A number worth sitting with
Ahu Chhapgar, CTO at Paysafe, said something on a recent Fintech Garden episode that should stop every compliance officer mid sip of coffee: 64 percent of the code Paysafe shipped in July was AI generated. Not prototyped. Not drafted and rewritten by a human. Shipped.
Chhapgar was a guest on Fintech Garden Podcast 173, hosted by Igor Tomych and our own Dumitru Condrea, and the conversation was less about the thrill of speed and more about what that speed demands from the organization around it. That is the part worth unpacking for anyone running technology inside a regulated payments business.
Writing code was never the bottleneck that mattered
Chhapgar's core point is simple and a little uncomfortable. AI did not remove the hard part of software delivery, it moved it. Authoring code got fast. Verifying that code is correct, secure, and compliant did not get any faster on its own, so that is where the pressure has piled up.
He compared it to the early days of public APIs, when the industry spent years iterating before anyone agreed on what a sane architecture even looked like. His view is that AI generated code is in that same awkward adolescence. The tooling races ahead, the governance catches up in fits and starts, and whoever manages that gap well ends up with an actual advantage instead of a headline statistic.
For a payments company specifically, that gap is not abstract. Paysafe operates under PCI and PII obligations that most software businesses never touch. Chhapgar described a two track model inside the company: low risk internal utilities move fast with light review, while anything touching core financial infrastructure gets explainability built into the architecture from day one, not bolted on after launch. Every commit, whether a human or a model wrote it, passes through the same security gate before it reaches production.
That is the operating principle regulated fintechs should take from this, regardless of what tool wrote the first draft: the review gate has to be uniform, not a courtesy extended to the code a human happens to feel responsible for.
The rulebook already agrees with him, whether companies have read it or not
This is where the podcast conversation lines up almost exactly with where EU regulation already sits. Article 14 of the EU AI Act requires that high risk AI systems let a human understand, oversee, override, and halt the system through something like a stop button. The bulk of those obligations for Annex III high risk systems become binding from August 2026, which means this is not a future planning exercise anymore. It is a live compliance window.
Credit scoring and risk pricing systems are explicitly named as high risk uses under Article 6 and Annex III. Any fintech using AI to touch those decisions, including AI that writes the code behind those decisions, needs an oversight mechanism that can actually be demonstrated to a regulator, not just claimed in a slide deck.
The US side has its own version of the same instinct. The Federal Reserve's SR 11-7 guidance has required model validation to be independent of the people who built the model since 2011. That independence requirement predates generative AI by well over a decade, and it does not bend for it. If your model risk team and your AI engineering team report into the same incentive structure, you have a structural problem that an audit will eventually find.
Put the two together and a clear picture forms: regulators on both sides of the Atlantic are not asking whether AI can write financial software. They are asking who is independently checking it, and whether that person can actually stop it.
Culture, not tooling, is the real constraint
Chhapgar's other point deserves equal attention, and it is one compliance teams sometimes miss because it sounds like an HR issue rather than a risk issue. He said the biggest obstacle to enterprise AI adoption at Paysafe was human behavior, not the software itself. People need to feel the tool makes their job better, not that it is quietly replacing them. He credits early, visible sponsorship from the CEO for removing a lot of the resistance before it could calcify into the kind of quiet, passive non adoption that kills transformation projects slowly and invisibly.
That matters for governance in a very practical way. A human review checkpoint only works as a real control if the human doing the reviewing is motivated to actually find problems, not just rubber stamp output to keep pace with a team that has already moved three sprints ahead. Independent sources we track describe this exact failure mode as review theater: a checkpoint that exists on paper and signs off automatically in practice. If your reviewers feel like a bottleneck to be worked around rather than a safeguard to be respected, that is a culture problem wearing a technical disguise.
What agentic commerce still lacks
One more thread from the episode is worth flagging for anyone watching the stablecoin and agentic payments space: Chhapgar was asked about autonomous agents buying things on a customer's behalf. His answer was measured. Transaction volume today is marginal, but the long term potential is real. The thing actually missing is not the technology, it is agreement across card networks, merchants, and issuers on who is liable when an agent initiates a disputed transaction. Until that liability framework exists, agentic commerce stays a demo, not a product line.
The practical takeaway
A 64 percent figure is a good headline. It is a bad target. The number that should actually matter to a regulated fintech's board is not how much code AI writes, it is how many of those commits pass through a review gate that is independent, documented, and capable of saying no. Build that gate once, make it apply to every commit regardless of who or what wrote it, and the velocity Chhapgar describes becomes an asset instead of an exposure.
Speed without a verification layer that can actually halt a bad decision is not transformation. It is just a faster way to accumulate risk you have not found yet.