From cc839b0915777ea3a15a7a540afc1ea4ce20ccf6 Mon Sep 17 00:00:00 2001 From: Martyn Fewtrell Date: Wed, 29 Apr 2026 13:56:12 +0100 Subject: [PATCH 1/4] Add UKHO Engineering Strategy document Introduced a new strategy document detailing the purpose, principles, outcomes, and governance for software, data, and test engineering at UKHO. The strategy focuses on sustainable, secure, and resilient practices, product-centric teams, technical debt management, and alignment with wider organizational and government standards. Clarifies the document as a guiding framework rather than a delivery plan. --- .../strategy/software-engineering-strategy.md | 98 +++++++++++++++++++ 1 file changed, 98 insertions(+) create mode 100644 software-engineering/strategy/software-engineering-strategy.md diff --git a/software-engineering/strategy/software-engineering-strategy.md b/software-engineering/strategy/software-engineering-strategy.md new file mode 100644 index 00000000..38c39310 --- /dev/null +++ b/software-engineering/strategy/software-engineering-strategy.md @@ -0,0 +1,98 @@ +# UKHO Engineering Strategy + +*A pragmatic, government-aligned strategy for sustainable engineering* + +## 1. Purpose and Context + +### Purpose + +This strategy sets out how engineering (Software , Data and Test) at the UK Hydrographic Office (UKHO) enables the delivery of Defence, SOLAS and commercial obligations through sustainable, secure and resilient digital services, while supporting the development and retention of engineering talent. + +### Context + +UKHO delivers long‑lived, safety‑critical products in an environment of increasing digital demand. This strategy aligns with cross‑government Digital, Data and Technology (DDaT) expectations, while remaining tailored to UKHO’s specific mission. Software engineering is treated as a core organisational capability rather than a purely delivery-focused activity. + +## 2. Strategic Outcomes + +The UKHO Software Engineering Strategy optimises for the following outcomes: + +- Reliable and resilient digital services that meet safety, availability and performance expectations +- Sustainable systems that can be evolved rather than repeatedly replaced +- Secure‑by‑design delivery throughout the software lifecycle +- High‑performing engineering teams with clear accountability +- Value for money through reduced technical debt and predictable delivery + +## 3. Engineering Principles + +These principles guide engineering decisions across UKHO: + +- User and mission led - build software that meets genuine operational, safety and user needs +- Small, frequent and reversible change - prefer incremental delivery over large releases +- Build to operate - teams are accountable for software in production +- Secure and resilient by default - security is embedded from design through operation +- Automate wherever sensible - CI/CD, testing and monitoring reduce risk +- Open and documented - code, architecture decisions and dependencies are visible and maintained + +## 4. Strategic Focus Areas + +### 4.1 Product‑Centric, Long‑Lived Teams + +**Intent:** Organise delivery around products and services rather than temporary projects. + +**In practice:** Stable multi‑disciplinary teams, clear service ownership, and named technical leadership. + +### 4.2 Modern Delivery Practices + +**Intent:** Reduce delivery risk while increasing pace and predictability. + +**In practice:** Agile, iterative delivery supported by continuous integration, automated testing and continuous deployment. + +We look to leverage AI where we can obtain the biggest ROI, but being aware of the ethical, technical, security and and other risks (A separate AI Engineering strategy has been created) + +### 4.3 Sustainable Architecture and Technical Debt + +**Intent:** Treat technical debt as a managed risk rather than an unavoidable cost. + +**In practice:** Architecture Decision Records, explicit time for debt reduction, and appropriate platform reuse. + +### 4.4 Security, Quality and Resilience Engineering + +**Intent:** Protect critical services and data through disciplined engineering. + +**In practice:** Secure‑by‑design patterns, resilience testing, and observability (logging, metrics and alerting) as standard. + +### 4.5 Engineering Capability and Culture + +**Intent:** Make UKHO a great place to be an engineer. + +**In practice:** Clear role expectations, career pathways, communities of practice, and active mentoring and coaching. + +## 5. Governance and Decision‑Making + +**Ownership:** The Head of Engineering is accountable for this strategy, with engineering standards owned collaboratively by the engineering community. + +**Decision‑making:** Teams make day‑to‑day technical decisions independently, with escalation only where there is significant safety, security or organisational impact. + +**Assurance:** Lightweight assurance through architecture reviews, live service health checks and security posture reviews, avoiding unnecessary bureaucracy. + +## 6. Measures of Success + +Success will be monitored using a small