The AI-Native Engineering Checklist
The 25 controls every engineering org needs before AI velocity becomes AI liability — walk them through your staff engineers and find every gap in 30 minutes.
The problem is not AI adoption. The problem is unstructured AI adoption.
Some of your teams are getting 10x from AI. Others are guessing. Nobody can point to where one team's practice ends and another's gap begins — and that unevenness is exactly where the next incident hides. A control that holds on one team and not another is not a control. It is a gap you haven't found yet.
of engineering orgs have any formal AI governance
more production incidents per PR without governance
of AI-generated code fails security tests
Five practices. 25 controls. 30 minutes.
Curate
The context AI agents consume. 5 controls: codebase indexing · standardised, PR-reviewed AGENTS.md / CLAUDE.md · context ownership and metrics · window-scoping guidelines · AI onboarding and MCP allowlist.
Refine
Specs before AI generates code. 5 controls: spec-completeness gate · predicate-form acceptance criteria · systematic edge-case generation · Specify → Plan → Tasks → Implement · requirement-to-code traceability.
Architect
Within governed patterns. 5 controls: codified pattern and anti-pattern library · machine-readable ADRs linked from AGENTS.md · AI PR review before human · agentic CI/CD and intelligent test selection · tech-debt registry in AI context.
Fortify
Against AI-introduced risk. 5 controls: SAST/DAST/SCA at AI velocity · SBOM/AIBOM provenance · dependency, MCP and extension allowlists · policy-as-code compliance · closed-loop remediation.
Test
Before AI ships. 5 controls: higher AI coverage thresholds · adversarial edge-case testing · blocking quality gates · DORA segmented by AI-assisted · failure-to-context feedback loop.
Score yourself
Tally your ticks, place your org on the CRAFT maturity ladder — Ad-Hoc to AI-Native — and read off the leftmost practice with an unchecked box. That is where you start on Monday.
See it before you gate it.
Maintain AI-Readable Standards
Good — every team feeds AI the same quality of context; instruction files are version-controlled, not personal side files. Risk — each team feeds a different quality of context, and the 10x team stays a personality instead of becoming a practice.
Defend the Supply Chain
Good — allowlists enforced at generation time; AI-suggested dependencies gated against registry-existence and reputation; MCP servers pinned. Risk — AI installs whatever it hallucinates. ~20% of AI-recommended packages don't exist and 43% recur (USENIX 2025) — slopsquatting is a repeatable attack vector.
Gate Quality
Good — AI code faces stricter, blocking thresholds no one can wave through unilaterally. Risk — marginal AI code merges on a green PR. Apiiro found 4× velocity brings 10× vulnerabilities without gates (June 2025).
Count your ticks. Place your org.
CRAFT's order is a dependency chain, not alphabetical convenience. Fix the leftmost practice where you have unchecked boxes first — a refined spec still fails if the AI is reading the wrong context, and a downstream practice built on an ungoverned upstream one is built on sand.
Read this if you're a leader who…
…has some teams flying with AI and others floundering, with no shared method between them.
…can't get a straight answer to "do we actually have that control on every team, or just one?"
…wants a single page you can print, pass around your staff engineers, and fill in together in half an hour.
…suspects your AI governance is real on one team and theatre on the rest.
It best serves the middle of the maturity ladder — The Emerging Framework (41–60) and The Structured Org (61–80) — where a method exists but adoption is uneven, and naming the gaps is the next move.
CRAFT Method wasn't designed in a boardroom. It was forged in production.
It was forged by building production software with AI, every day, for months. FIKR Space — eleven integrated products, built solo plus AI — is the live proof point.
EU AI Act high-risk obligations enforceable
Article 12 logging is architectural, not retrofittable. If it isn't built in, it isn't there when the audit arrives.
Insurance exclusions for generative-AI claims live
The financial backstop for AI-introduced defects is narrowing. The liability is moving onto the balance sheet.
The decision is yours. The clock is not.
Before you ask.
Is this really free?
Yes. The checklist is a free download in exchange for your email. You'll get the PDF instantly and the occasional field note — unsubscribe anytime, and we never share your email.
How is this different from the Free Scorecard?
The Free Scorecard is the Curate practice only — 25 questions, scored to an archetype, done on screen. This checklist is all five practices, unscored, printable, and built to pass around every team lead. It is the natural bridge: the checklist shows you the shape of the gaps; the full diagnostic scores them.
Do we need a specific AI tool for this to apply?
No. CRAFT Method is tool-agnostic. Every control governs how any AI coding assistant is curated, refined, architected, fortified, and tested — whether that is Claude, Copilot, Cursor, or whatever ships next.
What's the Enterprise Diagnostic?
125 questions across all five practices — five per sub-practice — scored to a number and an archetype for every practice, with a per-sub-practice gap list, plus a 30-minute live debrief with Luis Gonçalves. Listed at €1,500–2,000; free during the 2026 launch period, limited capacity. The Free Scorecard (25 questions, 5 minutes) is always free.