AI in Engineering: Adding a Copilot Isn’t Enough

AI is already accelerating software development. The challenge is integrating it with the right processes, security, and metrics to deliver more value without losing control.

By Rodrigo Garau, Head of Technical Delivery at Santex

Artificial intelligence in software development is no longer a bet on the future. It is a decision companies are making today. Yet the most important question is not which AI tool to adopt, but how to integrate it into the engineering process without losing control over the code, security, and outcomes.

Access to models is no longer the main barrier. The real challenge lies in everything around them: who validates AI-generated outputs, which model is used in each context, how data is protected, and how teams determine whether delivery has actually improved.

At Santex, we call this AI-Optimized Engineering: a way of designing the development lifecycle with AI integrated from end to end. It is not about generating more code. It is about building within clear, scalable processes designed for traceability.

Working with AI Means Designing a Process

Giving developers access to a copilot does not transform engineering on its own. AI-Optimized Engineering integrates artificial intelligence into code generation, testing, documentation, and technical reviews, while incorporating development metrics to ensure traceability and clear accountability at every stage.

The difference between a team that uses AI and one that is designed to work with AI is similar to the difference between having data and making data-driven decisions. The input may be the same, but the value comes from the process built around it.

Security Cannot Be an Afterthought

AI assistants accelerate development, but they also expand the attack surface. They may operate with access to repositories, terminals, data sources, and other sensitive information within the environment. That is why controls must be in place before a new capability is allowed to interact with the codebase.

At Santex, we developed Skill Scanner, a tool that audits the skills and plugins used by AI assistants before they are installed. It analyzes their code, identifies risks, and helps teams decide which capabilities can be enabled safely.

We also assess services that are already exposed through a combined process that includes static application security testing (SAST), dynamic application security testing (DAST), and penetration testing (pentesting), all conducted in controlled environments and with human approval.

Security is not added at the end of the pipeline. It is designed into the process.

The Right Model Depends on the Context

Not every project needs the most powerful model. It needs the right one.

Initiatives involving sensitive information may require local models or private environments. For repetitive, high-volume tasks, smaller models may offer a better balance between cost and outcomes. For rapid prototyping, cloud-based models may be the most efficient option. Far from being a purely technological decision, this requires applying engineering criteria to balance capabilities, costs, and risks.

An AI-Optimized Engineering architecture can therefore combine local, cloud-based, open-weight, and frontier models depending on the use case.

The decision should not be driven by a tool’s popularity. It should be based on engineering criteria that balance capabilities, costs, and risks while prioritizing the outcomes the business needs.

Measuring Activity Is Not the Same as Measuring Impact

Saying that a team uses AI for a large share of its work does not reveal whether the process has actually improved.

What matters is what changed:

Did delivery times decrease?
Were there fewer incidents?
Did quality improve?
Can the team deliver more value?

In our experience integrating AI into Delivery, we recorded a 42% reduction in time spent on coding tasks, delivered three times as many features, and reduced QA validation time by 77%.

At the same time, we strengthened pull request reviews, ensured that 90% of pull requests included integrated tests, and reduced the time from idea to implementation by 72%, from 9 days to 2.5 days.

Speed matters, but it only creates value when it is supported by quality, review processes, and measurable outcomes.

Not Every Team Needs to Start with Code

In some cases, AI agents are a better entry point. They can automate high-volume, low-ambiguity tasks such as ticket processing, documentation generation, data validation, and responses to internal queries.

The goal is not to remove people from the process. It is to reduce the friction that keeps specialized professionals focused on repetitive work and give them more time for architecture, analysis, and decision-making.

That is where the real value lies.