More than one in five code reviews on GitHub is now performed by an AI reviewer: Copilot code review passed 60 million reviews by March 2026, less than a year after general availability (GitHub Blog, 2026). The volume being reviewed is also climbing: GitHub users merged 43.2 million pull requests per month on average in 2025, up 23% year over year (GitHub Octoverse 2025). Trust has not kept pace, since 96% of developers do not fully trust AI-generated code (Sonar State of Code Developer Survey 2026), and 85% of surveyed developers and technology buyers agree AI has shifted the bottleneck from writing code to reviewing it (GitLab AI Accountability Report 2026). We aggregated data from the Stack Overflow Developer Survey, GitHub Octoverse, GitLab’s DevSecOps research, Google’s DORA report, Sonar, Qodo, Veracode, CodeRabbit, Faros AI, METR, JetBrains, Atlassian, and Gartner. For the code-writing side of the story, see our companion roundup of AI code generation statistics.
TL;DR
- Copilot code review accounts for more than 1 in 5 code reviews on GitHub, with 60 million reviews completed (GitHub Blog, 2026)
- 85% agree AI has moved the bottleneck from writing code to reviewing and validating it (GitLab AI Accountability Report 2026)
- 96% of developers do not fully trust AI-generated code, but only 48% always verify it before committing (Sonar State of Code 2026)
- 10.2% of developers mostly use AI for committing and reviewing code; 58.7% have no plans to (Stack Overflow Developer Survey 2025)
- Teams with high AI adoption merge 98% more PRs, while PR review time rises 91% (Faros AI Productivity Paradox Report 2025)
- 81% of developers using AI review saw quality gains vs 55% of similarly fast teams without it (Qodo State of AI Code Quality 2025)
- 45% of AI-generated code samples failed security tests across 100+ LLMs (Veracode GenAI Code Security Report 2025)
- AI co-authored PRs carry 10.83 issues per PR vs 6.45 for human-only PRs (CodeRabbit State of AI vs Human Code Generation 2025)
- 72.6% of Copilot code review users say it improved their effectiveness (GitHub Octoverse 2025)
- 80% say their organization adopted AI tools faster than it built policies to govern them (GitLab AI Accountability Report 2026)
- 90% of technology professionals now use AI at work, but 30% have little or no trust in AI-generated code (Google DORA 2025)
- 90% of enterprise software engineers will use AI code assistants by 2028, up from under 14% in early 2024 (Gartner, 2025)
1. Developer AI Adoption: The Baseline for Automated Review
Automated review is a downstream consequence of automated writing. 90% of technology professionals now use AI at work (Google DORA State of AI-assisted Software Development 2025), so nearly every pull request entering a review queue has some probability of containing machine-written code. That changes what review is for: it is no longer only a peer check, it is the main control point for code that no human fully authored.
Adoption is also deep, not just broad. Sonar’s respondents say 42% of the code they commit is already AI-generated or assisted, and JetBrains finds 62% of developers rely on at least one AI coding assistant, agent, or AI code editor. The question for engineering leaders has moved from whether teams use AI to how much unreviewed AI output their pipeline can absorb.
| Metric | Value | Source |
|---|---|---|
| Technology professionals using AI at work | 90% (up 14% from the prior year) | Google DORA State of AI-assisted Software Development 2025 |
| Median time spent with AI per day | 2 hours | Google DORA 2025 |
| Developers using or planning to use AI tools | 84% (up from 76% in 2024) | Stack Overflow Developer Survey 2025 |
| Professional developers using AI tools daily | 51% | Stack Overflow Developer Survey 2025 |
| Developers who regularly use AI for coding and development | 85% | JetBrains State of Developer Ecosystem 2025 |
| Developers relying on at least one AI coding assistant, agent, or AI editor | 62% | JetBrains State of Developer Ecosystem 2025 |
| Developers who tried AI coding tools and now use them every day | 72% | Sonar State of Code Developer Survey 2026 |
| DevSecOps professionals using or planning to use AI in the SDLC | 97% | GitLab Global DevSecOps Report 2025 |
Context note: these surveys use different populations (Stack Overflow is open to all developers, DORA targets technology professionals, JetBrains surveyed 24,534 developers in 194 countries), so the adoption rates are best read as a consistent 84% to 97% band rather than a single figure. Full question wording is on the Stack Overflow 2025 AI results page and in JetBrains’ State of Developer Ecosystem 2025. Broader cross-industry figures are in our developer survey statistics roundup.