set of meaningful signals rather than rigid targets: + +- Reliability - service availability and incident recurrence +- Delivery - lead time for change and deployment frequency +- Quality - defect escape rates and automated test trends +- Sustainability - technical debt trends and system longevity +- People - retention, engagement and skills development + +These measures are indicators of health, not performance targets. + +## 7. Alignment with Wider UKHO Strategy + +This Software Engineering Strategy supports the UKHO Technology Strategy and aligns with MOD, SOLAS and Cabinet Office expectations. It complements data, cloud and security strategies and draws on cross‑government DDaT standards while remaining tailored to UKHO’s needs. + +## 8. What This Strategy Is and Is Not + +This strategy is a guiding framework for consistent decision‑making. + +It is not a delivery plan, a tooling mandate or a reorganisation programme. From 05b54ad393408c22f195e5d12dc3310a971d0a1d Mon Sep 17 00:00:00 2001 From: Martyn Fewtrell Date: Fri, 15 May 2026 09:10:26 +0100 Subject: [PATCH 2/4] Broaden strategy docs from Software Eng to Engineering Expanded both AI and engineering strategy documents to cover all engineering disciplines (software, data, test). Updated terminology, scope, use cases, and governance references to reflect the wider remit. Adjusted audience, applicability, and strategic alignment accordingly. --- ...strategy.md => engineering-ai-strategy.md} | 26 +++++++++---------- ...ng-strategy.md => engineering-strategy.md} | 10 +++---- 2 files changed, 18 insertions(+), 18 deletions(-) rename software-engineering/strategy/{software-engineering-ai-strategy.md => engineering-ai-strategy.md} (83%) rename software-engineering/strategy/{software-engineering-strategy.md => engineering-strategy.md} (79%) diff --git a/software-engineering/strategy/software-engineering-ai-strategy.md b/software-engineering/strategy/engineering-ai-strategy.md similarity index 83% rename from software-engineering/strategy/software-engineering-ai-strategy.md rename to software-engineering/strategy/engineering-ai-strategy.md index 2b972c6f..0f964f82 100644 --- a/software-engineering/strategy/software-engineering-ai-strategy.md +++ b/software-engineering/strategy/engineering-ai-strategy.md @@ -1,8 +1,8 @@ -# Software Engineering AI Strategy +# Engineering AI Strategy ## Foreword -Software Engineering plays a central role in delivering UKHO's digital products and services. AI-powered developer tools are an opportunity to increase productivity, improve code quality, and free engineers to focus on higher-value design and systems thinking. This document sets out our practical, security-conscious approach to adopting AI within software delivery, with GitHub Copilot established as the sanctioned coding assistant. +Engineering plays a central role in delivering UKHO's digital products and services. AI-powered engineering tools are an opportunity to increase productivity, improve quality, and free engineers to focus on higher-value design, analysis and systems thinking. This document sets out our practical, security-conscious approach to adopting AI across engineering delivery, with GitHub Copilot established as the sanctioned coding assistant. The strategy balances pragmatic adoption with strong governance: engineers remain accountable for all code, security and IP considerations are enforced, and we prioritise training, monitoring and targeted support so benefits are realised evenly across teams. @@ -10,7 +10,7 @@ This is a living strategy and will be reviewed annually to reflect technology, p ## 1. Executive Summary -This strategy sets out how Software Engineering will use AI to improve delivery quality and developer productivity while maintaining security, IP and governance standards. Our pragmatic approach focuses on sanctioned developer tooling (GitHub Copilot), training and measurement to ensure benefits are realised safely and evenly across teams. +This strategy sets out how Engineering will use AI to improve delivery quality and productivity while maintaining security, IP and governance standards. Our pragmatic approach focuses on sanctioned engineering tooling, including GitHub Copilot, alongside training and measurement to ensure benefits are realised safely and evenly across teams. Key outcomes: @@ -20,11 +20,11 @@ Key outcomes: ## 2. Purpose & Scope -This document describes the purpose, scope and constraints for adopting developer-facing AI within Software Engineering. It sets out how AI assistants and related tooling will be used to improve software delivery efficiency and quality while meeting obligations for security, legal compliance, data stewardship and public service transparency. +This document describes the purpose, scope and constraints for adopting engineering-facing AI within Engineering. It sets out how AI assistants and related tooling will be used to improve engineering delivery efficiency and quality while meeting obligations for security, legal compliance, data stewardship and public