The AI SDLC is the software development life cycle with AI working in every stage: drafting requirements, designs and tests, writing code through coding agents, and checking and summarising what changed, while people make the decisions at each gate.
Published · Every figure links to its primary source.
The same stages, a different bottleneck
The software development life cycle is the path from an idea to software in production and back again. The international standard for it, ISO/IEC/IEEE 12207, defines the processes without prescribing a model; its current edition was published in 2026 and replaced the 2017 one. (ISO/IEC/IEEE 12207:2026)
Anthropic’s playbook describes six stages most organisations run: plan, design, build, test, deploy and maintain. In the AI SDLC the stages stay, but the work inside them changes: AI drafts, coding agents implement, and the bottleneck moves to the steps that still run at human speed. As the playbook puts it: “The bottleneck moves to the steps to the left and right of the build phase. This is mainly plan, review/test, and deploy, which still run at human speed.” (Anthropic, The AI-Native SDLC playbook (2026))
The AI SDLC, stage by stage
What AI does in each stage today, what stays with people, and what to watch for.
The six stages of the AI SDLC: what AI does, what people keep, and what to watch
Stage
What AI does
What people keep
What to watch
Plan
Turns a brief into stories with acceptance criteria, flags gaps and duplicates, and summarises status.
Decide what is worth building, in what order, and what done means.
Stories that read well but leave the edge cases unstated, which an agent then guesses.
Design
Drafts architecture options, diagrams and decision records from the requirements and the existing system.
Choose the option and own the trade-off.
A plausible design that ignores a constraint nobody wrote down.
Build
Coding agents implement a story end to end in a branch, run the checks and open a pull request.
Review each change against the story it claims to finish.
Bigger pull requests and slower reviews, the cost that lands on the reviewer.
Test
Drafts test cases from each acceptance criterion, writes tests before the code, and triages failures.
Decide how much testing is enough, and explore what no criterion anticipated.
Tests written to pass the code rather than to check the requirement.
Deploy
Runs pipelines, checks quality gates and flags risky changes before release.
Approve the release and own the rollback.
Instability. DORA 2025 found AI adoption still associated with higher delivery instability.
Maintain
Summarises incidents, proposes fixes, and keeps documentation in step with the code.
Decide what to fix first, and what the incident should change.
Fixes that treat the symptom and documentation nobody reviews.
Vendors, analysts and researchers use several names for the same shift. They differ mostly in where they put people.
Names for the AI SDLC, who uses each, and what each stresses
Name
Who uses it
What it stresses
AI-native SDLC, also “agentic SDLC” and “AI SDLC”
Anthropic, The AI-Native SDLC playbook, August 2026 (claude.com)
A loop instead of a line, with AI at every point, six stages (plan, design, build, test, deploy, maintain), each ending in an artifact the next reads, and humans accountable for every judgment call.
AI proposes, asks clarifying questions and implements only after human validation, across Inception, Construction and Operations; sprints give way to “bolts” of hours or days. AWS open-sourced the workflow in November 2025.
AI inside the existing lifecycle, judged by delivery outcomes. DORA’s headline: AI is an amplifier of what is already there.
Autonomous SDLC platform
Harness, in its current tagline
AI for the pipeline after code is written: delivery, security testing, runtime protection and cloud cost.
What the evidence says
Across surveys, trials and telemetry the pattern is the same: individual output rises, while review, testing, stability and trust become the constraint. An AI SDLC is mostly the work of moving those constraints, not of writing code faster.
DORA 2025: AI amplifies what is already there
Survey of 4,867 technology professionals, June to July 2025
90% of respondents use AI at work, and more than 80% believe it made them more productive. AI adoption now improves delivery throughput, but it is still associated with higher delivery instability, and 30% report little or no trust in AI-generated code. DORA names seven capabilities that decide whether AI helps, from a clear AI stance and AI-accessible internal data to working in small batches and quality internal platforms.
Caveat: Self-reported, and cross-sectional: it shows associations, not causes.
With AI tools allowed, tasks took 19% longer (confidence interval +2% to +39%), while the same developers believed AI had sped them up by 20%. Experts had predicted a speed-up of 38 to 39%.
Caveat: METR now labels these results out of date, and judged its 2026 re-run unreliable because many developers declined to work without AI. Read it as evidence that perceived and measured speed can diverge, not as today’s effect size.
84% use or plan to use AI tools, and 51% of professional developers use them daily. Yet more developers distrust the accuracy of AI output (46%) than trust it (33%), and the top frustration, for 66%, is solutions that are almost right, but not quite.
