EXECUTIVE

BRIEFING

The Questions You Should Be Able to Answer About AI in Your Software Development Organization

A diagnostic framework for boards, chief executives, general counsels, compliance officers, and chief financial officers. Prepared by Technossus Enterprise Governance for AI-Driven Software Development

May, 2026

The Questions You Should Be Able to Answer About AI in Your Software Development Organization

The conversation you should be having

AI-assisted software development has already entered your production systems. The question is no longer whether to adopt it. The question is whether your organization can defend what is now happening inside it.

In our work with executives across regulated industries: financial services, healthcare, life sciences, energy, public sector, three observations recur.

First. AI in software development is already material. By our estimate, between thirty and sixty percent of new code at large enterprises now passes through some form of AI tooling before it ships. Most boards have not been told this directly. Most compliance functions have not adjusted their evidentiary expectations. Most CFOs have not updated their certification posture. The use has moved faster than the governance.

Second. The risk does not present itself dramatically. There has not yet been a defining public incident that crystallizes executive attention the way the 2017 credit reporting breach crystallized cybersecurity attention. The risk surfaces gradually, through unexplained defects, regulatory inquiries that take longer to answer than they should, audit findings that previous years did not produce, and the slow accumulation of code whose provenance no human in the organization can fully reconstruct.

Third. The executives who are most exposed are the ones whose accountability requires them to certify, defend, or attest to operational integrity and who have not yet examined whether their attestations remain defensible given the change. That is the audience for this document.

The framework below is organized by the accountability of the executive. Each section presents the questions the role should be prepared to answer; to a regulator, to a litigant, to a board, to a shareholder, to a journalist. The depth varies by role; the questions follow the materiality, not a template.

If you find, on reading the questions that follow, that you cannot answer them to your own standard, you are not alone. Most organizations cannot. The relevant question is whether you know you cannot, and whether you have a plan to be able to.

For the Chief Executive and the Board For the Chief Executive and the Board

What you sign your name to when you sign 10-Ks, proxy statements, and public commitments.

The Chief Executive's accountability for AI in software development is not a matter of operational detail. It is a matter of whether the public statements the organization has made, and continues to make, remain defensible.

Q&A

Leadership should be able to provide a defensible estimate, not a general observation. If the organization does not track this activity, the question becomes whether that absence of visibility represents a governance gap.

The central Board question is not whether AI is being adopted. It is whether the organization can govern, explain, and defend its use with confidence.

For the General Counsel

Whether the organization remains defensible, in litigation, in regulatory examination, in privileged matters, in commercial dispute.

The legal function bears a particular responsibility for AI in software development because the exposure surface is new. Traditional software development practices accumulated decades of precedent on questions of liability, privilege, intellectual property, and discovery. AI in development is unsettling each of those settled areas simultaneously.

Q&A

Increasingly sophisticated litigants will demand a clear chain of evidence, including specifications, approvals, verification activities, governance controls, and decision history. The ability to reconstruct this chain may become central to legal defensibility.

For the Chief Compliance Officer

Whether the organization can demonstrate, to its regulators, that it operates within the regulatory and policy boundaries it claims to.

Compliance functions have spent twenty years building evidentiary discipline around human-generated artifacts. AI-generated artifacts have not yet been incorporated into that discipline at most organizations. The gap is not academic. The gap is the precise zone in which an organization that has been compliant in its own self-perception can be found non-compliant in regulatory examination.

Q&A

Organizations should be able to demonstrate what controls applied, who approved the work, and how compliance was verified. In regulated environments, a response that ends with "the AI generated it and a developer reviewed it" may not be sufficient.

For the Chief Financial Officer

Financial reporting integrity, internal controls over financial reporting, certification posture, and the cost discipline of AI itself.

The Chief Financial Officer's accountability for AI in software development operates across two dimensions: control and cost. The first is ensuring that systems supporting financial reporting continue to meet regulatory and audit requirements. The second is determining whether AI related productivity and cost claims can withstand scrutiny.

Q&A

Many organizations have not updated their control frameworks to address AI generated changes. As AI touches financially significant systems, control gaps are becoming increasingly visible during audits and compliance reviews.

The central question is not whether AI creates value. It is whether that value can be measured, governed, and defended with the same rigor applied to every other financially material activity.

Adjacent roles where these questions also apply

The questions above are not exhaustive. Several adjacent executive functions face their own variants of the same diagnostic.

The Chief Risk Officer

Most enterprise risk frameworks do not yet treat AI in development with the granularity its materiality requires. The risk extends beyond a single category and spans cybersecurity, regulatory compliance, operational resilience, third party dependencies, reputation, and strategic competitiveness. The CRO's question is whether AI in development is reflected appropriately within the enterprise risk register.

The Chief Information Security Officer

AI agents increasingly operate within development environments that provide access to code, configuration, and sensitive context. Existing security controls may not fully address the risks introduced by AI generated code and AI enabled workflows. The CISO's question is whether the organization's security model has evolved alongside AI adoption.

The Audit Committee

AI in development affects financial reporting, internal controls, and audit readiness. The Committee's question is whether management and external auditors have assessed its impact with a level of scrutiny proportional to its growing importance. Waiting for external pressure to raise the issue is rarely the optimal approach.

What the framework reveals and what to do with it

Senior executives reading this framework typically experience one of three patterns of recognition. Each pattern implies a different shape of work.

Pattern One: Consolidation

The answers already exist within the organization, but they are fragmented across functions. Compliance, engineering, finance, and risk teams each hold part of the picture. The work is to consolidate these perspectives into a single, defensible view that leadership can use for oversight and decision making. The outcome is a current state diagnostic that establishes a baseline for governance.

Pattern Two: Synthesis

The answers do not yet exist, but the evidence does. Decisions are captured in tickets, controls reside in documentation, and operational data exists in logs and systems. The challenge is to synthesize these inputs, identify governance gaps, and create a framework that transforms disconnected evidence into accountable oversight.

Pattern Three: Foundation

AI adoption has outpaced governance. The evidence, controls, and accountability structures required to answer these questions do not yet exist at sufficient scale. The work is foundational: establishing governance, instrumenting systems, and creating the operating model through which AI development can be governed, measured, and defended.

Most organizations fall into Pattern Two or Pattern Three. Few are in Pattern One. Identifying which pattern applies is often the most valuable outcome of the diagnostic itself. The questions in this framework are not the conclusion of the conversation. They are the starting point.

The executives who address these questions in the next twelve months will be operating from a position of strength when the next eighteen months produces the developments that demand answers. The executives who defer the conversation will be answering questions in different conditions, often with less time and less optionality. The cost of preparation is consistently lower than the cost of response.

A note on timing

The questions in this framework are appropriate to the regulatory, audit, and operational environment as of mid-2026. They will evolve.

Several developments are likely within the next eighteen months that will sharpen the questions further: new regulatory guidance specifically addressing AI in development from agencies in multiple jurisdictions; evolving audit standards from PCAOB and equivalent bodies addressing AI-touched financial systems; the first wave of substantive case law on liability allocation when AI-generated code causes harm; tightening of contractual standards for AI use in vendor relationships.

The framework will refresh. The work of establishing defensible answers should not wait for the refresh.

Loading insight