When AI writes a share of your production code, someone still has to answer for what it wrote. That is the question regulators, auditors, and increasingly your own compliance team will ask, and most engineering organizations do not have a clean answer. Nearly half now run AI-generated code in production. AI models generate vulnerable code at rates between 9.8% and 42.1% across published benchmarks, and by early 2026, researchers had counted more than 110,000 AI-introduced defects surviving in production repositories. Speed came first. Governance did not come with it.
For healthtech companies, that gap is not theoretical. Compliant AI first software squads at ITJ exist because someone has to own accountability for what an AI agent changes in a system that touches PHI or informs clinical decisions, and “the model did it” is not an answer that survives an audit.
The Governance Gap Nobody Priced In
The problem is not that AI writes bad code more often than humans. Teams disagree on that point, and the honest answer depends on the codebase and the task. The real problem is ownership. Most engineering leaders track what changes week to week, but close to a third admit they cannot, and the changes that hide best are the ones that hurt most: security tweaks, dependency shifts, performance regressions buried inside a pull request that looks routine and was never really reviewed by a person who understood its full implications.
In a regulated environment, “we could not see it coming” is not a defense an auditor accepts, and neither is pointing at the model. The EU AI Act requires high-risk AI systems to meet compliance obligations starting August 2, 2026, with fines reaching €15 million or 3% of global annual turnover for noncompliance. Deloitte’s most recent State of AI report found that only one in five companies has a mature governance model for autonomous AI agents. AI accelerated creation. It did not solve who is responsible when that creation goes wrong.
AI-Assisted Is Not the Same as AI-First Compliant
Most teams that call themselves AI-first mean they use AI coding tools aggressively. That is a workflow choice, not governance. An AI-assisted team generates code faster and reviews it the same way it always did. A compliant AI-first squad defines the constraints before generation happens, validates every output against them automatically, and controls what changes reach production, regardless of who or what wrote the change.
That distinction shows up in decisions no model should make alone. Can an AI agent modify clinical decision logic without a documented approval step?. Who signs off when a generated change touches an access control rule. How does the system record that a specific modification was reviewed, by whom, and against what criteria, in a form an inspector could reconstruct months later. A squad that cannot answer those questions in the moment does not have governance. It has automation with no chain of accountability.
Specifications Are Where Governance Actually Lives
Spec-driven development formalizes the answer to who governs AI. Instead of a vague prompt, the specification defines the outcome, the explicit boundaries, the regulatory constraints the system must satisfy, and the verification criteria the output must pass before it ships. The squad governs AI through the specification, the verification pass, and the traceable record those two produce together, not through a policy document nobody reads during a sprint.
- Outcomes defined precisely enough that ambiguity does not become the agent’s decision to make
- Constraints inherited from HIPAA, PCCP, or other regulatory requirements written directly into the spec
- Verification criteria checked before code reaches a human reviewer, not after
- A traceable record of what was generated, what was checked, and who approved the result
A single missing constraint in the spec is enough for a violation to repeat every time the AI regenerates that section, since the model has no memory of the fix applied last time. The correction has to live in the specification, not in a pull request comment that disappears once it is merged.
Why Human Review Cannot Carry Governance Alone
Code review already consumes a large share of developer time, and roughly one in ten developers spend more than 40% of their week on it. Relying entirely on human review to govern AI-generated code does not scale, and an overloaded reviewer is a governance control that fails silently. That risk compounds across a codebase touched by multiple AI agents working in parallel, each blind to constraints the others already learned, unless those constraints live in a specification every agent reads first.
This is why ITJ pairs the specification layer with structured, automated verification, run before a human ever opens the pull request. The human reviewer still signs off, but as the final check in a governed process, not as the only thing standing between an AI agent and production.
How ITJ Builds These Squads
Our compliant AI first software squads combine engineers who write specifications with regulatory constraints already embedded, and a verification discipline that checks AI-generated output against those constraints before code moves forward. The advantage is not simply access to engineers who use AI tools. It is access to engineers who understand what changes require evidence, approval, and traceability before they become part of a regulated system like Life Sciences and BioMedTech indsutries. That structure is also an agile software development team in every practical sense: sprint-based, iterative, and fast. This is the same governance foundation that underpins nearshore MLOPs for digital health work: specification, audit trail, and verification are one continuous process, not separate concerns owned by different people at different stages.
The engineers on these squads have governed AI-generated code against FDA and HIPAA requirements before this engagement started, not while building that governance model for the first time on your codebase. That is the gap between hiring for a nearshore software engineering partner and hiring engineers who happen to work nearshore.
A general nearshore software development Mexico contract gets you the second. It rarely gets you the first, and the difference surfaces the moment an AI-generated change needs a documented chain of accountability an inspector can actually follow.
Scale AI in healthcare with the right engineering foundation. Call us and let’s build it together.
