AI and your website: how we use AI to build better, and where we never let it decide

Every web design company is now asked the same question: "Do you use AI?" The honest answer is yes, and the more useful answer is how. Used well, AI makes good work faster and gives more attention to the hard parts. Used carelessly, it produces confident, polished, plausible mistakes, and they are expensive because they look fine until they fail.

This article explains where we use AI, where we deliberately do not, what the research says about the risks, and what it all means for the quality, search ranking and security of your website. I would rather you hear it from me than guess.

Where AI genuinely helps

We treat AI as a quick, tireless junior colleague who has read a great deal and is wrong often enough that nothing is accepted without checking. In that role it is useful for:

• Drafting and exploring. A first outline, three alternative headlines, a list of questions customers might ask. Drafts are raw material, never the finished product.
• Routine code. Repetitive scaffolding, conversions, small utilities and boilerplate that no one enjoys writing. We still read every line.
• Writing tests. AI is good at proposing edge cases a tired human forgets: empty input, huge input, odd characters, two clicks at once. We review the tests too.
• Research and summaries. Pulling together documentation, comparing options, finding the right standard. Anything that matters is checked against the original source.
• Refactoring and explaining. Tidying old code and describing what a confusing function does.
• Accessibility and quality hints. Suggestions about missing labels or contrast issues, which a person then verifies by testing.

Where we never let AI decide

Some decisions need responsibility, context and accountability. A model has none of these. We keep a human firmly in charge of:

1. Architecture. How the system is structured, where data lives, what depends on what. Wrong choices here are costly to reverse.
2. Security. Who may see and do what, how sign-in works, how money moves, how files are accepted. Models happily produce code that works and is unsafe.
3. Accessibility. Real usability needs a keyboard, a screen reader and common sense. A tool cannot tell you whether a page is pleasant to use.
4. Facts, claims and numbers. Statistics, laws, prices and promises. Language models can state invented facts as calmly as true ones, so every figure we publish links to its source.
5. Reviews and testimonials. We never generate them. The reviews on our site come from real clients, and the case studies we label as concepts say so plainly.
6. Your brand voice and your strategy. These come from listening to you, not from the average of the internet.

What the research says about AI-written code

This is not a hypothetical worry. In 2025 the application security company Veracode tested more than 100 large language models on 80 coding tasks, each with a secure and an insecure way of writing it. The models chose the insecure option in 45% of cases. The weaknesses were not exotic: for example, the generated code failed to defend against cross-site scripting in the large majority of the relevant samples, and some languages fared worse than others. The vulnerabilities fell into the categories listed in the OWASP Top 10, the standard list of web security risks.

Two cautions are fair. The 45% figure describes the share of test cases in a controlled study, not the proportion of all AI-written code in the world, and models keep improving. But the lesson for anyone building websites is clear and not controversial: code written by AI deserves at least the review you would give code written by a stranger. That is exactly how we treat it.

What our process looks like in practice

• A person owns every line. If AI helped to write something, a developer reads it, understands it and takes responsibility for it, the same as anything else.
• Automated tests stand guard. Our own client portal is covered by more than 330 automated checks that run before each release. If a change, however it was written, breaks sign-in, permissions, payments or uploads, the tests fail and nothing ships.
• Security review is separate from writing. We check input validation, access control and error handling deliberately, against known risk lists, instead of trusting that code looks right.
• Dependencies are checked. AI tools sometimes suggest libraries that are abandoned or do not exist. We verify every package before it goes anywhere near a client project.
• Secrets and customer data stay out of prompts. Passwords, keys, personal data and anything confidential are not pasted into AI tools.
• We test the result as a user would. On real phones, with a keyboard, with slow connections.

For a deeper look at the habits behind this, see how we build a website.

AI, content and Google: what actually matters for ranking

A common fear is that using AI for text will get a site penalised. Google's published position is more nuanced. It says it rewards original, high-quality, people-first content that shows experience, expertise, authoritativeness and trust, however the content is produced, and that using automation, including AI, mainly to manipulate rankings is a violation of its spam policies. In 2024 Google added a policy against scaled content abuse, which targets mass-producing low-value pages regardless of whether people or machines make them.

The practical meaning for you:

• Do not mass-produce pages. Hundreds of near-identical "location" or "service" pages generated by a tool are exactly what the policy aims at.
• Add what only you can add. Real photos, real prices and processes, real stories from real customers, your own expertise. That is what a machine cannot copy.
• Be clear about who is behind the page. Authors, an About page, contact details and honest sourcing all build trust.
• Check every fact. One confident falsehood can undo a page's credibility.

We help clients plan content that is original, structured and useful, and we link every claim we make on our own blog to a source, so readers and search engines can verify it.

Building AI features for your customers

Sometimes the question is not how we use AI but whether your website should include some: a chat assistant, a product finder, a recommendation. We are cautious but not against it. The rule is that AI on your site should be honest, useful and easy to leave. On our own site, for example, the assistant introduces itself as a guide, helps people find things, and offers a way to reach the real person whenever they want, instead of pretending to be human. We explain when AI features are worth building in AI on your website: what is worth building.

If you do add one, plan for the awkward cases: what it says when it does not know, how it avoids giving legal or medical advice, how personal data is handled, and who is accountable for what it says. Those questions matter more than which model is behind it.

Being found by AI assistants too

People increasingly ask AI assistants for recommendations. The advice here is the same as for classic search, plus a few extras: clear, well-structured pages, accurate structured data, honest facts that can be cited, and a short plain-language summary of your business that machines can read. We publish such a summary for our own site, and we can do the same for yours.

AI website builders and AI-generated sites: an honest comparison

You may have seen tools that promise a complete website from a single sentence. They can be a perfectly reasonable start for a hobby page or a quick test. For a business that depends on its website, the gaps tend to appear in the places that are hard to see:

• Generic structure. Pages that look plausible but say what every competitor says, with no research into your customers and no reason for anyone to choose you.
• Missing foundations. No structured data, weak or duplicated titles, headings used for styling instead of meaning, and no redirect plan if you are replacing an existing site.
• Accessibility gaps. Unlabelled forms, poor contrast, image descriptions that describe nothing, and menus that cannot be used with a keyboard.
• Heavy or tangled code. Large scripts, repeated markup and dependencies nobody chose on purpose, which cost speed and make the site hard for anyone to maintain.
• No accountability. When something breaks, or a customer's data is exposed, there is nobody who understands the system and owns the problem.

None of this means AI has no place in the process, which is the point of this article. It means a tool's output is only as trustworthy as the person who checks it.

A short checklist for any AI-assisted project

1. Who reviewed the code, and what did they check?
2. Are there automated tests, and do they run before every release?
3. Where do the facts and statistics come from, and are they linked?
4. What was tested on a real phone and with a keyboard?
5. Who owns the result, and can another developer take it over?

Why this is good for you

The benefit of using AI well is not lower quality at a lower price. It is more time spent on the work that depends on judgement: understanding your customers, designing the experience, testing the details, and keeping your site safe. The speed AI gives us goes back into the care.

Written by Vish Jay

I design and build websites, online stores and business systems for clients in the US, UK, Europe, Australia and Canada, from Colombo, Sri Lanka. When you work with iVishwa, you talk to me directly, from the first call to launch and after.