🤖 AI Summary
This study addresses the challenge in regulated industries where existing AI coding systems lack mechanisms to dynamically calibrate human oversight based on regulatory impact, thereby struggling to balance compliance and efficiency. To bridge this gap, the authors propose the GAIE framework, which introduces an innovative three-tier Oversight Classification Model (OCM) that categorizes code-generation tasks according to regulatory impact, customer proximity, reversibility, and data sensitivity, and aligns each category with appropriate supervision levels and compliance evidence requirements. By integrating rule-driven deterministic classification, compliance evidence mapping, and alignment with multi-jurisdictional regulatory standards—including those from the Bank of Thailand, MAS, NIST, ISO/IEC 42001, and the EU AI Act—the framework uniquely links AI development maturity with regulatory governance. Empirical results demonstrate that GAIE maintains 84%–97% (median 91%) of autonomous coding speed while ensuring comprehensive compliance evidence coverage, confirming its efficacy and broad applicability.
📝 Abstract
The adoption of agentic AI coding systems -- where autonomous agents generate, review, test, and deploy code with minimal human intervention -- creates a governance challenge in regulated industries. Existing frameworks address AI-assisted development maturity or the productivity-reliability tension but offer no mechanism for calibrating human oversight intensity to regulatory impact. We present the Governed AI-Assisted Engineering (GAIE) framework, a three-tier graduated human oversight model for agentic code generation in regulated domains. GAIE introduces the Oversight Classification Model (OCM), a deterministic decision function that classifies code generation tasks by regulatory impact, customer proximity, reversibility, and data sensitivity to route them through one of three oversight tiers: human-in-the-loop (strategic functions), human-over-the-loop (customer-impacting), or automated-with-monitoring (internal). Each tier defines required evidence artifacts for compliance auditability. We map GAIE against the Bank of Thailand's 2025 AI risk-management policy and demonstrate cross-jurisdiction applicability to MAS (Singapore), NIST AI RMF, ISO/IEC 42001, and the EU AI Act. Evaluation through regulatory coverage analysis, comparative framework analysis, and analytical productivity modeling suggests that graduated oversight preserves 84--97% of agentic coding velocity (central estimate: 91%) while maintaining compliance evidence coverage for regulated functions. GAIE contributes a framework that explicitly bridges AI-assisted development maturity with regulatory governance through proportionate human oversight.