When AI writes a growing share of code, the question shifts from "should humans review AI code?" to "which changes need how much human review?" Reviewing everything deeply doesn't scale; reviewing nothing is reckless.
Signals that quality is slipping
- Duplication rising, refactoring falling. GitClear's analysis of 211 million changed lines found copy-pasted lines rising from 8.3% to 12.3% between 2020 and 2024 and refactoring falling from 25% of changed lines in 2021 to under 10% in 2024.
- Bigger PRs. DX reported median PR size nearly doubling from 44 to 72 lines in the year to June 2026.
- Rising change-failure rate or rework as the AI-authored share grows.
A risk-tiered review model
| Tier | Examples | Review |
|---|---|---|
| Low | Tests, docs, internal tooling, mechanical migrations with strong test coverage | Automated checks + light human review |
| Medium | Feature code in well-tested services | Standard peer review; AI first-pass review allowed |
| High | Auth, payments, crypto, data migrations, infrastructure-as-code, public APIs, safety-critical paths | Qualified human reviewer, security review, no auto-merge |
Tiers are decided by what the code touches, not by who or what wrote it — but AI-authored changes in high tiers deserve explicit attention because reviewers may assume they are routine.
Keeping reviewers effective
- Cap PR size; ask agents to split work.
- Require the author (human or agent) to explain why the change is correct, with test evidence.
- Rotate reviewers and protect review time in planning.
- Track review time and defects found in review per period.
Code health practices
Schedule refactoring, enforce duplication and complexity checks in CI, and keep architecture decision records so agents and humans follow the same patterns.