Version: 2026-06-05
Summary
- AI code is own code: understand, check, test, and own it.
- Unreviewed AI code is taboo.
- The developer is responsible for code, tests, commit message, and pull request content.
- AI involvement should be visible in the pull request when relevant.
- Sensitive areas need a second review or lead/maintainer review.
- AI-generated tests are allowed, but they are not independent control.
- AI may support review, but people approve.
Topic
Code, tests, refactorings, commit messages, and reviews that are created with AI support or strongly influenced by AI.
Starting Point
AI can generate code quickly. It can also explain diffs, propose tests, write commit messages, and comment on pull requests. This is useful, but it does not transfer responsibility away from the developer.
AI-generated output may look plausible while misunderstanding architecture, edge cases, migration behavior, permissions, or domain rules.
Risk
The main risk is not that AI wrote code. The main risk is code that nobody really understands but everyone assumes is probably correct because it compiles or tests pass.
Recommendation
The developer owns the result. Before a change is submitted, the developer must understand the diff, check the impact, run appropriate tests, and write or verify the pull request description.
For security-sensitive, deployment-sensitive, data-sensitive, payment, authentication, authorization, or migration code, AI assistance should increase review attention rather than reduce it.
AI-generated tests should be useful, but not treated as independent evidence. If the same AI created code and tests from the same wrong assumption, both can be wrong together.
Review Checklist
- Can the developer explain the diff?
- Are edge cases and failure modes covered?
- Are tests meaningful and not only generated from the happy path?
- Does the change touch sensitive areas?
- Is AI involvement visible where it matters?
- Did a human approve the final review?
Wall rules
AI code is own code: understand, check, test, own.
Unreviewed code is taboo.
Green AI tests are not a free pass.
AI review supports, people approve.
If AI cannot explain the diff correctly, check it twice.
Open questions for a project
- When should AI involvement be mentioned in pull requests?
- Which areas require a second review?
- Which test types are mandatory for AI-assisted changes?
- Who approves generated migrations or security-relevant changes?