iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
The AI software development lifecycle is best understood as a familiar software delivery process—planning, development, testing, release, deployment and operation—with AI-assisted work inside those stages and added validation and governance for AI systems. There is no single universally mandated “AI SDLC.” NIST’s DevSecOps model offers a delivery workflow; its AI Risk Management Framework (AI RMF) adds AI-specific lifecycle tasks and responsibilities that can be applied across that workflow.
How the software and AI lifecycle models fit together
NIST’s notional DevSecOps model follows software delivery through Plan, Develop, Build, Test, Release, Deploy and Operate. Operational feedback flows back into planning and informs corrections and improvement. It is a useful end-to-end structure, not a universal lifecycle standard.
The AI RMF describes work around design and context, data and input, model development, deployment, and operation and monitoring. It also emphasizes test, evaluation, verification and validation (TEVV) throughout the lifecycle, alongside governance, human factors, procurement and impact assessment. These are complementary views: the delivery model helps organize how software moves to and through production; the AI RMF helps teams account for AI-specific risks and responsibilities along the way.
| Framework view | What it organizes | How to use it |
|---|---|---|
| NIST DevSecOps notional model | Software delivery phases from planning through operation, with feedback into planning. | Use as the practical delivery backbone; integrate secure development practices into its stages. |
| NIST AI RMF lifecycle and actor tasks | AI system design, data, model development, deployment, operation and monitoring, with TEVV across the lifecycle. | Use alongside delivery stages to identify AI-specific checks, people, impacts and governance needs. |
NIST’s AI RMF resource page notes that a revision is in progress, so consult the current publication when establishing an organizational process.
#1 Best Overall
Stages of an AI-enabled software development lifecycle
1. Plan and define the problem
Start with the intended users and use, desired outcomes, requirements, operating context, constraints and risks. Decide whether AI is appropriate for the problem and what success and unacceptable outcomes mean. AI tools can help turn source material into draft requirements, user stories, task breakdowns, documentation or threat-model prompts. Treat these as proposals: stakeholders with authority must set priorities and approve acceptance criteria.
2. Design the system and data
Define what the system should do, how it will fit into its environment, and what data and model approach are suitable. Record assumptions and relevant data characteristics. Plan evaluation against the intended deployment setting, users and operating conditions—not only an abstract benchmark. Consider human interaction, impacts, procurement and governance as design concerns rather than tasks to leave until release.
3. Develop
Development may use AI assistants to propose code, configuration, documentation and tests, or to analyze security issues. Review changes for correctness and security, verify that they fit the relevant source context, and preserve traceability to their origin. AI-produced artifacts should pass the same established review and approval gates as other changes; generated output is not evidence that a change is safe or correct.
Free tools Windows power users keep installed
One-click scans. No signup required.
4. Build and test
Integrate code and dependencies, then test functionality, integration, security and operational behavior. NIST’s DevSecOps reference model describes continuous-integration checks and scanning for code, dependencies, secrets, infrastructure-as-code and container images before deployment. AI can help create or analyze tests, but teams still need to assess whether tests are relevant, sufficiently comprehensive and correctly interpreted. For AI systems, TEVV also applies to assumptions, data, model behavior and system-level performance in the intended context.
Rank #3
5. Release and deploy
Release reviewed, traceable artifacts and validate the integrated system against its use context, user experience and applicable requirements. Where consequences warrant it, use a pilot or controlled rollout and establish who can authorize expansion or rollback. Do not treat a successful build or a model evaluation in isolation as proof that the deployed system is fit for its intended use.
6. Operate, monitor and improve
Monitor application behavior, vulnerabilities, performance, incidents and AI outputs or impacts. The AI RMF describes operational responsibilities that include periodic testing, incident tracking and response. Feed findings into remediation, root-cause analysis, updates and renewed planning; deployment is a transition into ongoing responsibility, not the end of the lifecycle.
Where AI can assist—and what that does not establish
NIST’s DevSecOps project documents a human-directed implementation that used generative AI for requirements generation, task decomposition, ticketing, code generation and modification, infrastructure configuration and test-case creation. It also describes code scanning, vulnerability detection and remediation summaries. Users reviewed and validated generated outputs in that implementation. This is an example of possible workflow use, not a measured productivity study or proof that each use improves results in every organization.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Across the lifecycle, AI is most useful when it accelerates bounded tasks while leaving decisions, approvals and accountability with the people responsible for the system. Suggested code, a generated test, or a security summary should be treated as input to an engineering process, not as a substitute for it.
Best Value
Validate AI-generated code before release
Use the ordinary engineering gates for any proposed change, with additional attention to provenance, context and permissions when AI tools or agents are involved.
- Check scope and provenance. Identify what was generated or changed, which source context informed it, and whether the change is traceable to an approved requirement or task.
- Review the implementation. Have a qualified reviewer inspect the diff for correctness, maintainability, unintended behavior, insecure patterns and assumptions that do not hold in the target environment.
- Run the project’s normal checks. Build the change and run relevant unit, integration, functional and security tests. Scan code, dependencies, secrets, infrastructure configuration and container images as appropriate to the project.
- Evaluate the test evidence. Confirm that generated tests exercise the intended behavior and meaningful failure cases; passing tests do not demonstrate coverage of requirements the tests never address.
- Approve and preserve records. Require accountable human approval at the same release gates used for other changes, and retain relevant provenance, review and test records.
- Observe the deployed result. Monitor behavior and incidents after release, and use findings to correct, roll back or replan when needed.
Risks that call for lifecycle-wide controls
NIST identifies risks including inaccurate outputs, insecure generated code, unauthorized actions, limited explainability, hallucinated security recommendations, data leakage, excessive agent privileges, context tampering, and AI-generated supply-chain artifacts that lack provenance or approval. These concerns are not confined to code review.
- Limit authority: give AI tools and agents only the permissions needed for their task, and require explicit authorization for consequential actions across tools.
- Validate outputs: check generated code, tests, configuration and security advice against requirements and independent evidence.
- Keep accountable approval gates: assign people responsibility for decisions and releases rather than letting generated output approve itself.
- Maintain traceability and auditability: preserve relevant records of inputs, changes, actions, reviews and approvals, while handling sensitive information appropriately.
- Monitor after deployment: track behavior, incidents and impacts so teams can respond and improve.
Scale controls to the system’s potential impact and the autonomy granted to AI. Agentic systems that can act across tools need explicit authorization, auditability, governance and human oversight. NIST’s Secure Software Development Framework (SSDF) provides secure development practices and shared vocabulary that can be integrated into different SDLC models; NIST SP 800-218A extends SSDF version 1.1 with AI-specific secure development practices for AI model producers, AI system producers and acquirers.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallQuick Recap
References
- NIST SP 800-218, Secure Software Development Framework (SSDF) version 1.1, published February 2022.
- NIST SP 800-218A, AI-specific secure software development practices, final publication July 2024.
- NIST NCCoE DevSecOps project documentation, including its notional delivery model and AI implementation discussion.
- NIST AI Risk Management Framework 1.0, Appendix A resource on AI actor tasks, TEVV, operation and monitoring.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
