AI code review: speed up without automatic merge

AI comments, humans approve

Code review remains a quality pillar, but it has costs: time, reviewer variance, queues that block delivery. AI review aims at a fast, more consistent first pass.

In practice the bot looks at the diff (nearby lines), style, suspicious patterns, sometimes global team rules. It posts comments on the MR/PR. It does not merge.

Observed upsides: time to first feedback, coverage when humans are saturated, consistent feedback on cross-cutting rules.

Limits: acceptance criteria of a user story, subtle business intent, rare races, product design. Without US context the bot stays on “global” rules.

Risk: inverted review fatigue

If everything is “AI-approved”, nobody reads. Same trap as poorly calibrated HITL.

Countermeasure: comments only; auth, payments, migrations and PII always senior-reviewed; short mandatory human checklist.

More commits does not mean more value. We look at post-merge incidents and time-to-understand a module.

What AI detects well (and poorly)

Often good: obvious style, missing null checks, deprecated APIs, missing happy-path tests, simple hardcoded secrets.

Often weak: business intent, rare edge cases, cross-cutting architectural debt, sarcasm in specs.

Judge signal/noise after calibration over 2 sprints, not one false positive. If more than 30% of comments are ignored, cut the rule.

Setup in 2 sprints

Sprint 1: bot on a non-critical repo, measure noise vs real catches, 5-item human checklist, 45-minute training.

Sprint 2: main repos; block merge only on deterministic rules (secrets, lint), never on a fuzzy LLM opinion alone.

Integrate with existing CI (GitHub/GitLab). Check code confidentiality (DPA, enterprise mode, self-host) if the diff leaves your perimeter.

If you want AI review plus conventions, we can scope in 20-40 minutes.