"Which of these tests did an AI write, and who reviewed them?" is now an audit question — and most QA organizations cannot answer it. This module equips leads to run the transition: a signable AI-testing policy, skeptical vendor scorecards, QA ownership of AI-generated dev code, prompt libraries, upskilling pathways, and evidence-backed go/no-go authority.
The leadership numbers frame the mandate. PractiTest 2026: 78.8% of testing professionals call AI the most impactful trend of the next five years, and 65.6% are very concerned about the future of the profession — meaning a QA lead's team is simultaneously adopting AI tools and afraid of them, usually without a single written rule about either. India-market data adds urgency: roughly 58% of enterprises are upskilling QA teams in AI while services companies convert pure-automation roles into AI-testing hybrids. Someone has to govern the adoption, judge the vendors, and design the transition. That someone is whoever finishes this module — because nobody else in the org is positioned to.
Marcus — QA manager, fourteen years, at an EU fintech — sits in a client-audit preparation call. The auditor's advance questionnaire contains a new section. Question 14: "Identify test artifacts generated wholly or partly by AI systems, the review controls applied, and the data shared with AI tools in the process."
Marcus surveys his three teams. One uses Copilot heavily, one has a Playwright agent pipeline someone set up in a hackathon, one swears it uses no AI — and its lead privately admits everyone pastes failures into ChatGPT. Nobody logs which tests were generated. One team has been pasting stack traces containing customer identifiers into a free-tier chatbot. There is no policy — there are three folk practices, one of them a data-protection incident in progress.
The vendor pitch scheduled that afternoon promises "autonomous testing — 3x faster, 40% fewer bugs." The deck contains no measurable claim about wrong-heal rates or maintenance cost. Marcus realizes he has no evaluation method beyond the demo's shine, and the CTO wants a recommendation by Friday.
Marcus writes the one-page AI-testing policy this module teaches — where AI-generated tests are allowed, which gates are mandatory, what data may enter which tool, how AI use is disclosed. Every team signs. The vendor gets a two-week POC with Marcus's scorecard instead of a contract. The audit answer becomes a query against PR labels and the policy document, not an archaeology project.
The same auditor's follow-up visit takes forty minutes. The vendor — whose POC showed a 22% wrong-heal rate on Marcus's own regression suite — was declined with evidence. Two manual-heavy testers are mid-pathway to AI-augmented test design roles, and the anxiety survey inside his org ticks visibly down.
Nothing Marcus built required new budget. It required the lead-level artifacts this module hands you: the policy, the scorecard, the pathway, and the habit of pinning every claim — vendor's or model's — to a measurement.
An AI-testing policy that nobody can remember is a policy that nobody follows. The format that works is a single page with four sections, each answering a question an auditor, a client, or a new joiner will actually ask:
The worst policy outcome is not tool misuse — it is the confident "we don't use AI" from a team lead whose engineers all use it covertly, because covert use has no gates, no data rules and no logs. A realistic permissive policy with hard gates beats a strict policy that drives usage underground.
AI-generated dev code is QA's new intake. Developers now ship AI-authored code at volume — and the survey signal is blunt: 59% of developers reject AI code review as unreliable, while validating that code lands, organizationally, on QA (UC-58). The leadership move is a risk-ranked response, not a blanket one:
Vendor claims get a scorecard, not a demo verdict. The AI-testing market's marketing— "autonomous testing," "3x faster, 40% fewer bugs" — is exactly the class of claim phase-1 research flagged for skepticism. The counter-instrument is a structured two-week POC against your own suite as the control, measuring what the deck omits:
| Scorecard dimension | What you measure | Why the demo hides it |
|---|---|---|
| Real coverage | Bugs your seeded-defect set catches via the tool vs your control suite | Demos run on the vendor's app, tuned for the demo |
| Wrong-heal / false-pass rate | Heals or auto-fixes that mask genuine failures (Module 3's audit method) | The silent failure mode never appears in a 30-minute pitch |
| Maintenance cost | Engineer-hours to keep the tool's suite green across two weeks of real churn | "Self-maintaining" is the claim; churn is the test |
| Data handling | Where your app data and artifacts actually go; DPDP/GDPR posture in writing | Legal exposure lives in the appendix nobody demos |
| Exit cost | What you keep if you leave — exportable tests, or a hostage suite? | Lock-in is the business model |
Marcus's 22% wrong-heal finding is the archetype: invisible in the demo, decisive in the decision, and discoverable only because the POC was designed by someone who knew where the bodies are buried. That knowledge is Modules 1–7; the scorecard is just its checklist form.
