Spec-Driven Development: Writing Specs Is the Highest-ROI Engineering Move in the AI Era — Learn AI Slowly 177
Your Biggest Mistake Isn’t Not Buying Tools, It’s Not Writing CLAUDE.md
A regional carrier’s CIO complained to me: “We’ve bought AI tools, deployed models, and even trained our people, but by the end of the first half of 2026, our delivery cycle hasn’t changed much. The head of the core systems team was even more blunt: ‘The AI-generated code works, but we have to rewrite it every time – it doesn’t understand our bank’s rules, it doesn’t understand the regulatory requirements, and it doesn’t know how to integrate with our 30-year-old legacy system.’”
The issue isn’t that AI isn’t powerful enough, it’s that you haven’t written down the rules. CodeRabbit’s analysis of 470 open-source PRs in December 2025 yielded a widely-cited statistic: AI-assisted PRs averaged 10.83 issues, while purely human PRs averaged 6.45 - 1.7 times more, with 70% more bugs than human-written code. By 2026, the story hadn’t changed: New Relic’s 2026 State of AI Coding Report found that 78% of teams reported more incidents after deploying AI-generated code, and 62% of technical leaders admitted their teams “confidently deploy AI code without reviewing it line-by-line” (New Relic Official Report 2026, 0.866 score, primary source). Both datasets are saying the same thing - AI isn’t lacking in capability, it’s lacking context. At this point in August 2026, all narratives about “accelerating AI transformation” need to be viewed in light of this:
| Camp | Progress (2026 H1) | Counterexample (2026 H1) |
|---|---|---|
| EY | Rolled out Microsoft 365 Copilot to 150,000 employees, saving 2.5 million hours / $250 million; expanding to 400,000 global employees | Acknowledges 95% acceleration and 37% reduction in financial operations costs, attributing success to “regulatory compliance first” |
| Atos | Deployed to 54 countries / 56,000 employees; running 19,000 AI agents with unified identity, security, compliance, and governance control plane | Emphasizes “getting Agent 365’s governance capabilities online before scaling” |
| Microsoft | 2026 Work Trend Index: 82% of leaders plan to use AI agents to augment workforce within 12-18 months | Simultaneously acknowledges “organizational change lags behind individual adoption” – a core paradox in the Frontier Firm concept |
来源：Microsoft FY26 retrospective 2026.7.28；Microsoft 2026 Work Trend Index Annual Report 2026.5.5；New Relic 2026 State of AI Coding Report。
The following two comparisons illustrate one thing: without standards, scaling up means multiplying risks by N. The “speed” of EY, Atos, and Microsoft is not about the speed of models, but about “organizations answering how to use AI first.” This is the context in which Spec-Driven Development (SDD) has become mainstream in 2026 H1 - not because engineers prefer documentation, but because not writing specifications is no longer viable in environments with 19,000 agents.
This article clarifies three things:
- Why AI code defects are more severe than human-written code by over 1.7 times;
- How GitHub, AWS, OpenAI, Anthropic, and Alibaba have converged on the same paradigm in 2026 H1 - using documentation to constrain AI behavior;
- Why SDD is an organizational capability, not a tool choice, and the three stages of implementation in 2026 H1.
1. AI Defect Rates: A Contextual Problem, Not a Model Problem
A statement from CodeRabbit’s report has been frequently quoted: “AI lacks local business logic: models infer code patterns statistically, rather than semantically. Without strict constraints, they miss system rules internalized by seasoned engineers.” This statement explains why CodeRabbit, an AI coding platform specializing in AI code review, was among the first to notice this data. They review thousands of PRs daily and see the output of AI-generated code.
The most critical finding is not the total number, but the distribution:
- Logic/Correctness: +75%: Business logic errors, dependency errors, control flow errors, and configuration errors—these issues may not be exposed in testing but can cause accidents in production environments.
- Code Quality: +64%: Inconsistent naming, unclear structure, and project pattern violations—this is the “largest difference category.” Seasoned engineers can immediately spot “this isn’t how we write code here.”
- Security: +57% (XSS highest at 2.74×): Inadequate password handling (1.88×), insecure object references (1.91×), sensitive information disclosure, and insecure deserialization (1.82×)—in the finance industry, this isn’t about “can it be used,” but “can it be released.”
The issue isn’t that AI isn’t powerful enough. It’s that it can’t see.
To return to this CIO’s real pain point, here are three concrete AI failures in critical financial systems:
First, AI can’t see 30 years of reconciliation logic. A bank’s risk-control rules live in core system stored procedures—written 30 years ago, and no one remembers them in full. AI-generated code logic looks fine, but in production it triggers that forgotten reconciliation check and fails an entire batch of transactions.
Second, AI can’t see regulatory constraints. Passwords must go through a key management system, sensitive fields must be encrypted at rest, logs cannot print customer information—these are hard regulatory constraints written into internal policies. AI doesn’t know them; the code it writes runs, but won’t pass compliance review.
Third, AI can’t see your technical debt. That 30-year-old host system uses its own interface protocol, and the documentation is long gone. AI writes code to generic RESTful standards, only to discover in production that the interfaces don’t match—two weeks of rework.
Back to New Relic’s other numbers: 62% of teams “confidently ship without review” AI code, and 78% report more incidents after deployment. Put together, these two numbers say one thing—the defect rate of AI code itself isn’t the problem; “I don’t know what defects my AI code has” is the problem.
