-IT - Gartner predicts that by 2026, developers outside formal IT departments will account for at least 80 percent of the user base for low-code development tools, up from 60 percent in 2021⁹.
• Citizen developers outnumber professional ones - At large enterprises, citizen developers will outnumber professional software developers by a 4 to 1 ratio in 2026 according to Gartner⁹.
• 70 percent of new enterprise apps built outside IT - The same Gartner research projects that 70 percent of new enterprise applications by 2026 will be built by citizen developers rather than traditional IT teams⁹.
• The market is exploding - Gartner expects the low-code development technologies market to reach 44.5 billion US dollars by 2026⁸, with vibe-coding-native tools (Cursor, Lovable, Replit) growing the fastest within that.
• 92 percent of developers vibe-code - Early 2026 surveys find 92 percent of US-based professional developers have adopted some form of vibe coding in their workflows²⁴. This is no longer a niche practice.
• 25 percent of Y Combinator W25 founders ship 95 percent AI-generated code - Inside the Y Combinator Winter 2025 cohort, a quarter of the startups had codebases that were 95 percent AI-generated³. The economic pattern of new software is already vibe-coded.
• Karpathy himself moved on - In early 2026 the inventor of the term declared vibe coding passé in favour of agentic engineering, where senior engineers orchestrate multiple coding agents under oversight³. The Mittelstand is mostly still catching up to vibe coding while the leading edge already shifted.

And the Mittelstand context makes the wave land harder than in larger companies. German SMEs already report extreme IT capacity constraints, the labour shortage is structural rather than cyclical, and the business teams have a long history of solving their own problems with Excel and Access. Vibe coding is the next step in that tradition - whether IT participates or not.

What Vibe Coding Actually Is (and What It Is Not)

Vibe coding is not low-code, not no-code, and not the AI-pair-programming most engineers already use. It sits in its own quadrant. The boundary matters because the right governance for vibe coding is different from the right governance for low-code platforms.

The four quadrants of build

• Pro code - Engineers writing code in an IDE, using AI as autocomplete or pair programmer (GitHub Copilot, Cursor in tab-complete mode). The engineer reads, reviews, and ships every line.
• Agentic engineering - Engineers orchestrating multiple AI coding agents (Claude Code, Codex, Cursor in agent mode), reviewing and integrating their output. Karpathy’s 2026 evolution of vibe coding for production work³.
• Low-code / no-code - Business users (or developers) building apps through visual canvases backed by predefined components (Power Apps, Mendix, OutSystems, Bubble, Airtable). Constrained by the platform, but the platform takes care of most of the engineering.
• Vibe coding - Users describing what they want in natural language to an AI tool that generates real code, with the user often not reading the result (Lovable, Bolt.new, Replit Agent, v0, Power Apps with Copilot in chat mode). Unconstrained by predefined components, accelerated by the model, accountable to no one in the original definition.

What vibe coding feels like in practice

Concrete example. A controller at a Mittelstand machinery firm wants a tool that pulls daily sales orders from SAP, projects revenue against the budget, and emails the leadership team a one-pager every morning. Six months ago this was a quarter-long IT project. Today the controller opens Lovable, types a four-paragraph description, watches the tool generate a full-stack web app with a database and email integration, connects it to a sandbox SAP export, and ships it Monday morning. Total time: two evenings.

The controller does not know what programming language was used. The controller cannot tell whether the SQL is parameterised or vulnerable to injection. The controller’s manager is delighted by the new dashboard. IT learns about it three weeks later when someone in security notices an unfamiliar app calling the SAP REST gateway.

Why the Mittelstand Cannot Ignore This

For the Mittelstand specifically, three structural pressures make vibe coding less optional than for larger firms.

