Generative AI as a compliance accelerant for software delivery

Generative AI is often discussed in the context of developer productivity, but it also promises to reshape how enterprises handle compliance. Software delivery teams have long struggled with compliance requirements that introduce manual, time-consuming steps into their workflows—steps that slow down delivery and innovation. Developer-focused compliance programs, powered by generative AI, could change that dynamic by automating foundational controls while keeping developers in the flow.

The code review as a compliance control

Separation of duties is a core compliance concept borrowed from accounting and applied to software delivery as a check and balance. In practice, it often creates friction: a single person or function should not be able to move code from one stage to the next without an independent review. However, PCI-DSS guidance offers a more DevOps-friendly view, focusing on functions and accounts rather than people. Developers may hold elevated-privilege accounts in development environments while maintaining separate, user-level accounts for production access.

Code review sits at the center of this. Having an objective set of eyes examine changed code—whether human or AI—helps surface security vulnerabilities, technical debt, and risks early. Code review also enforces separation of duties across several domains: not just application code, but also Infrastructure as Code workflows, Policy-as-Code configurations, and Kubernetes declarative deployments.

Pull requests are already a natural home for code review within the workflows that millions of developers use daily. Integrating a foundational compliance piece into that existing tooling means compliance and audit teams can get what they need without introducing a parallel process that slows development.

AI-assisted pull requests

One area where generative AI could relieve compliance pain is pull request handling. GitHub's Next team has been exploring this with Copilot for Pull Requests, with a focus on two capabilities.

The first is AI-generated pull request descriptions. AI-powered tags are embedded into the pull request description and automatically populated by GitHub Copilot based on the code changes. The team is also investigating auto-generating descriptive sentences and paragraphs as developers compose pull requests.

The second is AI-assisted code review. The same system can help review the changed code and offer suggestions for improvements. The description of changes is created from the code itself, and the human reviewer receives everything they need to quickly decide whether to advance the change or send it back for revision. This optimizes the human interaction rather than replacing it.

Once these features reach production readiness, they offer three things that compliance programs value:

  • A review process driven by a neutral, independent description based on the actual code changes
  • Optimized development and compliance workflows that let humans concentrate on higher-value work
  • A separation of duties mechanism that retains human judgment at the decision point

What is available today

While pull request automation is still in development, GitHub Copilot for Business already offers capabilities relevant to compliance, audit, and security teams. The most significant for those functions is AI-based security vulnerability filtering, which can flag potentially insecure code patterns as developers write them. For enterprises just beginning to integrate generative AI into their compliance practices, it provides a concrete starting point before more advanced features are generally available.

The trajectory is clear: automating the tedious parts of compliance work will allow developers to remain in the flow and focus on creative, business-critical work while enabling enterprises to sustain a robust, risk-based compliance posture.