If AI writes the code and AI reviews the code, what exactly is the human verifying?
GitHub says Copilot code review now accounts for more than one in five code reviews on GitHub, and its review system can explore repository context, inspect large pull requests, review bot-authored PRs, and re-check its own findings after changes.
But only if we are clear about what the human reviewer is still responsible for.
AI reviewing AI-generated code is not the same thing as independent verification.
An AI reviewer can often detect: obvious bugs null handling unsafe patterns missing validation suspicious logic inconsistent naming duplicated code test gaps
GitHub has been expanding Copilot code review with deeper repository exploration, severity levels, and stronger agentic review capabilities.
It may live in: a conversation with a customer a product meeting a support ticket a legal requirement a business rule an undocumented edge case a decision made six months ago
Before reviewing the implementation, ask: What was the original requirement? What behavior should the user actually see? Which business rules matter? What should never happen? What assumptions did the AI make? Are those assumptions correct?
And it may become one of the most important developer skills in AI-assisted development.
Those tests are often based on the same mental model the AI used for the implementation.
An AI-generated feature may introduce: another service another queue another database table another cache another dependency another abstraction
That question is often more important than whether every line is technically correct.
The system creates the appearance of verification because multiple stages agree.
When AI writes the code and AI reviews the code, I think the developer should verify at least these 7 things. Verify the Requirement
Hidden assumptions cause a huge number of production bugs. Verify the Failure Modes
Ask: What happens if the network fails? What happens if the DB write partially succeeds? What if the request is repeated? What if the external API times out? What if two requests happen simultaneously? What if the input is technically valid but unexpected?
A change touching a critical path deserves more human attention than a small UI change. Verify the Architecture
Ask: Did the AI add a new abstraction? Did it introduce another dependency? Did it duplicate existing functionality? Did it bypass an existing architectural boundary? Did it make the system harder to reason about?