06:17 pm
Web developers hold three things AI cannot. Legal accountability. Professional liability. Authority to sign off on compliance.
.png)
Web developers hold three things AI cannot. Legal accountability. Professional liability. Authority to sign off on compliance. An AI tool writes code. It cannot be named in an AODA accessibility complaint. It cannot carry errors and omissions insurance. It cannot answer to a contract when your checkout breaks. Canadian regulators fine businesses, not language models.
That gap explains why serious companies still hire development teams in 2026.
Most articles on this topic argue about creativity and empathy. This one argues about who pays when the website is wrong.
AI builds working prototypes, landing pages, and simple brochure sites in hours. Tools like Lovable, Replit, v0, and Base44 generate React components from plain-English prompts. The output runs. It looks modern. For a founder testing an idea over a weekend, that is real value.
Honest framing matters here. Keyhole Software's 2026 tracking puts AI-generated code at 41% to 46% of new production code. Developers use these tools heavily. The 2025 Stack Overflow Developer Survey put adoption at 84% of respondents. They use these tools or plan to.
The question is not whether AI writes code. It does.
The question is what happens in month seven. A customer using a screen reader cannot complete the checkout. The Ontario government asks who is responsible. A prompt cannot answer.
At AurixLab that question shapes how every build begins.
Legal accountability matters more because regulators penalize the business, not the tool that built the site. A development team signs a contract. It accepts defined scope. It carries professional liability coverage. If the build breaches a standard, a named party holds the obligation.
An AI tool offers none of this. Read the terms of service on any generative platform. They disclaim warranty. They disclaim fitness for purpose. They cap liability at what you paid that month. You own the risk entirely.
Canadian exposure is real. Under the Accessibility for Ontarians with Disabilities Act, corporations face penalties up to $100,000 per day. Directors and officers face up to $50,000 per day. No prompt absorbs that.
Insurance is the mechanism nobody discusses. Established development firms carry errors and omissions coverage. That policy responds when a build causes financial loss. Many Canadian agency contracts also include indemnification clauses. The agency defends you against third-party claims arising from its work.
Ask an AI platform for indemnification. There is no counterparty to ask.
Trust also compounds. Google's quality rater guidelines added Experience to E-E-A-T in December 2022. Google looks for content and products made with first-hand knowledge. A named engineer with shipped work supplies that signal.
AI-built websites commonly miss five Canadian requirements. AODA accessibility standards. Quebec's French-language rules. Law 25 consent architecture. CASL script consent. PIPEDA data handling. Competing articles on this topic mention none of them.
Ontario businesses with 50 or more employees must meet WCAG 2.0 Level AA. That deadline passed on January 1, 2021. It covers public web content published after 2012. The Accessible Canada Act applies parallel duties to federally regulated organizations. Banks, airlines, and telecom providers all fall inside it.
The failure rate is measurable. WebAIM tested the top one million home pages in February 2026. It found 95.9% carried detected WCAG 2 failures. That figure rose from 94.8% a year earlier. Average errors per page climbed 10.1% to 56.1.
WebAIM named a suspected cause. Rising reliance on automated and AI-assisted coding practices reversed years of slow improvement.
Quebec's Bill 96 requires French commercial web content. The French version must sit on terms at least as favourable as any other language. It cannot be a shortened summary. Penalties run from $3,000 to $30,000 per violation. They double on a second offence. No employee threshold exempts a website. A five-person store selling into Quebec is in scope.
Quebec's Law 25 requires explicit, purpose-specific consent. Privacy settings must default to their highest level. Users can request their data in a portable format. Administrative penalties reach $25 million or 4% of worldwide turnover.
CASL regulates installing computer programs on a user's device. That reaches tracking scripts and certain cookie behaviour. Corporate penalties run to $10 million.
An AI generates a cookie banner because banners appear in its training data. It does not know whether your consent flow satisfies Law 25. A developer reads the statute. Then maps the data flows. Then documents the decision.
Documentation itself carries legal weight. Law 25 requires privacy impact assessments before certain data projects begin. Regulators ask to see them. An assessment names the systems, the data categories, and the retention periods.
Nobody can produce that record retroactively from a chat history. A development team builds the record as it builds the site.
AI-written code fails security testing at high rates. Veracode's 2025 GenAI Code Security Report tested output from over 100 large language models. It covered Java, Python, C#, and JavaScript. The finding: 45% of samples failed security testing, introducing OWASP Top 10 vulnerabilities.
The language breakdown is worse than the average suggests. Java failed 72% of the time. C# failed 45%. JavaScript failed 43%. Python failed 38%. Against cross-site scripting, models failed to defend in 86% of relevant samples.
Veracode reported one more finding. Newer models wrote more functional code without writing more secure code. Capability improved. Security stayed flat.
Then there is the dependency problem. Spracklen and colleagues published at USENIX Security 2025. They analyzed 576,000 generated code samples across 16 models. They found 19.7% of recommended packages did not exist. That produced over 205,000 unique fake package names.
Attackers now register those invented names and wait. Researchers call the technique slopsquatting.
