The AI SDLC Rollout Playbook
Generic phasing you adjust to team size and regulatory weight - a regulated team should expect every phase to run longer. The promise is a published baseline in three weeks and a first measured delta at 90 days, not a velocity multiple in the first 60 days.
Why the Phases Overlap
None of the four phases below has a hard stop. Phase 1's plan-first review keeps running through Phase 2 and Phase 3; Phase 2's Lane B agents do not replace the pre-review rules Phase 1 built, they run on top of them. Each phase adds a capability without retiring the ones before it, which is why the exit criteria matter more than the calendar - a team that hits Phase 1's numbers in six weeks should move on, and a team that has not published a baseline should not be running unattended agents no matter what month it is.
What compounds is not the tooling - it is the organization-specific material the tooling produces: review rules learned from your own escaped defects, eval fixtures built from your own incidents, an evidence pack shaped by your own audit requirements. A competitor can buy the same agents. They cannot buy three quarters of your review rules.
The Timeline
Phase 0. Baseline and Configure
Weeks 1 to 3
Measure where you stand and set the guardrails before agents touch anything.
Phase 1. Assist
Months 1 to 3
Agents draft and pre-review inside the existing loop; a human still owns every merge.
Phase 2. Delegate
Months 2 to 5
Unattended agents take the safe work class; the learn loop starts turning defects into rules.
Phase 3. Compound
Months 5 to 9
Evidence, domain pipelines, and quarterly upgrades turn accumulated rules into a moat.
Phase 0. Baseline and Configure (Weeks 1 to 3)
The goal is a number, not a vibe. Instrument the pipeline and settle the policy and access model while the stakes are still small - everything that follows gets measured against what this phase publishes.
- Approved tool list, company-managed accounts, and training opt-out confirmed in writing.
- An AI usage policy written and communicated.
- Data classification mapped to AI surfaces, per security and compliance.
- API platform org and service identity for CI set up, with budgets and caps in place.
- Seat mix rebalanced toward premium tiers for heavy agent users.
- Repo hygiene: root and per-package instruction files, CODEOWNERS, and the ticket contract and PR templates.
- Baseline instrumentation: cycle time, review latency, change failure rate, escaped defects, deploy frequency, and mutation score on critical modules.
Exit Criteria
The baseline is published. Cost incurred so far: seats only.
Phase 1. Assist (Months 1 to 3)
Agents assist inside the existing loop - drafting plans, pre-reviewing, generating tests - while a human is still in the loop of every merge.
- Plan-first review on all non-trivial tickets, per engineering practices.
- Risk-tiered routing live, so higher-risk changes get more scrutiny automatically.
- AI pre-review with a first set of org-specific rules, run through the eval fixture set - see AI code review at scale.
- Generated tests from acceptance criteria on new work.
- A merge queue in place.
- AI-drafted release notes and change records.
Exit Criteria
Review latency down materially (40% is a reasonable target), QA cycle time down, and change failure rate flat or better.
Phase 2. Delegate (Months 2 to 5)
The safe work class moves to unattended agents, and the learn loop starts running on its own cadence instead of waiting for a retrospective.
- Lane B unattended agents on the safe work class only.
- Bug-to-failing-test automation.
- Pipeline auto-repair on the safe failure class.
- Contract tests for external adapters against recorded fixtures.
- Learn loop running: escaped defects become review rules on a weekly cadence.
Exit Criteria
20 to 30 percent of merged PRs are agent-originated; change failure rate and incidents per deploy are unchanged; Lane B's cost per merged PR is below the human-loaded cost for that work class.
Phase 3. Compound (Months 5 to 9)
Evidence generation and domain-specific pipelines become routine, and the rules, skills, fixtures, and evidence accumulated so far start compounding.
- An evidence pack generated on every release.
- Domain-specific pipelines - for a regulated product, a rule change becomes a config diff, tests, and evidence, with humans adjudicating.
- An incident agent on call, proposing and drafting, never acting alone.
- Quarterly model and rule upgrades run through the eval suite.
Exit Criteria
There is no fixed exit here. This is the phase that becomes a moat, because the review rules, skills, fixtures, and evidence are specific to your organization and compound every quarter.
What to Promise Leadership
Do not promise a velocity multiple in the first 60 days - that number will not exist yet, and promising it invites a broken measurement to fill the gap. Promise a published baseline at three weeks, which is Phase 0's exit criterion, and a first measured delta at 90 days, once Phase 1 has had time to move review latency, QA cycle time, and change failure rate.
See Measuring Impact for what belongs in that 90-day readout and which metrics to leave out of it.
Where It Fits in AIDLC
The rollout playbook is not a sixth phase - it is the adoption curve running underneath all five. Phases 0 and 1 mostly touch Analyze and Ideate work through plan-first review and pre-review; Phase 2 pushes further into Develop and Launch as unattended agents take on real work; Phase 3's evidence packs and learn loop feed Curate, closing the loop that lets the next quarter compound.
Frequently Asked Questions
A generic rollout runs about nine months across four phases: a three-week baseline, three months of assisted review, two to five months of delegated work on safe tasks, and an open-ended compounding phase after that. Team size and regulatory weight change the durations - a regulated team should expect longer phases and more evidence work throughout.
Phase 0 delivers a published baseline, not a pilot result. That means an approved tool list, a written AI usage policy, data classification mapped to AI surfaces, repo hygiene like instruction files and CODEOWNERS, and instrumentation for cycle time, review latency, change failure rate, escaped defects, deploy frequency, and mutation score. The only cost incurred is premium seats.
Not before Phase 2, and only on the safe work class - never on auth, money math, or adapters, which stay human-reviewed regardless of phase. Phase 2's unattended agents also depend on Phase 0's instrumentation and Phase 1's pre-review rules already running, so the guardrails exist before the autonomy does.
Know Which Phase You're In
Check your level against the maturity model, or start from the beginning of the framework.