Typical scenario: a joint-stock bank introduces AI-assisted development for the risk-control module of its core system. Within three months, the compliance review rejection rate climbs significantly—the top reasons are password handling, sensitive field encryption, log compliance, and other internal rules. All these rules live in internal documents, but AI can’t see them. The team then writes the core rules into a CLAUDE.md file, and the rejection rate drops noticeably.
2. The Five Major Platforms in 2026 H1 — Converging on “Spec-Driven”
GitHub released Spec Kit in July 2025; in early 2026, AWS Kiro, OpenAI Codex, and Anthropic Claude Code completed the lineup; in May 2026, Alibaba Qoder wrote “Spec-Driven Workflow” into its product positioning. All five platforms converged on the same paradigm in 2026 H1—using documentation to constrain AI behavior. This isn’t any one company’s invention; it’s the industry’s collective response to the “AI code quality crisis.”
GitHub Spec Kit: a reference implementation with five-stage gating. Open-sourced in September 2025, by H1 2026 it has become the industry’s reference implementation. 5 core commands + 2 supplements: /speckit.constitution (Non-Negotiable Principles), /speckit.specify (what and why), /speckit.plan (how to change), /speckit.tasks (task breakdown), /speckit.implement (execution), plus /clarify and /analyze. The key design is model-agnostic: the same spec/plan/tasks files are not bound to any specific execution agent and can be picked up by Claude Code, Copilot, Cursor, Codex CLI, Gemini CLI, opencode, Windsurf, or Qwen Code. That’s what makes it an “organizational-level SDD protocol,” not a GitHub-exclusive product (vibecoding.app review, June 2026, 0.816 score, secondary source).
AWS Kiro: spec-driven embedded in the IDE. Launched in July 2025, AWS Kiro evolved into a full-fledged Agent IDE by H1 2026. Its workflow runs in three phases: requirements → design → tasks. What sets Kiro apart from Spec Kit is its “hooks” — Kiro’s spec files can trigger predefined agent actions and weave compliance, audit, and deployment steps that require external systems into the workflow. If you want to enforce spec-writing in your team, pick Kiro — without a spec, Kiro simply won’t start (AWS Kiro, July 2025; Kiro.dev documentation, 2026).
OpenAI Codex: AGENTS.md + composable Skills. Between 2025 and 2026, OpenAI pushed AGENTS.md to the center of its ecosystem. Skills are the key H1 2026 extension: they let you pre-assemble workflows — “read an Excel file,” “generate SQL,” “run a data migration” — and invoke them like Lego blocks. By June 2026, Codex had passed 5 million weekly active users, 20% of whom are non-developers — a frequently overlooked signal that spec-driven development is no longer just for engineering teams but for the whole enterprise. Product, operations, and risk-management teams now write their own AGENTS.md files (OpenAI announcement, June 2, 2026; thebcms.com review, 2026, 0.801 score).
Claude Code: CLAUDE.md + .claude/rules/ + Skills. Anthropic calls its project instruction file CLAUDE.md (entered the official marketplace in February 2026), .claude/rules/ (rules layered by directory), and Skills (shareable workflows). Claude Code is the highest developer-satisfaction tool in H1 2026 — the JetBrains 2026.1 survey gives it CSAT 91% and NPS 54, a number corroborated by two independent studies (Pragmatic Engineer, February 2026). That’s the industry’s best score in the AI coding assistant category (uvik.net, May 2026, 0.956 score, aggregation of primary sources). Claude Code went from zero to $2.5 billion annualized revenue in nine months (Anthropic Series G, February 2026), with 112,000 stars on GitHub (Skills repo) — developers vote with their feet, and that vote is evidence of the real value of a rules-driven approach.
Alibaba Qoder: spec-driven for the Chinese market. Launched in August 2025, Qoder went to version 1.0 on May 15, 2026, officially repositioning from “AI IDE” to “Autonomous Agent Development Workbench.” Its Spec-Driven Workflow shipped alongside Quest Mode (autonomous multi-file tasks), Expert Mode (parallel execution by expert teams), and RepoWiki (repository knowledge graph). On May 28, 2026 came Cloud Agents (fully managed agent runtime), followed on July 21 by Qoder Security (compliance and security capabilities), and a Mobile version (Android/iOS/HarmonyOS) the same month. By May 2026 Qoder had more than 5 million global users, and Microsoft Teams CLI lists it among supported agent execution environments (Yahoo Finance 2025; Alibaba Cloud Official 2026; Baidu Baike, July 2026).
Common Paradigm: Explicitly document “how we collaborate with AI” and store it in a repository, allowing all team members and AI agents to work with the same set of guidelines. Although the implementation details of the five platforms differ (file names, stages, hook mechanisms), their goals are identical.
Why did this happen in H1 2026? The AI capability threshold has been crossed - Claude Code autonomous agents, Codex multi-agent parallelism, and Cursor multi-file refactoring have made AI more than just a “completion tool”, it’s a “colleague”. If you can provide an onboarding document for a new colleague, you should also be able to provide one for AI.
Three: Specification-Driven is an Organizational Capability, Not a Tool Choice
This is the most important point for decision-makers. Specification-driven is not about choosing tools, but defining “how our organization collaborates with AI”. Whether you choose GitHub Spec Kit or Claude Code is irrelevant; what matters is whether you have documented your specifications, stored them in a repository, and ensured that all team members and AI agents work with them.
