How regulated organizations can increase AI code velocity safely

There's a particular anxiety running through regulated industries right now, and it's not about whether AI can write code. It clearly can. The worry is what happens when it writes a lot of code, fast, inside a bank or hospital system where a single hardcoded credential or unpatched dependency isn't just a bug — it's an audit finding waiting to happen.

The New Stack's argument is that this tension is real but solvable, and the fix isn't slowing down AI adoption. It's redesigning verification so it runs continuously alongside development instead of showing up at the end as a gate. That's a meaningful reframe. For years, compliance in software has been treated as a tax bolted on after engineers finish the real work. The piece makes the case that most compliance requirements — secure coding, change management, dependency tracking, access controls — are just descriptions of good engineering practice wearing a different hat. If verification is embedded in the pipeline itself, compliance evidence stops being a separate scramble and becomes a natural byproduct of pull requests, test runs, and release approvals.

The bigger shift described here is about who gets to build software at all. A clinician who knows exactly where a care workflow breaks, or an actuary who knows which underwriting rule actually matters, has traditionally been several translation steps removed from the code itself. AI-assisted development shortens that distance, letting domain experts prototype and specify logic directly instead of losing nuance through a chain of handoffs to product managers, then architects, then engineers.　That's a genuine efficiency gain for organizations where internal software is core infrastructure, not a side project.

But the piece is careful — rightly — to point out that AI agents now operate in loops: exploring a codebase, writing changes, running tools, opening pull requests, largely unsupervised until a human looks at the output. A vulnerability introduced by an autonomous agent is exactly as dangerous as one introduced by a junior engineer at 2 a.m. The proposed operating model, which the author calls AC/DC — Guide, Verify, Solve — tries to formalize this: set standards before agents build, verify during and after generation, and route findings back into the loop rather than letting them die in a stale pull request comment.

What's notable is the reframing of the human engineer's job. Less time spent manually catching predictable defects, more time spent on the judgment calls only a human should be making — architecture, risk tradeoffs, what the system should actually do. If that holds up in practice, it's a real answer to the productivity-versus-risk tradeoff regulated industries have been stuck on for years, rather than just another AI vendor pitch dressed up as strategy.