Intro & scope
Use cases where LLMs and agents write, check, operate or migrate code and code-like artefacts. Four patterns: CODE.DEV (writing: IDE assistants, coding agents, app builders, UI, schemas, PLC, RTL, data pipelines, performance kernels, rules as code), CODE.QUALITY (review, tests, docs, bug fixing, accessibility, LLMOps, game testing), CODE.MODERNIZE (legacy migration, dependency upgrades, connectors) and CODE.OPS (IaC, AIOps, logs).
Scope boundaries: - CODE-001 (interactive, developer in the loop) vs CODE-002 (asynchronous ticket-to-PR agent) vs CODE-014 (bug-specific triage, reproduction and fix) vs CODE-021 (fleet-wide upgrades and refactoring with deterministic recipes). - CODE-005 (language/platform migration of legacy systems) vs CODE-021 (keeping modern code current) vs CODE-012 (new integration code against APIs). - CODE-003 (review of human/AI diffs) vs CODE-004 (test creation and QA) vs CODE-017 (accessibility defects) vs CODE-024 (game playtesting). - CODE-007 (non-developer app building) vs CODE-008 (design-to-code for developers). - CODE-009 (IaC and CI/CD authoring) vs CODE-010 (anomaly-based incident detection and RCA) vs CODE-011 (log and trace summarisation) vs CODE-018 (observability of LLM apps themselves). - CODE-013 (OLTP schema and query tuning) vs CODE-022 (analytics pipelines, dbt, Spark). - CODE-016 (PLC), CODE-019 (RTL/EDA) and CODE-020 (embedded, functional safety) share the "generate, compile/simulate, formally check, human sign-off" loop; CODE-023 (kernel and hot-path optimisation) uses the same benchmark-verified loop. - CODE-015 (requirements) vs CODE-025 (legislation to executable rules).
AI Act: development tooling is minimal risk (the code, not the tool, is regulated). "Depends" applies where output ends up in regulated products or decisions: CODE-016/020 (safety components, Machinery Regulation, medical devices, ISO 26262 / IEC 62304) and CODE-025 (eligibility decisions on natural persons may be high-risk, Annex III). Provider/deployer duties for AI-built systems stay with the organisation; GDPR applies mainly to code context (secrets, personal data in logs, tickets, recordings in CODE-011, 015, 018). Human review of every merge is the default; secrets scanning and sandboxing are mandatory for agents.
Use cases
| ID | Title | Pattern | Maturity | Path | HW tier | AI Act risk |
|---|---|---|---|---|---|---|
| CODE-001 | AI code completion & chat in the IDE | CODE.DEV | commodity | A | HW2 | minimal |
| CODE-002 | Autonomous coding agents (issue-to-pull-request) | CODE.DEV | early-adopter | A | HW4 | minimal |
| CODE-003 | AI code review | CODE.QUALITY | mainstream | A | HW3 | minimal |
| CODE-004 | Test generation & QA automation | CODE.QUALITY | mainstream | B | HW3 | minimal |
| CODE-005 | Legacy code modernisation & language migration (e.g. COBOL → Java) | CODE.MODERNIZE | early-adopter | A | HW4 | minimal |
| CODE-006 | Code documentation & architecture documentation generation | CODE.QUALITY | mainstream | B | HW3 | minimal |
| CODE-007 | Natural-language app building for non-developers (vibe coding / AI low-code) | CODE.DEV | early-adopter | A | HW0 | minimal |
| CODE-008 | UI generation from designs, screenshots & sketches | CODE.DEV | early-adopter | B | HW3 | minimal |
| CODE-009 | Infrastructure-as-code & DevOps assistant | CODE.OPS | early-adopter | B | HW3 | minimal |
| CODE-010 | AIOps: incident detection & root-cause analysis | CODE.OPS | early-adopter | A | HW3 | minimal |
| CODE-011 | Log analysis & observability summarisation | CODE.OPS | mainstream | A | HW2 | minimal |
| CODE-012 | API integration & connector generation | CODE.MODERNIZE | early-adopter | B | HW2 | minimal |
| CODE-013 | Database schema design & query optimisation | CODE.DEV | early-adopter | B | HW2 | minimal |
