AI-generated code absolutely belongs in production, behind the same seatbelt human code always needed: review gates, tests and a named owner for every merged line, and the teams treating this as a ban-or-YOLO binary are both committing malpractice. Banning AI coding in 2026 is choosing to ship slower than every competitor for no safety gain, your engineers are using it anyway, just secretly and without standards. Merging unreviewed AI output is the same negligence with the opposite sign. Provenance was never the quality bar. Verification is.
Why both extremes fail
- The ban: forfeits a genuine 2-5x speedup on routine code, gets circumvented within weeks, and leaves you with unreviewed AI code plus a culture of hiding, the worst of every world.
- The YOLO merge: AI's failure mode is fluent wrongness, code that reads correct, compiles, and embeds a subtle logic or security flaw. Volume plus plausibility is precisely the combination that defeats tired reviewers.
- Both extremes share the same root error: treating the code's origin as the quality signal, instead of the verification it passed.
The seatbelt, specified
- 1Named ownership: the merging engineer owns the code exactly as if they'd typed it. This single rule changes review behavior more than any tool.
- 2Real review gates: AI-assisted PRs get the same scrutiny as human ones, with reviewers explicitly briefed on fluent-wrongness failure modes.
- 3Test floors: AI-generated code ships with tests, ideally written or at least verified by the human, covering the edge cases AI notoriously skips.
- 4Evals for AI features: where AI writes code that itself calls models, eval sets gate deployment, quality is a number, not a vibe.
- 5Provenance honesty: engineers mark heavily AI-generated changes so review attention goes where the risk is. No stigma, no hiding.
Making it stick
- Say the policy out loud: 'we expect you to use AI, and you own what you merge'. Ambiguity produces secrecy; clarity produces standards.
- Train reviewers on AI failure patterns: hallucinated APIs, plausible-but-wrong logic, silently skipped error handling, quietly weakened security.
- Watch the leading metrics: incident rates and review depth, not AI usage. Usage going up with incidents flat is the goal state.
- In incident reviews, 'the AI wrote it' is treated identically to 'I don't know', as a signal the ownership rule failed, not an excuse.