Notifications
Clear all
Topic starter
18/08/2026 2:39 pm
TL;DR: AI can increase software delivery speed in regulated industries, but Sonar argues that velocity only becomes usable when code quality, security, and maintainability are verified continuously rather than left to manual review. The real issue is governance: AI expands who can contribute, so delivery controls must scale with the work, not after it.
NHIMG editorial — based on content published by Sonar: AI-assisted development in regulated industries and the role of SonarQube
Questions worth separating out
Q: How should security teams govern AI experimentation without slowing delivery?
A: Use lane-based governance.
Q: Why do AI coding tools increase secrets risk?
A: AI coding tools increase secrets risk because they can accelerate the reuse of insecure patterns across repositories, test fixtures, and automation scripts.
Q: What do security teams get wrong about code quality tools?
A: They often treat code quality tools as development hygiene instead of risk controls.
Practitioner guidance
- Embed automated quality gates in CI/CD Block merges when code introduces secrets, critical vulnerabilities, or maintainability issues that exceed policy thresholds, and make the gate consistent across all repositories.
- Separate generation from approval Design AI-assisted workflows so code generation, verification, and release approval are not performed by the same trust step or automated actor.
- Extend governance to secrets and dependencies Treat embedded tokens, API keys, and risky third-party packages as delivery risks that must be scanned and remediated before production promotion.
What's in the full article
Sonar's full article covers the operational detail this post intentionally leaves for the source:
- Specific examples of how SonarQube embeds security and maintainability checks into AI-assisted development workflows.
- The Agent Centric Development Cycle structure and how its Guide, Verify, and Solve steps are intended to work in practice.
- The kinds of regulated-industry development scenarios Sonar uses to explain why AI output still needs independent verification.
- Examples of enterprise organisations referenced by Sonar as part of its use-case framing.
👉 Read Sonar's analysis of AI-assisted development and continuous code verification →
AI-assisted development and code verification: are controls keeping up?
Explore further
18/08/2026 3:23 pm
Continuous verification is becoming the control plane for AI-assisted development. When AI expands code output, manual review stops being a credible primary safeguard. Organisations need controls that evaluate every change for security, secrets, and maintainability before it reaches production. The discipline here is closer to policy enforcement than ad hoc review, and that is where regulated environments will separate scalable delivery from avoidable risk.
A question worth separating out:
Q: How can teams separate AI speed from production risk?
A: By putting a verification layer between code generation and release. That layer should check for security defects, dependency issues, and maintainability problems independently of the AI system that helped create the code. If the same process generates and approves changes, speed is being added without meaningful control.
👉 Read our full editorial: AI-assisted development needs continuous code verification in regulated sectors
