AI Is Software

AI systems are software products, subject to the same incentive structures, market pressures, and liability gaps that produced today's unsafe software ecosystem — and they should follow the same Secure by Design Principles.

The newness of AI does not reset the clock on those forces. Every broken pattern from 40 years of software — insecure by default, costs externalized to customers, no manufacturer accountability — is already visible in AI systems. Understanding why human-created software is unsafe today is the prerequisite for not making the same mistakes with AI.

Discussion prompts

• How does your team's view of AI as 'different' shape the security practices you apply to AI products you build or buy?
• Which incentives from the Economics cards are already visible in AI markets (see E-08)?
• What would it take for your organization to hold AI systems to the same security standards as the rest of your software?