How to meet it
OWASP AISVS v1.01
AI-Assisted Secure Coding (Appendix C) · AI-Assisted Secure-Coding Workflow
Cover every development phase
Verify that the workflow covers every SSDLC phase from design and implementation through code review, testing, deployment, and post-deployment monitoring, and names the security gates that stay mandatory whether AI was involved or not.
OWASP AISVS v1.01, requirement AC.1.2
In plain English
Cover AI use in every stage of development, from design to monitoring, and state which security checks stay mandatory whether AI was involved or not.
What good looks like
- The workflow covers design, coding, review, testing, deployment and monitoring.
- Mandatory security gates are named for each stage.
- AI use never removes a gate.
How teams usually do it
- Adding AI-specific notes to your existing secure development lifecycle documents.
Evidence an auditor would accept
- The updated lifecycle document.
Common mistakes
- Treating AI-written code as faster to merge because "the AI already checked it".
Not sure which requirements apply to your system? Take the assessment.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.