AI-generated code has quietly become part of the enterprise software supply chain, introducing risks that traditional governance frameworks weren't designed to handle. Unlike open-source dependencies with traceable lineage, AI-generated code has uncertain provenance, may propagate insecure patterns at scale, and creates architectural inconsistency over time. Key risks include unknown implementation origins, hidden vulnerability propagation, model drift, shadow AI usage, and compliance gaps. The post outlines a five-level AI governance maturity model and an executive action checklist covering immediate steps (publishing AI coding policies, training developers) through long-term goals (standardizing governance, integrating into procurement). Core recommendations: treat AI coding assistants as software suppliers, document prompt history and model versions, require human review accountability, extend SBOMs with AI provenance records, and report AI code risk metrics to executive leadership.
