Who is this framework for?¶
This framework is written for anyone accountable for how AI-assisted development happens inside a company. That includes:
| Role | What you'll use most |
|---|---|
| CTO, VP Engineering, Head of Platform | Roadmap, Metrics taxonomy, Leadership charter worksheet |
| CIO, Chief Digital Officer | Governance overview, Regulatory mapping, Vendor standards |
| CISO, Head of AppSec | S.H.I.E.L.D., S.E.C.U.R.E., Incident response, Audit trails |
| Head of Developer Experience / DevEx Lead | C.O.D.E.S., Metrics baselining worksheet, Pilot scope |
| Engineering Manager / Tech Lead | V.E.R.I.F.Y., C.L.E.A.R., Pilot retrospective worksheet |
| Individual Contributor (developer, SRE, data engineer) | S.C.A.F.F., R.E.F.A.C.T., Prompt library starter |
| Legal, Privacy, Compliance | IP & licensing, Data handling, Regulatory mapping |
| Procurement | Vendor selection scorecard |
| Internal Audit / Risk | Risk classification, Audit trails |
| HR / L&D | Training needs assessment |
| Board / Audit Committee | Evidence overview, Regulatory mapping |
Not sure where to start?¶
Pick the statement closest to your situation.
"We haven't decided whether to adopt AI-assisted development yet."¶
Read, in order:
- Philosophy: the framework's stance (augmentation, not replacement).
- Evidence overview: what the public research actually says.
- Leadership charter worksheet: decide, in one meeting, whether and under what conditions to adopt.
"Developers are already using Copilot/Cursor/Claude, we're catching up."¶
This is the most common starting point. Read:
- Phase 0: Readiness. Stabilise what exists before it grows.
- AUP drafting worksheet. Publish an interim policy within two weeks.
- Incident response. Have a plan before you need one.
"We've piloted and need to scale."¶
Read:
- Pilot retrospective worksheet: structured go/no-go.
- Phase 2: Scale: expansion playbook.
- Metrics taxonomy: what to measure to justify expansion.
"Legal/Privacy/Risk is asking hard questions."¶
Read:
- Regulatory mapping: crosswalk to SOC 2, ISO 42001, EU AI Act, HIPAA, PCI.
- IP, licensing & provenance.
- Data handling & residency.
"We're in a regulated industry."¶
Start with Public sector & regulated and then follow the "Legal is asking" path above.
Who this is not for (yet)¶
- AI model trainers. This framework is about using coding assistants, not training them.
- Pure-research teams. If your AI use is exploratory with no production path, the governance overhead here will be disproportionate. Skim Philosophy and return when something goes to production.
- "No AI, full stop" organisations. You can still read Evidence overview as input to that decision, but the rest won't apply.
Changing roles?
Bookmark this page. The right starting point for a new CISO is not the right starting point for a new tech lead, and the framework is designed to be re-entered from any role.