2. AI Code Review Adoption and Scale
Review is the stage of the workflow where developers are most hesitant to hand over control, and the survey data shows it. Only 10.2% of developers mostly use AI for committing and reviewing code, and 58.7% say they do not plan to (Stack Overflow Developer Survey 2025). Yet platform telemetry tells a different story: AI review is being switched on at the organization level, running on every pull request whether individual developers asked for it or not.
That gap between personal intent and organizational defaults is the defining feature of this market in 2026. GitHub says usage of Copilot code review has grown 10x since launch, and that more than 12,000 organizations run it automatically on every pull request (GitHub Blog, 60 million Copilot code reviews). Multi-tool stacks are the norm: 91% of organizations in GitLab’s 2026 survey have two or more AI coding tools in active use.
| Metric | Value | Source |
|---|---|---|
| Copilot code reviews completed since April 2025 launch | 60 million | GitHub Blog, March 2026 |
| Share of all code reviews on GitHub handled by Copilot code review | More than 1 in 5 | GitHub Blog, March 2026 |
| Organizations running Copilot code review automatically on every PR | 12,000+ | GitHub Blog, March 2026 |
| Copilot code reviews that surface actionable feedback | 71% (average 5.1 comments per review) | GitHub Blog, March 2026 |
| Copilot code review users saying it improved their effectiveness | 72.6% | GitHub Octoverse 2025 |
| Developers who mostly / partially use AI for committing and reviewing code | 10.2% / 22.6% | Stack Overflow Developer Survey 2025 |
| Developers planning to partially / mostly use AI for this task | 31.4% / 16.3% | Stack Overflow Developer Survey 2025 |
| Organizations with two or more / three or more AI coding tools in active use | 91% / 54% | GitLab AI Accountability Report 2026 |
Outlier note: the 71% actionable-feedback rate also means 29% of Copilot reviews return no comments, which GitHub presents as a deliberate design choice (silence when nothing is wrong) rather than a failure. The Copilot code review feature reached general availability on April 4, 2025, according to GitHub Octoverse 2025. Earlier precedent comes from Google, where an internal ML model could address about 52% of reviewer comments at a 50% precision target, and code authors applied 40% to 50% of previewed suggested edits (Google Research, 2023). Most recent available data for that internal study: Google Research, 2023.
3. Trust and Accuracy: The Verification Gap
Trust is moving in the opposite direction from usage. 96% of developers do not fully trust that AI-generated code is functionally correct, yet only 48% always verify it before committing (Sonar State of Code Developer Survey 2026). That 48-point gap between doubt and diligence is precisely the space automated review tools are being sold into: if humans will not consistently check AI output, something else has to.
The pattern repeats across independent samples. Stack Overflow found that two-thirds of developers hit AI answers that are almost right, but not quite, and DORA found 30% have little or no trust in AI-generated code even while 80%+ report productivity gains. Developers have settled into treating AI as a fast but fallible collaborator whose work must be checked, which is also why Sonar respondents ranked reviewing and validating AI-generated code as the single most important skill for the AI era.
| Metric | Value | Source |
|---|---|---|
| Developers who do not fully trust AI-generated code is functionally correct | 96% | Sonar State of Code Developer Survey 2026 |
| Developers who always verify AI code before committing | 48% | Sonar State of Code Developer Survey 2026 |
| Developers agreeing AI produces code that looks correct but is not reliable | 61% | Sonar State of Code Developer Survey 2026 |
| Developers who highly trust / actively distrust AI output accuracy | 3.1% / 46% | Stack Overflow Developer Survey 2025 |
| Developers frustrated by AI solutions that are almost right, but not quite | 66% | Stack Overflow Developer Survey 2025 |
| Technology professionals with little or no trust in AI-generated code | 30% | Google DORA 2025 |
| Respondents who trust AI to handle daily tasks without human review | 37% | GitLab Global DevSecOps Report 2025 |
| Developers reporting both low hallucinations and high confidence shipping AI code | 3.8% | Qodo State of AI Code Quality 2025 |
Context note: Stack Overflow’s own leadership brief reports trust in AI accuracy at 29% in 2025, down from 40% in 2024, while the public results page shows 33% combining somewhat and highly trust; the difference reflects how answers are grouped, and both point to a decline (Stack Overflow 2025 survey for leaders). Qodo adds that 25% of developers estimate one in five AI suggestions contains factual errors or misleading code, and that developers who see fewer hallucinations are 2.5x more likely to merge code without reviewing it (24% vs 9%).
