When AI Writes Most of the Code, Peer Review Must Be Redesigned

Anthropic reports that Claude now writes more than 80% of the code merged into its production codebase, up from low single digits in early 2025. Other agents increasingly handle review too, meaning far less human line-by-line reading of code than before. Yet SOC 2 and ISO 27001 programs still lean on the old requirement that a second qualified human reviews and approves every change—language that no longer describes how the work actually happens.

The piece argues that traditional pull-request approval quietly bundled five distinct functions: defect detection, intent verification, independence, knowledge transfer, and accountability. Defect detection, ironically the weakest of the five in large diffs, was never why auditors trusted it—independence and accountability were the real value.

The proposed fix moves human sign-off away from the diff and onto the spec, the verification plan, and the automation policy. Independence is reconstructed structurally: same model, but different goals for writer versus reviewer, a clean context for the reviewer, and author-independent tooling (property tests, fuzzers, static analysis) the writing agent cannot edit. Running the same model twice with identical context isn't real review; changing goal, context, and harness is.

For engineering and compliance teams, the takeaway is that continuing to treat PR approval as meaningful evidence risks either rubber-stamp theater or an audit finding—redesigning the control now is cheaper than remediating it later.