Right now, developers are shipping production code written entirely by AI, with no review and no second set of eyes, because the process does not require it.
This is not a prediction. It is happening today at companies of every size, in every industry.
The NIST AI Risk Management Framework has been available since 2023. Three years later, most organizations still cannot answer the most basic question it raises. When something breaks, the conversation that follows is always the same.
Who owned this?
The developer points to the AI. The manager points to the process. The executive points to the team. Nobody has a clear answer, because nobody defined one before the code went live.
NIST already named the person who should have been in the room
The framework calls this role a TEVV specialist: Test, Evaluation, Verification and Validation. It is an independent reviewer whose job is to confirm that the AI output does what the team believes it does.
Most companies do not have this role. Most have never heard the term.
The framework does not explain how to hire this person. It does not say where the role sits on the organization chart. It does not define a minimum viable team for organizations that cannot fund a dedicated reviewer.
It assumes the capability already exists.
Adopting a framework is the easy part
Building the human capability a framework assumes is the hard part, and it is the conversation most organizations are not yet having.
Across AI initiatives, the answer is rarely a new hire. It is almost always a defined review process and a named owner, two things most teams can put in place this quarter.
A template for setting up that role, "Minimum Viable Review Role," is on the author's site: swapniltamse.com/tool/tevv-template.