1. The IT bottleneck is structural, not cyclical - Most Mittelstand IT teams operate at 1 to 2 percent of headcount, compared to 4 to 6 percent at larger firms. Internal app requests pile up while the small IT team triages keep-the-lights-on work. Vibe coding redirects the long tail of small requests to the people who actually need them.
2. The skilled labour shortage is permanent - The DIHK reports Germany needs 300,000 skilled foreign workers per year just to maintain current staffing¹⁹, and the OECD projects the working-age population will shrink by 3.9 million by 2030²⁰. The ifo Institute reports 28.3 percent of German companies cannot find enough qualified workers¹⁸. There is no version of the next decade where IT teams grow fast enough to build everything the business asks for.
3. Process knowledge sits in the business - The Mittelstand’s strength is deep operational expertise. The controller knows controlling, the production planner knows production, the sales engineer knows the deal flow. Forcing them to translate that knowledge through a ticket system into IT is exactly where most internal software projects die. Vibe coding lets the domain expert build directly.
4. Existing low-code investments are already there - 88 percent of German Mittelstand firms have Microsoft 365 licences¹⁰. Power Apps with Copilot, Power Automate with Copilot, and Copilot Studio are available the moment a company turns them on. Most do not even know.
5. Competitive pressure from agile firms - The hidden champions that compete on operational excellence will lose to firms that ship 5 internal tools a quarter when they ship 5 a year. The compounding gap closes faster than any other digital transformation lever.

What changes for the Geschäftsführer

The deepest change is not technological, it is organisational. The Mittelstand has historically separated those-who-think-up-software (the business) from those-who-build-it (IT). Vibe coding collapses the distance to a few hours. That has three downstream effects.

• The IT roadmap stops being the bottleneck - Departmental tools that used to be deferred for two years now ship in two days. IT moves up the value chain to integration, security, and the agents that need to be reliable.
• Spec design becomes the strategic skill - The new bottleneck is the quality of the description. Senior people who can write a clear three-page spec become 10 times more productive. People who cannot articulate what they want struggle even with vibe coding tools.
• Quality bar becomes a leadership question - The Geschäftsführer cannot delegate the question of which apps run the business and how they are tested. The wrong answer is to ban vibe coding. The right answer is to define the bar at which a tool moves from sandbox to production.

5 Use Cases That Actually Work

Not every internal tool benefits from vibe coding. The pattern that works is small, departmental, low-stakes, fast-moving. The pattern that fails is anything customer-facing, finance-critical, or data-sensitive without a hardening pass. Here are five use cases that consistently land in the Mittelstand.

Use case 1: Departmental dashboards and reports

Daily operations dashboards, weekly KPI reports, ad-hoc analyses that the BI team would take six months to deliver. The data lives in SAP, DATEV, HubSpot, or a SharePoint export. The user wants a focused view, not a generic BI tool.

• Typical builders - Controllers, sales operations, plant managers, HR business partners.
• Typical tools - Lovable, v0, Cursor, Power Apps with Copilot, Hex.
• Typical timeline - 2 to 8 hours from idea to working prototype.
• Where governance matters - Read-only access to production data, no writebacks, no PII unless reviewed.
• Realistic ROI - 4 to 8 hours per week saved per dashboard, often replacing manual Excel work.

Use case 2: Internal request and approval flows

Holiday requests, capex approvals, supplier onboarding intake, IT access requests, training requests. Most run today through email threads or generic ticketing. A vibe-coded form-plus-workflow ships in days and integrates with Teams or Slack for approvals.

• Typical builders - HR coordinators, office managers, IT helpdesk staff, internal communications.
• Typical tools - Power Apps with Copilot, Bubble, Glide, custom Lovable apps.
• Typical timeline - 1 to 3 days for the first working version.
• Where governance matters - Approval chains touching financial limits or HR data must be reviewed by IT or compliance.
• Realistic ROI - 30 to 60 percent reduction in cycle time for the workflow, plus a clean audit trail.

Use case 3: Quality and operations checklists

Shift handover forms, quality inspection lists, tool calibration logs, machine setup checklists. Most are still on paper or in PDF templates. Vibe-coded mobile apps replace them with timestamped digital records that integrate with the QMS.

• Typical builders - QM officers, shift leads, plant engineers.
• Typical tools - Power Apps with Copilot, AppSheet, Glide, custom Lovable apps.
• Typical timeline - 1 week including pilot on the shop floor.
• Where governance matters - Records that feed ISO 9001 or IATF 16949 audits must be tamper-evident and exportable.
• Realistic ROI - 60 to 80 percent time saving on data capture, plus dramatically better audit-readiness.

