Topic starter
14/09/2026 10:09 am
TL;DR: Developer teams are being asked how they are handling the shift from AI-assisted writing to AI-heavy review workflows, after last year’s survey found 42% of committed code was AI-generated and only 48% of developers always verified AI output before commit, according to Sonar. The governance question is no longer whether AI writes code, but whether verification, accountability, and change control still work when agents accelerate production.
Editorial analysis by NHI Mgmt Group, based on content published by Sonar: “How has AI changed code review? The next State of Code developer survey is open”.
By the numbers:
- 42% of committed code was AI-generated, according to Sonar's State of Code survey.
- Only 48% of software developers always verified AI output before committing, according to Sonar's State of Code survey.
Key questions
Q: What breaks when AI-assisted code is merged without provenance controls?
A: When AI-assisted code is merged without provenance controls, teams lose attribution, review evidence, and incident reconstruction capability.
Q: Why does AI-assisted development create a governance problem beyond code quality?
A: AI-assisted development changes who creates code, how fast it moves, and how difficult it is to trace.
Q: How can security teams tell whether code verification is keeping pace with AI output?
A: Look for smaller pull requests, stable review times, lower duplication rates, and declining defect escape rates.
Practitioner guidance
- Separate generation from approval Require an independent reviewer or policy check for AI-generated changes before merge, especially for code touching secrets, authentication, privilege, or data handling logic.
- Risk-rank review depth Apply stricter review and testing gates to changes that modify access control, deployment paths, or production-facing automation, because those changes can amplify AI coding mistakes.
- Track verification coverage Measure how often AI-authored changes receive full human review, and compare that rate with the proportion of AI-generated commits moving through the pipeline.
Bottom line: AI-generated code changes the security meaning of code review, because the control now has to validate trust, provenance, and risk rather than just style or correctness.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
14/09/2026 10:10 am
AI-generated code creates verification debt: once agents increase the volume and speed of changes, the organisation accrues a control burden that conventional review processes were never sized for. The issue is not just output quality, but the widening gap between what is produced and what can be meaningfully checked. Practitioners should treat this as a governance debt problem, not a tooling problem.
A few things that frame the scale:
- Only 44% of developers are reported to follow security best practices for secrets management, exposing a significant developer behaviour gap, according to the State of Secrets in AppSec.
A question worth separating out:
Q: What should organisations do first to avoid bottlenecks from AI-generated code?
A: The first move is to upgrade pipeline capacity around the places where volume accumulates, especially testing, integration, and release coordination. If those controls stay unchanged, code production outpaces validation and deployment discipline. Organisations should introduce automation, smarter resource allocation, and streamlined release management before AI output becomes the new normal.
👉 Read our full editorial: AI code verification is lagging behind agent-generated output