How much AI-written code needs human review? — CTO AI Forge

When it comes up

When AI-authored share rises, when review becomes a bottleneck, when agents start opening many PRs, or after an incident involving AI-written code.

Your options

Deep human review of every change

Fits when: Early adoption, weak tests, regulated or safety-critical systems.

Watch out: Review becomes the bottleneck; reviewers fatigue and start skimming anyway.

Risk-tiered review

Fits when: You can classify code paths by impact and have good automated checks.

Watch out: Tiers must be maintained; misclassified paths slip through with light review.

Automated gates plus AI first-pass review, human approver for all merges

Fits when: Strong tests, scanning and small PRs are in place; you want to scale agent output.

Watch out: Rubber-stamping risk; automation can miss design and business-logic flaws.

How to decide

Classify code by risk (what it touches): low (tests, docs, mechanical changes), medium (feature code), high (auth, payments, crypto, data migrations, infrastructure, public APIs).
Make automated gates non-negotiable for all code: tests, SAST, dependency and secret scanning, size limits.
Set review depth per tier, and require a named human approver for every merge.
Watch the signals each period: review time, change-failure rate, vulnerabilities per 1,000 lines, duplication.
Tighten or relax tiers based on the evidence.

Trade-offs

Deeper review lowers risk but caps throughput and burns out seniors; lighter, tiered review scales with AI output but depends on strong automation and correct risk classification.

Real examples

Veracode's 2025 GenAI Code Security Report found that across 80 coding tasks and more than 100 LLMs, models chose the insecure option 45% of the time, and larger models did not perform significantly better. Source: Veracode — AI-generated code poses major security risks in nearly half of all development tasks (Jul 30, 2025) ↗
On Alphabet's Q3 2024 earnings call, Sundar Pichai said more than a quarter of all new code at Google is generated by AI, "then reviewed and accepted by engineers". Source: Alphabet — Q3 2024 earnings call: CEO Sundar Pichai's remarks (Oct 29, 2024) ↗
Google Research reported in May 2023 that ML-suggested edits addressed 52% of reviewer comments at a target precision of 50%, an example of AI supporting — not replacing — human review. Source: Google Research — Resolving code review comments with ML (May 23, 2023) ↗

What to check first

Are tests, SAST, dependency and secret scanning required checks on every PR?
Have you classified code paths by risk?
Is every merge approved by a named human?
Is review time or change-failure rate rising as AI share rises?

Learn and use

Sources

Last reviewed 2026-10-01.