Skip to content

Phase 2: Scale (Months 3–12)

Duration: 9 months, nominally. Can be faster in a small company, slower in a regulated or multi-region enterprise. Goal: expand the pilot to a majority of eligible engineers, without losing the safety properties that made the pilot acceptable.

What Phase 2 produces

Output Notes
Permanent Acceptable Use Policy, replacing the Phase 0 interim AUP. Published, acknowledged, on a review cadence.
Tool & vendor standards: a short list of approved tools, with the rest denied. Reviewed against the vendor scorecard yearly.
Center of Excellence (CoE): a small team owning the framework day-to-day. 2–8 people, depending on org size. See C.O.D.E.S..
Training curriculum: role-differentiated, embedded in onboarding. Developer, tech lead, security reviewer tracks.
Prompt library, reviewed, classified, and governed. See Resources: prompt library starter.
Monthly KPI dashboard: DORA + SPACE + security + quality + financial. Dashboards & reporting.
Regulatory crosswalk v1, mapping company AI controls to applicable standards. Regulatory mapping.
Quarterly framework review cadence, with the first review held. See Phase 3 for ongoing cadence.

Exit criteria

  • ≥60% of eligible engineers onboarded, with evidence (not "licences issued" but active weekly usage).
  • Monthly KPI dashboard has been live for ≥3 consecutive months, with metrics trending within ±20% of targets.
  • CoE has a named lead and at least one public artifact (updated AUP, new training module, or prompt-library governance decision).
  • Permanent AUP signed off by Security, Legal, Privacy, and the executive sponsor.
  • At least one incident has been detected, triaged, and closed through the updated IR plan, proving it works in production, not just tabletop.
  • Regulatory crosswalk v1 reviewed by Internal Audit or an equivalent assurance function.

Sizing guide

  • Small (< 50): CoE is typically one part-time role. "Whole organization" is the pilot plus everyone else.
  • Mid (50–500): CoE is 2–4 people, often inside an existing Platform or DevEx team. Scale in 3–5 waves.
  • Enterprise (500+): 5–8 person CoE; business-unit champions embedded; 8+ waves over the 9 months.
  • Regulated: add a second sign-off loop (audit, risk committee) for each wave. Expect 12–18 months instead of 9.

The core moves

1. Stand up the Center of Excellence (month 3–4)

The CoE owns the framework day-to-day: AUP, tool standards, training, prompt library, metrics, and incident learning. It is not an approvals body; that would be a bottleneck. It is a support and standards body.

Minimum roles (can be combined in small orgs):

  • CoE Lead. Single accountable owner; reports to executive sponsor.
  • AppSec liaison. Reviews AI-specific threats; owns the security side of AUP.
  • DevEx / Platform engineer. Owns tool integration and metrics pipelines.
  • Training / enablement owner. Owns the curriculum and its cadence.
  • Legal / Privacy liaison (fractional). Reviews vendor changes and regulatory updates.
  • Business-unit champions (one per BU or large product line), 20% time.

See C.O.D.E.S. for the collaboration model.

2. Expand in waves, not broadcasts (months 4–10)

Resist the urge to "turn it on for everyone next Monday." Use waves of 50–200 engineers at a time, ideally spaced 2–4 weeks apart. Each wave:

  1. Announce. 2 weeks ahead, so teams can plan.
  2. Onboard. Training sessions scheduled in advance.
  3. Observe. CoE watches metrics and incident reports for 2 weeks.
  4. Decide. Go-signal for the next wave, or pause to investigate.

This cadence is how you catch problems early. A 5,000-person org that rolls out in one big bang has no capacity to respond to the first incident because it's also managing the forty-first.

3. Finalise the permanent AUP (month 4–6)

Replace the Phase 0 interim AUP with a permanent one. Inputs:

  • All pilot incidents and their root causes.
  • Legal and Privacy review (now with real usage data to reason about).
  • Vendor contract actual terms (including anything negotiated post-pilot).
  • Regulatory crosswalk v1.