| CODE-014 | Bug triage, reproduction & automated fixing | CODE.QUALITY | early-adopter | A | HW4 | minimal |
| CODE-015 | Requirements engineering from stakeholder input | CODE.DEV | early-adopter | B | HW3 | minimal |
| CODE-016 | Industrial control code generation (PLC, IEC 61131-3) | CODE.DEV | early-adopter | A | HW3 | depends |
| CODE-017 | Accessibility testing & remediation of web apps | CODE.QUALITY | early-adopter | B | HW2 | minimal |
| CODE-018 | LLM & agent application evaluation, tracing & observability (LLMOps) | CODE.QUALITY | mainstream | C | HW1 | minimal |
| CODE-019 | Hardware design code generation & chip verification (RTL, testbenches) | CODE.DEV | early-adopter | A | HW4 | minimal |
| CODE-020 | Embedded & safety-critical software development (MISRA, ISO 26262, IEC 62304) | CODE.DEV | early-adopter | B | HW3 | depends |
| CODE-021 | Automated dependency upgrades & large-scale codebase refactoring | CODE.MODERNIZE | early-adopter | A | HW2 | minimal |
| CODE-022 | Data pipeline & analytics-engineering code generation (ETL/ELT, dbt, Spark) | CODE.DEV | early-adopter | A | HW3 | minimal |
| CODE-023 | Automated performance optimisation & GPU kernel generation | CODE.DEV | early-adopter | B | HW3 | minimal |
| CODE-024 | Automated game testing & playtesting with AI agents | CODE.QUALITY | early-adopter | B | HW3 | minimal |
| CODE-025 | Rules as Code: translating legislation into executable eligibility & calculation logic | CODE.DEV | emerging | B | HW3 | depends |
Shared stack
Common core (all tiers): Git forge with CI (GitLab/Forgejo/GitHub) as the system of record, sandboxed execution (containers, gVisor/Firecracker) with no default network egress, a repository index (tree-sitter + embeddings in pgvector/Qdrant, optional code graph via SCIP/Sourcegraph), an LLM gateway (LiteLLM) with logging, PII/secret redaction and EU-region routing, MCP servers for tickets, CI, docs and databases, deterministic gates (linters, SAST, type checkers, tests, OpenRewrite recipes) before any human review, and tracing/eval (Langfuse, promptfoo; CODE-018) on every agent.
HW0 (no self-hosting). EU-hosted SaaS builders and IDE assistants with a DPA and zero-retention terms. Serves CODE-007; all others can start here (path A/B).
HW1 (CPU / small server). Langfuse + Postgres + promptfoo, LLM judges via API or a 3-8B quantized model, OpenTelemetry collector. Serves CODE-018.
HW2 (single GPU 24-48 GB). HW1 plus vLLM or Ollama serving a 7-32B code model (Qwen-Coder, Devstral class) for completion and chat (Continue, Tabby), small embedding model, OpenRewrite/Renovate for deterministic changes, Loki/ClickHouse with a small log model, axe-core + Playwright. Serves CODE-001, 011, 012, 013, 017, 021.
HW3 (multi-GPU server, 2-4 x 80 GB). HW2 plus a 70B-class code/reasoning model or open VLM, agent runtime (OpenHands, Aider, LangGraph) with sandbox pool, SonarQube/Semgrep, Playwright and device farm for E2E, dbt/Spark sandboxes, simulators and compilers (PLCnext/CODESYS simulation, Verilator, QEMU, MISRA checkers), benchmark rigs. Serves CODE-003, 004, 006, 008, 009, 010, 015, 016, 020, 022, 023, 024, 025.
HW4 (cluster / 8+ GPUs). Large open reasoning/coding models (200B+ MoE class) with long context and many parallel sandboxes for autonomous multi-step agents and EDA simulation farms. Serves CODE-002, 005, 014, 019.
Cross-family reuse: the vector index and RAG layer is shared with KNOW and DOC (CODE-006, 015); the agent runtime and tool gateway with AGENT (CODE-002, 012); log/metric streaming and anomaly stack with ANOM and PRED (CODE-010, 011); guardrails and red-teaming with SEC (CODE-003, 014, 018); ASR/diarization with SPEECH (CODE-015); VLM with VIS and GEN (CODE-008, 017, 024); data platform with DATA (CODE-013, 022); simulation with OPT and ROBO (CODE-016, 019, 020, 023).