4. Productivity and the Review Bottleneck
The fastest way to see why AI review is growing is to look at where the time went. Teams with high AI adoption merge 98% more pull requests, while PR review time increases 91% (Faros AI, The AI Productivity Paradox Research Report 2025). Writing got cheaper; reading did not. Faros also found average PR size up 154%, so reviewers face both more pull requests and bigger ones.
Self-reported data agrees. GitLab’s 2026 survey found 78% of respondents say developers write and commit code faster, and 85% agree AI has shifted the bottleneck to reviewing and validating it. A controlled study from METR adds a caution about perception: experienced open-source developers took 19% longer to complete issues with AI tools, even though they still believed afterwards that AI had made them 20% faster (METR, July 2025).
| Metric | Value | Source |
|---|---|---|
| Change in PRs merged on high-AI-adoption teams | +98% | Faros AI Productivity Paradox Report 2025 |
| Change in PR review time on high-AI-adoption teams | +91% | Faros AI Productivity Paradox Report 2025 |
| Change in average PR size | +154% | Faros AI Productivity Paradox Report 2025 |
| Change in tasks completed per developer | +21% | Faros AI Productivity Paradox Report 2025 |
| Change in pull requests touched per developer per day | +47% | Faros AI Productivity Paradox Report 2025 |
| Developers saying reviewing AI code takes more effort than reviewing colleagues’ code | 38% | Sonar State of Code Developer Survey 2026 |
| Pull requests merged on GitHub per month (2025 average) | 43.2 million (+23% YoY) | GitHub Octoverse 2025 |
| Change in task completion time with AI tools in a randomized trial (16 developers, 246 issues) | +19% slower | METR, 2025 |
Context note: Faros found no significant correlation between AI adoption and company-level DORA metrics, meaning individual gains evaporated before reaching delivery outcomes. Atlassian’s State of Developer Experience 2025 (3,500 developers and managers) shows the same offset: 68% save more than 10 hours a week with AI, while 50% lose 10+ hours a week to organizational friction (Atlassian, 2025). Automated review is one of the few levers aimed at the stage where the time is actually piling up.
5. Code Quality and Security Findings
Quality data splits cleanly into two stories. AI-written code, unreviewed, measurably carries more defects. AI co-authored pull requests averaged 10.83 issues per PR against 6.45 for human-only PRs, roughly 1.7x more (CodeRabbit, State of AI vs Human Code Generation Report 2025), and Veracode found 45% of AI-generated code samples failed security tests and introduced OWASP Top 10 vulnerabilities.
The second story is that review in the loop changes the outcome. Qodo found 81% of developers using AI code review reported quality improvements, versus 55% of equally fast teams without it, and AI review adopters saw quality gains even when productivity stayed flat (36% vs 17%). Read together, the numbers argue that the risk sits in unreviewed AI output, not AI output as such. Readers tracking the broader threat landscape can compare these figures with our cybersecurity statistics.
| Metric | Value | Source |
|---|---|---|
| AI-generated code samples that failed security tests (100+ LLMs) | 45% | Veracode GenAI Code Security Report 2025 |
| Security failure rate by language: Java / C# / JavaScript / Python | 72% / 45% / 43% / 38% | Veracode GenAI Code Security Report 2025 |
| Samples where AI failed to defend against cross-site scripting (CWE-80) | 86% | Veracode GenAI Code Security Report 2025 |
| Issues per PR: AI co-authored vs human-only (470 open-source PRs) | 10.83 vs 6.45 | CodeRabbit State of AI vs Human Code Generation 2025 |
| Security issues in AI co-authored PRs vs human-only PRs | Up to 2.74x higher | CodeRabbit State of AI vs Human Code Generation 2025 |
| Quality improvements with AI review vs without (among fast teams) | 81% vs 55% | Qodo State of AI Code Quality 2025 |
| Respondents reporting a positive AI influence on code quality | 59% | Google DORA 2025 |
| Repositories with CodeQL alerts for broken access control | 151,000+ (+172% YoY) | GitHub Octoverse 2025 |
Context note: Veracode reports that larger, newer models did not produce more secure code, so model upgrades alone are not a substitute for review. On the positive side, GitHub’s Octoverse 2025 reports vulnerability fix times improved 30% over the past year and 26% fewer repositories received critical alerts. Faros adds a 9% increase in bugs per developer on high-AI-adoption teams. The Veracode report summary lists the full methodology.