Use case 4: Customer-data lookup and prep tools

Sales reps before a call need a one-page customer brief. Account managers preparing a QBR want a quick scorecard. Service techs en route to a job want the install history. Vibe-coded read-only apps over a sandbox CRM export deliver this in days.

• Typical builders - Sales operations, service operations, key account managers.
• Typical tools - Cursor, Lovable, v0 over a CSV or REST endpoint.
• Typical timeline - 3 to 7 days for the first working version.
• Where governance matters - Read-only by default, refreshed nightly, pulled from a sanctioned data source. Writebacks require IT involvement.
• Realistic ROI - 1 to 2 hours per rep per week, better customer interactions, fewer copy-paste errors.

Use case 5: Throwaway analyses and prototypes

The single most underrated use case. Someone wants to test whether a new pricing model works. Someone wants to see if a German labelling regulation breaks the existing product taxonomy. Someone wants to mock up a partner integration before a kickoff meeting. Vibe coding for one-week-throwaways is almost pure upside.

• Typical builders - Product managers, strategy team, internal consulting, the CEO’s office.
• Typical tools - Lovable, Replit Agent, v0, Cursor.
• Typical timeline - 4 hours to 3 days, usually thrown away after.
• Where governance matters - Synthetic data only, sandbox tenant, automatic 30-day expiry. Almost no governance friction needed.
• Realistic ROI - The team learns 3 to 5 things they would not have learned without the prototype, often saving a much larger engineering investment later.

5 Failure Modes to Avoid

The use cases above land when governance is in place. Without governance, the same tools cause five predictable failure modes. Anticipate them before the first prototype ships.

Failure mode 1: The vulnerable app in production

The most consequential failure. A vibe-coded internal app handles employee performance data, customer information, or supplier financials. Independent code-security studies consistently find that 40 to 62 percent of AI-generated code samples contain security vulnerabilities, and that AI-written code produces flaws at 2.74 times the rate of human-written code¹⁵. Without a quality gate, the chance of a vulnerable app reaching production is uncomfortably high.

• Symptoms - SQL injection, exposed API keys in client-side code, missing authentication, broken access control, hardcoded credentials.
• Mitigation - Production gate with automated SAST scan, secret detection, and an actual human review for anything that touches sensitive data.
• Critical rule - No vibe-coded app touches PII, financial data, or production write paths until it has passed the gate.

Failure mode 2: The ghost app graveyard

The team builds 40 prototypes in six months. 32 are abandoned within weeks. 5 are used by exactly one person. 3 become real dependencies for parts of the business. No one tracks which is which. The team that built them is now busy elsewhere. When something breaks, no one knows whether it matters.

• Symptoms - Apps with unclear ownership, unmaintained dependencies, unknown user counts, dead URLs, unanswered support requests.
• Mitigation - 90-day expiry on every sandbox app, mandatory named owner for every production app, quarterly inventory with usage telemetry, automatic archival below a usage threshold.
• Critical rule - Build the gravedigger from day one. The hardest cultural shift is making it OK to delete things people built.

Failure mode 3: Shadow AI everywhere

Most worrying for compliance. Business teams sign up for Lovable, Replit, Cursor, and ChatGPT on personal accounts because IT was too slow to provide them. Customer data flows to vendor APIs that have no DPA. Gartner predicts 40 percent of organisations will suffer security or compliance incidents from shadow AI by 2030⁷.

• Symptoms - Employees mentioning tools you have not procured, payment receipts on personal cards, customer data appearing in third-party logs, GDPR exposure no one mapped.
• Mitigation - Provide sanctioned tools fast. The fastest path is a small but well-resourced sandbox with Copilot for Microsoft 365, Cursor for IT champions, and a pilot Lovable or Power Apps tenant for citizen developers, all on company SSO.
• Critical rule - You do not stop shadow AI by banning AI. You stop it by being faster than the personal-account alternative.