Without this, even the best tools will only enable your team to create more debt at a faster pace.
Viewed through the lens of scaled deployment in H1 2026, the evidence gets even stronger. In its FY26 retrospective published in July 2026, Microsoft framed the EY and Atos cases as “Frontier Firm” templates—not because the models were new, but because both companies had already answered the “how do we actually use AI” question before scaling:
EY: Governance first, scale pays off. Between 2024 and 2025, EY rolled out Microsoft 365 Copilot to 150,000 employees, saving 2.5 million hours and roughly $250 million. The prerequisite: an AI governance framework built before deployment. EY used Power Platform, Copilot Studio, Azure, Foundry, and Fabric to create a unified toolchain, embedding compliance, governance, and audit into a single foundation. That’s what enabled the subsequent 95% speedups, 37% reduction in finance operations costs, and up to 90% reduction in manual workflows. As EY’s vice president put it bluntly at the 2026 AI Tour: “We didn’t roll out AI and then bolt on governance—we built governance first, then scaled AI.”
Atos: A Unified Control Plane for 19,000 Agents. Atos is among the first organizations globally to deploy Microsoft 365 E7 (Frontier Suite), rolling out Copilot to 56,000 employees across 54 countries. They are simultaneously running 19,000 AI agents—spanning internal IT, business units, and client projects—all built on Foundry and Copilot Studio. The key to Atos’s success is a “single control plane”: Entra (identity) + Defender (security) + Intune (device management) + Purview (compliance) + Agent 365 (agent governance), all bound together. This integrated approach, when mapped to the financial sector, translates to a governance architecture—covering security assessments, data cross-border compliance, algorithm filing, auditing, and model governance—rather than just a standalone AI tool.
Microsoft’s Own “Organizational Change Paradox.” In its 2026 Work Trend Index report, Microsoft itself acknowledged a key tension: “the pace of organizational change is lagging behind individual adoption.” Among the 20,000 AI users they surveyed, 82% of leaders plan to scale their workforce with AI agents within 12–18 months, but only 24% have completed enterprise-level deployment. 81% of leaders expect AI agents to be moderately or heavily integrated into their AI strategy — yet again, only 24% have actually done so. This means the vast majority of organizations face a 12-to-18-month gap between “getting ready” and “getting it done.” How that gap gets closed is where governance-driven discipline becomes the primary anchor.
Source: Microsoft FY26 retrospective, July 28, 2026; Microsoft 2026 Work Trend Index Annual Report, May 5, 2026 (assets-c4akfrf5b4d3f4b7.z01.azurefd.net, primary PDF source); Futurum Group analysis, January 26, 2026 (secondary source).
Takeaway #1: Investing in governance is high-ROI.
CodeRabbit’s data gives us a clear basis for ROI calculation: AI code issue rate is roughly 1.7x, and security vulnerabilities are reduced by 2.74x. What this means:
- Less rework (in financial services, one compliance review rework alone costs 2–4 weeks)
- Fewer security incidents (regulatory fines and reputational damage from a single data breach)
- Lower maintenance costs (a 40% reduction in technical debt is a commonly cited figure)
Writing a CLAUDE.md/AGENTS.md project specification is the highest-ROI engineering move in the AI era. EY’s case provides a real-world conversion—150,000 employees equipped with Copilot, saving $250 million. Note that EY’s savings didn’t come from the tool being “powerful”—they came from the spec “unlocking the tool’s value.”
Insight Two: Bake the spec into organizational processes, not individual habits.
If the spec lives only in a senior engineer’s head, it’s lost the moment that person leaves. It must be embedded in:
- Repository documentation (AGENTS.md / CLAUDE.md / constitution.md)
- CI gates (automated checks for spec compliance)
- Team-shared configurations (Skills system makes it usable across the whole team)
Let Governance Be an Organizational Asset, Not an Individual Skill
This matters especially in financial services—your compliance requirements, security rules, and business rules are organizational assets, not one engineer’s “experience.” Atos runs 19,000 agents across 54 countries because governance isn’t “someone knows how to do it”—it’s “the system enforces it.”
Insight Three: Gating matters more than speed.
GitHub Spec Kit’s five-stage gating (constitution → specify → plan → tasks → implement), Claude Code’s “don’t write code before tests fail,” and Kiro’s “can’t start without a spec”—they’re all doing the same thing: putting a brake between AI and the final output. Every step produces a reviewable artifact (spec.md, plan.md, tasks.md) that can be rejected or revised before code is generated.
The more autonomous the AI, the more it needs gating. In financial services, the Change Advisory Board (CAB), algorithm filing requirements, and security compliance assessments are all gates before production. AI code needs the same kind of gating, just in a different form. The 62% of teams in New Relic’s 2026 report who “confidently ship without review” are paying for that confidence with a higher incident rate (78%).
Phase 3: Real-World Implementation in H1 2026
Using the financial industry as an example, this three-phase path also applies to other heavily regulated sectors. EY and Atos’s H1 2026 practices map neatly onto these three phases.
Phase 1: Inventory Your Rules (2–4 weeks).
This phase takes the most time but delivers the highest ROI. The goal is to surface every rule scattered across your organization:
- Compliance requirements: For financial institutions, the minimum baseline = ISO 27001 certification + GDPR/UK GDPR compliance + EU AI Act high-risk AI registration (if serving EU clients) — if any one is missing, don’t roll out AI. Above that, you have regulatory reporting rules, customer data protection, cross-border data transfer restrictions, and rules on which data AI is even allowed to see.
