AI-Assisted Development Governance (LLM Coding Agents)
Purpose
Define governance for AI/LLM-assisted software development (e.g., Cursor, Copilot, Claude): human review expectations, evidence that generated code is covered by requirements-based tests, tool validation for GxP-adjacent workflows, and alignment with Computer Software Assurance (CSA) principles (risk-based, critical thinking) without replacing your SOPs.
When to Apply
- Teams using LLMs for code generation, refactor, or test synthesis in regulated projects.
- Establishing AI usage policies for design history / audit trail.
- Qualifying IDE plugins or CI bots that touch production or QMS repositories.
Requirements (testable)
- Policy: Document where LLM assistance is allowed (e.g., scaffolding vs safety-critical modules) and required human review gates per risk class. Rationale: controlled process.
- Traceability: Every merged change must retain author/reviewer identity; LLM assistance disclosed in commit or PR template when policy requires. Rationale: audit trail.
- Independent Review: For Class B/C changes, second-person review of generated patches focusing on requirements coverage, failure modes, and misinterpreted specs. Rationale: defect detection beyond automation.
- Test Evidence: No merge without tests (or justified analysis) demonstrating REQ→TEST linkage for new behavior; forbid “LLM says it works” as evidence. Rationale: verification independence from generator.
- Prompt & Context Hygiene: No PHI/PII/proprietary trial data in prompts; use sanitized snippets; pin skill/context versions (e.g.,
SKILL.md hashes) when claims depend on agent guidance. Rationale: confidentiality and reproducibility.
5a. IEC 62304 Skills by Class: Load REG-IEC62304 and child skills appropriate to safety class (e.g. DOC-SW-REQ, REG-IEC62304-SWRM for B/C, detailed design for C); record skill IDs/versions in change records. Rationale: proportional lifecycle guidance.
- Tool Validation (GxP): For tools affecting GMP/quality records, apply FDA CSA approach: risk assessment, intended use, testing records, and change control when models or plugins update. Rationale: 21 CFR Part 11 / 820 alignment for QMS software.
- Regression & Flakes: Treat LLM-generated tests like any other code — deterministic CI, seed control where needed, flake triage. Rationale: valid CI as design verification aid.
- Record Retention: Store PR descriptions, review comments, and test reports as part of DHF/evidence; avoid relying on vendor chat logs as SOLE records. Rationale: durable evidence.
Recommended Practices
- Use a PR checklist:
[ ] REQ IDs, [ ] tests added, [ ] reviewer not sole prompt author, [ ] no secrets in diff.
- Snapshot agent skill versions in release notes when agent guidance materially influenced design.
Patterns
PR template excerpt (markdown):
## AI assistance
- [ ] No PHI/secrets in prompts or logs
- [ ] Assistant tools: Cursor 2.x + skills @ commit `abc1234`
- [ ] Reviewer verified REQ/TEST mapping for generated code
Commit message:
fix: debounce door sensor per REQ-62304-088
AI: scaffolded by LLM; reviewed by @jdoe; TEST-412 added
Anti-Patterns (risks)
- Blind merge of generated safety-critical code — risk: latent defects and audit failure.
- Pasting production credentials into chat — risk: data breach and Part 11 issues.
- Skipping review because “coverage is high” — risk: wrong tests for the right requirement.
Verification Checklist
Traceability
- Link
REQ-* / TEST-* / PR URLs in change records; optional tag AI-GEN on commits for metrics (internal only).
References
- FDA Guidance: “Computer Software Assurance for Production and Quality System Software” (2022).
- IEC 62304:2006+A1:2015 — software development process (human processes still apply).
- Internal QMS SOPs for design control and records (primary authority).
Changelog
- 1.0.1 (2026-05-21): Require class-appropriate IEC 62304 child skills and version pinning in change records.
- 1.0.0 (2026-03-20): Initial skill for LLM-assisted dev governance, review, and CSA alignment.
