AI governance landed on engineering agendas when Stack Overflow surveys started showing more than 80% of developers using coding assistants. Your team adopted those tools before any policy existed. Treating that fact as a scandal slows everything down; treating it as a starting point moves the work forward.
Shadow AI is the default state
Engineers have pasted code snippets into public chatbots since 2023. Shadow AI grew in the policy vacuum and keeps growing while formal approval drags on. Acknowledging the usage and channeling it cuts risk; pretending it away leaves the company exposed on every front.
Data classification comes first
Build a direct map: which data may touch external APIs such as OpenAI and Anthropic, and which stays inside your infrastructure. Exposure under the LGPD and the EU AI Act depends on that map. Without it, every new tool restarts the debate from scratch.
Lightweight approval in five days
One-page form, joint security and legal review, five working days. A slow pipeline pushes usage underground, and the company loses sight of what runs there anyway. Publish the status of every request in an open channel; visibility kills the shadow queue.
Code provenance
Record which tool generated each contribution, in the commit message or a repository tag; one template line settles it. Intellectual property questions surface during acquisitions and contract disputes. Answering with documented history protects the company valuation.
Accountability with a name on the PR
Every AI-originated line has an identified reviewer. The reviewer owns the code as if they wrote it; hold that standard. Auto-merge stays off the critical paths: payments, authentication, personal data.
Audit trail
Log the models and versions that touched production code, storing the record alongside the build artifact. Keep that log queryable by repository so answers take minutes instead of weeks. Auditors and acquirers running due diligence ask the question, and a "we don't know" costs real money at the table.
The eight-item checklist
- Map the data each system handles and classify by sensitivity.
- Define which classes may travel to external providers.
- Publish a one-page approval form with a five-working-day SLA.
- Require recorded provenance for every code contribution.
- Attach a named reviewer to each PR containing AI code.
- Keep auto-merge disabled on critical repositories.
- Log model and version for any AI touching production.
- Review the policy every six months.
Eight controls, one month of implementation, zero additional budget. Governance at this level fits into an architecture afternoon.