Failure mode 4: The integration debt avalanche

Every vibe-coded app integrates with SAP, DATEV, or another core system in its own way. Some hit REST endpoints, some scrape exports, some embed credentials, some go through Power Automate, some go through homemade Python scripts. Six months in, no one understands how data flows between systems.

• Symptoms - Multiple apps making the same SAP calls with different logic, inconsistent customer or product master data across tools, integration bugs no one can trace.
• Mitigation - IT publishes a small, well-documented set of read-only data products that any app can connect to. Citizen developers consume those instead of integrating directly.
• Critical rule - The integration layer is non-negotiable IT territory. Citizens build on top of it, not around it.

Failure mode 5: The skills two-class society

Subtle but corrosive. The vibe coding programme empowers business teams who happen to be comfortable describing what they want. The teams that struggle - older workers, technical roles with weaker writing skills, non-native German speakers - get left behind. Within a year, the company has a clear two-class structure of those who ship and those who do not.

• Symptoms - The same five departments produce most of the apps, others stop trying, complaints about IT favouritism, fairness questions from the Betriebsrat.
• Mitigation - Active enablement, not just access. Office hours, paired sessions, written guides, multilingual training. Treat citizen development like an apprenticeship system, which the Mittelstand already understands.
• Critical rule - The fairness question is real. Plan for it in the rollout, not after the first internal complaint.

Vibe Coding vs Agentic Engineering: The Quality Bar Question

The most useful framing for the Mittelstand IT leader is the distinction between vibe coding and agentic engineering. Karpathy, who coined vibe coding, declared the term passé in 2026 and now prefers agentic engineering³. The distinction is the difference between raising the floor and raising the ceiling.

• Vibe coding raises the floor - Anyone can ship something. The bar for the first prototype drops from weeks to hours. The risk is that the bar for what reaches production drops with it. Use vibe coding for sandbox, prototype, and throwaway work.
• Agentic engineering raises the ceiling - A senior engineer orchestrates 3 to 10 AI coding agents under explicit oversight, reviewing diffs, designing specs, and accountable for what ships. Production code lands 5 to 10 times faster than traditional development without the floor dropping. Use agentic engineering for production, integration, and anything that needs to be reliable.
• Both are real, both are needed - The Mittelstand needs both lanes. Vibe coding handles the long tail of departmental tools. Agentic engineering handles the spine of integration, security, and the agents that the business actually depends on.

What changes in the engineering workflow

Agentic engineering changes how IT teams operate. The senior engineer becomes a director of multiple agents rather than a single author of code. Reviewing diffs and writing specs becomes 60 to 80 percent of the day. Junior tasks largely disappear. The role of the team lead shifts from work-breakdown to spec design and quality gates.

The Three-Lane Governance Model

The simplest, most defensible governance model for vibe coding in the Mittelstand has three lanes. It maps cleanly to existing IT processes, the Betriebsrat usually accepts it, and IT leaders can explain it to the Geschäftsführer in one slide.

Lane 1: The Sandbox

• Who can ship - Any trained employee with a sandbox account.
• What runs there - Prototypes, dashboards on synthetic or sandbox data, throwaway analyses, first versions of departmental tools.
• Data access - Sandbox copies of production data only, refreshed nightly, no PII unless explicitly approved, no write-back to production systems.
• Tooling - Lovable, Cursor, Replit Agent, Power Apps with Copilot, all on a single tenant with SSO.
• Quality gate - None. Speed is the point.
• Lifetime - 90 days. After 90 days the app expires unless promoted.
• Owner - The builder.

Lane 2: Production

• Who can ship - Trained citizen developers + IT champions, after passing the quality gate.
• What runs there - Departmental tools that actually run the business: dashboards on live data, approval flows, QM checklists, customer lookup tools.
• Data access - Live data through sanctioned data products published by IT. No direct database connections. Writeback only with explicit IT approval.
• Tooling - Same as sandbox plus IT-managed deployment (Vercel, Azure App Service, Power Apps managed environments).
• Quality gate - Automated SAST + secret scan, dependency review, manual security review for anything touching sensitive data, basic test coverage required.
• Lifetime - Unlimited but reviewed quarterly. Apps below a usage threshold (e.g. fewer than 5 active users for 60 days) get archived.
• Owner - Named individual + named team. Documented in the citizen-app inventory.

