The compliance frameworks were written before AI coding tools existed
ISO 27001, SOC 2, and NIST assume humans made decisions and left a paper trail. That assumption is breaking. Imagine an auditor sitting across from your engineering team. They're working through your change management controls. They want to know: who approved this code change? What was the review process? Is there evidence that a qualified person made a deliberate decision? Six months ago, the…
Compliance frameworks such as ISO 27001, SOC 2, and NIST were developed long before artificial intelligence coding tools became commonplace. They assume that humans make decisions and leave a paper trail. However, this is no longer the case. Auditors are finding it difficult to assess whether AI coding tools are properly accounted for when evaluating the engineering practices of organizations.
There are three main gaps in the current compliance frameworks:
1. Change management evidence: When an AI tool suggests a code change, there is uncertainty about the review process. The question arises as to what evidence there is of a qualified person reviewing the AI-generated change. The auditor might ask for a walkthrough of the review process, to which the organization may struggle to provide a response, as the AI session may no longer exist.
2. Audit trails and session records: NIST SP 800-53 controls related to audit and accountability do not cover AI coding sessions. There are no logs or records of AI conversations, which leaves a significant gap in evidencing the review and approval process.
3. Data handling and third-party disclosure: Developers often share sensitive information, such as production schemas and error logs, with AI tools. This practice is not covered by current compliance controls, such as GDPR Article 30 and ISO 27001 Annex A.15. The lack of a record of what information was shared and when poses a challenge for auditing.
Currently, organizations are taking two approaches to address these gaps. Some have banned AI coding tools entirely due to compliance concerns, but this is becoming less feasible as the productivity gains from AI are substantial. Another approach is to add AI-specific code review steps, which helps with change management but does not address data handling or audit trail requirements.
To effectively meet the evolving compliance landscape, organizations need to develop interim controls that treat AI sessions as auditable activity. It is crucial to decide explicitly whether AI coding sessions are in scope for compliance frameworks and establish systematic approaches to capturing the AI involvement in engineering work. While compliance framework updates may take years to materialize, organizations must take proactive steps to address these challenges in the short term.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
