Last week, a Salesforce admin survey dropped a number that should make every Australian SMB owner stop and think: 59 percent of admins said Salesforce is "becoming increasingly complex to work with."
The response from the market? A growing number of small and medium businesses are building their own CRMs — not by buying software, but by prompting AI coding assistants to generate custom systems from scratch.
According to a Forbes report published July 12, 2026, SMBs are using "vibe coding" — describing their business requirements to an AI assistant and getting back a working CRM — as a direct replacement for enterprise platforms like Salesforce. The motivation is straightforward: cost, complexity, and control.
But there is a blind spot in every single one of these builds. And it is the same blind spot in every AI-generated business system.
What "Vibe-Coded CRM" Actually Means
Picture a tradie who needs to track customer inquiries, quotes, jobs, and invoices. Instead of paying $150 per user per month for Salesforce and spending weeks configuring it, they open Claude Code or Cursor and describe what they want:
"Build me a CRM where I can add a customer, create a quote, convert it to a job, and send an invoice. Store everything in a database. Let me search by customer name or job date."
Twenty minutes later, they have a working system. It does exactly what they asked for. It's custom, lightweight, and cost nothing beyond the AI subscription.
This is happening at scale. And for the businesses doing it, the benefits are real:
- Cost: A few dollars of AI compute versus thousands in SaaS subscriptions
- Speed: Hours instead of weeks
- Control: Every feature exists because you asked for it
- Ownership: Your data stays on your infrastructure
The Blind Spot Nobody's Discussing
Here is what those same SMBs are not building into their custom CRMs:
- Audit trails — Who created this record? Who modified it? When?
- Access controls — Can the admin see customer payment data that the sales rep shouldn't?
- Verification gates — Did the AI-generated code actually implement the business logic correctly?
- Recovery procedures — If the system corrupts data, how do you roll back?
- Agent readiness — Can this CRM be queried or updated by an AI agent without breaking?
The same AI tools that make building fast also make it easy to skip boring infrastructure. But in a business system that handles customer data, invoices, and commercial commitments, "boring infrastructure" is the only thing standing between a useful tool and a liability.
Why This Connects to the Agent Governance Story
Two weeks ago, Microsoft researchers documented that 47 percent of AI agent failures in enterprise settings were caused by insufficient verification, not bad model outputs. The agents did what they were asked — but nobody checked that "what they were asked" was the right thing.
The same pattern applies to vibe-coded business systems. The AI delivered what was prompted. But:
- Is the data model correct for your actual business process?
- Are there edge cases the prompt didn't cover?
- Will the system behave correctly when multiple users access it simultaneously?
- Can an outside auditor verify that the system handles customer data compliantly?
These are not edge cases. They are the difference between a tool and a liability.
The Australian SMB Context
According to NAB's July 2026 Business Pulse, 42 percent of Australian SMBs are already using AI tools regularly — nearly double the rate from two years ago. With that adoption comes an increasing number of AI-generated business systems running real operations.
The Australian Office of AI, launched this month, will eventually produce guidance on AI-generated business software. But that guidance is months away, and the systems being built today will have been running for months by then.
What to Do Instead of Ship Blind
If you are building a custom CRM or business system with AI coding tools, here is the minimum verification layer you should include:
1. Every data write needs an audit record — who or what created it, when, and from what input. 2. Access controls must be intentional — not "everyone can see everything" by default. 3. Export capability before you have data — if you cannot pull your data out in standard format, your CRM owns you, not the other way around. 4. One verification checkpoint per major feature — before you let the system touch real customer data, verify the business logic independently. 5. Plan for agent access — if you will eventually want an AI assistant to read or update your CRM, design the API surface now rather than retrofitting it later.
The Bottom Line
Vibe-coded CRMs are not the problem. They are a signal that the market has been waiting for tools that match how businesses actually operate. The problem is shipping a business system without verification — and that problem exists whether the code was written by a developer or by an AI.
The smart SMBs will be the ones who build the verification and governance layer into their custom systems from day one. The rest will learn why audit trails exist — the hard way.