Sociotechnical systems in software and AI: Code review in the age of AI-generated code — harder or easier?

AI changes how code is produced, but it doesn't remove the social glue that makes teams resilient. Code review is now as much about knowledge transfer and process as it is about finding bugs.

Introduction

AI tools that generate code are reshaping daily engineering work. They can accelerate prototyping, surface quick fixes and even suggest security improvements. But in sociotechnical terms — where technology and team practices co-evolve — the arrival of AI-generated code changes the balance between speed, understanding and long-term maintainability.

Why code review matters more than ever

Code review has always been about more than catching syntax errors. It is a primary channel for knowledge transfer: reviewers absorb context, design rationales and trade-offs from authors. When a human writes code, that conversation helps teams share system understanding. Addy Osmani observes that if an AI writes code that the submitting developer can't explain, the review process — and therefore team resilience — breaks down. The practical cost here is on-call time: if no one knows why something behaves a certain way, debugging at 02:00 becomes expensive and stressful.

Where AI makes review harder

Several patterns have emerged in practice that make reviewing AI-assisted output more taxing.

Volume and review bottlenecks. AI can flood teams with code. Addy Osmani points out that while AI can produce large quantities of code, teams still need bandwidth to inspect changes; an example often cited is the OCaml maintainers rejecting a 13,000-line AI-generated PR because there wasn’t capacity to meaningfully review it.
Unfamiliar logic increases review time. Graphite reports that reviews take longer when reviewers are unfamiliar with the code or when the code was AI-generated. Understanding a patch you didn’t write — or one generated by a model that makes implicit assumptions — slows review and can introduce blind spots.
Hidden technical debt and maintenance risk. Practical experience and surveys noted by AgilePainRelief and Graphite highlight that AI-generated code can introduce maintainability problems: efficient at first, but potentially brittle, inefficient or inconsistent with project patterns over time.
Testing blind spots. If no one on the team drove the design, it’s harder to know the edge cases to test. Graphite and other practitioners note this gap in situational awareness: tests can miss scenarios the AI didn’t reason about.

Where AI can make review easier

AI isn’t only a complication. It can also be a force multiplier for reviewers.

Automated checks at scale. AI-based review tools and static analysers can flag style, security and obvious logic problems quickly. Tools described in the literature (for example, Sonar and Mend) can ensure AI-generated code passes basic quality and security gates before a human looks, reducing routine work.
Augmented reviewer productivity. Graphite notes that a significant share of actionable review comments in some organisations now come from AI tools — roughly 30–35% in their dataset — which suggests AI can surface low-level or repetitive issues so humans can focus on architecture and domain correctness.
Consistent detection of small but consequential problems. AI review tools are good at spotting duplicates, missing logic and code smells that humans sometimes miss. LegitSecurity and other sources highlight this as a win for long-term security posture and maintenance.

Practical guidance for sociotechnical teams

Balancing the technical and social aspects is the crux of modern code review. Below are pragmatic steps teams can take to keep reviews effective and humane when AI enters the pipeline.

Treat AI output as a draft, not a final commit. Mend recommends treating AI suggestions as starting points. Require the submitting developer to understand, test and document any AI-generated changes before a formal review. This preserves the knowledge transfer role of review.
Limit change size and scope. Large, AI-generated diffs are hard to review. Enforce smaller, focused pull requests so reviewers can reason about intent. Addy Osmani’s analysis of the OCaml PR highlights how volume alone can kill a review.
Use automated gates wisely. Add AI-powered static analysis, linters and SAST tools (Sonar and Mend are recommended approaches) to catch obvious issues early. Automate quality checks so humans can concentrate on design, security trade-offs and system behaviour.
Keep humans in the loop for context-heavy decisions. AI can suggest an implementation, but domain knowledge lives with people. Make it policy that reviewers probe rationale, ask for explanations and require that the author can explain why a change is correct for the system.
Document model provenance and prompts. Keep a short note in the PR describing what prompt or tool produced the code and what constraints were given. This is low-effort but helps reviewers understand the origin of assumptions embedded in the change.
Measure review health and investment. Track review latency, churn and the proportion of AI-suggested comments your tools contribute (Graphite’s finding that ~30–35% of actionable comments can be AI-sourced is a useful benchmark). If review time spikes, adjust team processes or reduce AI throughput.
Invest in ongoing developer skill development. Sonar suggests continuous learning so developers remain able to reason about edge cases, complexity and security. Relying solely on AI will erode institutional skills over time unless teams guard against it.
Align incentives and expectations. If individual velocity is rewarded without regard for review quality, teams will ship brittle code. Make review quality and explainability part of your engineering standards.

Organisational tweaks that reduce sociotechnical friction

Beyond process fixes, consider social interventions. Rotate reviewers so context is shared, run short “explain to me” sessions where authors walk a reviewer through AI-generated logic, and reserve time in sprint planning to address technical debt that accumulates from rapid AI-assisted delivery. These are small cultural investments that pay off in fewer midnight calls and more confident releases.

Conclusion

Is code review harder or easier in the age of AI-generated code? The honest answer is: both. AI makes routine detection faster and boosts reviewer throughput in measurable ways, but it also produces volume, unfamiliar logic and potential technical debt that makes deep review more demanding. The sociotechnical fix is to treat AI as an assistant — powerful, fallible and in need of supervision — and to reinforce the social practices (explanation, small PRs, education, tooling) that keep teams resilient.