Lane 3: Critical Systems

• Who can ship - Professional engineers using agentic engineering practices. No citizen development here.
• What runs there - Integration layer, agents that act on production systems, anything customer-facing, anything affecting financial reporting, anything classified as high-risk under the EU AI Act, anything regulated under GoBD.
• Data access - Full, with proper IAM and audit trails.
• Tooling - Cursor in agent mode, Claude Code, Codex, internal AI agent platforms. Code review by a human in every PR, full SDLC, full SecOps integration.
• Quality gate - Standard enterprise SDLC: design review, security review, testing, staging, change approval.
• Lifetime - Maintained as core IT.
• Owner - IT.

The 90-Day Rollout Playbook

The full programme described above takes 6 to 9 months to mature. The 90-day version is the smallest meaningful unit of work that gets a Mittelstand company from no policy to a working three-lane model with first production apps.

Phase 1: Days 1-30 - Discovery and policy

1. Inventory shadow AI usage - One-week survey across all departments. Which AI coding tools are already in use, on which accounts, with what data? Often a long list. The result becomes the legitimisation argument with the Geschäftsführung.
2. Identify the 5 highest-value use cases - Not the 50, the 5. Top candidates are usually departmental dashboards, an approval flow, a QM checklist, a sales lookup tool, and one strategic prototype.
3. Draft the policy - One page, three lanes, named lifecycle for each lane. Plain German. Reviewed by Datenschutz, Betriebsrat, and Steuerberater. Approved by the Geschäftsführer.
4. Pick the tooling - One sandbox tool (typically Lovable or Power Apps with Copilot), one IT tool (typically Cursor + Claude Code or Codex), one production deployment target. Resist the urge to evaluate everything.
5. Run the first AI literacy training - Mandatory under EU AI Act Article 4²¹. 2-hour course tailored to citizen developers, covering vibe coding hygiene, security pitfalls, what data goes where.

Phase 2: Days 31-60 - Sandbox and first prototypes

1. Stand up the sandbox tenant - SSO, sandbox copies of the relevant data, network policy, expiry policy. 2 weeks of IT work for one engineer.
2. Onboard the first cohort - 8 to 15 people across the 5 use-case departments. Office hours twice a week, a #vibe-coding channel in Teams or Slack, a written getting-started guide.
3. Build the first 5 prototypes - Each in its own lane. Time-boxed to 5 days each. The sandbox apps run on sandbox data. Most of them work. Some are surprisingly good. Some flop. Document all of it.
4. Set up the quality gate pipeline - SAST tool, secret scanner, basic dependency check, the manual review checklist. Tooling: GitHub Advanced Security, Snyk, Semgrep, plus an actual reviewer.
5. Establish the inventory - One simple table or app listing every citizen-built tool, owner, lane, last-used date, lifecycle status. Update at least monthly.

Phase 3: Days 61-90 - First production apps and feedback loop

1. Promote the 1 to 3 prototypes that proved valuable - Run them through the gate. Most need 1 to 3 days of hardening - input validation, auth, data minimisation, basic tests. Some need IT to build the integration layer. None should be promoted without explicit owner sign-off.
2. Archive the prototypes that did not prove out - Not all 5 will. Document what was learned, archive the code, free the sandbox space. This is the cultural muscle that keeps the programme honest.
3. Run the first quarterly review - Citizen-app inventory, usage telemetry, gate pass-rate, security findings. Adjust policy if needed.
4. Train the next cohort - Double the size. By now the early adopters can teach.
5. Decide on agentic engineering for IT - Pick one IT-led project to ship using agentic engineering practices. The decision is whether to scale this to the whole IT team next quarter or stay piloted.

Tool Landscape: What to Pick When

The vibe coding tool space changes monthly. The categories below are stable; the leaders shift. As of mid-2026 these are the realistic picks for a German Mittelstand company.