Don't let the permanent AUP become a monolith. Structure:

Section Length Owner
Purpose & scope 1 page Exec sponsor
Approved tools (with links to their specific data-handling terms) 1 page, updated as tools change CoE
Data handling: what goes where, with examples 2 pages CISO / Privacy
IP & licensing: OSS provenance, indemnification expectation 1 page Legal
Developer obligations (verification, review, logging) 2 pages Engineering
Agent-specific rules (no prod write without approval, etc.) 1 page CISO
Incident reporting: how, to whom, what data to preserve 1 page IR lead
Exceptions process 1 page CoE + exec sponsor
Review cadence and change log 0.5 page CoE

4. Train by role, not by tool (months 4–12)

At pilot scale you can get away with "here's a one-hour intro." At scale you can't. Role-differentiated tracks:

  • Developer track (8–12 hrs): prompting, verification, secure patterns, when not to use AI.
  • Tech lead track (4 hrs on top): reviewing AI-generated code, coaching verification, metrics literacy.
  • Security reviewer track (6 hrs on top): AI-specific threat model, incident response, red-team basics.
  • Manager track (2 hrs): reading the KPI dashboard without misinterpreting it, detecting over-trust.
  • Executive track (1 hr): what the board needs to know, what not to commit to publicly.

Baseline spend is roughly what Accenture published for its LearnVantage program: in the order of thousands of dollars per engineer per year when certification paths are included1. Adjust for company size.

Consider external certifications as a signal, not a substitute:

  • GitHub Copilot certification (GH-300)2
  • AWS Certified AI Practitioner (AIF-C01)3
  • ISO/IEC 42001 Lead Implementer courses for governance roles4

5. Govern the prompt library (months 5–9)

A prompt library that everyone dumps into is worse than no library at all; it spreads old, insecure, or tool-specific patterns. Govern it with a three-tier model (based on the archived framework's template):

Tier Scope Review cadence Approval
Core Enterprise-wide patterns (auth, data access, logging, tests) Quarterly CoE + Security
Business Unit BU-wide patterns (payment-specific, clinical-specific) Bi-annually BU champion + CoE
Team Team-specific snippets Ad hoc Tech lead

Each library entry must have: purpose, tool compatibility, security notes, verification-level guidance, "used successfully in N projects", and a last-reviewed date.

6. Regulatory crosswalk v1 (months 6–10)

Map your controls to the standards you actually care about. At minimum:

See Governance: regulatory mapping for the crosswalk template.

7. First quarterly framework review (month 9 or 12)

End Phase 2 by running the first review that will become your steady state in Phase 3. The review answers:

  • What did the dashboard tell us this quarter?
  • What incidents happened, and what framework changes are implied?
  • What has the tooling landscape done that we need to respond to?
  • What regulations changed (EU AI Act stages, sector additions)?
  • What is the CoE's capacity forecast for the next quarter?

Scale anti-patterns

Don't

  • Don't scale without the CoE in place. "We'll set up governance as we go" is how 10,000 engineers end up with 10,000 interpretations of the AUP.
  • Don't treat acceptance rate as success. "People accept more suggestions" is the metric vendors track because it justifies pricing. Your organization's success metric is still DORA + quality + security, measured at the team level.
  • Don't freeze on one tool vendor. Cursor overtaking Copilot in developer preference in 2025 surprised many procurement teams. Maintain exit criteria and a backup in your scorecard.
  • Don't push AI use as a performance requirement until you have evidence it is net-positive for your context. Shopify and Duolingo both made AI use a performance expectation publicly56; both drew backlash. If you go this route, base it on evidence and acknowledge the cultural change explicitly.

Next

  1. Accenture press, "Accenture launches LearnVantage", Mar 2024. ↩

  2. GitHub Learning, certifications catalog. ↩

  3. AWS, Certified AI Practitioner. ↩

  4. ISO, ISO/IEC 42001:2023. ↩

  5. Tobi Lütke on X (widely reported), "Reflexive AI usage is now a baseline expectation at Shopify", Apr 2025. ↩

  6. Duolingo LinkedIn, "An update on our AI strategy", Apr 2025. ↩