AI is writing more and more code – which is why SonarQube is becoming ever more important

2026.08.11

Artificial intelligence has quickly become one of the most important tools in software development. AI-based coding assistants no longer just complete a few lines of code: they can create complete functions, APIs, database queries, tests, configurations and even entire application components.

This can bring a significant increase in productivity. At the same time, it raises a fundamental question:

If more and more code is created with the help of AI, who checks the quality and security of that code, and how?

AI speeds up the creation of code, but on its own it does not solve the problem of code quality, security, maintainability and compliance with corporate development rules. Quite the opposite: with the mass adoption of AI coding, these become even more important.

This is where SonarQube can become one of the key control points of a modern, AI-assisted development process.

We develop faster with AI – but we can also produce faulty code faster

One of the greatest advantages of AI-based development is speed.

A developer might previously have spent hours building a more complex function, database operation or integration. With an AI assistant, a first version can be created in minutes.

This, however, has an interesting consequence. If a developer used to produce, say, 300 lines of new code a day without AI, and can produce 600–900 lines with AI, then it is not only development output that increases. So does the amount of code that needs to be checked.

If 1% of the code contains some kind of problem, then with two or three times as much generated code there are potentially two or three times as many problems to detect and handle.

AI can therefore significantly increase development capacity, but this must be matched by adequate quality assurance capacity. The solution is not necessarily to have more people checking code manually. Rather, it is to automate the checking as well.

AI-generated code is source code too

An important realisation is that, from SonarQube’s point of view, it essentially makes no difference how a given piece of code was created. It may have been written by:

a junior developer,
a senior developer,
an external supplier,
or it may have been created with the help of AI.

Source code entering the repository must meet the same quality and security requirements.

This is especially important in an enterprise environment. AI can generate. But the company must still control what goes into its applications.

Example 1 – AI generates working SQL code, but is it also secure?

Suppose a developer asks the AI assistant:

“Write a function that retrieves a customer’s data from the database based on the customer ID.”

The AI produces a working solution. For example, to build the query it directly appends the parameter coming from the user.

The program works. It gives the right result with the test data. So the developer can easily move on.

However, with certain implementations this can create an SQL injection risk. It is a perfect example of how working code ≠ secure code.

In this case, the AI’s job was to support the developer and create the code. The job of code analysis, on the other hand, is to check whether the resulting solution meets the expected requirements.

The two technologies are therefore not competitors. They complement each other.

Example 2 – AI solves the problem but creates technical debt

Suppose that in an enterprise system the same business logic has to be used in several modules. Developers quickly build the individual features with AI. Each time, the AI creates a similar solution. Each one works.

A few months later, however, it turns out that several different implementations of the same business logic have found their way into the system.

In the short term this does not necessarily cause errors. In the long term, however, it can increase:

code complexity,
maintenance costs,
the risk of changes,
technical debt.

AI often optimises for solving the task at hand. The company, however, has to think in terms of the entire software lifecycle.

In this environment, SonarQube can help with continuous and consistent examination of code quality.

Example 3 – AI-generated code that is “too complicated”

A developer asks an AI assistant to implement a complex business rule. The AI creates a 150-line function. The function:

works,
runs,
gives the right result.

At first glance, then, everything is fine. The solution, however, may be full of nested conditions, branches and hard-to-follow logic.

Six months later another developer has to modify it. That is when the real problem emerges: the code works, but it is hard to understand and hard to maintain.

The lifecycle of an enterprise application, however, can be 5–10–15 years. So during development it is not enough to ask: “Does it work?” We also need to ask: “Will it still be maintainable years from now?”

AI + SonarQube: two different tasks

The relationship between AI coding and SonarQube can therefore be put very simply:

AI → helps create the code.
SonarQube → helps check the quality and security of the code that has been created.

Together, the two can form the basis of a much more controlled development process.

The goal is not to restrict the use of AI. Quite the opposite. Proper control allows the company to take advantage of the productivity gains offered by AI with greater confidence.

Quality Gate: don’t just flag the problem

One of SonarQube’s key concepts is the Quality Gate. The company can define quality conditions that determine whether a code change meets the expected requirements.

