Company Check : Google's App-Builder Expands To 15 More Countries

Google is widening access to Opal, its no-code AI mini-app builder, to 15 additional countries. However, new research warns that AI-accelerated development is outpacing software security.

What Is Opal?

Opal is a Google Labs experiment that turns a plain-English prompt into a working mini web app. Users describe what they want, then Opal assembles a visual workflow of inputs, AI model calls and outputs. Each step can be opened in an editor to review the prompt, adjust the logic, add new steps, or run the workflow step by step to see what happens and where it fails. Once ready, creators can publish the app to the web and share a link so others can use it with their Google accounts.

Google introduced Opal in the United States in late July 2025 as part of its push to make AI creation accessible to non-developers. The stated aim was essentially to let people turn ideas into small, useful tools without writing code, while keeping the workflow visible so it can be inspected and improved. However, when early U.S. adopters built more than just novelty projects, it seemed to nudge Google to move faster on a global rollout.

Where And When?

On 7 October 2025, Google said Opal would begin rolling out to 15 additional countries. These are Canada, India, Japan, South Korea, Vietnam, Indonesia, Brazil, Singapore, Colombia, El Salvador, Costa Rica, Panama, Honduras, Argentina and Pakistan. Google framed the expansion as a response to the sophistication of early user projects. As Megan Li, senior product manager at Google Labs, put it in a Google blog post,  “we did not expect the surge of sophisticated, practical and highly creative Opal apps we got instead,”  which made it clear the tool needed to reach  “more creators globally.”

That said, the rollout remains within Google Labs and the product is still presented as just experimental, which may be helping Google to manage expectations at this point. For example, Google is giving the message that Opal is designed for rapid prototyping, automation and lightweight utilities, but not really for performance-critical systems. In other words, it’s a step toward broader access rather than the final word on enterprise-grade app building.

What Has Improved?

Alongside the expansion, Google announced two upgrades based around improving reliability and speed. The first is advanced debugging that stays no-code. With this, users can run a workflow step by step in the visual editor, or iterate on a single step in a console panel, with errors surfaced exactly where they occur. The second is a faster core, which means that the new Opal is snappier than before, and steps can run in parallel so complex workflows execute more quickly. Google’s hoping that these changes address common blockers for no-code builders, who need immediate context when something breaks and shorter wait times when experimenting.

Why Now?

Opal lowers the barrier to building AI-powered tools and keeps those experiments inside Google’s ecosystem. It also means that Google gets to learn what people are trying to build, where they get stuck, and which patterns succeed. That feedback loop improves the underlying models, the templates and the product itself. It also positions Google in a growing market where rivals are courting non-technical creators with prompt-to-app tools. Canva has expanded its Magic features, Figma has explored AI-assisted interface creation, and Replit has continued to blur lines between coding assistance and app scaffolding. By scaling Opal, Google can meet users where they are and channel more of that experimentation through its models and accounts.

Users And Teams

For individuals, Opal basically shortens the path from idea to working prototype. To give a few simple examples of how it could be used:

– A marketer could create a content repurposer that uses a brief to output social copy with a few review steps.

– A customer support manager could build a simple intake tool that classifies enquiries and drafts suggested replies for human approval.

– An analyst could chain together a data cleaning step, a summariser and a report generator without waiting for a development slot.

For teams inside businesses, the visual workflow aspect of Opal also matters. For example, people can see the logic, the prompts and the hand-offs between steps, which helps with training, peer review and handover when roles change. Publishing a mini-app as a link also makes internal distribution straightforward. That convenience is precisely why governance needs attention. Without some oversight, useful experiments can turn into shadow tools that handle customer data or trigger actions outside approved processes.

Businesses

Although the latest expansion does not include the UK, many UK organisations may be watching for signals about localisation, policy controls and Workspace integration. The draw is clear, i.e. faster prototypes mean faster experiments with customer journeys, marketing operations, knowledge management and lightweight analytics. The risk is also equally clear – if non-developers can publish AI-driven tools that interact with real data, then security, data protection and auditability have to be part of the pattern from day one. UK firms with regulated obligations will need to map Opal to existing controls for data handling, retention, identity and access, and change management.

Google’s Competitors

Following this wider rollout, Google’s competitors may now see three pressures intensify, which are:

1. Speed to value. Lower latency and parallel steps raise expectations for interactive build-iterate loops.

2. Visibility and trust. Step-level error context tackles a common barrier to adoption, which is uncertainty about what the AI system is doing and why it failed.

3. Distribution. Google can seed Opal where many small tools begin, inside consumer accounts and Workspace environments, which increases the chance of viral internal adoption once the feature reaches more markets.