6. Governance, Enterprise Challenges, and What Comes Next
Enterprises bought AI coding tools faster than they wrote rules for them. 80% of respondents say their organization adopted AI tools faster than it developed policies to govern them, and 92% report some form of governance challenge with AI-generated code (GitLab AI Accountability Report 2026). The next phase of automated review is therefore less about catching typos and more about provenance: knowing which code came from a model, which tool produced it, and who approved it.
The traceability numbers are the most worrying. 87% are confident they could tell within 24 hours whether AI-generated code contributed to a production incident, yet 34% of organizations that actually had an incident in the past year could not make that determination. Meanwhile the share of AI-written code keeps rising, which means the governance problem compounds every quarter. Our enterprise AI adoption statistics cover the same policy-lag pattern outside software teams.
| Metric | Value | Source |
|---|---|---|
| Organizations adopting AI faster than governance policies / reporting a governance challenge | 80% / 92% | GitLab AI Accountability Report 2026 |
| Respondents who cannot reliably distinguish AI-generated from human-written code | 43% | GitLab AI Accountability Report 2026 |
| Respondents saying AI code risks a new form of technical debt | 82% | GitLab AI Accountability Report 2026 |
| Respondents saying AI increases compliance management complexity | 70% | GitLab Global DevSecOps Report 2025 |
| Respondents discovering more compliance issues after deployment than during development | 76% | GitLab Global DevSecOps Report 2025 |
| Committed code that is AI-generated or assisted: today vs expected by 2027 | 42% vs 65% | Sonar State of Code Developer Survey 2026 |
| Enterprise software engineers using AI code assistants: early 2024 vs 2028 forecast | Under 14% vs 90% | Gartner Top Strategic Trends in Software Engineering 2025 |
Context note: the 76% post-deployment compliance finding from GitLab’s 2025 DevSecOps report (3,266 professionals, conducted by The Harris Poll) is a direct argument for moving checks into the review stage (GitLab press release, November 2025). The Gartner forecast is reported here via DevOps Digest’s coverage of the July 2025 Gartner release; the same release predicts at least 55% of software engineering teams will be building LLM-based features by 2027. On the ROI side, 60% of GitLab’s 2026 respondents say AI coding ROI has exceeded expectations, so the pressure is to govern AI code, not to retreat from it.
Summary: AI Code Review by the Numbers
| Metric | Value | Source |
|---|---|---|
| Share of GitHub code reviews handled by Copilot code review | More than 1 in 5 | GitHub Blog, 2026 |
| Copilot code reviews completed | 60 million | GitHub Blog, 2026 |
| Organizations running AI review on every PR (Copilot) | 12,000+ | GitHub Blog, 2026 |
| Copilot code review users reporting improved effectiveness | 72.6% | GitHub Octoverse 2025 |
| Developers mostly using AI for committing and reviewing code | 10.2% | Stack Overflow Developer Survey 2025 |
| Developers with no plans to use AI for committing and reviewing code | 58.7% | Stack Overflow Developer Survey 2025 |
| Technology professionals using AI at work | 90% | Google DORA 2025 |
| Developers who do not fully trust AI-generated code | 96% | Sonar State of Code 2026 |
| Developers who always verify AI code before committing | 48% | Sonar State of Code 2026 |
| Developers who actively distrust AI output accuracy | 46% | Stack Overflow Developer Survey 2025 |
| AI shifted the bottleneck from writing to reviewing code | 85% agree | GitLab AI Accountability Report 2026 |
| Change in PR review time on high-AI-adoption teams | +91% | Faros AI 2025 |
| Change in PRs merged on high-AI-adoption teams | +98% | Faros AI 2025 |
| Quality improvements with AI review vs without | 81% vs 55% | Qodo State of AI Code Quality 2025 |
| AI-generated code samples failing security tests | 45% | Veracode GenAI Code Security Report 2025 |
| Issues per PR, AI co-authored vs human-only | 10.83 vs 6.45 | CodeRabbit 2025 |
| Organizations adopting AI faster than governance policies | 80% | GitLab AI Accountability Report 2026 |
| Technology professionals with little or no trust in AI-generated code | 30% | Google DORA 2025 |
| AI share of committed code, today vs 2027 expectation | 42% vs 65% | Sonar State of Code 2026 |
| Enterprise engineers using AI code assistants by 2028 | 90% (forecast) | Gartner, 2025 |
Methodology and Sources
- Stack Overflow Developer Survey 2025, AI section: adoption, trust, frustrations, and AI use for committing and reviewing code (33,662 respondents answered the AI usage questions).