service transparency. Scope -- Developer-facing AI assistants (primary focus: GitHub Copilot) used by engineers, testers and platform teams during development, test and documentation activities. +- Engineering-facing AI assistants, with GitHub Copilot as the primary approved assistant, used by software, data, test and platform teams during development, analysis, test and documentation activities. - Tooling that generates or suggests code, tests, infrastructure-as-code, configuration or documentation. - Integration patterns and platform controls that permit safe experimentation with AI tools. @@ -34,13 +34,13 @@ Out of scope Applicability and constraints -- Applies to all civil service staff, contractors and suppliers working in or for Software Engineering. +- Applies to all civil service staff, contractors and suppliers working in or for Engineering. - Use of AI tooling with classified (anything above Official), personal, or otherwise sensitive data is prohibited unless explicitly authorised by security policy and executed within approved sandboxes or vetted on-premises solutions. - All use must comply with MOD/UKHO policies, data protection law and procurement rules. Audience -This document is intended for software engineers, engineering managers, security and compliance teams, legal/IP advisers, procurement and vendor managers, platform and operations teams, and senior leadership. +This document is intended for engineers across software, data and test disciplines, engineering managers, security and compliance teams, legal/IP advisers, procurement and vendor managers, platform and operations teams, and senior leadership. Relationship to organisational strategy @@ -69,9 +69,9 @@ Refer to the [Code Generation Tools Policy](../../software-engineering-policies/ - Maintain clear policies and approval processes for developer-facing AI tooling and ensure guidance is readily available. - Monitor and mitigate risks (data leakage, licensing, model hallucination) and integrate AI-specific incidents into security playbooks. -## 5. Priority Use Cases for Software Engineering +## 5. Priority Use Cases for Engineering -- AI-assisted development (code generation, refactoring, documentation) +- AI-assisted development and analysis (code generation, refactoring, documentation and data or test artefact support) - Automated testing and test generation - CI/CD optimisation and release automation, with senior engineering oversight and stronger security review, especially for initial CD design and infrastructure or networking changes. - Static and dynamic analysis, security scanning @@ -87,7 +87,7 @@ Priority rationale: ## 6. Capability Development -To accelerate practical AI adoption within Software Engineering we will prioritise developer-facing tooling. GitHub Copilot has already been rolled out organisation-wide and licences issued to most engineers. The current phase focuses on consolidating that rollout by emphasising training, pilots, monitoring and targeted support to raise effective adoption across all teams. +To accelerate practical AI adoption within Engineering we will prioritise engineering-facing tooling. GitHub Copilot has already been rolled out organisation-wide and licences issued to most engineers. The current phase focuses on consolidating that rollout by emphasising training, pilots, monitoring and targeted support to raise effective adoption across all teams. - **GitHub Copilot adoption program:** - Licences have been provisioned for the majority of engineers; continue onboarding remaining staff as needed. @@ -118,9 +118,9 @@ Implementation notes: - **Partnerships:** - Work with GitHub and other vendors to stay aligned on security, licensing and feature roadmaps. -By focusing on Copilot as the primary developer-facing AI tool, we expect faster, measurable productivity gains while ensuring governance and security controls are in place. +By focusing on Copilot as the primary approved engineering AI tool, we expect faster, measurable productivity gains while ensuring governance and security controls are in place. -## 7. Governance & Ethics for Developer-Facing AI +## 7. Governance & Ethics for Engineering-Facing AI - **Tool approval and policy:** - GitHub Copilot is the recommended and organisationally approved coding assistant. Use of other external coding assistants must follow the tool approval process. @@ -228,6 +228,6 @@ Final review checklist: - Confirm proposed targets and timelines with engineering leadership. - Ensure licence registry and monitoring dashboards in place. -Approved by: [Head of Software Engineering] +Approved by: [Head of Engineering] Date: [TBD] diff --git a/software-engineering/strategy/software-engineering-strategy.md b/software-engineering/strategy/engineering-strategy.md similarity index 79% rename from software-engineering/strategy/software-engineering-strategy.md rename to software-engineering/strategy/engineering-strategy.md index 38c39310..1d66613d 100644 --- a/software-engineering/strategy/software-engineering-strategy.md +++ b/software-engineering/strategy/engineering-strategy.md @@ -6,15 +6,15 @@ ### Purpose -This strategy sets out how engineering (Software , Data and Test) at the UK Hydrographic Office (UKHO) enables the delivery of Defence, SOLAS and commercial obligations through sustainable, secure and resilient digital services, while supporting the development and retention of engineering talent. +This strategy sets out how engineering (software, data and test) at the UK Hydrographic Office (UKHO) enables the delivery of Defence, SOLAS and commercial obligations through sustainable, secure and resilient digital services, while supporting the development and retention of engineering talent. ### Context -UKHO delivers long‑lived, safety‑critical products in an environment of increasing digital demand. This strategy aligns with cross‑government Digital, Data and Technology (DDaT) expectations, while remaining tailored to UKHO’s specific mission. Software engineering is treated as a core organisational capability rather than a purely delivery-focused activity. +UKHO delivers long‑lived, safety‑critical products in an environment of increasing digital demand. This strategy aligns with cross‑government Digital, Data and Technology (DDaT) expectations, while remaining tailored to UKHO’s specific mission. Engineering is treated as a core organisational capability rather than a purely delivery-focused activity. ## 2. Strategic Outcomes -The UKHO Software Engineering Strategy optimises for the following outcomes: +The UKHO Engineering Strategy optimises for the following outcomes: - Reliable and resilient digital services that meet safety, availability and performance expectations - Sustainable systems that can be evolved rather than repeatedly replaced @@ -47,7 +47,7 @@ These principles guide engineering decisions across UKHO: **In practice:** Agile, iterative delivery supported by continuous integration, automated testing and continuous deployment. -We look to leverage AI where we can obtain the biggest ROI, but being aware of the ethical, technical, security and and other risks (A separate AI Engineering strategy has been created) +We look to leverage AI where we can obtain the biggest return on investment, while remaining aware of the ethical, technical, security and other risks. A separate AI engineering strategy has been created. ### 4.3 Sustainable Architecture and Technical Debt @@ -89,7 +89,7 @@ These measures are indicators of health, not performance targets. ## 7. Alignment with Wider UKHO Strategy -This Software Engineering Strategy supports the UKHO Technology Strategy and aligns with MOD, SOLAS and Cabinet Office expectations. It complements data, cloud and security strategies and draws on cross‑government DDaT standards while remaining tailored to UKHO’s needs. +This Engineering Strategy supports the UKHO Technology Strategy and aligns with MOD, SOLAS and Cabinet Office expectations. It complements data, cloud and security strategies and draws on cross‑government DDaT standards while remaining tailored to UKHO’s needs. ## 8. What This Strategy Is and Is Not From db35b286a0b0b51b1a08e3df9954a6f8c433b293 Mon Sep 17 00:00:00 2001 From: Martyn Fewtrell Date: Tue, 21 Jul 2026 14:26:41 +0100 Subject: [PATCH 3/4] Rewrite engineering-strategy.md for clarity MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Completely restructured engineering-strategy.md using an additive diff. Reformatted and restated the UKHO Engineering Strategy in a clear, sectioned Markdown format, organizing content into purpose, context, outcomes, principles, focus areas, governance, measures of success, alignment, and scope. Removed previous content and replaced with a detailed, structured version. No code changes—documentation update only. --- .../strategy/engineering-strategy.md | 0 .../strategy/engineering-ai-strategy.md | 233 ------------------ 2 files changed, 233 deletions(-) rename {software-engineering => engineering}/strategy/engineering-strategy.md (100%) delete mode 100644 software-engineering/strategy/engineering-ai-strategy.md diff --git a/software-engineering/strategy/engineering-strategy.md b/engineering/strategy/engineering-strategy.md similarity index 100% rename from software-engineering/strategy/engineering-strategy.md rename to engineering/strategy/engineering-strategy.md diff --git a/software-engineering/strategy/engineering-ai-strategy.md b/software-engineering/strategy/engineering-ai-strategy.md deleted file mode 100644 index 0f964f82..00000000 --- a/software-engineering/strategy/engineering-ai-strategy.md +++ /dev/null @@ -1,233 +0,0 @@ -# Engineering AI Strategy - -## Foreword - -Engineering plays a central role in delivering UKHO's digital products and services. AI-powered engineering tools are an opportunity to increase productivity, improve quality, and free engineers to focus on higher-value design, analysis and systems thinking. This document sets out our practical, security-conscious approach to adopting AI across engineering delivery, with GitHub Copilot established as the sanctioned coding