Tailor the SDLC for Artificial Intelligence (AI)-Enabled Solutions

Defines how to tailor the Enterprise SDLC for AI-enabled Solutions without replacing lifecycle obligations or assuming every AI use requires identical control depth.

Best Practice: Establish the Governing Principle for Tailor the SDLC for Artificial Intelligence (AI)-Enabled Solutions

Tailor AI lifecycle treatment according to intended use, autonomy, consequence, uncertainty, data sensitivity, affected populations, supplier control, and reversibility while preserving minimum governance outcomes.

Benefits: Scaling AI governance to actual autonomy and consequence means a low-stakes internal drafting tool isn’t burdened with the same controls as a customer-facing automated decision system, while genuinely high-consequence AI use gets the human oversight it needs. This proportionality is what keeps AI governance sustainable as adoption grows, rather than becoming a bottleneck teams route around.

Best Practice: Define Required Lifecycle Treatment for Tailor the SDLC for Artificial Intelligence (AI)-Enabled Solutions

Benefits: Classifying an AI capability by autonomy and potential harm before selecting its lifecycle treatment prevents both under-governing a high-autonomy system and over-governing a low-risk one. Treating a Model, prompt, or grounding-source change as a Release trigger also closes a real gap — AI behavior can shift materially without any application code changing at all.

Best Practice: Apply Tailor the SDLC for Artificial Intelligence (AI)-Enabled Solutions Throughout the SDLC

Apply this discipline continuously from Intake through Retirement, translating the governing principle into testable requirements during Design and Build, generating decision-ready evidence through integration and acceptance testing, verifying the authorized state in Production and Operations, and closing remaining obligations at Retirement.

Benefits: Defining measurable output-quality and human-oversight requirements at Design time, rather than discovering acceptable behavior only through post-launch complaints, gives teams something concrete to test against during SIT and UAT. Evaluating adverse and ambiguous scenarios specifically — not just typical ones — is what surfaces the failure modes generative AI is most prone to before users encounter them.

Best Practice: Govern Decisions and Preserve Evidence for Tailor the SDLC for Artificial Intelligence (AI)-Enabled Solutions

Establish named ownership — Solution, Release, discipline, evidence, and Risk — proportionate to the work’s actual criticality and reversibility. Keep Risks, exceptions, and Technical Debt visible in authoritative systems, not buried in narrative updates. Generative AI may assist with analysis and drafting, but accountable decisions remain with named human authorities.

Benefits: Recording Model provenance, evaluation results, and known limitations in an authoritative system means the next person to modify the AI capability inherits that context instead of starting from scratch. Requiring renewed evaluation whenever the Model, prompt, or grounding source changes materially closes the gap where AI behavior drifts without triggering any of the usual code-change controls.

Example

An AI-assisted underwriting service follows the standard SDLC but adds controls for training-data quality, privacy, model validation, bias and fairness testing, explainability, human review, override capability, and prohibited-use boundaries. Production readiness includes model versioning, monitoring thresholds, rollback, and escalation procedures. Operations tracks drift, outcome quality, incidents, and changes in data or regulation. A model update is treated as a governed Release because behavior can change even when surrounding application code does not.

Best Practice: Advance Maturity Deliberately for Tailor the SDLC for Artificial Intelligence (AI)-Enabled Solutions

At Crawl maturity, tailor AI-specific SDLC treatment case by case, with the accountable owner reasoning through autonomy and consequence for each Release individually. At Walk maturity, apply a published AI risk classification with defined tailoring rules mapped to autonomy, data sensitivity, and consequence tiers. At Run maturity, generate an initial AI risk classification and tailoring recommendation automatically from Solution and use-case characteristics, with an accountable owner confirming it before it governs the Release.

Benefits: Case-by-case tailoring at Crawl maturity is enough to apply sound judgment to a small number of AI-enabled Releases without requiring a formal classification framework the enterprise doesn’t yet have. A published classification with defined tailoring rules at Walk maturity means similar AI use cases receive genuinely comparable treatment instead of depending on who happens to review them. Automating the initial classification at Run maturity accelerates routine AI Releases while keeping a human owner accountable for confirming the recommendation actually fits the use case.

Connections to Related IF4IT Practices and Inventories

Use Application Portfolio Management (APM) Best Practices and the Applications Inventory and Attributes to clarify enduring ownership, lifecycle accountability, value, cost, risk, and dependency information. Use the Data and Information Inventory and Attributes and the Integrations Inventory and Attributes to connect the decisions and responsibilities addressed in this chapter to authoritative information, semantic meaning, interface dependencies, lineage, and lifecycle records.

Ground quality expectations in the Non-Functional Requirements (NFRs) Framework for Software Systems, connecting them to validation methods, test evidence, acceptance criteria, readiness gates, and Production assurance.

Apply Enterprise AI Governance Best Practices and, where AI Agents are involved, the AI Agents Inventory and Attributes to govern approved use, ownership, data access, autonomy, validation, monitoring, supplier exposure, and human accountability for generative AI and AI-enabled solutions.