The Debt You Can't See: Sweden's Codebase Credit Check

Here's the sentence that should ruin your week: nobody at your company can explain, line by line, why your production system does what it does. Not the founder who "vibe coded" the first version. Not the three contractors who touched it after. Not the AI agent that wrote forty percent of it in a weekend sprint. That's not a hypothetical. That's most codebases I look at right now, in Jönköping and everywhere else.

Everyone talks about AI making software cheaper to build. I don't buy it anymore. What AI actually did was make software debt invisible, right up until the moment a regulator, an auditor, or a security incident forces you to open the hood. And for a lot of Swedish companies, that moment lands in 2026 and 2027, exactly when NIS2 enforcement and AI Act compliance audits start knocking on doors that were never built to be opened.

The Klarna Hangover Nobody Wants to Talk About

Sweden has a folklore problem. We tell ourselves the Klarna story, the Spotify story, the "move fast, break things, apologize later, IPO eventually" story, and we've turned it into a national identity for tech. It worked when the stakes were a payment button breaking for an afternoon. It does not work when the thing breaking is a system that processes personal data under GDPR, sits inside critical infrastructure under NIS2, or makes automated decisions that fall under the EU AI Act's risk categories. Computer Sweden is already asking whether "billig vibe coding" is over, and Omni has been sounding alarms about "skugg-IT", shadow IT, spinning up inside companies faster than security teams can track it. Both are right, but they're missing the bigger connection. This isn't just a code quality problem or a shadow IT problem. It's a regulatory collision course. The audits are coming for systems that were assembled, not engineered, and the paper trail explaining "why" simply does not exist.

Why AI Coding Debt Is Not Like Old Tech Debt

Traditional tech debt was visible if you knew where to look. Bad architecture, missing tests, spaghetti dependencies. A senior engineer could read the code, wince, and give you a rough number for how bad it was. You could point at the mess and say "a human did this, and here's why." InfoWorld made the point clearly this week: AI coding debt is structurally different, because it compounds silently and no human ever fully understood the logic to begin with. GitLab's own research shows the gap widening between how fast organizations generate AI code and how fast they can actually review or govern it. That gap is the whole story. You're not looking at debt from decisions someone made. You're looking at debt from decisions nobody made, that got generated, accepted, and shipped, one Cursor autocomplete and one AI agent commit at a time. When a NIS2 auditor or an AI Act compliance officer asks "explain the decision logic in this system," the honest answer in a huge number of Swedish companies right now is: we don't fully know, an AI wrote most of it, and the person who reviewed the pull request was moving too fast to catch what it actually did.

Sweden vs. the Global Picture

Here's where the Nordic angle gets uncomfortable. In San Francisco, "ship fast with AI, clean it up later" is a defensible strategy, because the regulatory environment is loose and the market rewards speed above almost everything else. In parts of Asia, state-directed tech policy means compliance often follows growth rather than gating it. Sweden and the EU chose a different bet. We chose to regulate first and grow inside guardrails, which is a legitimate strategy, but it only works if companies actually respect the guardrails while building. Right now a lot of Swedish startups and even established companies are building like they're in San Francisco while being regulated like they're in Brussels. That mismatch is the actual crisis, not vibe coding itself. DI and SVT have both covered how unprepared mid-sized Swedish companies are for NIS2's expanded scope, which now pulls in far more sectors than the original NIS directive ever did. Add the AI Act's phased enforcement, with high-risk system obligations tightening through 2026 and into 2027, and you get two compliance regimes landing on top of codebases that were never designed with either in mind. The uncomfortable truth: Sweden's regulatory ambition is ahead of Swedish engineering discipline. We wrote the rules like a country that builds carefully. We're currently building like one that doesn't.

Is Swedish Policy Actually Ready?