Sandbox tools for citizen developers

• Microsoft Power Apps with Copilot - The default choice if you are already on Microsoft 365. Release Wave 1 2026 added autonomous AI agents to Power Apps and Copilot Studio¹³. Strong governance built in via Power Platform admin. Best for forms, approval flows, internal apps.
• Lovable - Web app generator with one of the strongest natural-language interfaces. Generates real React code. Self-host or cloud. Good for dashboards, internal tools, and prototypes.
• Bolt.new (StackBlitz) - Similar to Lovable, slightly more developer-leaning. Good when the citizen developer has some HTML or SQL background.
• Replit Agent - Strong full-stack agent that works inside the Replit IDE. Better for builders who want to learn over time.
• v0 by Vercel - Best at UI generation. Less complete as a full-stack tool but excellent for component-driven prototypes.
• Glide and AppSheet - Mobile-first, spreadsheet-driven. Excellent for QM checklists and field operations apps.

Tools for IT and agentic engineering

• Cursor - The market default for AI-native IDEs. Tab-complete, agent mode, multi-file edits. Solid pricing for teams.
• Claude Code - Anthropic’s CLI agent. Strong on long-running engineering tasks, refactors, and large codebases.
• OpenAI Codex (GA 2026) - The OpenAI CLI agent. Strong on JavaScript and Python ecosystems.
• GitHub Copilot Agent Mode - The default if you are already on GitHub Enterprise. Works well for incremental engineering work, less for greenfield generation.
• Self-hosted alternatives - Continue.dev, Aider, Cline. Useful when sovereignty or air-gapped environments matter.

Quality gate and governance tooling

• SAST - Snyk, Semgrep, GitHub Advanced Security, Checkmarx. Pick one, run it on every promotion request.
• Secret detection - GitGuardian, TruffleHog, GitHub native scanning.
• Dependency review - Snyk, Dependabot, FOSSA.
• Power Platform CoE Starter Kit - For Power Apps governance specifically. Free, built by Microsoft, mandatory if you scale Power Platform.
• Citizen-app inventory - Often a Power App or Notion page maintained by IT. Off-the-shelf solutions exist (Make, Pomerium) but a simple, owned table works fine.

EU AI Act, GDPR, and Betriebsrat: The Compliance Layer

Vibe coding does not get a compliance pass because it is fast. If anything, it raises the bar - more apps, more builders, more places where data ends up. Three frameworks matter for the Mittelstand.

EU AI Act

• Article 4 (AI literacy) - In force since February 2025. Every company using AI must ensure adequate AI literacy among the people deploying or using AI tools. For citizen developers using vibe coding tools, that means a documented training programme²¹.
• Provider obligations - The AI coding tool itself (Lovable, Cursor) is the provider for AI Act purposes. Your company is the deployer of the tool, with deployer obligations. Most of those flow naturally from the three-lane model.
• Risk classification depends on output - The vibe coded app itself is rarely a regulated AI system. But if it makes high-risk decisions (employment, credit, safety) the high-risk classification applies and the standard high-risk SDLC kicks in. This is where citizen development must hand off to the Critical lane.
• Penalties - Up to 35 million EUR or 7 percent of global turnover for prohibited practices, up to 15 million EUR or 3 percent for other major violations²². SMEs get lower caps and access to regulatory sandboxes.

GDPR (Datenschutz-Grundverordnung)

• Data minimisation in the sandbox - The sandbox tenant should never see raw production data unless the use case demands it. Synthetic data, anonymised exports, or sampled production exports are the default.
• DPA for every tool - Lovable, Cursor, Replit, OpenAI, Anthropic - every tool needs a data-processing agreement on file. Your Datenschutzbeauftragter approves the list. Tools without a DPA do not enter the sandbox tenant.
• Right to erasure - Every production app must support deletion of personal data records on request. This is a checkbox in the quality gate.
• Cross-border transfers - Most leading vibe coding tools are US-based. Standard Contractual Clauses + a transfer impact assessment are standard. Some Mittelstand companies prefer EU-only or self-hosted alternatives for sensitive use cases.