- Security rules: Password management, encryption standards, sensitive-field handling, logging requirements.
- Business rules: Risk-control thresholds, claims eligibility, transaction limits, billing logic.
- Technical constraints: Legacy system interfaces, database naming conventions, framework version limits.
- Vendor governance: How to contractually require vendors to follow your standards, and how to audit their AI usage.
A typical scenario: during the inventory phase, a securities firm discovers that its rules are scattered across countless Word documents, JIRA wikis, personal emails, and Excel spreadsheets—only after consolidating everything does a structured rule list emerge. Atos takes a more systematic approach: they split rules directly into five categories—compliance, security, business, technical, and vendor—each with its own governance workflow, all wired into the Agent 365 control plane.
This isn’t a technical exercise; it’s an organizational one. You have to bring compliance, security, and business teams to the same table and write down rules everyone agrees on. The first time you do this, a financial organization typically needs 3–8 weeks—but what you get is a permanent organizational asset.
Phase 2: Land it in the repo (1–2 weeks).
Take the rules from Phase 1, write them up as documentation, and commit them to the repository. GitHub Spec Kit uses constitution.md, Claude Code uses CLAUDE.md, OpenAI Codex uses AGENTS.md, and Alibaba Qoder uses Spec Workflow. The file names differ, but the goal is the same—make the AI load them the moment it opens the repo.
Structure Recommendations (Mainstream Form in 2026 H1):
- Project Overview: What this system does and who it serves
- Non-Negotiable Principles: Security red lines, compliance red lines, business red lines
- Tech Stack and Constraints: Which frameworks, databases, and interface standards to use
- Code Standards: Naming conventions, directory structure, and minimum test coverage requirements (no mandatory TDD cadence—just spell out coverage thresholds, must-test paths, and forbidden paths; TDD is an optional organizational rhythm, not a hard requirement driven by standards)
- Business Rules: Risk control logic, transaction rules, billing rules
- Compliance Requirements: MLPS (等保, Multi-Level Protection Scheme), cross-border data transfer, regulatory reporting, and whether AI-generated algorithms require filing
- AI Usage Guidelines: Which scenarios can use AI, which scenarios require mandatory human review, and cross-border data rules
- Vendor Governance: Contract terms, audit mechanisms, and responsibility allocation
Appendix: CLAUDE.md Financial Edition Skeleton (~200 lines, ready to fork and adapt)
Below is a CLAUDE.md skeleton for a joint-stock bank’s core system overhaul, organized in the order of “Non-Negotiable Principles → Compliance Requirements → AI Usage Guidelines → Business Rules → Engineering Constraints.” Your company doesn’t need to start from scratch—just fill in the blanks with your specific rules.
1 | # CLAUDE.md — <System Name> AI Collaboration Standards |
This skeleton is not a “standard answer” — it’s a “fill-in-the-blank template.” What matters more than how much you write is what goes into each slot. The blank spaces reveal the parts your company hasn’t thought through yet.
A typical example: one joint-stock bank’s CLAUDE.md defines a dedicated password-handling rule — any AI-generated code involving passwords must call the internal key management API, and hardcoding is prohibited. Rules like this account for a large share of compliance review rejections.
An important new field in 2026 H1 is Skills/workflow definitions — not just documentation, but toolchains that AI can actually invoke. Claude Code’s Skills system (listed on Anthropic’s official marketplace in February 2026, 112K stars on GitHub) turns routine tasks like “read an Excel sheet,” “generate SQL,” and “run a data migration” into shareable workflows. This is the key evolution of spec-driven development in 2026 H1: specs are not just constraints — they are executable workflows.
Phase 3: Institutionalization (ongoing).
Writing a spec is not the finish line—it’s the starting point. You have to turn it into part of your organizational process:
- CI gating: Automatically check code against the spec (e.g., detect hardcoded passwords, unencrypted sensitive fields)
- Team-shared configs: Use the Skills system so the whole team works from the same spec
- Regular update cadence: When rules change, the spec changes with them (quarterly review)
- Metrics and feedback: Track defect rates in AI-generated code, compliance review pass rates, rework rates
- Agent governance: Extend human governance to AI agents—what Atos is doing with Agent 365 is making this “system-level” rather than “individual-level”
Both EY and Atos made Phase 3 about “organizational capability” in H1 2026. EY’s 2.5 million hours saved came down to getting Phase 1 and Phase 3 right—Phase 2 was just translating rules into documents AI could read.
V. The Heavily Regulated Variant: Three Engineering Approaches to Embedding Compliance
For heavily regulated industries like finance, telecom, and healthcare, spec-driven adoption has one extra hurdle compared to general industries—compliance is not a bolt-on to the process; it’s built into the code. The three approaches below are compliance-embedding patterns validated in H1 2026. CIOs and digital transformation leads can reference them directly when designing their organizations.
5.1 Embedding Compliance Representatives in Stream Teams: Making Compliance “Present” Rather Than “Approval”
The traditional approach: business teams write code, compliance teams review afterward—by the time issues are found in review, the code has already been in production for two weeks, and rework costs 2–4 weeks. The core problem is that compliance sits at the end of the pipeline.