1---2name: ai-assisted-development-governance3description: AI-Assisted Development Governance (LLM Coding Agents)4---56# AI-Assisted Development Governance (LLM Coding Agents)78## Purpose9Define **governance** for **AI/LLM-assisted software development** (e.g., Cursor, Copilot, Claude): human review expectations, **evidence** that generated code is covered by requirements-based tests, **tool validation** for GxP-adjacent workflows, and alignment with **Computer Software Assurance (CSA)** principles (risk-based, critical thinking) without replacing your SOPs.1011## When to Apply12- Teams using LLMs for code generation, refactor, or test synthesis in regulated projects.13- Establishing **AI usage policies** for design history / audit trail.14- Qualifying **IDE plugins** or **CI bots** that touch production or QMS repositories.1516## Requirements (testable)171. Policy: Document **where LLM assistance is allowed** (e.g., scaffolding vs safety-critical modules) and **required human review** gates per risk class. Rationale: controlled process.182. Traceability: Every merged change must retain **author/reviewer identity**; LLM assistance **disclosed in commit or PR template** when policy requires. Rationale: audit trail.193. Independent Review: For Class B/C changes, **second-person review** of generated patches focusing on **requirements coverage**, **failure modes**, and **misinterpreted specs**. Rationale: defect detection beyond automation.204. Test Evidence: **No merge without tests** (or justified analysis) demonstrating **REQ→TEST** linkage for new behavior; forbid “LLM says it works” as evidence. Rationale: verification independence from generator.215. Prompt & Context Hygiene: **No PHI/PII/proprietary trial data** in prompts; use **sanitized snippets**; pin **skill/context versions** (e.g., `SKILL.md` hashes) when claims depend on agent guidance. Rationale: confidentiality and reproducibility.225a. IEC 62304 Skills by Class: Load `REG-IEC62304` and child skills appropriate to safety class (e.g. `DOC-SW-REQ`, `REG-IEC62304-SWRM` for B/C, detailed design for C); record skill IDs/versions in change records. Rationale: proportional lifecycle guidance.236. Tool Validation (GxP): For tools affecting **GMP/quality records**, apply **FDA CSA** approach: risk assessment, **intended use**, **testing records**, and **change control** when models or plugins update. Rationale: 21 CFR Part 11 / 820 alignment for QMS software.247. Regression & Flakes: Treat LLM-generated tests like any other code — **deterministic CI**, seed control where needed, flake triage. Rationale: valid CI as design verification aid.258. Record Retention: Store **PR descriptions**, **review comments**, and **test reports** as part of DHF/evidence; avoid relying on vendor chat logs as SOLE records. Rationale: durable evidence.2627## Recommended Practices28- Use a **PR checklist**: `[ ] REQ IDs`, `[ ] tests added`, `[ ] reviewer not sole prompt author`, `[ ] no secrets in diff`.29- Snapshot **agent skill versions** in release notes when agent guidance materially influenced design.3031## Patterns32PR template excerpt (markdown):33```markdown34## AI assistance35- [ ] No PHI/secrets in prompts or logs36- [ ] Assistant tools: Cursor 2.x + skills @ commit `abc1234`37- [ ] Reviewer verified REQ/TEST mapping for generated code38```3940Commit message:41```42fix: debounce door sensor per REQ-62304-0884344AI: scaffolded by LLM; reviewed by @jdoe; TEST-412 added45```4647## Anti-Patterns (risks)48- **Blind merge** of generated safety-critical code — risk: latent defects and audit failure.49- Pasting **production credentials** into chat — risk: data breach and Part 11 issues.50- Skipping review because “coverage is high” — risk: wrong tests for the right requirement.5152## Verification Checklist53- [ ] AI use policy acknowledged for the repo/product line.54- [ ] PRs show human reviewer distinct from sole prompt author where required.55- [ ] Requirements and tests updated for all generated behavior changes.56- [ ] No sensitive data in prompts or CI logs (spot audit).57- [ ] Tool/plugin major updates assessed under change control if GxP applies.5859## Traceability60- Link `REQ-*` / `TEST-*` / PR URLs in change records; optional tag `AI-GEN` on commits for metrics (internal only).6162## References63- FDA Guidance: “Computer Software Assurance for Production and Quality System Software” (2022).64- IEC 62304:2006+A1:2015 — software development process (human processes still apply).65- Internal QMS SOPs for design control and records (primary authority).6667## Changelog68- 1.0.1 (2026-05-21): Require class-appropriate IEC 62304 child skills and version pinning in change records.69- 1.0.0 (2026-03-20): Initial skill for LLM-assisted dev governance, review, and CSA alignment.
AminAlam