Citizen development allows non-IT professionals to create or configure simple apps, workflows and automations using low-code or no-code tools.
This article explains how citizen development works, the opportunities and risks it creates, and the types of solutions that can be developed. It also considers how in-house legal teams can use citizen development themselves and contribute to governance around security, data privacy, compliance and responsible use.
Key takeaways
- Citizen development allows non-IT professionals to create apps, workflows and automations with limited coding.
- Low-code and no-code tools make it easier to configure solutions without traditional software development.
- Citizen development can improve efficiency but creates risks around security, data privacy, governance and support.
- In-house legal teams can use citizen development to automate simple, repeatable processes.
- Legal teams can help establish governance and controls for citizen development across the organisation.
What is citizen development?
Citizen development is a process in which non-IT professionals successfully use software that can be configured to produce simple solutions or “apps” and workflows with minimal involvement from IT professionals, and little to no coding needed.
Most or all of the configuration is done through interfaces designed for non-IT people, although some traditional software development may still be required. Generative AI is also making it easier for non-IT professionals to create apps and workflows.
Generally, citizen developers are “super-users” or administrators in particular functions throughout the business with specialist needs, and work to configure custom solutions that help to improve or automate processes and ways of working.
Teams or departments that typically benefit from a citizen development approach include sales, finance, marketing, operations and R&D, and potentially legal teams too. Arguably, citizen development is the latest incarnation of a mega-trend that has been developing over the past twenty years or so whereby central IT functions empower people throughout businesses by giving them the ability to manage their own technology.
What are low-code and no-code solutions?
Citizen development can be seen as part of a move away from the individual customisation of software due to the prevalence of cloud-based solutions where upgrades are provided on a continuous basis, meaning there is no longer flexibility for organisations to customise software to their own needs. Instead, IT software vendors are incorporating the ability to configure solutions into software design to suit individual organisational needs rather than having to change underlying code. Increasingly, this is being targeted to non-IT specialists with a growing number of low-code or no-code solutions.
The growth of low-code and no-code solutions are creating opportunities for citizen developers. These invariably have various elements that make it easier for super-users, including:
- Well-designed interfaces and “authoring canvases” that make it easy for non-IT professionals to configure workflows, automation and solutions.
- Libraries of pre-existing connectors to popular enterprise applications such as Salesforce, SharePoint and ServiceNow which make it easy to connect and integrate different systems.
- Libraries of popular patterns of workflow or automation that can be re-used in your own solutions.
There are numerous low-code and no-code solutions that particularly focus on automation and workflow, such as Zapier, IFFT, Kissflow, K2 and Nintex. Perhaps the most prevalent solution is the Microsoft Power Platform: a suite of apps available within some Microsoft 365 licenses that includes Power Automate (automation and workflow), Power BI (data reporting and visualisation) and Power Apps (web and mobile apps). The Power Virtual Agents feature producing chatbots that used to be part of Power Platform has now been rebranded as part the Copilot series of AI features. The use of the Power Platform is currently the focus for many official citizen development initiatives.
What about generative AI?
Generative AI is changing citizen development by making it easier for people without traditional software development skills to create applications, workflows and automations. Users can increasingly describe what they want to achieve in natural language and use AI to help generate, configure or modify a solution.
This expands the potential benefits of citizen development, but it also creates additional governance considerations. AI-generated solutions may still contain errors, use data in unexpected ways or create security and compliance risks. The fact that a solution can be created quickly does not remove the need for appropriate testing, access controls, oversight and ongoing review.
The distinction between citizen development and generative AI is therefore becoming less clear. Rather than treating them as separate trends, organisations may increasingly need to consider how AI-enabled development fits within their existing technology, data and governance frameworks.
What are the advantages of citizen development?
There are a number of benefits of engaging with citizen development, including that:
- Specialists within the business who know its processes can leverage their own knowledge to create solutions that are completely focused on the way they work.
- Local and department-specific solutions can be created that resource-stretched central IT development teams cannot provide, ultimately saving on resources.
- Local teams are more invested in using solutions they have partly created themselves, leading to better adoption of particular solutions.
- It allows organisations to get a better ROI on their investment in tools like the Microsoft Power Platform.
- It arguably creates a culture of innovation and digital enablement that goes on to produce further results.
The growing use of generative AI within development tools may increase these benefits by making it possible for a wider range of employees to create and adapt solutions without specialist development skills.
What are the disadvantages?
Of course, there are also disadvantages in citizen development. Probably the most prominent of these is a number of associated risks in “opening up” development to non-IT professionals; these range from security to data privacy, to following best practices in design, through to whether an app produces value. To date, the design of low-code and no-code platforms and the controls that can be put in place can significantly reduce some of these risks.
Another risk is around resourcing - supporting and training “citizen developers” may require an investment in resources that outweighs the value gained from developing solutions in the first place.
