Vibe Coding for SMEs: Building Internal Tools Without Developers

How small and medium-sized enterprises can create their own internal tools with vibe coding. With 3 practical projects, risk assessment, and a 30-60-90 day plan.

Author: SIMO GmbH
Published on: November 19, 2025
Reading time: 9 minutes
Category: AI Tools & Technology

Most of what is currently written about vibe coding is either hype or scaremongering. Neither helps. The truth lies in between: vibe coding is neither the magic bullet you use to build your own SaaS tomorrow, nor the security nightmare tech blogs are warning about. It is a tool. And like any tool, what matters is who holds it and whether that person knows what they are doing.

As of today, according to Bitkom, 57 percent of German companies are engaging with AI, but only 20 percent use it productively. The other 37 percent are still talking. This article is aimed at those who want to stop talking.

What Vibe Coding Really Is—and What It Is Not

Andrej Karpathy, former AI lead at Tesla and OpenAI co-founder, coined the term in February 2025. The core idea: you describe what you want. The AI writes the code. You accept, iterate, ask follow-up questions—without needing to understand the code in detail.

That sounds appealing. It is. But here lies the trap.

Simon Willison, a well-known developer and one of the sharpest critics of the blind vibe coding approach, draws a clear line: if the AI writes the code and you review it, test it, and understand it—that is no longer vibe coding. That is AI-assisted development. Sensible. Professional. Recommended.

Pure vibe coding without review? For internal tools of small teams with manageable scope, it is justifiable if you know what you are doing. For customer data, external systems, and production environments, it is risky.

No-Code, Vibe Coding, Programming—Where Is the Difference?

No-code tools like Zapier or Make work with predefined building blocks. You connect blocks without any code ever being generated. Fast, but limited—as soon as you want to go outside the intended paths, you hit boundaries.

Vibe coding goes further: here, actual code is generated. Python scripts, web apps, APIs, database queries. The AI writes, you steer through language. No drag-and-drop, but no programming degree needed either.

Traditional development is a different league: architecture decisions, code review, security testing, deployment pipelines. Important, but not required for an internal proposal tool.

The sweet spot for SMEs and self-employed professionals lies in structured vibe coding: implement 70 to 80 percent with AI, understand and verify the remaining 20 to 30 percent yourself. You will not become a developer. You will become a project manager. That is enough.

5 Internal Use Cases That Truly Make Sense

Internal tools are the ideal entry point: manageable user base, controlled risk, direct benefit. The five most common types:

Intake forms with downstream processing—receive, structure, and route requests
Proposal generators with pricing logic and PDF output
Internal dashboards with live data from existing systems
Documentation tools that make knowledge from internal sources retrievable
Ticket triage—automatically categorize and assign incoming requests

All five have one thing in common: they save measurable time, require no external developer, and can be built iteratively.

3 Real-World Projects

Project 1: Automating Order Intake (Timber Construction)

A timber construction business with 18 employees had a classic problem: inquiries came via email, WhatsApp, and phone—and ended up nowhere in a structured way. The office spent 1.5 hours daily sorting through them.

The solution: An intake form on the website that captures inquiries in a structured format. An n8n automation pulls the data, categorizes by order type and urgency, and writes a structured record into the CRM. In parallel, the responsible employee receives a Slack notification with all relevant information.

Tool stack: Typeform for the form, n8n for the automation, Claude for the categorization, HubSpot as CRM. The connecting app—a small Python script—was written by the AI in three iterations. The owner did not understand every line of code in detail but checked every step: What goes in? What comes out? Is the result correct?

Time savings: A solid 8 hours per week. And no order slips through the cracks anymore.

Project 2: Proposal Generator (Window Manufacturing)

A window manufacturer producing custom products, a mix of B2B and B2C. A proposal used to take 30 to 45 minutes: enter measurements, look up prices, assemble the document, generate a PDF, send it off.

The solution: The owner enters measurements and material selection into an internal tool. The AI calculates, the system generates a finished PDF with letterhead, line items, and total price, and sends it via automated email.

What vibe coding concretely means here: The backend—pricing logic, PDF generation, email sending—was written by the AI. The requirements were formulated, every output was manually tested, and there were two rounds of adjustments because the price rounding was off. Total time to MVP: one long afternoon.

