Govern the Use of Generative AI Across the Systems Development Lifecycle (SDLC)

Defines how enterprises should govern generative AI used to create, analyze, transform, recommend, decide, automate, or operate work throughout the SDLC, including approved uses, source grounding, human accountability, data protection, evaluation, traceability, and operational monitoring.

Best Practice: Establish the Governing Principle for Govern the Use of Generative AI Across the Systems Development Lifecycle (SDLC)

Use generative AI as a governed lifecycle capability whose outputs remain attributable, reviewable, evidence-based, permission-aware, and subject to accountable human decision authority.

Benefits: Requiring generative AI outputs to remain attributable and reviewable means a hallucinated citation or an over-confident recommendation gets caught by a human reviewer before it becomes a Design decision or a Production change. This is what allows the enterprise to use AI to accelerate lifecycle work without quietly transferring accountability to a tool that can’t be held accountable.

Best Practice: Define Required Lifecycle Treatment for Govern the Use of Generative AI Across the Systems Development Lifecycle (SDLC)

Establish approved and prohibited use cases, accountable owners, data and intellectual-property restrictions, source-grounding requirements, prompt and Model configuration controls, evaluation methods, human-review obligations, output-retention rules, and escalation paths. Distinguish assistance from delegated authority: generative AI may draft, summarize, compare, classify, or recommend, but it must not silently approve requirements, Architecture, Risks, exceptions, Production authorization, supplier acceptance, or Retirement closure.

Benefits: Distinguishing what generative AI may draft or recommend from what it must never silently approve — Architecture decisions, Risk acceptance, Production authorization — keeps a fast, useful drafting tool from quietly becoming an unaccountable decision-maker. Defining source-grounding and IP restrictions up front also prevents a well-intentioned use case from creating licensing or confidentiality exposure no one noticed.

Best Practice: Apply Govern the Use of Generative AI Across the Systems Development Lifecycle (SDLC) Throughout the SDLC

During Intake, Research, and Planning, identify intended use, affected stakeholders, information sources, supplier dependencies, autonomy, consequence, and required controls. During Requirements, Design, and Build, define measurable output-quality, Security, Privacy, explainability, accessibility, provenance, and human-oversight requirements. During SIT, UAT, and staging, evaluate representative, adverse, ambiguous, and prohibited scenarios; verify citations, permissions, prompt behavior, tool access, and failure handling. During Production and Operations, monitor output quality, harmful or misleading behavior, drift, supplier changes, data leakage, cost, and human override. During Retirement, revoke access, remove prompts and tools, disposition retained interactions, and preserve required evidence.

Benefits: Evaluating adverse, ambiguous, and prohibited scenarios during SIT and UAT — not just typical prompts — is what surfaces where a generative AI feature will actually fail or produce a harmful output before real users encounter it. Monitoring for drift and data leakage in Production catches degraded behavior that no amount of pre-launch testing can fully rule out.

Best Practice: Govern Decisions and Preserve Evidence for Govern the Use of Generative AI Across the Systems Development Lifecycle (SDLC)

Record the approved use, Model and supplier, prompts or orchestration, grounding sources, tool permissions, evaluation results, known limitations, human-review responsibilities, monitoring thresholds, Risks, exceptions, deferred obligations, and change triggers in authoritative systems. Treat material prompt, Model, grounding, tool, policy, or supplier changes as governed configuration changes that may require renewed Verification, Validation, and authorization.

Benefits: Recording which Model, prompts, and grounding sources were actually used lets the enterprise reconstruct why an AI-assisted decision looked the way it did, which matters enormously if that decision is later questioned. Treating a prompt or Model change as a governed configuration change — requiring renewed Validation — closes the gap where AI behavior shifts without any of the usual code-review triggers firing.

Example

A developer uses an approved generative AI tool to draft code and test cases for a portal enhancement. Sensitive customer data and proprietary source material are excluded from prompts. The developer reviews and revises all generated content, records material provenance where required, and subjects code to normal peer review, security scanning, testing, and approval. Test cases are checked for missing conditions and false assumptions. The tool accelerates work, but accountability for correctness, security, licensing, evidence, and production outcomes remains with authorized enterprise roles.

Best Practice: Advance Maturity Deliberately for Govern the Use of Generative AI Across the Systems Development Lifecycle (SDLC)

At Crawl maturity, maintain a short list of approved generative AI tools and use cases, with prohibited uses clearly stated and a single accountable reviewer for questionable cases. At Walk maturity, apply a published policy defining approved and prohibited use cases by risk tier, with source-grounding and evidence requirements built into standard Release practice. At Run maturity, monitor AI-assisted outputs continuously for policy compliance, source attribution, and drift, with automated flags routed to accountable reviewers for the judgment calls that require them.

Benefits: A short approved-use list at Crawl maturity is enough to prevent the most consequential missteps without requiring a formal AI governance program the enterprise doesn’t yet have. A published policy with defined risk tiers at Walk maturity means AI-assisted work receives genuinely consistent scrutiny instead of depending on which team happens to be using it. Continuous automated monitoring at Run maturity catches policy drift and attribution gaps across a volume of AI-assisted work no manual review could reliably track.

Best Practice: Avoid Common Antipatterns in Govern the Use of Generative AI Across the Systems Development Lifecycle (SDLC)

Enterprises should avoid treating a Model, prompt, or grounding-source change as exempt from Release governance. AI behavior can shift materially from a Model update, prompt edit, or new grounding source even when no application code changes, so skipping renewed evaluation for these changes leaves a real behavior change ungoverned.

Benefits: Avoiding this antipattern keeps AI-enabled Solutions under the same governance rigor as any other material change. It prevents a quiet prompt or Model update from altering user-facing behavior without the review and evidence a code change would normally require.

Connections to Related IF4IT Practices and Inventories

Use the Data and Information Inventory and Attributes and the Integrations Inventory and Attributes to connect the decisions and responsibilities addressed in this chapter to authoritative information, semantic meaning, interface dependencies, lineage, and lifecycle records.

Apply Enterprise AI Governance Best Practices and, where AI Agents are involved, the AI Agents Inventory and Attributes to govern approved use, ownership, data access, autonomy, validation, monitoring, supplier exposure, and human accountability for generative AI and AI-enabled solutions.

Connect quality expectations to validation methods, test evidence, acceptance criteria, readiness gates, and Production assurance using the Non-Functional Requirements (NFRs) Framework for Software Systems.