This can become particularly valuable in AI-based development. Imagine the following process:

The developer builds a feature with the help of AI.
The code enters the development process.
SonarQube analyses it automatically.
The Quality Gate checks the predefined requirements.
If there is a problem, the developer receives feedback.
The problem is fixed – possibly again with the help of AI.
Another automatic check takes place.

This results in a very interesting development cycle:

AI generates → SonarQube checks → developer/AI fixes → SonarQube checks again.

In this way, automated quality assurance can accompany the speed of AI.

One of the biggest risks of AI: it is too easy to accept the answer

AI assistants can generate code extremely convincingly. The code:

looks professional,
is well formatted,
seems logical,
and often even works on the first attempt.

This also presents an interesting psychological problem. The better the AI, the more easily a feeling can develop: “If the AI made it and it works, it’s probably fine.”

Yet AI can also apply bad patterns, create unnecessary complexity or generate a solution that does not comply with a particular company’s development rules.

That is why a control layer is needed that does not “trust” the author of the code. It does not matter whether it was written by a human or by AI – the code must be examined according to the same rules.

Even more important at financial institutions

In banking, financial, telecommunications, government and other critical systems, AI-based development raises particularly interesting questions. In these environments it is not enough to say: “The developer checked the AI-generated code.”

Reproducible, consistent and, where possible, automated controls are also needed.

In a large organisation, hundreds of developers and numerous external suppliers may be working at the same time. Different people bring with them:

different AI tools,
different prompts,
different development methods,
different experience.

The common point must be the company’s quality requirements. SonarQube can help establish uniform control here.

AI does not make static code analysis redundant – quite the opposite

A few years ago, one might have thought that increasingly intelligent development tools would gradually reduce the importance of static code analysis. In practice, the opposite may well happen.

AI increases development speed, which increases the amount of code being produced, which increases the number of changes to be checked, which makes automated quality assurance even more important.

In other words, the more successful AI becomes in software development, the greater the need may be for systems that check the finished code automatically and consistently.

The development model of the future

The enterprise development environment of the coming years is unlikely to be about “human or AI”. It will be much more about a collaborative model:

Developer + AI + automated code quality checking + automated testing + CI/CD + security controls.

In this model, each participant has a different role.

🤖 AI – Helps create and modify code faster.
👨‍💻 Developer – Defines the goal, evaluates the solution and takes responsibility for the implementation.
🔍 SonarQube – Provides continuous and automated control for examining the quality and security of the source code.
🧪 Automated testing – Verifies how the system behaves.
⚙️ CI/CD – Automates the development and release process.

Together, these can form the modern software development infrastructure of the AI era.

The question is not whether to use AI

For companies, the interesting question will soon no longer be “Should we allow developers to use AI?”, but rather: “How do we build AI into our development processes in a controlled way?”

To do this, at least three questions need to be answered:

Who may use which AI tools?
What data and source code may be handed over to these tools?
How do we check code created with the help of AI?

One important technological answer to the third question is SonarQube.

AI speed + SonarQube control

Artificial intelligence represents a huge opportunity for software development. But speed alone cannot be the goal. The company still needs secure, reliable, maintainable and controlled source code.

That is why the relationship between AI and SonarQube can perhaps best be summed up in a single sentence:

Let AI help you code faster. Let SonarQube help you keep code quality under control.

Together, the two are not simply a technological improvement. They are one possible foundational model for enterprise-level quality assurance in AI-based software development.

Szitár-Net Kft. – SonarSource Silver SVAR Partner

As a Silver-certified SonarSource SVAR partner, Szitár-Net Kft. helps Hungarian companies and institutions select, license, implement and integrate SonarQube solutions into their development processes.

Our SonarQube references include leading Hungarian organisations such as:

Magyar Nemzeti Bank | OTP Bank | K&H Bank | IdomSoft | One Magyarország

With the rapid spread of AI-based development, one of the defining questions of the coming years will not simply be how much faster we can produce code, but also how we can check the quality and security of ever more rapidly created code just as quickly.

This is where SonarQube is playing an increasingly important role.