Caveat: Self-reported, and recruitment skews toward engaged Stack Overflow users.
Vendor telemetry from 22,000 developers in more than 4,000 teams
Comparing each organisation’s periods of lowest and highest AI adoption, epics completed per developer rose 66%, but median time in review rose 441.5%, and the ratio of incidents to pull requests rose 242.7%.
Caveat: A vendor study, not peer reviewed; Faros says its data contradicts DORA’s 2025 findings.
The practice that holds an AI SDLC together is writing the intent down before the code: a spec becomes the contract the agent builds from and the reviewer checks against. The tools that made it popular all converge on the same chain, from intent to requirements to a plan to tasks to code.
GitHub Spec Kit. Open-source toolkit, released September 2025, that takes a coding agent from a spec to a plan to tasks to an implementation. (github.blog)
Kiro. AWS’s agentic IDE, in preview from July 2025 and generally available from November 2025, built around requirements, a design document and tasks. (kiro.dev)
AWS AI-DLC. Its Inception phase turns business intent into requirements, stories and units before any code is written. (aws.amazon.com)
Our guide to spec-driven development walks through the chain from intent to code, with a worked example.
Governance: what changes when agents write code
Prompt injection is the top risk in OWASP’s Top 10 for LLM applications, in the 2025 edition and again in 2026. For an AI SDLC it means any text an agent reads, a ticket included, can try to steer it. (OWASP Top 10 for LLM Applications)
OWASP’s Top 10 for Agentic Applications (2026) adds the agent-specific risks: goal hijack, tool misuse, identity and privilege abuse, and cascading failures among them. (OWASP Top 10 for Agentic Applications)
NIST’s AI Risk Management Framework organises the work into four functions (govern, map, measure and manage), and its Generative AI Profile lists the risks specific to generative AI. (NIST AI RMF)
NIST’s Secure Software Development Framework has a companion, SP 800-218A, that adds practices for AI model development across the software life cycle. (NIST SP 800-218A)
How to start
1Write down what done means. Acceptance criteria an agent can test against are the cheapest improvement you can make, and every later stage depends on them.
2Give agents the context once. An instruction file (AGENTS.md or CLAUDE.md) tells every agent how to build, test and follow your conventions, instead of each session guessing.
3Start where a person can verify. Tests drafted from criteria and documentation are easy to check; architecture and deployment are not. Begin with the first.
4Keep people at the gates. Review every change against the story it claims to finish, and keep release approval human.
5Measure stability, not only speed. Track change failure rate and time to restore beside throughput. The published evidence says instability is where AI costs show up first.
6Widen one stage at a time. Move to the next stage when the last one is stable, not when the tool allows it.
Where Stride fits
Stride, our product, is a lifecycle platform for the AI SDLC: stories and acceptance criteria, designs and decision records, tests and releases share one connected graph, AI drafts from it, and coding agents read and update it over MCP. It covers the stages up to the release gate; your pipeline tools handle the rest.
The AI SDLC is the software development life cycle with AI working in every stage: drafting requirements, designs and tests, writing code through coding agents, and checking and summarising what changed, while people make the decisions at each gate.
Is the AI SDLC the same as AI-assisted development?
Not quite. AI-assisted development adds AI to tasks inside an unchanged lifecycle, which is how Google’s DORA research frames it. The AI SDLC, which Anthropic calls the AI-native SDLC and AWS the AI-Driven Development Life Cycle, redesigns the lifecycle around it: AI plans and executes, people approve at gates, and every stage leaves an artifact the next one reads.
What is AWS AI-DLC?
AWS’s AI-Driven Development Life Cycle, published in July 2025. AI proposes a plan, asks clarifying questions and implements only after people validate it, across three phases (Inception, Construction and Operations), with short cycles AWS calls bolts in place of sprints. AWS open-sourced the workflow in November 2025.
Does AI make software teams faster?
It depends where you measure. Surveys report wide perceived gains, and delivery throughput rose in DORA’s 2025 data, but instability rose with it, and METR’s 2025 trial found experienced developers 19% slower while they believed they were faster. Individual output goes up; review, testing and stability become the constraint.
What are the main risks in an AI SDLC?
Prompt injection through anything an agent reads, agents with more permissions than their task needs, larger changes that overload review, tests that check the code rather than the requirement, and instability in production. OWASP’s LLM and agentic Top 10 lists and NIST’s AI Risk Management Framework cover the controls.
Which stage should a team change first?
Start where a person can verify the output cheaply: test cases drafted from acceptance criteria, and documentation. Write the acceptance criteria first, since every later stage depends on them, and leave deployment for last.