No, and I'll say that plainly. Sweden's national AI Act enforcement body is still building capacity. NIS2 transposition into Swedish law happened, but supervisory authorities across sectors are unevenly staffed and unevenly experienced with software-specific audits, let alone AI-generated software audits. Regulators are going to be learning the technical reality of "AI coding debt" at the same time companies are being forced to confront it. That's not reassuring, it's a recipe for inconsistent enforcement, panic remediation, and a wave of consultants selling compliance theater instead of real fixes. If you're a CTO waiting for regulators to be lenient because "they don't really understand this stuff yet," that's the wrong bet. Under-resourced regulators tend to overcorrect once a high-profile failure happens. Don't be the case study.

Where This Actually Goes: 2027 and Beyond

Play this forward. As AI coding agents get more capable, and they will, the volume of AI-generated code in production systems doesn't slow down, it accelerates. GitHub's own ecosystem shows where the energy is: agent harness projects like ECC are exploding in popularity precisely because teams know their coding agents need memory, security constraints, and research discipline baked in, not bolted on after the fact. Automation platforms like n8n and coding agents like

• Audit-ready development becomes a selling point. "We can explain every material decision in our system" becomes a procurement requirement, not a nice-to-have, especially for anything touching critical infrastructure, finance, or health under NIS2 scope.
• Insurance and lending start pricing code risk. Just like a credit check, lenders and cyber insurers will start asking for evidence of code review discipline and AI usage governance before extending terms. "The debt you can't see" becomes literal financial debt.
• A new tier of tooling emerges around AI code provenance. Not just linting, but systems that track which AI agent generated which logic, what was reviewed, and by whom. This becomes as standard as version control.

What to Actually Do About This

Enough forecasting. Here's the practical part, because a briefing without action items is just anxiety with good formatting. First, audit your own AI-generated code exposure this quarter, not next year. Pull your git history, tag commits generated primarily by AI tools, and get a real percentage. Most founders I talk to guess wrong, usually by a lot. Second, if you're building anything that could plausibly fall under NIS2 or AI Act scope, and the scope is broader than people think, stop treating AI agent development as a shortcut around engineering discipline. It's a multiplier. It multiplies good practice and it multiplies debt equally well. We build agent systems at HEIMLANDR with explainability baked in from day one, because retrofitting it later costs three times as much and happens under regulatory pressure instead of on your own schedule. Third, if you're at the MVP stage right now deciding how much AI-assisted shortcutting to lean on, understand that MVP development speed and compliance-readiness are not opposites if you plan for it upfront. Fast doesn't have to mean undocumented. It means being deliberate about what gets generated versus what gets engineered, and keeping a real record of which is which. Fourth, get honest about your actual software development Sweden footprint. If half your stack was assembled by contractors using different AI tools with no shared standard, you don't have a codebase, you have an archive of decisions nobody agreed to. Fullstack development done right means one accountable standard end to end, not a patchwork stitched together under deadline pressure.

What to Look At

A few concrete things worth your attention this week:

• ECC (agent harness performance optimization), because the future of AI coding is agent memory and security discipline, and this project shows where serious teams are already heading.
• GitLab's own research on the AI code review gap, worth reading in full if you manage engineering teams, it quantifies the exact problem this article describes.
• Computer Sweden's ongoing coverage of the vibe coding cost correction, useful for tracking how Swedish market sentiment is shifting in real time.
• n8n if you're automating workflows and want visibility into what's actually running, rather than a black box of connected AI calls.

The Bottom Line From Jönköping

I've built software long enough to know that debt always comes due, the only question is whether you control the timing. Right now, a lot of Swedish companies have handed that timing decision to EU regulators, and regulators are not known for gentle timing. The companies that treat this seriously in the next twelve months, that get real about what their AI-generated code actually does and can document it, will walk into their NIS2 and AI Act audits with confidence instead of a scramble. The rest will discover that "billig vibe coding" was never actually cheap. It was a loan, and the interest rate is regulatory. If you're weighing whether to build your next system properly from the start rather than patch it into compliance later, that's a conversation worth having before the audit letter arrives, not after. Whether that's a full SaaS development build or something more specific, the principle doesn't change: build it so a human can still explain it.

Fredrik Brunnberg is the CEO of HEIMLANDR.IO, building AI and software solutions from Jönköping, Sweden. This is the daily HEIMLANDR briefing. If you found this valuable, share it with someone who builds things.