What are the phases of the AI SDLC?

Six in Anthropic’s playbook, the stages most teams already run: plan, design, build, test, deploy and maintain. What changes is the work inside each one: AI drafts requirements, designs and tests, coding agents do the build, and people approve at every gate. AWS’s AI-Driven Development Life Cycle groups the same work into three phases (Inception, Construction and Operations), and Microsoft’s October 2026 model into four: plan, build, verify and observe.

Is the AI SDLC the same as AI-assisted development?

Not quite. AI-assisted development adds AI to tasks inside an unchanged lifecycle, which is how Google’s DORA research frames it. The AI SDLC, which Anthropic calls the AI-native SDLC and AWS the AI-Driven Development Life Cycle, redesigns the lifecycle around it: AI plans and executes, people approve at gates, and every stage leaves an artifact the next one reads.

What are the main AI SDLC frameworks?

There is no single standard. AWS publishes the AI-Driven Development Life Cycle (July 2025), Anthropic the AI-Native SDLC playbook (August 2026), and Microsoft and GitHub call theirs agentic DevOps (May 2025); in October 2026 Microsoft described agentic software delivery in four stages: plan, build, verify and observe. Gartner’s name for the shift is AI-native software engineering. The practice that holds any of them together is spec-driven development: a written spec becomes the contract the agent builds from and the reviewer checks against.

AWS’s AI-Driven Development Life Cycle, published in July 2025. AI proposes a plan, asks clarifying questions and implements only after people validate it, across three phases (Inception, Construction and Operations), with short cycles AWS calls bolts in place of sprints. AWS open-sourced the workflow in November 2025.

Does AI make software teams faster?

It depends where you measure. Surveys report wide perceived gains, and in DORA’s 2025 data higher AI adoption went with higher delivery throughput, and still with lower stability. METR’s 2025 trial found experienced developers 19% slower while they believed they were faster; its newer data, with late-2025 agents, points to gains of about 4 to 20%, which METR calls very weak evidence and expects to understate the effect. Individual output goes up; review, testing and stability become the constraint.

What are the main risks in an AI SDLC?

Prompt injection through anything an agent reads, agents with more permissions than their task needs, larger changes that overload review, tests that check the code rather than the requirement, and instability in production. OWASP’s LLM and agentic Top 10 lists and NIST’s AI Risk Management Framework cover the controls.

Which stage should a team change first?

Start where a person can verify the output cheaply: test cases drafted from acceptance criteria, and documentation. Write the acceptance criteria first, since every later stage depends on them, and leave deployment for last.

Guide

What is the AI SDLC?

The AI SDLC is the software development life cycle with AI working in every stage: drafting requirements, designs and tests, writing code through coding agents, and checking and summarising what changed, while people make the decisions at each gate.

Published 27 September 2026 · Updated 2 November 2026 · Every figure links to its primary source.

The same stages, a different bottleneck

The software development life cycle is the path from an idea to software in production and back again. The international standard for it, ISO/IEC/IEEE 12207, defines the processes without prescribing a model; its current edition was published in 2026 and replaced the 2017 one. (ISO/IEC/IEEE 12207:2026)

Anthropic’s playbook describes six stages most organisations run: plan, design, build, test, deploy and maintain. In the AI SDLC the stages stay, but the work inside them changes: AI drafts, coding agents implement, and the bottleneck moves to the steps that still run at human speed. As the playbook puts it: “The bottleneck moves to the steps to the left and right of the build phase. This is mainly plan, review/test, and deploy, which still run at human speed.” (Anthropic, The AI-Native SDLC playbook (2026))

The AI SDLC’s six phases, stage by stage

What AI does in each stage today, what stays with people, and what to watch for.

The six stages of the AI SDLC: what AI does, what people keep, and what to watch
Stage	What AI does	What people keep	What to watch
Plan	Turns a brief into stories with acceptance criteria, flags gaps and duplicates, and summarises status.	Decide what is worth building, in what order, and what done means.	Stories that read well but leave the edge cases unstated, which an agent then guesses.
Design	Drafts architecture options, diagrams and decision records from the requirements and the existing system.	Choose the option and own the trade-off.	A plausible design that ignores a constraint nobody wrote down.
Build	Coding agents implement a story end to end in a branch, run the checks and open a pull request.	Review each change against the story it claims to finish.	Bigger pull requests and slower reviews, the cost that lands on the reviewer.
Test	Drafts test cases from each acceptance criterion, writes tests before the code, and triages failures.	Decide how much testing is enough, and explore what no criterion anticipated.	Tests written to pass the code rather than to check the requirement.
Deploy	Runs pipelines, checks quality gates and flags risky changes before release.	Approve the release and own the rollback.	Instability. DORA 2025 found AI adoption still associated with higher delivery instability.
Maintain	Summarises incidents, proposes fixes, and keeps documentation in step with the code.	Decide what to fix first, and what the incident should change.	Fixes that treat the symptom and documentation nobody reviews.