The increasing use of generative AI introduces additional risks. Solutions can be created or modified very quickly, potentially without the level of testing or technical review that would normally accompany software development. Organisations also need to consider what data is being used, what permissions a solution has, how it connects to other systems and who is responsible for maintaining it.
There is also a risk that employees create AI-enabled applications, workflows or automations outside established technology and governance processes. This can make it harder for an organisation to know what tools are being used, what information they can access and whether appropriate controls are in place.
What kind of solutions are citizen developers producing?
Generally, the kind of solutions that citizen developers are able to successfully produce tend to be basic and straightforward and focus on the automation of simple, repeatable tasks. For example:
- Triggering a simple action such as a notification based on an event or trigger, e.g. sending an automated email when somebody completes a form.
- Enabling an automated action across two separate systems, e.g. adding a piece of information to your intranet when a new project is added to Salesforce.
- Enabling data to be updated in more than one place at the same time or displayed across different systems, e.g. updating a calendar based on dates being set up in another system.
- Being able to build data reports and visualisations based on information from more than one system.
- Enabling different workflows based on values captured in a form.
- Putting some of these elements together to build simple apps that can be accessed via a browser.
As generative AI becomes more integrated into development platforms, the range of solutions that citizen developers can create is likely to expand. This may include AI-enabled workflows, assistants and automations that can process information, generate content or support decision-making.
What are the opportunities for in-house legal teams?
Citizen development has the potential to deliver efficiencies to the intense knowledge-work that in-house teams carry out. Adding simple automation delivered through citizen development can contribute to:
- Submitting requests for help or questions to in-house legal teams.
- Workflow around risk-related processes such as Know Your Client or any related due diligence around new suppliers.
- Gathering standard sets of information from people requesting contracts.
- Recording and tracking the progress of any task or process that is repeated across multiple jurisdictions.
In-house legal teams can also play an advisory role in reducing associated risks around the use of citizen development that can arise when it happens at-scale or without the necessary controls in place. If your organisation is considering deploying citizen development or it’s already happening in an “unofficial” form, in-house legal teams may be able to contribute to minimising risk and ensuring the right processes and approaches are being adhered to.
Security, data privacy, GDPR, where data resides and ethical considerations are all potential pitfalls, and training and review processes can be necessary.
The legal team can also help the organisation understand the legal and regulatory implications of citizen-developed solutions. This could include considering data protection, confidentiality, intellectual property, information security, contractual restrictions, third-party technology and appropriate access to business information.
Where citizen development incorporates generative AI or AI-enabled automation, legal teams may also need to consider how outputs are tested and reviewed, what information the system can access, whether there is an appropriate audit trail and who is accountable for the solution and its outputs.
What approaches do you need for citizen development to work?
For citizen development to work and provide value at-scale, you need to have the right governance in place, covering processes and roles. This means IT functions need to consider questions such as:
- What low-code or no-code software are users permitted to use?
- How are citizen developers trained and supported?
- What approval and review processes are in place around developing an app, and when do these reviews take place?
- Who is responsible for the app in circumstances such as someone leaving?
- How much do we support an app that goes wrong?
- How do we ensure different apps don’t undermine other digital efforts and strategies, for example, creating data siloes or bypassing important enterprise solutions?
- What other guardrails and guidance need to be put in place to support citizen development?
As stated above, there are also approaches which need to take place to ensure legal and regulatory commitments are met, and here, in-house legal teams as well as other risk and compliance functions will need to be involved in designing the right governance framework.
Generally, a governance framework needs to be considered when both:
- Citizen development is being scaled up or introduced as an enterprise programme.
- Citizen development is already happening and presenting risks.
If, in practice, your organisation’s citizen developers are limited to a handful of people who are already working closely with the IT function, it might be the case that the risk is already being managed through a close working relationship with IT, with an ongoing narrative about roles and responsibilities based on a case-by-case basis.
Governance also needs to evolve as citizen development incorporates generative AI and AI-enabled automation. Organisations should consider not only who can create solutions, but also what data and systems those solutions can access, what level of testing is required, who approves higher-risk applications and how solutions are monitored and maintained after deployment.
A proportionate approach is important. Not every simple workflow requires the same level of oversight as a solution that handles sensitive information, affects customers or makes decisions with significant consequences.
Citizen development should be on your radar
Citizen development may not be a significant trend in your organisation and it may go under a different name. However, if non-IT professionals are producing apps and workflows then it should be on your radar, both because of the opportunities to improve processes within your in-house legal team and because of risk mitigation that may need your input.
Going forward, the term “citizen development” may start to become less common as configuration of apps by people without a professional IT background becomes normalised. The growing use of generative AI is likely to make this development even more accessible, while increasing the need for appropriate governance.
For in-house legal teams, the challenge is to support useful innovation while helping the organisation understand and manage the legal, regulatory and operational risks.