In the ACE specification or the ACE program? In case of the specification, the language is designed to be easily verifiable, also through the generated test suite. This allows a domain expert to check it, as well as a programmer if required.

In case of the ACE program, it's a program so can indeed have bugs. But at least then we only have to verify the implementation of a single program, instead of all of them.