Clients sometimes ask, reasonably, whether code written with AI can be trusted. Our answer is that no code should be trusted because of who or what wrote it. It should be trusted because it has passed a review process designed to catch problems. AI changes what that process needs to look for, so we built ours with AI-drafted code in mind.
Here is how it works, layer by layer. For the full checklist, see our guide on how we review AI-generated code.
Layer 1: Small changes with clear intent
Review starts before any code is written. Each task is small and has written acceptance criteria. A reviewer can then ask a simple question: does this change do what the task says, and nothing else? Large, vague changes are hard to review, whether a person or an AI wrote them. Keeping changes small is the single most effective quality practice we have.
Layer 2: Automated checks on every change
Before a person looks, automated checks run:
- All existing tests must pass.
- New code must come with tests.
- Code style and formatting checks.
- Type checks where the language supports them.
- Security scans for known vulnerable patterns and dependencies.
These catch a large share of mechanical problems cheaply, so human review can focus on what machines miss.
Layer 3: A person reads every line
An engineer reads the whole change. With AI-drafted code, we pay particular attention to a few things:
- Things that do not exist: functions, options or library features that sound right but are invented. Tests usually catch these, but not always. See hallucination.
- Plausible logic that is subtly wrong: an off-by-one date, a missed edge case, a condition that is almost right.
- Doing more than asked: AI sometimes changes code beyond the task. Every extra change needs a reason.
- Inconsistency: a new pattern where the codebase already has one. Consistency keeps software maintainable.
- Unnecessary complexity: AI can over-engineer simple things. Simpler code is easier to trust.
Layer 4: Security review
Any change touching sign-in, permissions, personal data, payments, file uploads or external input gets a specific security review. We check that permissions are enforced on the server, inputs are validated, secrets are not exposed, queries are safe and errors do not leak information. AI can produce code that works and is still unsafe, so this layer is never skipped. See our AI development security checklist.
Layer 5: Business rules tested with real examples
The most damaging bugs are often not technical. They are business rules implemented slightly wrong: a discount applied in the wrong order, a deadline calculated in the wrong time zone. We write tests from the client's real examples, so the code is checked against how the business actually works, not only against what the code author assumed.
Layer 6: Design and product review
Someone checks the change as a user would: does the screen match the approved design, is the wording clear, does it work on a phone, is it accessible? AI-drafted interfaces can drift from the design system in small ways that add up.
Layer 7: Staged release and client sign-off
Changes go to a test site first. The client sees them in the weekly demo and approves what is ready. Releases to production are planned, with monitoring in place and a way to roll back. See human oversight and quality.
Keeping quality high over time
Review is not only about individual changes. Over months, small shortcuts can add up to technical debt. We keep an eye on it: refactoring when patterns repeat, updating dependencies regularly and cleaning up tests that have become slow or fragile. AI makes this upkeep cheaper, which means it actually gets done.
Who is accountable
For every change, a named engineer is accountable for it being correct and safe, regardless of how it was drafted. "The AI wrote it" is never an explanation. That accountability is what gives the process meaning.
What clients can check
If you work with us, you can see the evidence of this process: the tests, the review history and the release notes. If you are evaluating another team, ask how they review AI-drafted code. A good team will describe specific checks. A vague answer is a warning sign. See questions to ask before hiring a software agency.
Read more
For the wider picture, read why we build with AI, and what we still do by hand and what a week of AI-accelerated development looks like. To discuss a project, get in touch.