The new approach: embed a compliance representative in every stream-aligned team, structured as a dual reporting line—solid line to the compliance department, dotted line to the business team. Concretely:
- Headcount: One compliance representative per 6–8 stream teams, belonging to the compliance department but physically seated with the business team—not a “secondment” where they show up occasionally
- Dotted-line KPIs: 50% of the compliance representative’s performance weight is tied to the business team’s “compliance defect rate” and “first-pass review approval rate,” not just the compliance department’s “audit coverage”
- Shift-left engagement: Compliance representatives join daily stand-ups (once a week is sufficient), participate in PR reviews, and AI-generated code must pass the compliance representative before merge—not be caught and patched after the fact
- Tooling: Compliance representatives invoke compliance checklists via Skills rather than manually walking through each item line by line
Typical scenario: In H1 2026, a national joint-stock bank piloted three stream-aligned teams with embedded compliance representatives, cutting the AI code compliance rejection rate from 35% to 8% — the key wasn’t that compliance became “stricter,” but that it became “earlier.” The crux of this approach is that the compliance representatives’ dotted-line incentives must align with business goals — if their KPIs still only reflect tasks handed down by the compliance department, the embedding is doomed.
5.2 Compliance as an Enabling Team: Turning Constraints into Affordances
The traditional approach: compliance acts as a “gatekeeper,” and business teams see it as a “troublemaker.” It’s a zero-sum game.
The new approach: the compliance team is restructured along Team Topologies’ enabling team model — it doesn’t write code or review pull requests directly, but provides three things that let business teams achieve “self-service compliance”:
Compliance checks embedded in the CI pipeline: Turn high-frequency compliance pain points—hardcoded passwords, plaintext sensitive fields, cross-border data transfers, algorithmic decision points—into mandatory gates in GitHub Actions / GitLab CI. When a business team opens a PR, automated checks run immediately, and non-compliant code fails outright—no need for a compliance officer to manually review each change.
Regulatory requirements as affordances (environmental, context-aware constraints): For example, when a developer builds a feature that touches customer data, an IDE plugin pops up a hint like “This field should call KMS”; when writing logs, the system automatically detects whether sensitive information is included and raises an alert. Compliance becomes something that “happens naturally during development,” not something you’re told you violated at release time.
Shared Skills library + compliance training: The compliance team maintains a set of “compliance Skills” that new hires and cross-team transfers can invoke directly—turning compliance knowledge from “documentation” into “executable tooling.”
A typical case: a regional commercial bank rolled out CI compliance gates plus IDE compliance hints in H1 2026, cutting the average per-review time for AI-assisted code compliance checks from 45 minutes to 8 minutes. The real win isn’t that compliance “reviews got faster”—it’s that AI-generated code “doesn’t make mistakes in the first place.”
5.3 Dual-Speed Compliance: Matching Regulatory Rigor to Business Velocity
One final nuance: compliance shouldn’t be a one-size-fits-all approach. Split your rules into two tiers by risk level:
- High-risk rules (involving customer funds / algorithmic decisions / cross-border data / critical security baselines) go through strict gating: mandatory human review + AI second confirmation + Change Advisory Board (CAB) filing
- Low-risk rules (CRUD boilerplate / utility code / documentation generation) go through self-service gating: CI auto-checks are sufficient, no human review required
Atos’s Agent 365 control plane is essentially this tiering—different levels of agents bind to different governance requirements. When you tier compliance rules by risk, business teams stop feeling like “compliance is blocking me at every turn.”
The takeaway from all three points: embedding compliance isn’t about adding another process step—it’s about redesigning the structure and incentives of your delivery teams. If your compliance department is still stuck in “post-hoc review” mode, spec-driven adoption will hit a wall at the hardest stage: institutionalization. Compliance needs to transform first, and only then can spec-driven development run smoothly for business teams.
6. Questions You Might Be Asking
“We already have coding standards—how is this different?”
Coding standards govern how you write code; spec-driven development governs how you collaborate with AI. Coding standards don’t cover: business rules, compliance requirements, or AI usage policies. Spec-driven development makes the entire human-AI collaboration workflow explicit—it’s not a code style guide.
“Will writing specifications slow down development?”
In the short term, yes. In the long term, no. CodeRabbit’s data gives a clear answer: unconstrained AI code carries roughly 1.7x higher defect risk and 2.74x more security vulnerabilities. In financial services, a single compliance review rework costs 2–4 weeks—skip one rework and you’ve bought yourself a month’s worth of spec writing. EY’s $250 million savings is real-world proof that this pays off when done as an organizational capability.
“What if our team has no one who knows how to write specs?”
You don’t need to start from scratch. GitHub Spec Kit, Claude Code Superpowers, and AWS Kiro all ship with templates. All you need to do is fill in the rules specific to your organization—and most of those are compliance and security rules that your compliance and security teams have already written down. They just haven’t been put somewhere AI can actually see them.
“There are so many AI tools out there—which one should we pick?”
It doesn’t matter. Pick what you’re already using. The spec drives, not the tool—CLAUDE.md works in Claude Code, Cursor, and Codex; AGENTS.md runs in the OpenAI ecosystem; constitution.md is model-agnostic. The point is writing the spec, not switching tools. EY is rolling out across the Microsoft ecosystem, Atos is rolling out across the Microsoft ecosystem—the tool choice is just surface-level; the unified governance architecture is what matters underneath.
“The EU AI Act fully takes effect in August 2026—does that affect us?”
