UK government eyes GBP £45 billion savings with AI-assisted coding

The UK Government has disclosed significant efficiency gains following a trial involving the use of artificial intelligence to assist civil servants with coding tasks. According to government figures, the initiative has potentially saved as much as six working weeks per year through the outsourcing of programming workloads to AI tools. These productivity gains form part of a wider strategy aimed at digitising public services and streamlining bureaucracy.

The government's announcement included a projection that the adoption of AI-generated code could lead to cost savings of up to GBP £45 billion across the Civil Service. As pressure grows to deliver public services more efficiently, the promise of artificial intelligence to automate routine tasks continues to attract official attention. Yet industry experts warn that the government's enthusiasm must be matched by careful management of technical and security risks, as well as a comprehensive approach to automation.

Nigel Douglas, Head of Developer Relations at Belfast-based supply chain security firm Cloudsmith, welcomed the productivity improvements but cautioned about the security ramifications of AI coding assistants such as Github Copilot and Google Gemini Code Assist. "Looking at this UK Government trial, it's encouraging to see that only 15% of AI-generated code was used without any edits, and that users are finding great productivity boosts in these assistants, but I don't see much evidence of secure-by-design thinking," said Douglas.

Douglas highlighted that these tools expand the potential attack surface within an organisation. He pointed to vulnerabilities such as "slopsquatting", an attack that relies on AI's tendency to generate plausible but fabricated code or names, which could result in malicious code being inserted into live government systems. "If exploited, this supply chain risk would have direct access to the UK Government's codebase – which is pretty scary," Douglas noted.

He stressed that current AI coding tools generally focus on solving immediate problems rather than embedding security as a core consideration. For instance, if tasked with creating a deployment manifest for a web application, AI might not address whether the security context has been properly configured. "Of course, you can work with tools like ChatGPT and Gemini to ask them how to make a deployment more secure, but this requires some form of understanding of potential security implications before you request that code snippet," Douglas said.

Douglas warned that without automated security checks or policy enforcement, excessive reliance on AI coding could inadvertently introduce vulnerabilities into the government's software supply chain, potentially compromising critical systems. "We're getting past the point where it's acceptable for software development teams to 'hope for the best' – you've got to be able to verify the provenance of the ingredients flowing through your software supply chain and into production systems, and you need tools to help respond to newly emerging threats that may impact what you've already deployed."

Martin Reynolds, Field CTO at software delivery platform Harness, echoed the view that the current use of AI may not fully deliver on promised savings unless automation continues beyond simple code generation. "The government's update on its AI-assisted coding programme is promising, but it risks falling short of the GBP £45 billion savings target if automation stops with writing code. While AI is creating an initial velocity boost, 85% of government AI-generated code still needs to be manually edited by engineers," Reynolds commented.

He noted that significant manual intervention remains necessary in the post-generation stages, including testing, security scanning, deployment, and ongoing verification. These steps are vital to ensure any code, whether generated by humans or AI, is fit for deployment in complex live systems. "To unlock the full impact, the UK government must pair AI-generated code creation with automation across the entire software delivery lifecycle – giving them the guardrails they need to innovate without losing pace," Reynolds suggested.

Reynolds added that by integrating advanced automation and quality controls throughout all software development stages, not just coding, the government could surpass its own savings target while also enhancing the speed and safety of public service delivery.

The push to introduce AI into the UK's public sector reflects a global trend among governments seeking greater efficiency through technology. But as experts have underscored, ensuring that these promises do not come at the expense of software security and public trust will remain crucial as adoption widens.