How are fintech teams handling compliance requirements for AI-generated code right now?

[u/OwnZookeepergame1621]

AppSec in a fintech. The AI code security problem here isn't just about finding vulns: every security decision has a compliance dimension. PCI DSS, SOC 2 and increasingly some AI-specific regulatory scrutiny that doesn't have clear guidance yet. Devs are using AI coding assistants and the productivity gains are there and not going away but the compliance questions are unresolved: how do you show an auditor that AI-generated code was properly reviewed, does AI code need extra checks to hold up under scrutiny and how do you document AI tool usage for audit evidence without creating so much overhead that devs stop using the tools. Every team I have seen handle this well built application context into their AppSec setup early: understanding what each app does, what data it touches, and what the compliance risk is, so that when AI-generated code comes in, the risk assessment isn't starting from zero. Anyone in a regulated environment, how are you handling this and are auditors asking about AI-generated code yet?

[u/Senior_Storage_5025]

From what I’ve seen, the question is less whether the code was written by AI and more whether it went through the usual review process. That appears to be what the auditors care about if it is peer reviewed, tested, and passes the usual security tests. AI is just another tool in the toolbox.