Betriebsrat

• Co-determination is real - The Betriebsrat has co-determination rights under § 87 BetrVG when AI tools handle employee performance data or behaviour. A blanket Betriebsvereinbarung covering the sandbox programme is faster than negotiating each app.
• Transparency wins - Most German Betriebsräte will sign off on a vibe coding programme that includes a public inventory, training, and clear rules on what data citizen apps can touch.
• HR-data apps need extra care - Anything handling performance reviews, attendance, productivity metrics needs a specific Betriebsvereinbarung even within the sandbox programme.

GoBD (German tax archival)

• Anything touching invoices, ledgers, or tax data - Stays out of citizen development. GoBD requires unalterable archives, full audit trails, and Steuerberater alignment. Citizen apps in the production lane can read GoBD-archived data, but the archive itself stays in the Critical lane.
• Reporting and analytics on top of GoBD data - Allowed, useful, and a great citizen-development use case. The original records are unchanged; the citizen tool sits on a downstream copy.

How Superkind Fits

Superkind builds custom AI agents for German SMEs and enterprises. We do not sell a vibe coding tool. We come in where vibe coding stops being the right answer and agentic engineering takes over - the Critical lane in the three-lane model. Here is what we typically do for a Mittelstand company adopting vibe coding seriously.

What Superkind does

• Three-lane model design - We help IT leaders draft the policy, pick the tooling, and align with Datenschutz, Betriebsrat, and Steuerberater. A standard engagement runs 4 to 6 weeks.
• Quality gate pipeline - We set up the SAST + secret-scan + manual-review pipeline that turns sandbox prototypes into production apps. Often integrated with existing GitHub or Azure DevOps.
• Agentic engineering enablement - We help IT teams adopt Cursor, Claude Code, and Codex with the workflows that actually scale. Pair coaching for 4 to 8 weeks per team.
• Production-grade agents on top of citizen apps - When a vibe-coded prototype proves valuable but needs SAP or DATEV integration, sovereignty, or autonomous action, we replace the prototype with a production agent that meets the same need at production reliability.
• Integration layer as a product - We build the read-only data products that citizen apps consume, so IT does not have to expose raw SAP or ERP credentials.
• EU AI Act readiness - Article 4 literacy programme tailored to citizen developers, technical documentation for any high-risk apps, audit trails that hold up to BNetzA scrutiny.
• Sovereignty options - For Mittelstand firms that need EU-only or self-hosted models, we deploy on Aleph Alpha, Mistral, or self-hosted open-weights.
• Sustained partnership - We stay engaged on a retainer, run quarterly reviews, and absorb the agents into the operating model.

Where we deliberately do not compete

• Selling vibe coding licences - That is the job of Lovable, Cursor, and Microsoft. Superkind helps you use them well.
• Training every employee in vibe coding - Internal HR or a specialised training partner usually does this better.
• Replacing your IT department - We make IT 5 to 10 times more effective. We do not become IT.

Decision Framework: Should You Start Now?

Six signals that tell you whether vibe coding is the right move for your company in the next quarter, and what kind of move it should be.

Frequently Asked Questions

Related Articles

• Shadow AI in the Mittelstand: The Governance Playbook
• AI Literacy for the Mittelstand: How to Implement Article 4 of the EU AI Act in Practice
• AI Agents vs Microsoft Copilot: When Custom Is Worth the Premium for the Mittelstand
• Which LLM Should the Mittelstand Choose? GPT, Claude, Gemini and Mistral Compared
• AI Agent Security: Prompt Injection, Data Leakage, and the OWASP LLM Top 10 for the Mittelstand
• AI Agents on Top of Legacy: How the Mittelstand Modernises Without Ripping Out the ERP
• Fix Your Processes Before You Add AI: Why AI Cannot Save a Broken Workflow

Henri Jung

Co-founder of Superkind, where he helps SMEs and enterprises deploy custom AI agents that actually fit how their teams work. Henri is passionate about closing the gap between what AI can do and the value it creates in real companies. He believes the Mittelstand has everything it needs to lead in AI - it just needs the right approach.