What the data says about each stage

Plan: Planning is where developers want AI least: 69% of Stack Overflow’s 2025 respondents do not plan to use it for project planning, and analysing requirements has the lowest AI use of the ten tasks DORA charts (49%). (Stack Overflow Developer Survey (2025); DORA, State of AI-assisted Software Development (2025))
Design: 56% of DORA’s 2025 respondents who create specifications use AI to do it. (DORA, State of AI-assisted Software Development (2025))
Build: Writing new code has the highest AI use DORA charts (71%). In Faros AI’s telemetry, teams with high AI adoption merged 98% more pull requests while review time rose 91%. (DORA, State of AI-assisted Software Development (2025); Faros AI, AI Productivity Paradox Report (2025))
Test: 62% of DORA’s 2025 respondents who create test cases use AI to do it. (DORA, State of AI-assisted Software Development (2025))
Deploy: 76% of Stack Overflow’s 2025 respondents do not plan to use AI for deployment and monitoring, the most resistance of any stage. (Stack Overflow Developer Survey (2025); DORA, State of AI-assisted Software Development (2025))
Maintain: Writing documentation has the second-highest AI use DORA charts (64%), and 55% of those maintaining legacy code use AI for it. (DORA, State of AI-assisted Software Development (2025))

AI SDLC frameworks, and where the term comes from

Vendors, analysts and researchers use several names for the same shift. They differ mostly in where they put people.

Names for the AI SDLC, who uses each, and what each stresses
Name	Who uses it	What it stresses
AI-native SDLC, also “agentic SDLC” and “AI SDLC”	Anthropic, The AI-Native SDLC playbook, August 2026 (claude.com)	A loop instead of a line, with AI at every point, six stages (plan, design, build, test, deploy, maintain), each ending in an artifact the next reads, and humans accountable for every judgment call.
AI-Driven Development Life Cycle (AI-DLC)	AWS, July 2025 (aws.amazon.com)	AI proposes, asks clarifying questions and implements only after human validation, across Inception, Construction and Operations; sprints give way to “bolts” of hours or days. AWS open-sourced the workflow in November 2025.
Agentic DevOps	Microsoft and GitHub, May 2025 (azure.microsoft.com)	Agents that collaborate with people and each other across every stage of the lifecycle.
Agentic software delivery	Microsoft, October 2026 (commandline.microsoft.com)	Four stages (plan, build, verify and observe) where the traditional lifecycle had five, linked by a shared knowledge layer that connects people, AI and feedback.
AI-native software engineering	Gartner, July 2025 (gartner.com)	AI embedded in every SDLC phase, handling a significant share of tasks autonomously or semi-autonomously.
AI-assisted software development	Google’s DORA research programme, September 2025 (DORA, State of AI-assisted Software Development (2025))	AI inside the existing lifecycle, judged by delivery outcomes. DORA’s headline: AI is an amplifier of what is already there.
Autonomous SDLC platform	Harness, in its current tagline (harness.io)	Agents for delivery, security testing, runtime protection and cloud cost, and since October 2026 one that takes work from idea to merge-ready code.

The state of the AI SDLC in 2026: what the evidence says

Across surveys, trials and telemetry the pattern is the same: individual output rises, while review, testing, stability and trust become the constraint. An AI SDLC is mostly the work of moving those constraints, not of writing code faster.

DORA 2025: AI amplifies what is already there

Survey of 4,867 technology professionals, June to July 2025

90% of respondents use AI at work, and more than 80% believe it made them more productive. AI adoption now improves delivery throughput, but it is still associated with higher delivery instability, and 30% report little or no trust in AI-generated code. DORA names seven capabilities that decide whether AI helps, from a clear AI stance and AI-accessible internal data to working in small batches and quality internal platforms.