Yes. The EU AI Act enters full application on August 2, 2026, with mandatory compliance requirements for high-risk AI systems—including credit scoring, insurance pricing, employment screening, and critical infrastructure. These cover risk management (Art. 9), data governance (Art. 10), documentation and transparency (Art. 11–13), human oversight (Art. 14), and accuracy/robustness (Art. 15). Non-compliance can trigger fines of up to €35 million or 7% of global annual turnover. For Chinese companies expanding overseas, the EU market is a must-address; for domestic players, the EU AI Act’s framework is also the most widely referenced standard globally—you may not be directly subject to it, but you can hardly escape its ripple effects through your suppliers, partners, and cross-border operations (whisperly.ai 2026; surecloud.com 2026.6; artificialintelligenceact.eu 2026.6).
“Domestic comparison: the EU regulates AI—what do we regulate?”
China’s governance of generative AI rests on a three-pillar approach: algorithm filing (算法备案), training-data review, and security assessment, anchored by the Interim Measures for the Management of Generative AI Services, which took effect in August 2023. The biggest difference between the two regimes is not in the level of detail, but in the underlying legislative philosophy.
| Dimension | EU AI Act | China’s Generative AI Service Management Measures |
|—|—|—|—|
| Legal nature | Horizontal regulation (applies to all AI systems) | Vertical rule (focuses on generative AI services) |
| Risk tiers | 4 tiers (unacceptable / high / limited / minimal) | 2 tiers (involving public-opinion security / general commercial use) |
| Regulatory timing | Ex-ante (registration at development stage) | Ex-post (registration after launch + algorithm filing) |
| Transparency | High (requires public disclosure of training-data source summaries and model cards) | Medium (requires corpus compliance but does not mandate source disclosure) |
| Penalty cap | 7% of global revenue or €35 million | Service suspension / fines (typically multiples of illegal gains) |
| Scope | All enterprises meeting the global revenue threshold | All entities providing services within China |
In practice, AI systems at Chinese financial institutions are typically subject to three sets of rules simultaneously — the Generative AI Measures (foundation layer), the Measures for the Administration of Online Lending by Commercial Banks (business layer), plus MLPS (Multi-Level Protection Scheme, China’s cybersecurity classification regime) and algorithm filing (compliance layer). This means that for compliance-driven development in China, you cannot simply transplant the EU AI Act framework — you need to fold all three domestic tracks — “corpus compliance + algorithm filing + regulatory reporting” — into your CLAUDE.md.
For companies expanding overseas: the EU AI Act’s four-pillar framework of “risk management + data governance + documentation transparency + human oversight” is also the direction Chinese regulators are gradually aligning with — several generative AI filing feedbacks from the Cyberspace Administration of China (CAC) in 2025 already show a clear borrowing of the EU’s granularity. A compliance spec written to EU AI Act standards today will most likely remain compatible with China’s tightening regulatory trend over the next three years (CAC filing announcements 2025–2026; EU AI Act compliance deadline June 2026).
7. Implications for Decision-Makers
Takeaway one: writing a CLAUDE.md/AGENTS.md project spec is the highest-ROI engineering move in the AI era.
Its cost is 3–8 weeks of cleanup time plus 1–2 weeks of documentation. Its payoff: defect risk capped at roughly 1.7×, security vulnerabilities reduced by 2.74×, and rework down 40%+. In financial services, skipping a single compliance review rework cycle (2–4 weeks) already covers the investment. EY rolled out Copilot to 150,000 employees and saved $250 million—but only because the groundwork was already in place.
Insight #2: Spec-driven development is an organizational capability, not a tool choice.
Whether you pick GitHub Spec Kit or Claude Code doesn’t matter. What matters is whether you’ve defined how your organization collaborates with AI. Without that, even the best tool just lets your team build technical debt faster.
Insight #3: Bake specs into organizational processes, not individual memory.
If the spec lives only in a senior engineer’s head, it walks out the door the moment they leave. It has to be embedded in repo documentation, CI gates, shared team configs, and agent governance platforms. Make the spec an organizational asset, not a personal skill. Atos runs 19,000 agents across 54 countries because governance isn’t “someone knows it”—it’s “the system enforces it.”
Insight #4: Gates matter more than speed.
GitHub Spec Kit’s five-stage gating, Superpowers’ “no code before a failing test,” Kiro’s “can’t start without a spec”—all of these put a brake between AI and the final deliverable. The more capable the AI, the earlier governance needs to kick in. That 78% incident rate in New Relic’s 2026 report is the price paid by the 62% of teams shipping without review. CIOs in financial services know this better than anyone: your Change Advisory Board (CAB), algorithm filing requirements, and security compliance assessments (等保测评, China’s Multi-Level Protection Scheme) are all gates before production. AI-generated code needs the same gates—and they need to come even earlier.
Reverse self-check (no sugarcoating): How often does compliance review bounce back AI-generated code? What was the last incident caused by AI-written code? If you asked your tech lead “how do we collaborate with AI,” could they produce a document? If you can’t answer any of these three, your spec-driven practices aren’t in place yet—specs first, tools second.
Three coaching questions for decision-makers
Three questions to close with—not a checklist, but something you can use directly in conversations with your team:
“If all AI tools went offline tomorrow, how much would your team’s code quality drop?” — This question exposes the real value of spec-driven development: if the answer is “significantly,” your specs haven’t been internalized yet; if the answer is “barely at all,” spec-driven is already running in production.