assistant. - -The strategy balances pragmatic adoption with strong governance: engineers remain accountable for all code, security and IP considerations are enforced, and we prioritise training, monitoring and targeted support so benefits are realised evenly across teams. - -This is a living strategy and will be reviewed annually to reflect technology, policy and operational lessons learned. - -## 1. Executive Summary - -This strategy sets out how Engineering will use AI to improve delivery quality and productivity while maintaining security, IP and governance standards. Our pragmatic approach focuses on sanctioned engineering tooling, including GitHub Copilot, alongside training and measurement to ensure benefits are realised safely and evenly across teams. - -Key outcomes: - -- Broad, effective adoption of GitHub Copilot with measurable productivity improvements. -- Clear governance, audit and safe-usage standards for developer-facing AI tools. -- Reduced cycle times and improved code quality through AI-assisted testing and code review support. - -## 2. Purpose & Scope - -This document describes the purpose, scope and constraints for adopting engineering-facing AI within Engineering. It sets out how AI assistants and related tooling will be used to improve engineering delivery efficiency and quality while meeting obligations for security, legal compliance, data stewardship and public service transparency. - -Scope - -- Engineering-facing AI assistants, with GitHub Copilot as the primary approved assistant, used by software, data, test and platform teams during development, analysis, test and documentation activities. -- Tooling that generates or suggests code, tests, infrastructure-as-code, configuration or documentation. -- Integration patterns and platform controls that permit safe experimentation with AI tools. - -Out of scope - -- Automated decision systems in operational services that impact safety, navigation, or core public-facing outcomes unless they have completed full assurance and governance reviews. - -Applicability and constraints - -- Applies to all civil service staff, contractors and suppliers working in or for Engineering. -- Use of AI tooling with classified (anything above Official), personal, or otherwise sensitive data is prohibited unless explicitly authorised by security policy and executed within approved sandboxes or vetted on-premises solutions. -- All use must comply with MOD/UKHO policies, data protection law and procurement rules. - -Audience - -This document is intended for engineers across software, data and test disciplines, engineering managers, security and compliance teams, legal/IP advisers, procurement and vendor managers, platform and operations teams, and senior leadership. - -Relationship to organisational strategy - -This strategy aligns with the UKHO AI strategy and Data Strategy and supports cross-departmental interoperability, auditability and assurance. It complements existing security, accessibility and procurement policies and provides actionable controls for safe developer-facing AI adoption. - -Refer to the [Code Generation Tools Policy](../../software-engineering-policies/CodeGenerationTools/CodeGenerationToolsPolicy.md) for detailed organisational requirements on the use of code generation and AI-assisted development tools. - -## 3. Principles - -- Responsible and pragmatic AI use: adopt tools where they demonstrably add value and remain easy to govern. -- Safety and quality first: all AI-assisted outputs must meet existing quality gates and testing standards. -- Human-in-the-loop and accountability: engineers retain responsibility for correctness and security of code; AI is an assistant not an approver. -- Security and compliance: prevent leakage of sensitive data to external services and enforce licensing/IP checks. - -## 4. Strategic Objectives - -- Delivery Excellence - - Reduce routine engineering effort by automating repetitive tasks (tests, scaffolding, refactor suggestions) so engineers focus on architecture and domain complexity. - - Improve code quality and reduce defect injection by using AI-assisted testing and linting alongside existing quality gates. - -- Enabling Platform & Tooling - - Provide secure, supported Copilot integrations and platform controls so engineers can experiment safely without exposing sensitive data. - - Build observability and metric pipelines to measure Copilot usage and its impact on delivery and quality. - -- Governance, Ethics & Risk - - Maintain clear policies and approval processes for developer-facing AI tooling and ensure guidance is readily available. - - Monitor and mitigate risks (data leakage, licensing, model hallucination) and integrate AI-specific incidents into security playbooks. - -## 5. Priority Use Cases for Engineering - -- AI-assisted development and analysis (code generation, refactoring, documentation and data or test artefact support) -- Automated testing and test generation -- CI/CD optimisation and release automation, with senior engineering oversight and stronger