BNY Scales AI Across SDLC for 8,000 Engineers
BNY Mellon's Head of Software Engineering Strategy reveals how the bank scaled AI across 8,000 engineers by transforming the entire SDLC. Learn the 3x stress test framework, three-tier deployment model, and cultural shifts driving stability and compliance in regulated environments.
BNY Mellon has advanced AI adoption beyond coding assistants to transform the entire software delivery lifecycle for 8,000 engineers. Jason Valentino, Head of Software Engineering Strategy, details a pragmatic framework for scaling AI in highly regulated environments, emphasizing that coding velocity alone does not drive business value. The strategy centers on identifying and resolving bottlenecks across the SDLC, ensuring that increased developer output translates to reliable releases rather than system overload. With AI authoring nearly 50% of code, BNY is leveraging this capacity to resolve technical debt and improve quality metrics without expanding headcount.
Strategic Prioritization and Stress Testing
BNY employs a "3x stress test" to simulate tripling development velocity, revealing critical weaknesses in build systems, release gates, and infrastructure before AI scales. Teams decompose every SDLC task into a matrix to assess automation potential, current state, and developer sentiment, prioritizing interventions where AI can alleviate high-friction manual work. This granular analysis prevents盲目 tooling and focuses investment on workflows that genuinely impact throughput. For example, BNY identified peer review and change management as major holdups, leading to targeted automation efforts rather than generic tool deployment.
Three-Tier AI Deployment Model
The organization categorizes AI implementation into three distinct patterns: creativity tools for IDEs, autonomous "digital workers" for monotonous tasks, and embedded workflow agents for deterministic governance. Digital workers, described as "bratty interns," handle repetitive operations like access requests, Jira backlog grooming, and build fixes. More critically, BNY is embedding AI directly into SDLC workflows, where merge requests trigger deterministic evaluations. If code meets health criteria, AI assists in merging; if anomalies arise, the process escalates to humans. This approach codifies compliance, accelerates the "golden path" for trusted teams, and enables instantaneous change ticket approvals based on clean security and composition scans.
Cultural Agility and Compliance Modernization
Success relies on a "say yes" culture that encourages rapid internal innovation, supported by weekly show-and-tell sessions with 600 stakeholders to consolidate efforts and prevent long-term duplication. Platform engineering leads AI enablement, treating tools as products with community feedback loops. Simultaneously, BNY is rewriting compliance policies to focus on risk reduction and outcomes rather than legacy controls, collaborating closely with audit partners to validate AI-driven processes. This holistic strategy has eliminated code coverage gaps, improved test maturity naturally, and maintained system stability despite doubled commit activity. External audit requests are now resolved instantly via automated queries, demonstrating that AI can enhance both velocity and reliability while satisfying rigorous regulatory requirements.
Key insights
-
Coding assistants alone do not increase releases; value comes from automating the entire SDLC, including peer review, testing, and change management. BNY uses a 3x stress test to identify where systems will break under increased velocity, directing AI investment to critical bottlenecks.
Impact: Prevents infrastructure collapse during AI scaling and ensures automation efforts directly improve throughput and reliability.
-
AI deployment should follow three patterns: creativity tools for developers, autonomous agents for monotonous tasks, and embedded workflows for deterministic governance. Embedding AI into merge requests allows for automated reviews and approvals based on health metrics, reserving human intervention for anomalies.
Impact: Accelerates the golden path for trusted teams and codifies compliance, reducing manual review bottlenecks while maintaining safety.
-
A "say yes" culture combined with weekly show-and-tell sessions enables rapid innovation and consolidation of efforts. BNY allows teams to ship AI solutions quickly, then leverages community feedback to standardize tools and prevent duplication.
Impact: Fosters high engagement and accelerates adoption by removing gatekeeping, while show-and-tell mechanisms ensure long-term coherence.
-
Regulated enterprises must rewrite compliance policies to focus on risk reduction and outcomes rather than legacy controls. BNY collaborates with audit partners early to validate AI-driven processes, proving that regulators care about the spirit of risk management.
Impact: Aligns governance with AI capabilities, enabling faster approvals and reducing friction between engineering and compliance teams.
Action items
-
Conduct a 3x stress test across your SDLC to simulate tripling development velocity. Identify bottlenecks in build systems, release gates, and infrastructure, then prioritize AI investments to resolve these constraints.
Impact: Ensures your organization can handle increased AI-driven throughput without system failures or quality degradation.
-
Decompose every SDLC task into a matrix assessing automation potential, current state, and developer sentiment. Use this data to target high-friction manual tasks for AI intervention rather than deploying tools blindly.
Impact: Maximizes ROI on AI initiatives by focusing on workflows that deliver the greatest efficiency and developer satisfaction gains.
-
Implement a weekly show-and-tell session for AI innovations across the organization. Encourage teams to share solutions, then consolidate efforts to prevent duplication and standardize best practices.
Impact: Accelerates learning and adoption while maintaining coherence, turning fragmented innovation into enterprise-wide capabilities.
-
Review and rewrite compliance policies to focus on risk reduction and outcomes. Collaborate with audit and risk partners early to validate AI-driven processes, ensuring governance supports rather than hinders automation.
Impact: Reduces friction between engineering and compliance, enabling faster delivery while maintaining rigorous regulatory standards.
Quotes
“Writing code is just one of many, many, many steps in what it takes to build and ship products... we've effectively made the fun part of the job less of the job so that we can focus on the rest of it.”
“If we really believe this thing, we want to de-risk the organization from an AI surge. Where are we going to invest next?”
“Just start saying yes. I might get in trouble for that one. Just start saying yes.”