AI can produce a lot of plausible code very quickly. That makes review less about admiring syntax and more about checking intent, boundaries, failure modes and whether the code belongs in the system at all.
AI can accelerate typing. It does not inherit accountability.
The review bottleneck moved
When code is expensive to produce, there is only so much of it to review. AI changes that. An engineer can generate a large diff — the set of changes in one pull request — in minutes. It arrives complete with tests, migrations and abstractions, polished enough to discourage questions.
The danger is not obviously broken code. It is plausible code that quietly makes the wrong architectural or product assumption.
Review the problem before the implementation
Before reading line 1 of a large AI-assisted diff, ask what problem it claims to solve. What behaviour should change? What should not change? Which constraints matter?
If the author cannot explain the intended behaviour without pointing at generated code, the review is starting too late.
Smaller diffs still win
AI makes it easy to bundle refactoring, feature work, tests and cleanup into one enormous pull request. Resist that temptation. Smaller diffs make it easier to see what caused what, and easier to undo.
A 3,000-line PR is not more reviewable because a model wrote it politely.
Check boundaries and data assumptions
Generated code usually looks strongest in the middle of a function and weakest at the edges, where it meets everything else: sign-in, permissions, missing data, external APIs, concurrency, retries, transactions and error handling.
Spend most of your review attention there. That is where production incidents start.
Tests need independent thinking
Generated tests can mirror the implementation so closely that both agree on the same wrong assumption. Ask whether the tests cover the rules that must always hold true, the failure states, and the edge cases the code itself never hinted at.
The goal is not to make the test suite agree with the code. It is to make the code survive disagreement with reality.
Security review becomes more important, not less
AI can add dependencies, shell commands, data handling and permission logic very quickly. Check secrets, input validation, access checks, how queries are built, where each new dependency came from and who is allowed to do what. Give all of it the same seriousness as handwritten code.
Speed makes guardrails more valuable, because mistakes spread faster too.
The author still owns the diff
We do not treat ‘the AI wrote it’ as an explanation. The person submitting code should understand it well enough to defend the design, change it under review and debug it later.
AI is a collaborator. The engineer is still the accountable author.