security review, especially for initial CD design and infrastructure or networking changes. -- Static and dynamic analysis, security scanning -- Observability, anomaly detection and incident triage -- Developer productivity tooling (chatbots, knowledge search) -- Requirements and design synthesis - -Priority rationale: - -- Low friction: developer assistants yield quick productivity gains for routine code and documentation tasks. -- High value: automated testing and appropriately governed CI/CD optimisations can reduce downstream defects and rework, but higher-risk release automation work should be led or closely reviewed by experienced engineers. -- Safety alignment: security scanning and static analysis can be integrated with established security tooling to reduce risk. - -## 6. Capability Development - -To accelerate practical AI adoption within Engineering we will prioritise engineering-facing tooling. GitHub Copilot has already been rolled out organisation-wide and licences issued to most engineers. The current phase focuses on consolidating that rollout by emphasising training, pilots, monitoring and targeted support to raise effective adoption across all teams. - -- **GitHub Copilot adoption program:** - - Licences have been provisioned for the majority of engineers; continue onboarding remaining staff as needed. - - Establish a set of usage guidelines and best practices for Copilot. - - Maintain and grow a Copilot champions network to support peer-to-peer learning and share patterns. - -Implementation notes: - -- Licensing: maintain a licence registry and reconcile seat usage quarterly. -- Training approach: each team will schedule team-level sessions at a cadence appropriate to their members; cadence will vary according to need. Periodic deep-dive workshops will remain available for cross-team topics. New starters should complete basic Copilot training as part of onboarding. Suitable training can be found on PluralSight. -- Champions: identify champions to spread knowledge. - -- **Pilots and AI projects:** - - Continue focused pilots that demonstrate Copilot benefits on real engineering tasks (e.g., test generation, refactoring, documentation updates). - - Collect case studies and lessons learned to inform further improvements. - -- **Monitoring & adoption support:** - - Monitor usage metrics (adoption rate, active users, sessions) and correlate with productivity and quality metrics. - - Identify slower adopters and provide targeted coaching, workshops, and incentives. - -- **People & skills:** - - Upskill engineers in safe and effective use of AI assistants and review practices for generated code. - - Incorporate AI-assistant usage into onboarding and continuous professional development pathways. - -- **Platform & tooling:** - - Provide secure, approved integrations of Copilot with our development environments and repositories where permitted. - -- **Partnerships:** - - Work with GitHub and other vendors to stay aligned on security, licensing and feature roadmaps. - -By focusing on Copilot as the primary approved engineering AI tool, we expect faster, measurable productivity gains while ensuring governance and security controls are in place. - -## 7. Governance & Ethics for Engineering-Facing AI - -- **Tool approval and policy:** - - GitHub Copilot is the recommended and organisationally approved coding assistant. Use of other external coding assistants must follow the tool approval process. - - The current approval includes provisioning and management guidance for licences and access. - -- **Data handling & privacy:** - - Define acceptable data patterns to prevent exposure of sensitive or classified information to external services. - -- **Intellectual property & licensing:** - - Provide guidance to engineers on licensing considerations for code suggested by Copilot and how to validate and attribute where necessary. - -- **Explainability & accountability:** - - Engineers are responsible for code produced with Copilot. All generated code must be reviewed, tested and signed off according to existing code review processes. - -- **Monitoring & audit:** - - Track Copilot adoption and any incidents or misuse. Maintain an audit trail of tool approvals and major changes to usage policy. - -Operational governance responsibilities: - -- Engineering managers: ensure team members complete baseline training and that Copilot is used in line with guidance. -- Platform/security: maintain secure integrations and monitoring dashboards; run periodic compliance checks. -- Legal/IP: provide fast-turnaround guidance for licensing questions and keep an approved patterns list for reuse. - -## 8. Security & Resilience - -- **Secure supply chain:** Ensure Copilot integrations and any model artifacts are vetted and kept up to date. -- **Threat modelling:** Analyse threats introduced by AI-assisted development workflows and mitigate accordingly. -- **Fallbacks:** Maintain standard development workflows to operate without Copilot where necessary. -- **Incident response:** Extend incident