AI writes the code. But who is going to check it?

2026.09.10

AI-based development tools became part of everyday software development in a very short time. Today it is nothing special for a developer to have artificial intelligence generate code snippets, tests or even complete features.

The advantage is fairly clear: you can move faster.

The problems usually start when we confuse speed with quality.

AI-generated code can be fully functional while at the same time being hard to maintain, containing a security issue, or simply not fitting properly into the existing system.

And this will probably be one of the most important questions in AI-assisted development in the period ahead.

Not whether AI can write code.

It can.

But how we check the volume of code we are producing ever faster.

Working code is not necessarily good code

This is, of course, not a new problem.

Software development has always had code that worked but was not a particularly good solution technically.

What AI changes is mainly the scale of the problem.

A developer might, for example, ask the AI to build a database query or write an API endpoint. A few seconds later, a working solution is there.

But just because the code runs and produces the desired result does not mean it is free of, say, improper input handling, a security vulnerability or an unnecessarily complicated solution.

Nor is it certain that it follows the same development rules that the company or development team has previously defined.

This is a particular problem in larger systems.

When we are talking about a few hundred lines of code, human review is still relatively easy to manage. But when a development team uses thousands of lines of AI-generated or AI-modified code every day, the situation is quite different.

In such cases it can easily happen that the bottleneck is no longer development itself, but its verification.

AI can also produce technical debt faster

For a long time, technical debt built up in a system gradually.

A quick fix here, a temporary patch there, a few duplicated code fragments, and over months or years you ended up with a codebase that is hard to maintain.

With AI, this process can speed up significantly.

Generated code may contain unnecessary repetition, overly complex functions, or solutions that are technically correct but not a good idea in the longer term.

Individually, these usually do not cause any visible problems.

In a large system, however, they add up.

And a few years down the line, the question will no longer be how much faster a given feature was delivered, but how much it costs to keep maintaining the system.

Security is a particularly sensitive area

With AI-generated code, security is perhaps the area where unconditional trust can least be afforded.

A piece of code can look entirely correct at first glance while containing a flaw that only shows up under specific conditions.

There may be, for example, faulty input validation, inadequate access control, or a data handling approach that could later lead to a vulnerability.

On top of this comes a human factor.

If an AI gives a good solution nine times out of ten, a kind of trust in it develops very easily.

But the tenth case still has to be found.

Whether a human or an AI wrote it is probably not the right question

After a while, this may not even matter much.

From the point of view of the development process, it is far more practical to treat the question this way: all code has to pass the same quality and security checks.

Whether it was written by a senior developer.

A junior developer.

Or an AI assistant.

This is the approach in which automated code analysis really comes into its own.

What does SonarQube bring to this?

The essence of SonarQube is that source code analysis should not be an occasional task, but part of the development process.

The system can continuously examine issues relating to code quality, maintainability and security, among other things.

In my view, this is particularly important in AI-assisted development.

If the volume of code being produced grows, it is simply not realistic to check every single change through manual code review alone.

Automated checks can then act as a first filter.

They do not replace the developer or professional review, but they can flag a great many problems earlier that would otherwise only surface later.

The Quality Gate may become even more important than before

One of SonarQube’s useful features is the Quality Gate.

It lets you define which quality conditions new code must meet.

If these are not met, this becomes immediately visible in the development process.

In a CI/CD environment, the check can also be built directly into the build and deployment process.

This is a particularly good approach for AI code.

There is no need to create a separate set of rules for what AI has generated. The same requirements can be applied to every change.

In my view, this is far more sustainable in the long run than trying to separate code written by humans from code produced by artificial intelligence.

AI does not make the developer redundant

On the contrary, in a certain sense it actually increases the value of good developers’ knowledge.

If less and less time has to be spent actually typing code, more emphasis falls on someone defining the task well, understanding the architecture, recognising the risks and being able to decide whether a solution proposed by AI is genuinely good.

As a result, the developer’s role will probably change gradually.

Less “code production”, more design, verification and technical decision-making.

Faster development needs faster control too

It is probably no longer worth trying to stop or ignore the spread of AI coding.

Developers will use it, because it genuinely speeds up a great many tasks.

For companies, the question will rather be what kind of controls they build around it.

If AI multiplies development speed, verification processes have to be adapted to match.

Human code review will remain important, but on its own it will probably be less and less sufficient.

Automated code quality and security checking is therefore not an alternative to AI, but much more its natural counterpart.

AI writes code faster. And SonarQube can help ensure that quality and security do not fall behind the pace of development.

Szitár-Net Kft. – SonarSource Silver SVAR Partner

As a SonarSource Silver-certified SVAR partner, Szitár-Net Kft. provides support with SonarQube licences, implementation and professional services.