Caveat: Self-reported, and cross-sectional: it shows associations, not causes.

Source: DORA, State of AI-assisted Software Development (2025)

METR 2025: experienced developers were slower, and felt faster

Randomized trial: 16 experienced open-source developers, 246 real tasks, early-2025 tools

With AI tools allowed, tasks took 19% longer (confidence interval +2% to +39%), while the same developers believed AI had sped them up by 20%. Experts had predicted a speed-up of 38 to 39%.

Caveat: METR now labels these results out of date, and judged its 2026 re-run unreliable because many developers declined to work without AI. Read it as evidence that perceived and measured speed can diverge, not as today’s effect size.

Source: METR (2025), and its February 2026 update

METR 2026: a small speed-up, probably understated

Randomized trial: open-source developers using public agents from late 2025, first reported in February 2026

METR’s latest trial points to small productivity gains, of about 4 to 20%, after the slowdown it measured in early 2025, though METR calls the data only very weak evidence.

Caveat: METR expects this to be an underestimate because of selection effects: some developers declined to take part because they did not want to work without AI. It describes open-source developers, not product teams.

Source: METR, Frontier Risk Report (February to March 2026), published May 2026

Stack Overflow 2026: AI at work is the norm, and trust depends on checking

Survey, 30,903 valid responses from 169 countries, June to August 2026

66% of respondents use AI coding assistants or agents at work and 17% use no AI tools there; 73% of coding-assistant users use one daily. Trust is conditional: 48% trust AI output when they can easily check it, and 16% trust it for most tasks short of important decisions.

Caveat: Self-reported, recruitment skews toward engaged Stack Overflow users, and the trust question was worded differently from 2025’s, so the two years’ trust figures do not compare.

Source: Stack Overflow Developer Survey (2026)

GitHub Octoverse 2026: agents now start a large share of pull requests

Platform data from GitHub, October 2025 to September 2026

By September 2026, more than 40% of pull requests on GitHub started with an agent’s first draft, up from 17% in March, and 55% of Copilot’s monthly active users used its agent features, up from 35% a year earlier. That month, 90% of agent pull requests merged within two weeks, against about 86% of pull requests without detected agent involvement.

Caveat: Vendor data from the platform that sells Copilot: it counts activity, not the quality of the code or the cost of reviewing it.

Source: GitHub, Octoverse 2026

Faros AI 2026: review is where the work piles up

Vendor telemetry from 22,000 developers in more than 4,000 teams

Comparing each organisation’s periods of lowest and highest AI adoption, epics completed per developer rose 66%, but median time in review rose 441.5%, and the ratio of incidents to pull requests rose 242.7%.

Caveat: A vendor study, not peer reviewed; Faros says its data contradicts DORA’s 2025 findings.

Source: Faros AI, AI Engineering Report 2026

Spec-driven development: the working method

The practice that holds an AI SDLC together is writing the intent down before the code: a spec becomes the contract the agent builds from and the reviewer checks against. The tools that made it popular all converge on the same chain, from intent to requirements to a plan to tasks to code.

GitHub Spec Kit. Open-source toolkit, released September 2025, that takes a coding agent from a spec to a plan to tasks to an implementation. (github.blog)
Kiro. AWS’s agentic IDE, in preview from July 2025 and generally available from November 2025, built around requirements, a design document and tasks. (kiro.dev)
AWS AI-DLC. Its Inception phase turns business intent into requirements, stories and units before any code is written. (aws.amazon.com)

Our guide to spec-driven development walks through the chain from intent to code, with a worked example.

Governance: what changes when agents write code

Prompt injection is the top risk in OWASP’s Top 10 for LLM applications, in the 2025 edition and again in 2026. For an AI SDLC it means any text an agent reads, a ticket included, can try to steer it. (OWASP Top 10 for LLM Applications)
OWASP’s Top 10 for Agentic Applications (2026) adds the agent-specific risks: goal hijack, tool misuse, identity and privilege abuse, and cascading failures among them. (OWASP Top 10 for Agentic Applications)
NIST’s AI Risk Management Framework organises the work into four functions (govern, map, measure and manage), and its Generative AI Profile lists the risks specific to generative AI. (NIST AI RMF)
NIST’s Secure Software Development Framework has a companion, SP 800-218A, that adds practices for AI model development across the software life cycle. (NIST SP 800-218A)