“In your spec-driven initiative, is the compliance team a ‘gatekeeper’ or an ‘enabler’?” — If the answer is “gatekeeper,” your delivery speed will be throttled by review bottlenecks; if the answer is “enabler,” you’re already on the path outlined in Section 5.2.
“Twelve to eighteen months from now, how will your team size change?” — Microsoft’s WTI 2026 answer: 82% of leaders plan to “scale” their workforce with AI agents. If your answer is “no change,” either your business isn’t growing, or your org design hasn’t caught up with the spec-driven dividend.
There are no right answers to these three questions. But the direction of your answers matters more than the answers themselves.
Next Steps
This is the sixth installment in the “Software Engineering Transformation in the AI Era” series. We started with Conway’s Law (organizations shape architecture), moved through Team Topologies (how to design the organization), then bottleneck shifting (the constraint is in verification, not coding), and today we covered spec-driven development (using documentation to constrain AI behavior).
Why “Protocols” Are the USB-C of AI: How Standardized Rules Unlock Multi-Tool, Multi-Agent Interoperability
Want to Put This Framework into Practice at Your Company?
When protocol-driven development enters an enterprise, the real issues that need solving usually come down to a few specific questions: how do core rules crystallize into CLAUDE.md / AGENTS.md, how do you retrofit existing code to comply, how do you embed compliance, and what metrics should a pilot use for acceptance.
Currently, three types of collaboration are offered:
- Enterprise Training: Combined with your company’s real projects, this covers protocol documentation, CI gate design, compliance embedding paths, and governance mechanism construction.
- Specialized Consulting: Focused on a specific decision, such as “Should our company write CLAUDE.md / AGENTS.md first?” or the priority of compliance remediation for existing code.
- Management Sharing & Industry Talks: Centered around AI coding tools, protocol-driven development, organizational governance, and Frontier Firms.
The article provides a general framework, but real-world adoption still requires redesign based on your organization’s compliance requirements, regulatory boundaries, engineering maturity, and existing delivery processes. For collaboration inquiries, reach out via coach@iaiuse.com.
Further reading: The Signboard Methodology v1.0 (Learn AI Slowly 187), which lays out a 7-step framework for enterprise AI transformation.
About This Series
“Software Engineering Transformation in the AI Era” is a research series aimed at CIOs, CDOs, CTOs, and digital transformation leads across telecom, finance, manufacturing, and e-commerce. Across 18 articles, it examines how AI coding tools, specification-driven development, and organizational governance are reshaping software delivery processes, team structures, and engineering maturity.
The series continuously tracks academic papers, vendor materials, and industry reports, drawing on a research library of over 200 sources. Key claims are tagged with evidence levels, distinguishing verified facts, vendor claims, industry observations, and the author’s own reasoning.
I bring nearly 8 years of experience in large-enterprise consulting and business analysis, including a tenure at IBM working on projects in telecom, finance, insurance, and manufacturing. Since then, I’ve stayed hands-on in carrier products, internet products, and AI application development—covering requirements analysis, product design, and cross-team delivery.
This series’ judgments on standards-driven, organizational governance, and engineering practices are drawn from hands-on experience, cross-validated against public research and industry case studies. Project-specific details have been anonymized; some industry scenarios are typical problem extrapolations, with supporting references listed at the end.
Behind this account is actually a small team — myself and 1–2 long-term collaborators, each covering AI coding tool research, organizational governance case studies, and coaching conversations. Most of the projects described as “we walked enterprises through” were delivered jointly by us. Client confidentiality boundaries and individual names remain undisclosed; anonymity is preserved to leave room for future collaborators.
References (all verified, with evidence level noted per item)
CodeRabbit (2025.12). State of AI vs Human Code Generation Report. AI-generated code contains 1.7× more issues than human-written code (10.83 vs 6.45 issues per PR). Breakdown by category: logic/correctness 1.75×, code quality 1.64×, security 1.57×, password handling 1.88×, XSS 2.74×. Evidence tier: Level 1 Source: https://www.theregister.com/software/2025/12/17/ai-authored-code-needs-more-attention-contains-worse-bugs/2576263
The Register (2025.12.17). Coverage of the full CodeRabbit report: analysis of 470 open-source PRs shows AI-assisted PRs averaging 10.83 issues versus 6.45 for purely human-authored ones. Evidence tier: Level 2 Source: same URL as above.
