DevOps has long prioritised speed. Teams have optimised for faster deployments, shorter release cycles and continuous delivery pipelines, working on the assumption that faster delivery meant greater success with smaller, incremental changes producing less risk.
AI-assisted software development is changing that assumption.
AI agents can generate code, resolve incidents, and make operational recommendations with minimal human input. As these capabilities become more embedded into workflows and across the software lifecycle, organisations are gaining the ability to develop and release software at a pace that traditional governance models were designed to handle.
Compounding this, regulatory expectations are increasing. Legislation such as the European Cyber Resilience Act (CRA) and Product Liability Directive introduce stricter requirements for accountability and resilience. Together, these frameworks reinforce a growing reality for engineering leaders: organisations remain responsible for the behaviour of software in production, regardless of how automated the delivery process becomes.
The challenge for DevOps teams is no longer how fast they can deploy software, but whether they can govern highly automated delivery safely, transparently and in real time.
The governance gap
AI is removing friction from software creation. Tasks that once required significant engineering effort now happen almost instantly. Features can be generated faster, infrastructure optimised automatically, and release pipelines can operate with increasing autonomy.
Yet, while software generation is accelerating, governance models aren’t.
Many organisations still rely on governance processes built for slower release cycles. Manual approvals, fragmented audit trails, and disconnected tooling become increasingly difficult to manage when software is changing continuously across multiple environments.
The result is a widening governance gap.
Traditional frameworks break down when met with the deployment frequency and operational complexity of AI-driven workflows. As software becomes more autonomous, organisations need visibility, accountability, and control without slowing delivery to a halt.
Regulation is reshaping the role of the engineer
Historically, governance and compliance were treated as responsibilities handled outside of engineering teams. Security, legal, and risk departments would be the ones to establish policies, while engineering focused on delivery and reliability.
This division of responsibility is no longer possible.
Code moves through complex pipelines spanning development, testing and production environments, often involving AI-assisted systems at multiple stages – approving changes or making operational recommendations with limited human oversight. And regulation is responding accordingly with legislation now placing greater emphasis on operational accountability.
The CRA, for example, introduces stricter requirements around software security, vulnerability management, incident reporting and traceability across the entire software lifecycle. The Product Liability Directive reinforces this further by making companies accountable for damage caused by defective software and AI-enabled systems.
The practical implication is significant. Organisations must be able to explain what software is running, where it came from, how it was deployed and who or what influenced decisions along the way.
Crucially, it also reinforces that responsibility cannot be delegated to automated systems. Regulators will hold the organisation deploying that software accountable, not the model that generated it.
If an AI coding assistant was to introduce a vulnerable open-source dependency into production that later exposes customer data, accountability sits with the team that pushed out the software. Likewise, if an autonomous deployment tool pushes a faulty configuration update that causes a major outage, regulators will still expect evidence of appropriate controls, monitoring and response procedures.
This fundamentally changes what governance means in software delivery.
Compliance can’t rely on static documentation, retrospective audits, or manual oversight added after deployment. Governance must operate continuously and in real time, embedded directly into delivery infrastructure.
That requires far greater traceability, clearer ownership and greater visibility into software provenance, deployment state and runtime behaviour than many organisations currently possess.
Runtime control now matters
Visibility alone is not enough in highly automated environments. Organisations also need to be able to intervene safely and quickly when problems occur.
This means runtime control is critical.
Traditional deployment approaches often treat releases as fixed events: code is deployed, monitored, and rolled back later if issues emerge. But AI-assisted delivery changes the pace completely.
When software updates are happening continuously, sometimes with minimal human oversight, organisations cannot rely on slow rollback processes or overnight incident reviews. They need more flexible ways to manage software behaviour in production.
If an AI-generated update begins exposing customer data, degrading payment systems or causing outages, teams need the ability to contain the problem in minutes, not hours. That requires more than observability. It requires operational controls that allow organisations to reduce exposure, limit impact and maintain human oversight, even as delivery speeds increase.
Progressive delivery techniques such as feature flags, staged rollouts, and dynamic configuration management allow teams to introduce changes incrementally, monitor impact in real time, and reduce exposure before problems spread across an entire platform or customer base.
Rather than treating deployment as the final point of control, organisations need governance mechanisms that remain effective after software reaches production.
As automation increases, retaining meaningful human control becomes just as important as accelerating delivery.
Governability matters as much as speed
The organisations best prepared for this next phase of software delivery will not be those that deploy software the fastest but those able combine speed with demonstrable control, resilience, and accountability.
As AI systems become more capable and software delivery becomes increasingly autonomous, organisations need infrastructure designed not only for acceleration, but for governability. Teams need the ability to understand what systems are doing, monitor behaviour in real time, and intervene before problems escalate.
That means embedding visibility, accountability, and runtime control into delivery operations, rather than treating governance as a layer added afterwards.
Over the past decade, engineering excellence was defined by how quickly organisations could move software into production. Over the next decade, it may be defined just as much by how effectively they can govern increasingly autonomous systems once they get there.
