On 12 November, the code quality company Sonar published its yearly developer survey. The headline number is big: respondents say AI now generates or significantly assists an average of 65% of the code they commit. The more useful numbers for a team lead are a few lines further down, and they all point at the same place. Writing code is no longer the slow part. Checking it is.
What the survey found
Sonar asked 1,026 developers and engineering managers. According to the announcement and the report page:
- 76% say they generate AI code faster than they can verify it;
- 53% now spend more time reviewing code than writing it, compared with 18% before they adopted AI tools;
- only 39% completely agree that AI-generated code is always checked before it is committed, down from 48% last year;
- 94% don't fully trust AI-generated code;
- 42% are very or extremely concerned that well-written AI code makes bugs harder to spot;
- only 23% have well-defined, AI-specific guidelines or automated checks for AI-generated code;
- 76% say their teams use AI coding tools on business- or mission-critical services.
Read those together and the picture is clear. Most teams are shipping AI code into important systems, most developers don't fully trust it, and fewer than a quarter have agreed rules for checking it.
Two caveats. Sonar sells code verification tools, so it has a view on the answer. And the public pages don't describe the sampling or when the survey ran. Still, the findings line up with other surveys. In September, BairesDev's Dev Barometer of 705 developers found that 67% review more AI-generated code than a year ago and 52% spend more time debugging problems AI introduced.
Why this is a team problem, not a tooling one
When one developer writes code and another reviews it, the two speeds roughly match. Agents break that balance. A developer can now produce several pull requests in the time it takes a colleague to read one carefully. If review capacity stays the same, one of three things happens: a queue builds up, reviews get shallower, or code goes in without a real check. The drop in “always checked before commit” from 48% to 39% suggests many teams are already sliding toward the last two.
The point about well-written AI code is worth dwelling on. Human mistakes often look like mistakes: messy code, odd names, a half-finished thought. AI code tends to look clean even when it is wrong, and it can be wrong in ways your team would never be, such as ignoring a convention it never knew about or calling a function that was removed last quarter. A reviewer skimming for the usual warning signs will miss those.
Sonar's own data points the same way. It reports that 37% name unclear requirements among their top sources of toil, and 26% name correcting or rewriting AI-generated code. Teams with clear standards and controls for coding agents were more likely to report a return of 50% or more on their AI investment.
What to put in place
- Write down the rules once. Most teams in the survey have no AI-specific guidelines. Start with a short list: which checks must pass before a pull request is opened, which areas always need a human reviewer, and which conventions agents keep getting wrong. Put it where both people and agents read it.
- Make the agent check its own work first. Tests, type checks and linters should run before a pull request exists, not after a reviewer opens it. Every failure caught there is a review you don't have to do.
- Cap work in progress. If review is the bottleneck, more agents make it worse. A limit on open agent pull requests per person keeps the queue at a size people can actually read.
- Keep pull requests small. A small pull request gets read properly. A huge one rarely does, however good the reviewer. Ask agents for one change per pull request.
- Review for what AI gets wrong. Spend less time on formatting and naming, which tools can check, and more on intent: does this follow how we do things here, does it touch something it shouldn't, and would it pass a test that doesn't exist yet? We wrote a longer checklist in how to review AI-generated pull requests.
- Measure it. Only 36% of respondents measure AI's productivity impact and can see the results. Track review wait time, pull request size and how often merged AI changes are reverted or fixed. If those get worse while output goes up, you are not going faster.
The takeaway
AI has made writing code cheap. It hasn't made trusting code cheap. The teams that get real value from coding agents will be the ones that put as much thought into verification as they put into generation: clear rules, automatic checks, small changes and reviewers who know what to look for. As Sonar's CEO Tariq Shaukat put it in the announcement, “The goal is not simply to produce more code.”
Sources: Sonar announcement on PR Newswire (12 November 2026), Sonar State of Code developer survey report, Techzine on BairesDev's Dev Barometer (15 September 2026).