CodeRabbit / David Loker (Jan 2026). “2026 Predictions: The Speed Trap” — 2026 marks the shift from “code generation speed” to “code quality and governance.” Evidence level: Tier 2. Source: https://tfir.io/ai-code-quality-2026-guardrails
New Relic (2026). The 2026 State of AI Coding Report. 78% of teams report more incidents after shipping AI-generated code; 62% of technical leaders admit their teams “confidently ship AI code without review”; 96% say observability is a must-have. Evidence level: Tier 1 (vendor report). Source: https://newrelic.com/resources/report/2026-state-of-ai-coding
Microsoft 2026 Work Trend Index Annual Report (May 5, 2026). Survey of 20,000 AI workers across 10 countries; 82% of leaders plan to expand their workforce with AI agents within 12–18 months; 81% expect moderate to significant agent integration; 24% have already deployed at enterprise scale; 49% of Copilot conversations support knowledge work; 58% of AI users report doing things “they couldn’t do a year ago,” rising to 80% among Frontier Professionals. Evidence tier: Level 1. Source: https://assets-c4akfrf5b4d3f4b7.z01.azurefd.net/assets/2026/05/2026_Work_Trend_Index_Annual_Report_050526-6_69fa654a0ab65.pdf
Microsoft FY26 Retrospective: From AI Experimentation to Frontier Transformation (2026.7.28). EY deployed Microsoft 365 Copilot to 150,000 employees, saving 2.5 million hours and approximately $250 million; the rollout has since expanded to 400,000 global employees, with 95% faster task completion, a 37% reduction in finance operations costs, and up to 90% reduction in manual workflows. Atos rolled out Copilot to 56,000 employees across 56 countries, alongside 19,000 AI agents, unified under a single identity, security, compliance, and governance control plane. Evidence tier: Level 1 (official Microsoft retrospective). Source: https://blogs.microsoft.com/blog/2026/07/28/looking-back-on-microsofts-fy26-from-ai-experimentation-to-frontier-transformation
Atos Group and Microsoft Strategic Collaboration (2026.6.9). Atos is deploying Microsoft 365 E7 (Frontier Suite) across 56 countries for 56,000 employees, plus 19,000 AI agents, with a unified control plane spanning Entra, Defender, Intune, Purview, and Agent 365. Evidence level: Tier 1 (joint press release). Source: https://news.microsoft.com/source/2026/06/09/atos-group-and-microsoft-expand-strategic-collaboration-to-scale-secure-agentic-ai-across-atos-group-workforce-and-clients
GitHub Spec Kit (open-sourced Sep 2025, evolving through H1 2026). Five-stage gated workflow
/speckit.constitution → /specify → /plan → /tasks → /implement, plus/clarify/analyze; model-agnostic (works with Claude Code / Copilot / Cursor / Codex CLI / Gemini CLI / opencode / Windsurf / Qwen Code). Evidence level: Tier 1. Source: https://github.com/github/spec-kitAWS Kiro (released Jul 2025, evolving through H1 2026). Three-stage workflow: requirements → design → tasks; specs trigger predefined agent actions; the workflow won’t start without a spec. Evidence level: Tier 1. Source: https://kiro.dev/
OpenAI Codex + AGENTS.md + Skills (2025-2026). Codex hit 5M+ weekly active users by June 2026, with 20% non-developers; AGENTS.md + Skills form a composable instruction set. Evidence level: Tier 1 (official OpenAI announcement). Source: https://developers.openai.com/codex/skills
Claude Code (Anthropic, H1 2026). CLAUDE.md + .claude/rules/ + Skills system; entered Anthropic’s official marketplace in February 2026; Skills repository has 112K stars on GitHub; Series G disclosure in February 2026 showed $2.5B annualized revenue. Evidence level: Tier 1. Source: https://code.claude.com/docs/en/claude-directory
JetBrains AI Tools Research (2026.2). 15,000 developers surveyed; 46% chose Claude Code as “most loved,” Cursor 19%, Copilot 9%. Evidence level: Tier 1. Source: https://www.jetbrains.com/lp/tools/ai-tools/
Pragmatic Engineer Newsletter (2026.2). 15,000 developer survey; 46% picked Claude Code as “most loved,” Cursor 19%, Copilot 9%. Evidence level: Tier 1. Source: https://newsletter.pragmaticengineer.com/
Alibaba Qoder (Aug 2025 → Jul 2026). Released by Alibaba in Aug 2025; on May 15, 2026, Qoder 1.0 was upgraded to an Autonomous Agent Development Workbench, featuring Spec-Driven Workflow, Quest Mode, Expert Mode, and RepoWiki; on May 28, 2026, Cloud Agents (a managed agent runtime) was introduced; on Jul 21, 2026, Qoder Security followed. By May 2026, Qoder had surpassed 5 million global users. It also integrates with Microsoft Teams CLI. On May 20, 2026, Tongyi Lima was renamed Qoder CN. Evidence level: primary. Sources: https://www.alibabacloud.com/en/marketplace/qoder; https://baike.baidu.com/en/item/Qoder/1427525
vibecoding.app / thebcms.com / tfir.io (2026 H1). Spec Kit five-phase commands, SDD tool evaluations and comparisons, EARS notation method. Evidence level: Tier 2 (third-party evaluations). Sources: https://vibecoding.app/blog/spec-kit-review; https://thebcms.com/blog/spec-driven-development
EU AI Act / Code of Practice (full enforcement from Aug 2, 2026). Compliance deadline for high-risk AI systems is Aug 2, 2026; existing GPAI models are extended to Aug 2, 2027; fines up to €35 million or 7% of global annual revenue; Articles 9–15 cover risk management, data governance, documentation transparency, human oversight, and accuracy/robustness. Evidence level: Tier 1 (regulation + secondary compliance analysis). Sources: https://artificialintelligenceact.eu/code-of-practice-overview; https://www.surecloud.com/resource-hub/eu-ai-act-complete-compliance-guide
Qodo State of AI Code Quality Report (2025). 44% of issues stem from missing context. Evidence level: Tier 2 (vendor report). Source: https://www.qodo.ai/reports/state-of-ai-code-quality/
buymeacoffee
![[Bottleneck Shift] When Code Is Nearly Free, Where Has the Bottleneck of Software Engineering Gone? The Transformation of Software Engineering in the AI Era — Learn AI Slowly #173](https://cdn.iaiuse.com/img/2026/08/10/fb10b9116141238daf5a49ae7d60f446.webp)
