How are you reviewing AI-generated code on client projects without slowing delivery?
I'm a full-stack developer (MERN, Next.js, AWS) and most of my work is on client projects. Over the last year, AI coding tools have become part of how almost everyone on these teams works, and it has changed code review more than I expected.
The problem I keep running into: PRs are getting bigger and faster, but understanding hasn't kept up. A developer picks up a ticket, gets working code from an AI tool, and raises a PR. The feature works, but when someone asks why a particular file or function was changed, there often isn't a clear answer. Reviewers see a large diff that passes tests and approve it. Small unintended changes, like a modified API response or a refactored helper, slip through and show up later as bugs.
What I've been trying so far:
Writing a one-line "definition of done" from the ticket before using any AI tool, so I can check the output against it.
Asking the PR author to explain the change in two or three sentences in the description.
Treating any file that changed outside the ticket's scope as something to question first.
These help, but they add friction, and I'm not sure they scale across a team.
I'd like to hear from people handling this in practice:
Has your team changed its PR or review process because of AI-generated code? What actually stuck?
Do you limit the scope AI agents can touch (rules files, file-level restrictions, smaller tasks)?
For solo makers without a reviewer, how do you catch these unintended changes before users do?
Replies
The quiet diffs get me more than the big ones. A three line change inside error handling or a security check is a more likely bug than an obviously new two hundred line feature that gets read carefully because it looks unfamiliar.
I flag anything that touches auth, payments or input validation for a full line by line read regardless of size. Everything else gets the definition of done check you already described.