Goldman Sachs
AI Coding Assistant: 10,000 Developers Gain a Productivity Multiplier
Business Context & Strategic Drivers
Goldman Sachs's technology organization operates as a hybrid bank-technology company, with engineers building and maintaining mission-critical trading systems, risk models, and client platforms. Developer compensation inflation (30%+ over 2021-2023) and the success of GitHub Copilot at competitors motivated Goldman to build a customized internal solution that incorporated proprietary Goldman codebases and compliance guardrails.
Strategic Drivers
- Developer compensation inflation of 30%+ requiring productivity improvement to control costs
- Competitors including JPMorgan and Morgan Stanley deploying similar tools creating competitive pressure
- Regulatory compliance requirements meaning external tools (Copilot, ChatGPT) couldn't be used with proprietary code
- Goldman's Engineering Excellence initiative targeting 20% development velocity improvement
- Legacy system modernization backlog requiring accelerated code refactoring capability
The Problem
Goldman Sachs employs 10,000+ software engineers who spend significant time writing boilerplate code, documenting systems, and debugging legacy systems. The bank needed to accelerate software delivery without proportionally growing headcount in an environment of rising compensation costs.
The Solution
Deployed an internal AI coding assistant built on frontier models (including AWS Bedrock and proprietary fine-tuning) across the engineering organization. The system is customized with Goldman's internal code libraries, compliance requirements, and proprietary API references via a RAG system.
Technical Architecture
Tech Stack
Architecture Overview
Goldman's AI coding assistant integrates as an IDE extension with direct access to the engineer's current codebase and Goldman's internal API documentation via RAG. Code suggestions are generated by a fine-tuned LLM (Claude via AWS Bedrock) with Goldman-specific instruction tuning covering coding standards, security requirements, and proprietary API usage patterns. All code generation happens within Goldman's private AWS environment - no code is sent to public APIs. Generated code passes through automated security scanning before being presented as a suggestion.
Data Requirements
Goldman's entire internal codebase (100M+ lines across trading systems, risk models, client platforms) used for RAG context retrieval. Internal API documentation and coding standards. Security vulnerability patterns for the scanning pipeline. All data retained within Goldman's private infrastructure under strict access controls.
ROI & Financial Analysis
Investment
$30–50M over 3 years (AWS Bedrock licensing, internal engineering, security review infrastructure, change management)
Annual Return
$150M+
Payback
12 months
ROI Multiple
6x over 5 years
ROI Breakdown
Developer productivity gain
20% productivity uplift on 10,000 engineers at average $500k total compensation = $1B in developer cost; 10% efficiency gain on that
$100M/year
Reduced documentation debt
AI auto-documentation reduces the accumulated cost of undocumented legacy code
$30M/year
Faster regulatory technology delivery
Faster compliance system updates reduces regulatory risk and fine exposure
$20M/year
Implementation Journey
Total timeline: 24 months from vendor selection to full organization deployment
Security Review & Vendor Selection
6 monthsComprehensive security review of AI coding tools. Selected AWS Bedrock + Claude for data residency and compliance reasons. Designed private deployment architecture.
RAG System & Custom Fine-tuning
8 monthsBuilt RAG system over Goldman's internal codebase. Fine-tuned the LLM on Goldman coding standards. Built security scanning pipeline.
Pilot with 500 Engineers
4 monthsDeployed to 500 volunteer engineers across 5 teams. Measured productivity impact. Collected feedback. Refined the system.
Full Deployment
6 monthsRolled out to all 10,000+ engineers. Built internal community of practice for AI-assisted development. Launched continuous improvement program.
Challenges Overcome
- 1Data security: Goldman's proprietary trading code cannot be sent to external APIs - required building a fully private deployment
- 2Code quality verification: AI-generated financial code must meet higher accuracy standards than typical software
- 3Regulatory review: Any code touching trading systems requires compliance review - AI-generated code needed to fit into existing review workflows
- 4Legacy language coverage: Goldman uses significant amounts of Slang (an internal language) that external AI models weren't trained on
- 5Adoption across experience levels: Junior engineers adopted quickly; senior engineers resisted replacing their mental models
Governance & Oversight
Governance Controls
- AI-generated code for trading and risk systems requires mandatory peer review and sign-off
- Automated security scanning of all AI-suggested code before it enters version control
- Model audit log: all AI code generation events logged with engineer ID for regulatory review
- Quarterly review of AI code generation patterns by technology risk team
- AI-generated code identified as such in commit messages for traceability
Data Privacy Measures
- All code generation occurs within Goldman's private AWS environment
- No proprietary Goldman code transmitted to external AI providers
- Engineer activity data subject to Goldman's standard IT monitoring policies
- Code access controls enforce least-privilege even for AI RAG system
Human-in-the-Loop
All AI-generated code in production systems requires human code review before merge, per Goldman's standard development practices. The AI assistant generates and suggests; engineers review, modify, and approve. Trading system code changes additionally require sign-off from a senior engineer and compliance review.
Regulatory Considerations
- SEC and FINRA requirements for audit trails on trading system code changes
- GDPR for any code handling EU client data
- OCC guidance on model risk management for AI in banking systems
- Goldman's internal Model Validation Group review of AI systems affecting financial calculations
Lessons Learned
Key Lessons
- Building a private deployment is more complex but non-negotiable for a bank - the security review should be the first step, not the last
- RAG over the proprietary codebase dramatically outperforms generic Copilot for Goldman-specific APIs - the investment in indexing your own code is essential
- Junior developer productivity gains are larger and faster than senior developer gains - the business case is strongest in high-volume junior development
- AI-generated code review should be explicitly included in engineering standards - without guidance, engineers have inconsistent review practices for AI code
What Worked Well
- AWS Bedrock's data residency guarantees made it possible to get security approval that GitHub Copilot could not obtain
- FINOS Legend for data model generation aligned with Goldman's existing open-source community engagement
- Volunteer pilot approach: letting engineers opt in to the pilot created internal champions who trained their colleagues organically
The Outcome
Developer productivity increased significantly, with AI generating 20-40% of new code in early adopter teams. Reduced time to ship new features. Engineers reported higher satisfaction by spending more time on architecture and less on boilerplate.
Key Metrics
- 20-40% of new code AI-generated in pilot teams
- Deployed to 10,000+ engineers
- Reduced feature delivery time
- Significant reduction in documentation debt
Open Source & Code Resources
References & Further Reading
Quick Stats
Company
Goldman Sachs
Industry
Team Size
40 engineers, 10 ML engineers, 15 security specialists, 5 compliance officers, 10 change management staff
Timeline
24 months from vendor selection to full organization deployment
Investment
$30–50M over 3 years (AWS Bedrock licensing, internal engineering, security review infrastructure, change management)
Annual Return
$150M+
Payback Period
12 months
Key Metrics
- 20-40% of new code AI-generated in pilot teams
- Deployed to 10,000+ engineers
- Reduced feature delivery time
- Significant reduction in documentation debt
Tech Stack
Code Resources
ROI figures and metrics are based on publicly available data, company disclosures, and reasonable estimates. Always conduct your own due diligence for strategic decisions.