How to start

1Write down what done means. Acceptance criteria an agent can test against are the cheapest improvement you can make, and every later stage depends on them.
2Give agents the context once. An instruction file (AGENTS.md or CLAUDE.md) tells every agent how to build, test and follow your conventions, instead of each session guessing.
3Start where a person can verify. Tests drafted from criteria and documentation are easy to check; architecture and deployment are not. Begin with the first.
4Keep people at the gates. Review every change against the story it claims to finish, and keep release approval human.
5Measure stability, not only speed. Track change failure rate and time to restore beside throughput. The published evidence says instability is where AI costs show up first.
6Widen one stage at a time. Move to the next stage when the last one is stable, not when the tool allows it.

Where Stride fits

Stride, our product, is a lifecycle platform for the AI SDLC: stories and acceptance criteria, designs and decision records, tests and releases share one connected graph, AI drafts from it, and coding agents read and update it over MCP. It covers the stages up to the release gate; your pipeline tools handle the rest.

See what an AI software delivery platform is and the questions to ask any vendor, or the best AI software delivery platforms, ranked with ours among them.

Frequently asked questions

What is the AI SDLC?: The AI SDLC is the software development life cycle with AI working in every stage: drafting requirements, designs and tests, writing code through coding agents, and checking and summarising what changed, while people make the decisions at each gate.
What are the phases of the AI SDLC?: Six in Anthropic’s playbook, the stages most teams already run: plan, design, build, test, deploy and maintain. What changes is the work inside each one: AI drafts requirements, designs and tests, coding agents do the build, and people approve at every gate. AWS’s AI-Driven Development Life Cycle groups the same work into three phases (Inception, Construction and Operations), and Microsoft’s October 2026 model into four: plan, build, verify and observe.
Is the AI SDLC the same as AI-assisted development?: Not quite. AI-assisted development adds AI to tasks inside an unchanged lifecycle, which is how Google’s DORA research frames it. The AI SDLC, which Anthropic calls the AI-native SDLC and AWS the AI-Driven Development Life Cycle, redesigns the lifecycle around it: AI plans and executes, people approve at gates, and every stage leaves an artifact the next one reads.
What are the main AI SDLC frameworks?: There is no single standard. AWS publishes the AI-Driven Development Life Cycle (July 2025), Anthropic the AI-Native SDLC playbook (August 2026), and Microsoft and GitHub call theirs agentic DevOps (May 2025); in October 2026 Microsoft described agentic software delivery in four stages: plan, build, verify and observe. Gartner’s name for the shift is AI-native software engineering. The practice that holds any of them together is spec-driven development: a written spec becomes the contract the agent builds from and the reviewer checks against.
What is AWS AI-DLC?: AWS’s AI-Driven Development Life Cycle, published in July 2025. AI proposes a plan, asks clarifying questions and implements only after people validate it, across three phases (Inception, Construction and Operations), with short cycles AWS calls bolts in place of sprints. AWS open-sourced the workflow in November 2025.
Does AI make software teams faster?: It depends where you measure. Surveys report wide perceived gains, and in DORA’s 2025 data higher AI adoption went with higher delivery throughput, and still with lower stability. METR’s 2025 trial found experienced developers 19% slower while they believed they were faster; its newer data, with late-2025 agents, points to gains of about 4 to 20%, which METR calls very weak evidence and expects to understate the effect. Individual output goes up; review, testing and stability become the constraint.
What are the main risks in an AI SDLC?: Prompt injection through anything an agent reads, agents with more permissions than their task needs, larger changes that overload review, tests that check the code rather than the requirement, and instability in production. OWASP’s LLM and agentic Top 10 lists and NIST’s AI Risk Management Framework cover the controls.
Which stage should a team change first?: Start where a person can verify the output cheaply: test cases drafted from acceptance criteria, and documentation. Write the acceptance criteria first, since every later stage depends on them, and leave deployment for last.

Keep reading

What is an AI software delivery platform?The tools the AI SDLC runs on, and questions to ask any vendor The best AI software delivery platformsThe platforms ranked, ours included AI coding agentsGuides to running agents from your backlog Spec-driven developmentFrom intent to spec to plan to code AGENTS.md and CLAUDE.mdGiving every agent the same context What real AGENTS.md and CLAUDE.md files containOur census of popular GitHub repositories, with the data Backlog access over MCPWhat agents should read, and the injection risk that comes with it