Topic starter
18/08/2026 2:29 pm
TL;DR: AI-assisted development can speed software delivery in financial services, but Sonar’s analysis argues that continuous code verification is now essential to keep quality, security, maintainability, and supply chain risk visible across the SDLC, while aligning with FFIEC Development, Acquisition, and Maintenance expectations. The governance problem is not code generation itself, but whether institutions can still prove review, testing, and remediation are happening before release.
Editorial analysis by NHI Mgmt Group, based on content published by Sonar: “Scaling AI-assisted development in US financial services without losing control”.
Key questions
Q: How should financial institutions govern AI-assisted development without slowing delivery?
A: They should move verification into the development workflow so every change is analysed before merge or release.
Q: Why do AI coding agents create governance risk even when they improve productivity?
A: They create risk because faster output does not guarantee safer output.
Q: What breaks when code review is left to late-stage release checks?
A: Late-stage review cannot reliably keep up when AI produces more changes in less time.
Practitioner guidance
- Implement continuous code verification at every change stage Apply automated analysis to commits, pull requests, branches, and CI/CD so review happens before code is merged or released.
- Track remediation evidence for every security finding Retain issue severity, assignment, status, and quality gate outcomes so audit and risk teams can see what was found and what was fixed.
- Extend scanning to dependencies, secrets, and repository changes Check third-party libraries, transitive dependencies, embedded secrets, and private keys before packaging or deployment.
Bottom line: AI-assisted development increases delivery speed, but it also raises the volume and velocity of code that must still be reviewed, tested, and evidenced before release.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
18/08/2026 3:16 pm
Continuous verification is becoming the governing control for AI-assisted delivery. In regulated software environments, the question is no longer whether AI can generate code faster, but whether institutions can still prove that code was reviewed, tested, and remediated before release. That shifts control ownership toward the SDLC itself, where evidence must be created continuously rather than assembled after the fact. Practitioners should treat verification as the mechanism that keeps AI-assisted delivery governable.
A few things that frame the scale:
- Claude Code-assisted commits leaked secrets at a rate of 3.2%, more than double the human-only baseline of 1.5%, with peaks reaching 31 secrets per 1,000 commits in August 2025, according to the State of Secrets Sprawl 2026.
- 40 percent of financial and software companies have already deployed agentic AI systems, and deployments are expected to double by 2028.
A question worth separating out:
Q: What do financial services teams need to prove about AI-generated code?
A: They need to prove that code was reviewed consistently, vulnerabilities were identified early, remediation was tracked, and release decisions were made against defined standards. That proof matters because regulators and internal risk teams care about operating evidence, not just intent. Continuous verification is what turns that evidence into something durable.
👉 Read our full editorial: AI-assisted development in financial services needs continuous code verification