Challenges And Criticisms

No-code tools typically hit a ceiling with bespoke integrations, complex data governance and strict performance requirements. With this in mind, Opal is unlikely to replace traditional engineering for systems of record or heavily regulated workflows. There are also questions about lock-in, portability and transparency. For example, if a mini-app depends on specific Google prompts or components, migrating it to another platform may not be trivial. Observers of AI-assisted creation have also raised concerns about inconsistency and security weaknesses in generated logic. Even with step-wise debugging, a workflow that calls external models can behave unpredictably across inputs, which complicates testing and assurance.

‘ Security Debt’ In An AI-Accelerated World

This broader concern is reflected in new research from Black Duck, a long-running application security and open source risk specialist now part of Synopsys. For example, in a recent survey of 1,000 security professionals, 81 per cent said application security testing is slowing development and delivery, nearly 60 per cent said their organisations deploy code daily or more, and 46 per cent still rely on manual steps for security. The report warns that these patterns are creating  “security debt” , with vulnerabilities left unaddressed as release velocity increases. It also highlights tool sprawl and alert fatigue, with 71 per cent of respondents complaining about noisy and duplicative alerts, and it notes that 61.64 per cent of organisations test less than 60 per cent of their applications. Veracode’s separate analysis adds context, estimating that average remediation times have increased from 171 days in 2020 to 252 days in 2025.

Black Duck’s CEO, Jason Schmitt, has previously said that the findings show traditional approaches to application security are no longer keeping pace with the speed of modern software delivery. The company has advised development teams to move towards integrated, automated security processes that sit directly within their everyday workflows, rather than relying on separate or reactive testing later in the cycle.

How This Connects To Opal And Similar Tools

Opal’s improvements in transparency and debugging make failures easier to spot and discuss, however they do not replace secure design, testing and monitoring. If AI lowers the threshold for building and sharing tools, more people will build more tools, which increases the importance of guardrails that operate at the point of creation. For organisations experimenting with Opal, that means deciding where such tools are permitted, classifying data types that may flow through them, setting standards for prompts and outputs, and ensuring that automated checks run when a mini-app is created and whenever dependencies change.

Black Duck’s long-running audits of commercial codebases routinely find vulnerable open source components and out-of-date dependencies. Even small utilities can pull in libraries, connect to services or incorporate code fragments that carry risk. The lesson here is not to block experimentation. It is also to bring security to where the experimentation happens, to reduce manual steps, and to ensure there is visibility of what has been published, by whom, and with what data access.

What To Watch

For Google, the next test is how Opal scales beyond early adopters, including whether it gains the policy controls and enterprise integrations that larger organisations expect. For rivals, it seems the bar for speed, transparency and distribution has now been nudged a bit higher. For business users, especially in the UK, there is an opportunity to prototype faster while maintaining a clear line of sight on data and permissions (when it rolls out here). For security leaders, the priority is to embed checks in the same workflows that tools like Opal enable, so that velocity and visibility move together rather than in conflict.

What Does This Mean For Your Business?

For Google, the global expansion of Opal signals a growing confidence in the idea that AI-powered app creation can be simplified without losing too much control. It also highlights a clear ambition to (thankfully for many) make natural language the next user interface for software development, i.e. simplifying and democratising software development. Whether that ambition holds depends on how effectively Google can balance accessibility with governance. As more non-developers begin building tools that act on live data, the risk of inconsistency, bias and poor security hygiene rises. That is where the lessons from Black Duck’s research become most relevant. The warning is that automation alone does not guarantee safety, and that speed without embedded checks will always carry hidden costs.

For UK businesses, the wider rollout offers some cautious hope. It shows what could soon be possible for teams wanting to automate small tasks or prototype new ideas without waiting for developer time. However, it’s also a reminder that security, compliance and auditability can’t really be left behind. Firms that already use low-code or AI-assisted systems may now want to consider how no-code tools like Opal might fit within existing frameworks for risk management and data governance. The most successful adopters will likely be those that integrate these tools responsibly, pairing innovation with oversight.

Other stakeholders will also be watching closely – regulators may seek to understand how accountability works when the code itself is generated, while competitors will be under pressure to match Google’s blend of speed and transparency. For users, the immediate value lies in creativity and productivity, but long-term trust will depend on how reliably these mini-apps behave and how safely they handle information. What Opal ultimately represents is a shift towards a more participatory form of software creation, where almost anyone can build, test and share ideas. The challenge now is ensuring that such openness develops alongside the same rigour that businesses and users expect from any other form of technology.