Leveraging Requirements Engineering for AI Coding Tool Success

As AI generates more code, the role of developers is shifting from writing code to orchestrating AI coding assistants and agentic AI to achieve organizational outcomes. In fact, consulting firm Gartner predicts that shift will mostly be complete by 2028 with 90% of enterprise software engineers using AI code assistants.^a

Amid the shift to AI coding, whether a project succeeds or fails depends less on the speed and facility of AI coding than on how well developers and subject matter experts scope the project. That’s because while AI code looks good in review, shortcomings arise once it is put into production.

More than three-quarters of technology decision makers surveyed by Hanover Research reported that the reliability of AI code degrades due to measurable spikes in product incidents, increases in senior developer firefighting, and production failures linked to AI code.^b

That’s where requirements engineering comes in. Requirements engineering addresses how well developers and subject matter experts and developers understand the goals that a product is designed to achieve and the capabilities of the finished product.

“The reality is that AI is excellent at execution but poor at resolving ambiguity,” said Vit Koval, co-founder of GoGloby, a B2B AI engineering firm. “By forcing teams to answer critical questions upfront, requirements engineering helps identify edge cases early, align expectations, and reduce structural instability that often delays mid-sized SaaS projects by months.”

When and How AI Code Falls Short

While AI coding cuts the time required for initial coding, bottlenecks shift to later in the development cycle due to a number of factors, including the lack of scope clarity, the changing bases AI uses to code, security shortfalls, and more.

“When writing code was the slow part, incomplete requirements often surfaced naturally during development,” said Disha Patel, a software engineer and published machine learning researcher. “Engineers would discover ambiguities, ask questions, and refine the design as they went.

“AI can generate working code so quickly that those gaps are easier to miss,” she continued. “It will faithfully implement an incomplete or ambiguous requirement, producing software that appears correct while violating the intended behavior.”

The speed at which AI tools generate code can turn into a challenge when they generate code that is unnecessarily complicated, said Anand Rao, a distinguished services professor of applied data science and AI in the Heinz College of Information Systems and Public Policy at Carnegie Mellon University. “When you give an initial idea to systems like Claude, it will build out all the way to the end, giving you a very very complicated directory structure system, which includes more than 10,000 or 20,000 lines of code,” he said. “You wonder as a developer how you can test any of that.”

For Kriti Fajudar, a senior product manager at Microsoft, the fact that AI can write the code means upfront thinking matters more, rather than less; some developers conflate speed with quality. “AI is very good at producing plausible code fast, so the cost of building the wrong thing has dropped to almost nothing,” he said. “You can now generate a fully working feature nobody asked for in an afternoon.”

The consequences of relying on AI tools to generate correct, useful, and targeted code are high, and also include:

Plausible but wrong code: Code that seems correct, but that does not fulfill the actual intent of the developer;^c
Fabricated dependencies: Hallucinated software package names that create vulnerabilities that hackers can exploit;^d
Reproducibility failures: Nearly one-third of AI-generated projects fail to execute as specified according a 2026 survey of 300 AI-generated development projects;^e
Security correctness gap: Across initial and improved AI models, AI-generated code is insecure for both cross-site scripting attacks (86% of the time) and log injection attacks.^f

How Requirements Engineering Helps

The discipline of requirements engineering counteracts many of the tendencies within AI that undermine development. Requirements engineering establishes the explicit, verified specification of what a software system must accomplish, constraining development to a defined and testable scope.

“I urge the students and the companies that I work with to go through the discipline of scoping, getting the requirements, designing, architecting and exploring different options for their development projects,” said Rao.

Rao suggested developers and subject matter experts use AI to help tease out requirements and specifications that aren’t initially explicit. “If you move your load earlier in terms of the requirements of a development project, you’re actually better off, because you can develop in a more phased manner,” he said. “I’ve found that painting the big picture but asking the AI to work through it in bite-size chunks works better because it is easier to test.”

Rohit Poduval, senior software engineer at Amazon, said that bite-sizing AI coding helps avoid problems. “AI coding assistants have context limits,” he said. “Give an AI a massive, unspecified task and it hallucinates. Give it a small, well-scoped task with clear acceptance criteria and it executes cleanly. Spec-driven development isn’t just good engineering practice any more, it’s how you make AI-assisted development actually work.”

Requirements engineering places clarity at the beginning of the development process, which means subject matter experts and developers need to understand exactly what they are building and how users will interact with the product they have in mind. For Edward Tian, co-founder of GPTZero, an AI-text identification platform, “There is a clear correlation between the amount of time spent as a team clearly defining the user problem in layman’s terms, prior to coding software, and the resulting success of that software product in relation to meeting its original vision.”

Alejandro Declerk, senior AI manager at Veritas Automata, a regulated-industry AI integrator, identified two ways that AI works. The first is quickly, using informal input when prototyping to show a working demo within 48 hours. The second is formal requirements. “With a clear and complete spec, the cost goes down and the quality goes up,” he said. “The spec guides the model, so the model doesn’t have to guess. This is where the problems like defects, wrong features, and budget overruns are prevented.”

Footnotes

a. Gartner Identifies the Top Strategic Trends in Software Engineering for 2025 and Beyond, Gartner (July 1, 2025), https://www.gartner.com/en/newsroom/press-releases/2025-07-01-gartner-identifies-the-top-strategic-trends-in-software-engineering-for-2025-and-beyond

b. Introducing the State of AI Coding 2026, New Relic (June 10, 2026), https://newrelic.com/blog/ai/state-of-ai-coding-2026

c. Intent Formalization: A Grand Challenge for Reliable Coding in the Age of AI Agents, arXiv, https://arxiv.org/pdf/2603.17150

d. Slopsquatting: AI Code Hallucinations Fuel Supply Chain Attacks, Cloud Security AI Safety Initiative (April 19, 2026), https://labs.cloudsecurityalliance.org/wp-content/uploads/2026/04/CSA_research_note_slopsquatting-ai-supply-chain_20260419-csa-styled-1.pdf

e. AI-Generated Code is Not Reproducible (Yet): An Empirical Study of Dependency Gaps in LLM-Based Coding Agents, arXiv (March 23, 2026), https://arxiv.org/html/2512.22387v3

f. AI-Generated Code: A Double-Edged Sword for Developers, Veracode (Sept. 9, 2025), https://www.veracode.com/blog/ai-generated-code-security-risks/

Amy Buttell is a Silver Spring, MD-based technology, legal, and business journalist, content creator, writer, and ghostwriter.

Submit an Article to CACM

CACM welcomes unsolicited submissions on topics of relevance and value to the computing community.

You Just Read