Time savings: 20 to 25 minutes per proposal. With 15 proposals per week, that adds up significantly.

Project 3: Ops Dashboard with Alerts

The most complex of the three projects: an internal dashboard that pulls live data from various sources—order status, open invoices, resource utilization—and automatically sends a Slack message when defined thresholds are crossed.

This is where vibe coding requires the most discipline: multiple data sources, multiple dependencies, real risk of data errors if the logic is wrong. The approach: test every data pull individually before integrating it into the dashboard. Small steps. Never build three things at once.

The Risks—Honestly Named

Anyone who understands vibe coding as “just generate and done” is building themselves a problem.

Security vulnerabilities: Veracode analyzed in 2025 that in 45 percent of cases, AI models choose insecure implementations. XSS defense fails in 86 percent of relevant samples. Log injection in 88 percent. These are OWASP Top 10 vulnerabilities straight from the AI output.

Verification debt: According to Sonar, only 48 percent of developers consistently review AI-generated code. 96 percent do not fully trust it but still do not check it. AWS CTO Werner Vogels calls this “verification debt”—an apt term.

Shadow IT: When everyone on the team starts building their own tools without governance, without access rights, without documentation, things quickly become unmanageable. And GDPR-relevant.

“Vibe, Then Verify”—A Structured Approach

The counter-approach to blind accept-all is not “no vibe coding.” It is a structured approach.

The recommendation: treat AI output like code from a junior developer. Review it, but do not rewrite everything from scratch. Specifically:

Run every output in a test environment first
Manually test with real data
Build logging in from the start—not as an afterthought

For n8n workflows: the built-in security audit (n8n audit via CLI or API) checks unprotected webhooks, risky nodes, and credential risks. Use this before any workflow goes live.

Three minimum standards for every project:

No production data during the development phase
Clarify access rights before the first real user
Activate logging before the workflow goes live

That sounds like bureaucracy. It is not. It is the difference between a tool that runs for a year and one that causes problems after three months.

30-60-90 Days: The Startup Plan for SMEs Without an IT Department

30 days: Lay the foundation. Which processes cost the most time? Which data is sensitive, which is uncritical? Which tools are already in use? AI literacy for everyone involved—not optional. The AI literacy obligations under the EU AI Act have been in effect since February 2, 2025.

60 days: First internal tool in production. MVP, not perfection. Logs activated. One person who is responsible. A clear process: Who reports a bug? Who fixes it?

90 days: Three workflows running. Access rights documented, an update process exists. Not six tools at once, not the most complex use case first.

GDPR and EU AI Act—What SMEs Need to Know

If you operate an AI-assisted internal tool, you are likely a “deployer” within the meaning of the EU AI Act. That means: you bear responsibility for governance, logging, and human oversight.

Transparency obligations take full effect from August 2, 2026. But the foundation—data minimization, purpose limitation, traceable processing—already applies now through the GDPR. Start with the question: What data flows through the tool, for what purpose, and who has access?

Frequently Asked Questions

What exactly is vibe coding?

Vibe coding is an approach where software is primarily created through natural language prompts to an AI—without the creator understanding the generated code in detail. The term was coined in February 2025 by AI researcher Andrej Karpathy. In a business context, a structured variant makes sense: the AI generates, you steer and verify.

Do I need programming skills?

No—but you need the understanding of what your tool should accomplish and what good results look like. You formulate requirements, manually test outputs, and steer iteratively. No syntax knowledge needed, but a clear head for processes.

Which internal tools are best suited?

Intake forms with automatic downstream processing, proposal generators with pricing logic and PDF output, and internal dashboards with data from existing systems. All three have short implementation times, limited scope, and direct benefit.

How secure is AI-generated code?

According to Veracode 2025, AI models choose insecure implementations in 45 percent of cases. That does not mean vibe coding is fundamentally insecure—rather that the output must be reviewed, tested, and only then put into production. Plan for logging and access rights from the start.

What does it cost to build internal tools via vibe coding?

The real investment is time and learning effort, not large development costs. Most tools run on cost-effective cloud services or open-source tools like n8n. Those who build the capability internally pay once for training and benefit from it permanently.