The consequences are documented. Axios reported findings from Israeli security firm RedAccess in May 2026. Researchers found roughly 380,000 publicly exposed assets from AI app builders. About 5,000 applications held sensitive corporate data. The leaked material included medical records and banking information. Google had indexed many of those applications.
A developer runs dependency audits. Sets Content Security Policy headers. Reviews authentication logic. Confirms every package resolves to a real maintainer.
Database permissions deserve separate attention. Many AI builders connect a front end straight to a hosted database. Row-level security stays off by default in several of these setups. Any visitor can then query records the interface never displays.
A developer tests that boundary before launch. A prompt reports success because the page renders.
Ownership of purely AI-generated work sits unresolved in Canadian law. The Copyright Act does not require a human author outright. Canadian courts test originality instead.
CCH Canadian Ltd v Law Society of Upper Canada set that standard. A work must reflect skill and judgment. That effort cannot be so trivial it becomes purely mechanical.
That test creates a problem for AI output. The Canadian Intellectual Property Office registered the work Suryast in 2021. It listed a human and an AI as co-authors. The Samuelson-Glushko Canadian Internet Policy and Public Interest Clinic filed to expunge that registration.
An agency contract assigns intellectual property to you in writing. You receive a named assignor and a documented chain of title. Acquirers ask for exactly that paperwork during due diligence.
AI-built sites get harder to maintain because the code duplicates instead of consolidating. GitClear analyzed 623 million code changes from 2023 to 2026. The numbers describe a maintenance problem, not a productivity win.
Duplicated code blocks rose 81%. They reached 73.0 duplicated lines per million changed lines in 2026. That is the highest level GitClear has recorded.
Moved code signals real refactoring. It collapsed from 21% of changes in 2022 to 3.8% in 2026. Copy-paste climbed from 9.4% to 15.7%.
Two more figures matter for a second-year budget. Calls from new code into existing methods fell 35% since 2023. New code now sits isolated rather than connected. Updates to code last touched a year earlier dropped 74%.
Plainly stated: AI writes new code readily and repairs old code rarely. Every duplicated block becomes a place where one fix must land four times. Three of those four get missed.
The productivity assumption also deserves scrutiny. METR ran a randomized controlled trial with 16 experienced open-source developers. They worked in codebases averaging over a million lines. Developers using AI tools finished 19% slower. They had expected a 24% speedup. Afterward they still believed they had been 20% faster.
The perception gap ran roughly 39 percentage points against reality.
Handover is where the cost surfaces. A professional build ships with documentation, version control history, and named dependencies. A new developer reads the commit log and understands the reasoning. An AI-generated codebase carries prompts nobody saved and decisions nobody recorded.
That difference decides whether your second agency quotes a fix or a rebuild.
AI cannot judge business need because it never sees your business. It sees your prompt.
Discovery surfaces what clients forget to mention. The 40% of orders arriving by phone. The seasonal inventory crunch every March. The distributor agreement that forbids public pricing. None of that appears in a brief.
Requirements work is subtraction as much as addition. A developer who has shipped forty sites spots the mismatch. A client asks for a booking system. The business needs a callback form.
AI optimizes for the request as written. It delivers the booking system. It includes a calendar integration nobody will maintain.
Edge cases separate working sites from demo sites. A Canadian checkout handles GST, PST, and HST at different provincial rates. It handles Alberta, which charges no provincial sales tax. It handles shipping to postal codes where couriers refuse delivery.
Developers learn these rules from shipped projects and support tickets. Models learn them from documentation that rarely covers the exceptions.
Real interface craft requires three things. Performance budgets. Testing on actual assistive technology. Design decisions tied to business goals. AI generates layouts resembling good design. It has seen millions of them. Resemblance is not fitness.
Interactive 3D widens the gap sharply. Shopify reported a striking figure. Product interactions involving 3D or AR content converted at a 94% higher rate. That number describes correlation across merchants, not a guaranteed lift. The technical cost of chasing it is substantial.
A WebGL scene ships geometry, textures, and a render loop. Built carelessly, it wrecks Largest Contentful Paint and Interaction to Next Paint. Google measures both as Core Web Vitals.
Built properly, it requires specific engineering. Draco geometry compression. KTX2 texture encoding. Level-of-detail meshes. Lazy instantiation below the fold. A static image fallback for devices without hardware acceleration.
WebAIM's 2026 data shows why complexity punishes careless builds. Average elements per home page rose 22.5% in one year to 1,437. ARIA attributes rose 27% to over 133 per page. More markup produced more errors, not fewer.
Shipping 3D models, motion, and clean interfaces that stay fast is craft work. A Calgary digital marketing agency with in-house 3D capability plans this early. That planning starts at the first wireframe. A prompt does not.
Google ranks by quality signals, not by production method. Its scaled content abuse policy arrived in March 2024. That policy targets pages made primarily to manipulate rankings with little added value. Google applies the same test to thin human-written content.
Practical exposure remains real. Recent core updates hit sites publishing high volumes of near-duplicate programmatic pages. Those pages lacked original research, author credentials, and first-hand experience. Recovery averages around six months.
