Your SDLC documents describe a team without AI
Your biggest worry is code or customer data leaking into a public AI tool, and today no document tells a developer where the line is. Banks and insurers answer to financial regulators like OJK, MAS, and BNM for how they build and change software. Even without a regulator looking over your shoulder, you still need to know who’s using which tool, what data is going in, and how AI-written code gets reviewed. Your existing SOPs were written before AI, so they say nothing about it: who may use which tool, what data may go into a prompt, how AI-generated code is reviewed, or what the audit trail should show.
Tool and data rules
Which AI tools are approved, on which accounts, and which code, documents and customer data may be shared with them.
Review and approval flows
Who reviews AI-generated code, tests and documentation, and who signs off before release.
Agile and DevOps procedures
Planning, build, testing, release and change management, written for how your teams work today.
Rules for business-built tools
For the tools business users build through vibe coding: where they run, what they may touch, and when IT takes them over.
Write, test, adopt, and maintain
Discovery
We review your existing SOPs, policies and the rules you answer to. If you have run an AI SDLC Assessment, we start from its findings.
Drafting workshops
We draft the procedures with your engineering, security, risk and compliance people, in working sessions and follow-ups.
Pilot and sign-off
Each procedure is tested with a small number of teams before sign-off, so what is written matches how people can actually work.
Ongoing maintenance
Available as a retainer. We review how the procedures are working and update them as regulations, tools and your teams change.
Procedures your teams can follow and auditors can check
AI-aware SDLC and DevOps SOPs
Step-by-step procedures for each stage of your lifecycle, with the role of AI written into each one.
An engineering AI use policy
Approved tools, data rules and responsibilities for everyone who writes or reviews code.
Audit-ready templates
Checklists and records that show who approved what, and when.
A maintenance retainer
Optional. Regular reviews and updates, so the procedures stay current as your tools and rules change.
Where this leads next
Make it work in your teams
Bring an AI Engineer Coach into your teams to put the new procedures into daily practice.
Company-wide AI policy
For rules that cover every employee, see Responsible AI Governance.