Pivot and Scale with AI: why a good development partner still matters

It’s been a busy year or so at Pivale. We’ve been following, researching and adopting AI since well before the recent wave of large language models (LLMs) burst into everyone’s consciousness, and this past year we’ve been living our Pivot and Scale philosophy: changing how we work as AI has reshaped what’s possible, and growing what we can deliver for our clients as a result.

By the way: AI before the LLM boom. Our AI work started long before ChatGPT made headlines. We built algorithmic search and text-processing tools that categorised and ranked data against each client’s own schema. That powered their search results, putting the most relevant information first, and fuzzy matching, which finds close matches as well as exact ones.

Along the way, clients and contacts have asked a fair question: If AI can do so much, do businesses still need a software development partner?

I think they do, and this is a quick update on what we’ve learned this past year and why. The way we work has genuinely changed, and so has where we add the most value.

AI is making everyone more capable

I’m a big fan of what AI can do for our clients. On their side, it’s giving people new abilities within their roles. Someone in marketing, operations or finance can now prototype an idea, analyse data or automate a task that once needed a developer or a long wait in a queue.

On our side, every hour we spend working for a client now delivers far more than it used to. Features that might once have taken days can now be built in hours, complete with thorough automated tests.

A recent example is a customer data auditing tool we built for a client’s e-commerce system. With other priorities competing for time, we might once have had to put it off until later. Instead, we fitted it into their existing development programme, and it has already helped them clean up over a hundred customer account records.

More complex features no longer have to wait until time allows. Given a clear specification, even complex work can be rolled out with relative ease.

That’s a big win for everyone. But it isn’t the whole story.

Building fast isn’t the same as building well

Speed is only useful if you’re heading in the right direction. Even with the best AI tools, we find ourselves constantly steering the work towards what actually matters: the client’s business goals, whether a feature is genuinely ready, and whether it will stand up in the real world.

A lot of this comes down to reading the subtext of a request. What a client asks for and what they need aren’t always the same thing. Spotting the difference, and building something that works well for their customers and their team, takes experience and context that AI doesn’t have on its own.

We also think hard about the future. It’s easy to build something quickly that solves today’s problem but closes off options tomorrow. Understanding the underlying systems, designing a good user experience and testing a feature’s purpose against how it has actually been built is where most of our time now goes.

Knowing when to say “done”

One of the most important things we do is act as a gate for quality. That includes spotting the things that shouldn’t be built at all.

AI models love generating new code and adding new layers. Left unchecked, that leads to software that’s bloated, harder to maintain and less efficient over time. Keeping code effective in the long run means knowing when to stop, much like an artist knowing when a painting or a sculpture is finished.

Even with the latest AI models, detailed guidance written into our codebases and our own rules applied, we regularly need to refine what’s been produced. Often that means reminding the AI of design decisions that were already made, and made for good reasons.

Asking the right questions and owning the outcome

AI is only as good as the questions you ask it. The old adage of “garbage in, garbage out” still applies, especially when it comes to decisions about software and how systems are designed.

This matters most for systems that generate and protect revenue. A poorly framed request can introduce new risks, which is why that work needs to happen under the careful watch of people who are both accountable and responsible for the outcome.

Small changes can make a big difference. Think of a ship’s bearing: point it slightly in the wrong direction and, given enough time, you’ll end up well off course if nobody catches it early. Good navigators have always kept the destination in mind and made course corrections along the way.

That’s what we’re here to do. We understand how software projects succeed and fail, and we know the opportunities, pitfalls and trade-offs involved. That experience is what lets us ask the right questions in the first place.

It’s also why people still need to be in the loop. Someone has to be responsible for long-term quality, ready to respond when issues come up, and sure the right security measures are in place. AI is a powerful tool, but it doesn’t take responsibility for the outcome. We do.

More time for what matters most

A welcome side effect of all this is that we have more time for quick iteration and proper conversations with our clients. Our mission has always been to empower clients to make the best use of technology in their businesses, and AI is helping us do that more fully.

We’re seeing the balance tip towards the business consultancy side of our work, which is where I believe Pivale adds the most value. Implementation still matters enormously. There’s no point endlessly discussing features without real results to review and improve on.

What’s changed is that AI is helping us become the expert implementers we’ve always aimed to be: people who understand the business problem first, then deliver a solid solution quickly.

What actually keeps me up at night

Beyond the day-to-day work, the thing that keeps me up at night is security.

The number of security vulnerabilities seems to be growing rapidly, and bad actors have more ways than ever to cause real harm to businesses. Staying hyper-vigilant isn’t optional.

Increasingly, our role will be to keep our clients safe and ready to respond to those threats, while still helping them drive their businesses forward.

By the way: a recent example. Last month’s PHP2Shell vulnerability⁠ (opens in a new tab) affected a huge share of the web. The flaws were reportedly found with the help of AI, and attackers moved quickly once details leaked. Ahead of the official fix, and based on early reports, we switched off the affected upload feature and made sure Cloudflare protections were active. We then patched as soon as updated versions were released, and monitored client sites before, during and after. Careful choice of suppliers, layers of protection and Upsun’s secure hosting meant we were ahead of it. More recently, critical Drupal Commerce vulnerabilities were disclosed, and we patched client sites within 15 minutes of the fixes becoming available. This is where the good and bad uses of AI are playing out right now, and staying on top of security patches is an essential part of our role.

Know where your data goes

If there’s one area of AI adoption that deserves the most attention, it’s data protection. “Shadow AI”, where staff use AI tools the organisation hasn’t approved, is a real and growing concern. It’s all too easy for sensitive customer or business information to end up outside the scope of your data protection policies.

Good staff training and clear guidance on which tools to use, and how, go a long way. When it comes to protecting data, companies really can’t be too careful, and this is where I believe their attention should be as they roll out AI.

Looking ahead to 2027

Next year, I expect (and hope) we’ll enter an era of more sovereign AI, where businesses want closer control over the AI they use and less dependence on the handful of large providers that currently dominate.

Alongside that, we need to be resilient for when the AI bubble bursts^†. That means making sure neither we nor our clients become overly reliant on the big AI players, so a change in pricing, policy or availability doesn’t put critical systems at risk.

^† By ‘burst’, I mean specifically the economics around the way the large AI companies and hardware manufacturers are financed. The technology itself will only continue to evolve as will businesses who find ways to leverage it.

The bigger point is that businesses can no longer delay or ignore the role AI plays in their organisations. It’s already affecting them in many ways, both directly and indirectly.

Why a development partner matters

There’s a lot to discuss about the role of AI in business, and plenty to be cautious about. But I’m confident that enterprise consultancies and development partners like Pivale fill gaps that are essential to our clients’ success: making sure technology is used well, used safely and built with the long term in mind.

These are the things on my mind, and I’m looking forward to many more conversations about the role of AI in our clients’ businesses. If you’d like to talk about what it could mean for yours, whether you’re a new or existing client, I’d love to hear from you.