Remain code-compliant in a regulated, AI-powered world
Jun 23, 2025 / 3 min read
Artificial intelligence (AI) has already transformed software development. The productivity gains that AI coding assistants like ChatGPT, GitHub Copilot, and Amazon CodeWhisperer can deliver are undeniable. However, AI tools bring their own set of challenges, particularly when it comes to maintaining code compliance.
AI coding assistants can introduce code defects that impact software reliability, security vulnerabilities, intellectual property (IP) infringement, and more. These risks are especially significant in industries where software quality is paramount due to safety concerns (healthcare, manufacturing, transportation, etc.).
In this blog, you’ll learn some practical ways to maintain code compliance in today’s AI-powered development landscape.
Key takeaways
- AI code assist tools (Copilot, ChatGPT) boost productivity but introduce defects and vulnerabilities.
- Studies: GitHub Copilot is inaccurate about 54% of the time; ChatGPT about 35%.
- Mitigation strategies include code reviews, automated testing, SAST/DAST, compliance checks.
- Maintain human oversight and leadership to ensure regulatory adherence.
- Use developer-friendly AppSec tools like Black Duck to shift quality/security left.
Benefits and risks of AI coding assistants
For most developers, the productivity benefits of AI coding assistants outweigh potential risks. A recent study revealed that developers using GitHub Copilot benefit from a whopping 26.08% increase in completed tasks. And data scientist Sahin Ahmed found that using the AI coding assistant effectively turns an eight-hour workday into 10 hours of output.
The study evaluated the impact of generative AI on software developer productivity via randomized controlled trials at Microsoft, Accenture, and an anonymous Fortune 100 company. It was conducted by researchers at Princeton University, MIT, Microsoft Corp., and the University of Pennsylvania.
However, AI coding assistants can also introduce very real risks. A recent Bilkent University study revealed that the latest versions of ChatGPT, GitHub Copilot, and Amazon CodeWhisperer generate inaccurate code 34.8%, 53.7%, and 68.9% of the time, respectively. Worse, Stanford University research demonstrated that users of AI code assistants “wrote significantly less secure code” but were “more likely to believe they wrote secure code.”
Software embedded in many physical products must be exceptionally reliable, because failure could threaten personal safety, property, and the environment. Embedded software may be subject to functional safety regulations as well. Failure to comply with these regulations can have significant legal and financial implications. And defects that result in outages or negatively impact user experience can damage an organization’s reputation and give competitors an advantage.
Practical mitigation: testing, SAST, DAST and compliance
In this landscape, it is essential to take measures to minimize the risks of AI coding assistants. Rigorous testing, validation, and oversight are required to ensure that AI-generated code is reliable and secure. This includes, but is not limited to:
- Code reviews: Systematic human reviews of AI-generated code to identify potential errors, security flaws, and violations of coding standards
- Automated testing: Automated unit tests, integration tests, and security scanning to ensure code functionality, identify vulnerabilities, increase developer productivity, and eliminate human error
- Vulnerability checks: Checks that identify and mitigate vulnerabilities in AI-generated code
- License and compliance checks: Checks to ensure AI-generated code doesn't violate any licenses or compliance requirements
- Static application security testing (SAST): Scanning by SAST tools to identify potential security issues or code quality problems before code is executed
- Dynamic application security testing (DAST): Scanning by DAST tools to identify runtime errors or unexpected issues in a controlled environment
- Continuous integration and continuous delivery (CI/CD): Integrating the testing and validation process into the CI/CD pipeline to ensure code changes are automatically checked for errors and vulnerabilities
Maintaining human oversight and expertise throughout the AI-assisted development process is critical to ensure that code meets a project's specific needs and standards. Leadership plays a crucial role in this process. When leaders set the tone from the top, it sends a clear message about the importance of code compliance. This approach can help to instill a sense of responsibility and accountability among all team members.
Regular training sessions for developers are also required. Compliance training should emphasize continuous learning and cover coding standards, security protocols, data privacy, and ethical guidelines.
Choosing the right AppSec solution
In complex IT environments, AppSec tools that increase visibility into the codebase are essential. By centralizing risk management, development teams gain a clear and comprehensive view of the code, making it easier to identify and address potential issues.
When selecting an AppSec solution, look for developer-friendly options that integrate with IDEs, code repositories, and CI/CD pipelines, and support the programming languages, frameworks, and platforms developers use. Black Duck offers solutions that enable development teams to easily
- Identify defects early in the development process, when they’re easiest to resolve and before they impact customers
- Eliminate critical defects and vulnerabilities to ensure customer safety and comply with regulatory requirements
- Identify and mitigate software supply chain vulnerabilities to protect systems and data from being exploited
- Prevent legal issues and IP risks by detecting code pulled from software with license obligations, including small snippets
Black Duck helps enforce AI-era code compliance
Maintaining code compliance in the AI-driven software development landscape demands a proactive approach. By prioritizing quality, security, and regulatory adherence, organizations can build robust, reliable software that meets the highest standards.
For more information, check out “Build Reliability and Security into Your SLDC.” This white paper explores how to ensure your software is free of critical defects, integrate static analysis seamlessly into your SDLC, and accelerate your development velocity.
Continue Reading
Key insights from Black Duck’s 2024 Global State of DevSecOps report
Oct 08, 2024 / 5 min read