Enterprise Softwares Unsuitable For Citizen Developers

Introduction

The citizen developer movement, which empowers business users without formal coding experience to build applications using low-code and no-code platforms, has transformed enterprise software development. However, this approach has clear boundaries, and several categories of enterprise software remain firmly outside the scope of what citizen developers can safely or effectively create.

Categories:

1. Core Enterprise Resource Planning and Legacy Systems

Traditional ERP systems such as SAP, Oracle, and large-scale business management platforms present significant challenges for citizen developers. These systems involve intricate logic with complex decision-making junctures, integration with multiple interconnected components, and strict regulatory requirements that are generally beyond what most citizen developers can handle. SAP, for instance, has long tried to enable business users to develop on its platforms, but according to industry observers, “it is still way too complex” because the world has become far more intricate than it was decades ago, with SAP installations now managing worldwide distribution, complex contractor relationships, and global business networks.

Mainframe COBOL systems represent another category entirely unsuitable for citizen development. Around 43% of banking software still runs on COBOL, and over 80% of in-person transactions at U.S. financial institutions depend on these systems. These platforms require developers with 5+ years of experience in COBOL, MVS/JCL, DB2, SQL, CICS, and VSAM, along with deep understanding of software development lifecycle methodology. The specialized nature of mainframe development, combined with decades of legacy code and the critical nature of financial transactions, makes this domain exclusively the province of professional developers

2. Mission-Critical Financial Systems

High-frequency trading platforms and real-time trading systems demand performance characteristics that are fundamentally incompatible with citizen development approaches. These systems must handle thousands of orders per second, interface with multiple exchanges via low-latency APIs or the FIX protocol, and enforce risk limits in real-time to prevent catastrophic losses. Building such systems requires expertise in low-level programming, backend development for core functionalities like authentication and trading execution, and system performance optimization that achieves predictable microsecond latency. Regulatory compliance software for financial services similarly requires professional development teams. These applications must comply with stringent regulations including Basel III requirements for risk and capital management, regional data protection laws, and specific frameworks requiring data encryption, multi-factor authentication, and GDPR-compliant data handling. Building such software involves requirement analysis across multiple regulatory frameworks, secure architecture design, and seamless integration with existing CRMs, ERPs, and financial reporting tools, which demands extensive experience in risk management and software verification processes.

3. Healthcare and Medical Device Software

Software as a Medical Device (SaMD) represents one of the most heavily regulated domains where citizen development is entirely inappropriate. Under the EU Medical Device Regulation Rule 11, most medical device software now falls into Class IIa or higher, with certification times stretching to 13-18 months. Development requires adherence to IEC 62304 for software lifecycle and risk management, ISO 14971 for risk management throughout the product lifecycle, FDA 21 CFR Part 820 for quality system regulation, and FDA 21 CFR Part 11 for electronic records.

Software as a Medical Device (SaMD) represents one of the most heavily regulated domains where citizen development is entirely inappropriate

Healthcare integration software involving HL7, FHIR, and DICOM standards for medical device integration also falls outside citizen developer capabilities. These systems must navigate complex regulatory oversight, and any middleware or integration layer that interprets, transforms, or acts on data may fall under Class IIa or higher, triggering CE-marking requirements and formal conformity assessment. The combination of patient safety implications, data sensitivity under HIPAA and GDPR, and the potential for life-threatening consequences from software errors makes this domain exclusively suitable for experienced professional developers.

4. Industrial Control Technology Systems

SCADA (Supervisory Control and Data Acquisition) systems and industrial control systems (ICS) manage and monitor critical infrastructure including power grids, water treatment plants, and manufacturing operations. These systems require specialized architecture designed for real-time control and precision reliability in environments where uptime is critical. They must interface with PLCs, sensors, and proprietary systems while maintaining operational safety that citizen developers simply cannot guarantee. The security implications of industrial systems make them particularly unsuitable for citizen development. ICS/SCADA environments require solutions addressing unique challenges including just-in-time access, robust auditing capabilities, and integration with existing IT/OT infrastructures to protect against evolving cyber threats.

A misconfigured industrial control application could cause physical damage, environmental harm, or endanger human safety in ways that departmental workflow applications never could.

5. Security-Critical Software

Enterprise cybersecurity applications and network infrastructure software remain firmly in professional development territory. Without proper knowledge of security best practices, applications handling sensitive data or involving critical business operations present significant liability and can introduce security vulnerabilities. Citizen developers working outside IT security protocols can develop problematic habits, break rules, and ignore best practices, potentially leading to data breaches, cyberattacks, and compliance violations Enterprise network infrastructure requires specialized knowledge of software-defined networks, LAN/WLAN, WAN segments, and security integration including end-user identification, verification, policy implementation, and network segmentation. These systems demand expertise in connectivity options, security integration, performance requirements, and cost optimization that goes far beyond the visual development capabilities of low-code platforms.

6. Applications Requiring Complex Integration Architecture

Enterprise applications requiring deep integration with legacy systems pose substantial challenges for citizen developers.

Such professionals might find it challenging to navigate complex enterprise architectures and ensure their applications work well with all legacy systems, potentially resulting in siloed, disparate solutions that add more complexity rather than simplifying business processes. Legacy systems rarely integrate well with modern software or cloud platforms, leading to isolated data across departments that limits visibility, collaboration, and informed decision-making. When citizen-developed applications attempt to scale up with more users and operations, they often encounter significant performance issues. Unlike professional developers who follow best practices and coding standards ensuring software quality, resilience, and scalability, citizen developers are typically unfamiliar with these elements, creating significant pain points in maintenance and support. One documented case involved a warehouse tracking system that had been working for eight months before crashing because it was pulling real-time data from three different systems, had custom logic for calculations, and was writing data back without proper validation, all running on an integration architecture with a single point of failure that nobody had tested.

Characteristics That Disqualify Applications from Citizen Development

Beyond specific categories, certain application characteristics automatically place them outside citizen developer scope. These include high-performance requirements where systems must handle heavy loads or complex computations, highly customized solutions with unique requirements that don’t fit standard patterns, core business systems where stability and security are paramount, and innovative products that push technological boundaries. Applications involving patient information in healthcare, financial data subject to regulatory audit, or personally identifiable information under GDPR require governance frameworks that ensure citizen developers do not touch sensitive categories at all. Similarly, any software handling complex business logic, requiring enterprise-class security features, or needing robust integration capabilities demands the expertise that only professional developers bring to enterprise software development. The fundamental lesson is not that citizen development lacks value, but rather that organizations must establish clear boundaries defining which enterprise systems and data citizen developers can access, what security protocols and compliance requirements apply, and what review processes must occur before enterprise-wide implementation. A hybrid approach that blends professional developer strengths with citizen developer agility and user-centric focus offers the most sustainable path forward, respecting both the capabilities and limitations of each approach.

References: