1. AI-generated code is a draft
Generated code may compile and still violate architecture boundaries, leak data, ignore edge cases or create maintenance debt. The reviewer must understand the business behavior and the surrounding system.
The question is not whether AI wrote the code. The question is whether the team can own it after deploy.
- Check whether the code follows existing project patterns.
- Review data access, validation and error behavior.
- Confirm that secrets or credentials were not introduced.
- Remove unused dependencies and generated noise.
- Make sure future maintainers can understand the change.
2. Tests and observability are non-negotiable
AI often produces happy-path code. Production incidents usually happen in edge cases: invalid input, unavailable integrations, permission differences, concurrency, timeouts and data migration.
Before deploy, generated code needs the same release evidence as human-written code.
- Add or update tests for critical behavior.
- Check validation, authorization and error handling.
- Verify logs and metrics for important failures.
- Run smoke checks after deployment.
- Document rollback or disablement options.
3. The review process should be explicit
A team that uses AI heavily needs a visible review routine. Otherwise generated code enters production with unclear ownership. A checklist reduces emotional debate and keeps review focused on risk.
The routine can be lightweight, but it should exist.
- Mark AI-assisted changes when they need extra review.
- Use checklists for security, dependencies and production behavior.
- Ask for human explanation of non-trivial generated code.
- Reject code nobody can explain or maintain.
- Record lessons from AI-related defects.
How to use this article
Treat this page as a decision aid. Use it with the related hub, checklist or service route when the topic affects production, customer experience, deployment, security or business continuity.