E-E-A-T makes the human requirement explicit. Experience means content produced with genuine first-hand knowledge. A named developer with a portfolio and shipped work supplies that. A generated page cannot.
An AI website builder fits four situations. Validating an idea. Running a short campaign. Building an internal tool. Operating with no budget. Pretending otherwise would be dishonest.
Use AI when the site handles no personal data. When it takes no payments. When it faces no accessibility obligation. When you can discard it in three months. A conference landing page fits. A photographer's portfolio fits.
Hire a team under different conditions. The site takes payments. It collects personal information. It serves Quebec or Ontario customers under compliance duties. It must survive past year one. It represents a brand where credibility drives revenue.
Statistics Canada reported 19.2% of Canadian businesses used AI in the year to Q2 2026. That figure tripled from 6.1% two years earlier. Adoption is climbing. Regulatory exposure climbs with it.
Ask six questions that separate a development team from a prompt. Who signs the contract? What insurance applies? Which accessibility standard does the build target? Who owns the code? What are the maintenance terms? Who fixes a production outage at 2am?
A capable team answers all six in writing. The answers name a legal entity. A coverage amount. A WCAG conformance level. An IP assignment clause. A support SLA. An on-call contact.
Then ask to see the work. Ask which parts were hardest. A team that has shipped complex builds will have specific answers. Those builds include 3D product experiences and accessible checkout flows. Specific answers about specific failures sound like experience.
One question separates most vendors quickly. Ask how they test accessibility. A team that names screen readers and describes keyboard testing does the work. A team that names only an automated scanner does not.
Decide who carries the risk. AI writes code. Developers accept responsibility for it. Canadian law recognizes only one of those as a party with obligations.
Businesses getting the most from AI in 2026 treat it as one tool. It sits inside a professional process. Developers at AurixLab use AI daily for scaffolding and boilerplate. A named engineer reviews every line. A signed contract stands behind the result.
Choose the arrangement you want standing behind your website when something goes wrong.
1. Can AI build a website that meets WCAG 2.0 Level AA? AI cannot verify WCAG conformance. Conformance requires testing with assistive technology. Automated tools detect roughly 30% to 40% of WCAG issues. The rest needs manual testing with NVDA, JAWS, and VoiceOver. Keyboard-only navigation checks also apply.
2. Who is liable if an AI-built website breaches Canadian privacy law? The business operating the website carries liability. Under Quebec's Law 25 and PIPEDA, the organization collecting personal information is accountable. AI platform terms disclaim warranty. They typically cap liability at fees paid.
3. Does Google penalize websites built with AI tools? Google does not penalize websites by production method. Its scaled content abuse policy targets pages made primarily to manipulate rankings without adding value. That test applies equally to human-written and AI-written pages.
4. How much AI-generated code contains security vulnerabilities? Veracode's 2025 report found 45% of AI-generated samples failed security testing. That covered over 100 models. Java performed worst at 72% failure. Cross-site scripting defences failed in 86% of relevant samples.
5. What is slopsquatting and how does it affect AI-built websites? Slopsquatting means registering package names that AI models invent. Spracklen and colleagues published the finding at USENIX Security 2025. Nearly 19.7% of AI-recommended packages did not exist. That produced over 205,000 unique fake names available for registration.
6. Do Quebec businesses need a French version of their website? Quebec's Bill 96 requires French commercial web content. It must appear on terms at least as favourable as any other language. No employee threshold exempts the requirement. Penalties run from $3,000 to $30,000 per violation.
7. Can I copyright a website that AI generated for me? Copyright in purely AI-generated work remains unsettled in Canada. The CCH Canadian originality test requires skill and judgment beyond the purely mechanical. A Federal Court challenge to AI co-authorship registration is pending.
8. Are developers actually faster when using AI coding tools? METR's randomized controlled trial found the opposite in large codebases. Sixteen experienced developers finished 19% slower with AI tools. Those same developers believed they had been 20% faster.
9. What does AODA non-compliance cost an Ontario business? AODA penalties reach $100,000 per day for corporations. Unincorporated organizations face up to $50,000 per day. Directors and officers face the same $50,000 daily exposure. The WCAG 2.0 Level AA deadline passed on January 1, 2021.
10. Why do AI-generated codebases become expensive to maintain? GitClear analyzed 623 million code changes. Duplicated code blocks rose 81% between 2023 and 2026. Refactoring fell from 21% of changes to 3.8%. Duplicated logic multiplies the cost of every future fix.
11. Can AI build interactive 3D product experiences for websites? AI generates basic Three.js scenes. It does not manage performance budgets. Production 3D needs draco geometry compression, KTX2 textures, and level-of-detail meshes. Devices without hardware acceleration need fallbacks. All of it gets measured against Core Web Vitals.
12. Is it cheaper to fix an AI-built website or rebuild it? Rebuilding usually costs less once architectural problems compound. Duplicated code means one fix must land in multiple places. Missing tests and absent documentation slow every change. Accessibility and consent retrofits typically become rebuilds regardless.