response playbooks to include AI-related supply chain or data leakage events. - -Controls and safeguards: - -- Pre-approved data patterns: lists of safe code and data that can be used with Copilot in non-sandboxed environments. -- Sandboxing: ephemeral workspaces where engineers can run Copilot on sensitive code without sending secrets to external services. -- Access controls: RBAC for Copilot features where supported and integration with SSO for auditability. - -## 9. Implementation Roadmap - -### Phase 1: Consolidate Rollout (Year 1) - -- Rollout complete for most engineers; focus on onboarding remaining staff and closing any licence gaps. -- Complete training curriculum and ensure baseline training completion across teams. -- Capture early pilot results and case studies to support wider adoption. -- Finalise governance baseline and refresh policies based on pilot feedback. - -Success criteria for Phase 1: - -- 50%+ of engineers have completed basic Copilot training within 6 months. -- Two case studies demonstrating measurable productivity gains. - -### Phase 2: Integrate & Scale (Years 2-3) - -- Embed Copilot-enabled workflows into CI/CD, code review and documentation processes where safe. -- Launch monitoring dashboards and adoption incentives; provide targeted support for slower adopters. -- Expand sandbox and platform support for experimentation. - -### Phase 3: Optimise & Institutionalise (Year 4+) - -- Use metrics to continuously refine training and tooling. -- Institutionalise Copilot best practices and maintain a Copilot champions community. -- Explore advanced integrations (secure code generation, internal model tuning) where justified and governed. - -## 10. Metrics & Evaluation - -We will measure both adoption and impact: - -- **Adoption metrics:** percentage of engineers with Copilot licences; active Copilot users; session frequency; training completion rates. -- **Quality metrics:** number of defects introduced by generated code, security findings related to AI-assisted changes. -- **Governance metrics:** number of tool approvals, incidents, and compliance with review processes. - -Use these measures to target coaching for slower adopters and to verify that Copilot usage delivers expected benefits. - -Data sources and cadence: - -- Usage telemetry: weekly and monthly reports from Copilot management portal or platform integrations. -- Delivery metrics: pull request, CI and defect metrics from SCM and CI systems (weekly rollups). -- Quality/security: automated test and SAST/DAST results integrated into dashboards (per release). - -Reporting: - -- Monthly engineering leadership dashboard summarising adoption and key impact metrics. -- Quarterly review with security and legal for policy adjustments. - -## 11. Risks & Mitigations - -- Over-reliance on generated code and perfunctory review practices - enforce mandatory peer review and testing, with sufficiently detailed reviews of AI-assisted changes to keep engineers aligned with the codebase and to catch subtle security and quality issues. -- Erosion of core engineering skills where AI adoption is limited or inappropriate - reinforce code-writing and review capability through deep-dive reviews and periodic non-AI coding exercises or hackathons, particularly for teams operating in higher-security environments. -- Data leakage via external services - redact sensitive inputs. -- IP and licensing uncertainty - provide legal guidance and approval workflows. -- Uneven adoption - monitor usage and target support to teams lagging behind. - -## 12. What we will not do - -- Replace human judgement in safety-critical decisions. -- Expose sensitive operational data to unvetted services. -- Mandate Copilot in contexts where its use would breach security, privacy or licensing constraints; instead we will require approved alternatives or workflows. - -## 13. Draft Information - -- Draft created: [date] - -Final review checklist: - -- Confirm leadership foreword and sign-off. -- Confirm proposed targets and timelines with engineering leadership. -- Ensure licence registry and monitoring dashboards in place. - -Approved by: [Head of Engineering] -Date: [TBD] - From b13da0850294fdc54590cd602ff83518de4d5835 Mon Sep 17 00:00:00 2001 From: Martyn Fewtrell Date: Tue, 21 Jul 2026 14:33:54 +0100 Subject: [PATCH 4/4] Update subtitle formatting in engineering-strategy.md Removed italics from the subtitle for consistency, making "A pragmatic, government-aligned strategy for sustainable engineering" plain text. --- engineering/strategy/engineering-strategy.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/engineering/strategy/engineering-strategy.md b/engineering/strategy/engineering-strategy.md index 1d66613d..59c7d2ca 100644 --- a/engineering/strategy/engineering-strategy.md +++ b/engineering/strategy/engineering-strategy.md @@ -1,6 +1,6 @@ # UKHO Engineering Strategy -*A pragmatic, government-aligned strategy for sustainable engineering* +A pragmatic, government-aligned strategy for sustainable engineering ## 1. Purpose and Context