The anxiety statistic — 65.6% very concerned — is a leadership assignment, and the honest answer to it is a pathway, not a pep talk. Two artifacts carry the transition:
The prompt library (UC-61) turns individual discoveries into team capability: a versioned git repo of working prompts — test design, triage, defect drafting, review rubrics — each with example input, example output, and known failure modes. Review it like code; prune it quarterly; every "how did you get it to do that?" conversation ends with a commit. Teams with libraries compound; teams without repeat each other's first month forever.
The pathway (UC-62) sequences the transition for a mixed team, and the sequencing is the reassurance — each phase makes people visibly better at work they already recognize as theirs:
Manual-heavy testers adopt Module 1 (design with review gates) and Module 4/5's evidence workflows: defect drafting, triage briefs, data hygiene. The daily win is immediate and legible — better artifacts, faster — and the fear of "AI replaces execution" is answered by owning the judgment layer above execution.
SDETs take Modules 2–3: conventions-loaded generation, mutation gates, the agentic stack with heal audits. The role shift is from writing every test to owning suite quality at agent speed.
Selected engineers take Modules 6–7 toward the AI-evaluation lane: golden datasets, regression gates, judge calibration, agent benches. This is the new-title path — and the salary-premium evidence belongs in the appraisal conversation.
The competency rubric makes the pathway administrable: observable behaviors per level — "runs generation with a review gate and logs caught defects," "operates the heal audit," "owns a calibrated judge" — usable in appraisals and hiring. It answers the appraisal-season question ("what does AI-QA competence mean here?") with behaviors instead of tool name-dropping, and it is the document that converts 65.6% anxiety into a visible ladder.
Sequencing is strategy: starting the pathway at Phase 3 because it is exciting strands the majority of the team and confirms their fear. Phase 1 is where trust is built — the manual-heavy tester who catches the AI's hallucinated test case in week two has personally experienced being the indispensable layer, and that experience recruits harder than any slide.
Quality reporting is the leadership surface where AI both helps most and endangers most (UC-60). The rule from Module 4 becomes organizational law: prose generated, numbers pinned. Weekly reports draft themselves from CI, test-management and defect-tracker APIs; trend explanations and anomaly flags are model-drafted and lead-reviewed; and no number appears without a source system behind it — because one invented statistic, discovered by an executive, poisons every honest report that follows.
For AI features, the go/no-go brief inherits Module 7's criteria sheet: quality thresholds with eval evidence, refusal-matrix rates, cost/latency against budgets, judge calibration status, chaos-test results — assembled under the policy, signed by a named human. That signature is the whole point of the module: the AI drafts everything and decides nothing. Accountability is the one artifact that never delegates.
Leading quality in the AI era is governance plus evidence: a one-page signable policy that makes AI use auditable, a POC scorecard that makes vendor claims measurable, a pathway that makes the team's transition real, and reporting where prose is generated but every number is pinned. The AI drafts everything; a named human signs — and the lead who builds that system is the least replaceable person in the building.
Take this into Lab 15 (AI-feature release audit) — red-team run, refusal matrix, budget check, and a go/no-go brief signed under the policy you draft. Companion playbooks: pb-48 through pb-52.