- Stack Overflow 2025 Developer Survey for Leaders, AI adoption: year-over-year trust comparison (2024 vs 2025).
- GitHub Octoverse 2025: Copilot code review effectiveness, PR and commit volumes, CodeQL and vulnerability fix-time data.
- GitHub Blog, 60 million Copilot code reviews and counting (March 2026): review volume, share of GitHub reviews, organization count, actionable-feedback rate.
- GitLab AI Accountability Report 2026 press release: The Harris Poll, 1,528 developers and technology buyers in six countries, released June 23, 2026.
- GitLab Global DevSecOps Report 2025 press release: The Harris Poll, 3,266 DevSecOps professionals, released November 10, 2025.
- Google Cloud, Announcing the 2025 DORA Report and Google Blog DORA 2025 summary: nearly 5,000 technology professionals plus 100+ hours of qualitative data.
- Sonar State of Code Developer Survey 2026 and Sonar AI trust gap analysis: 1,100+ professional developers, published January 2026.
- Qodo State of AI Code Quality 2025: 609 developers across company sizes and regions.
- Veracode 2025 GenAI Code Security Report: 100+ LLMs tested across Java, Python, C#, and JavaScript, published July 30, 2025.
- CodeRabbit State of AI vs Human Code Generation Report: 470 open-source PRs (320 AI co-authored, 150 human-only), published December 17, 2025.
- Faros AI, The AI Productivity Paradox Research Report: telemetry from 10,000+ developers across 1,255 teams, published July 2025.
- METR, Measuring the Impact of Early-2025 AI on Experienced Open-Source Developer Productivity: randomized controlled trial, 16 developers, 246 issues.
- JetBrains State of Developer Ecosystem 2025: 24,534 developers in 194 countries, surveyed April to June 2025.
- Atlassian State of Developer Experience 2025: 3,500 developers and managers in six countries.
- Google Research, Resolving code review comments with ML (2023): internal ML-suggested edits for reviewer comments.
- Gartner Top Strategic Trends in Software Engineering 2025, via DevOps Digest: Gartner’s original release was not publicly fetchable; figures are quoted as reported.
- Zhong et al., From Human-Centric to Agentic Code Review (arXiv, July 2026): analysis of 1.02 million reviewed PRs from 207 GitHub projects, finding agent-involved reviews are associated with faster decisions but not better review quality; used as qualitative context only.
- Data watch: vendor-run research (GitHub, Sonar, Qodo, CodeRabbit, Faros AI) comes from companies that sell AI coding or review tools, so treat their framing with care even where methodology is disclosed. CodeRabbit’s 470-PR sample and METR’s 16-developer trial are small; their direction matches larger surveys but the exact multipliers should not be generalized. Stack Overflow publishes two trust figures for 2025 (29% in its leadership brief, 33% on the results page) because of different answer groupings. Google’s ML code review data dates from 2023 (most recent available data for that internal study). We excluded market-size estimates for AI code review tools because we could not cross-check them across two firms with disclosed methodology. Newer data expected: the Stack Overflow Developer Survey 2026, GitHub Octoverse 2026, and the 2026 DORA report.
Last updated: October 3, 2026. We update this roundup quarterly, and the next refresh is expected when GitHub publishes Octoverse 2026.