Over the last 18 months most of your team started using some AI tool at work: GitHub Copilot, ChatGPT, Claude, Cursor. The company never asked, the team never waited for permission, and nobody banned it.
In many organizations the result is fragmented use, inconsistent patterns, generated code merged without critical review, and a technical lead with no visibility into what the repositories are accepting.
State of adoption
The Stack Overflow Developer Survey of 2024 recorded 76% of respondents using or planning to use AI tools in development. Sida Peng, Eirini Kalliamvakou, Peter Cihon and Mert Demirer measured a task finished 55% faster with Copilot on in "The Impact of AI on Developer Productivity: Evidence from GitHub Copilot" (2023).
Using covers a wide range: completing an import up to generating an entire business-logic file. The risk shows up when every engineer works their own way, with no critical review.
- Generated code that runs and that nobody understands well enough to maintain
- Inconsistent patterns that slow code review and onboarding
- A vulnerability accepted without analysis
- An unnecessary dependency added by the generator
- A test that covers the happy path and skips edge cases
Four team practices
1. Set where AI enters
On repetitive code, well-defined transformation, unit tests for pure functions and API documentation, the tool shortens the time. Keep active human review for critical business logic, security code and architecture decisions.
2. A review rule for generated code
Generated code goes through the same criteria as human code. Whoever opened the PR answers for what sits there, whatever produced it. Write the rule down: part of the team treats tool output as a draft that skips review.
3. Reference prompts for the repository
A prompt tuned to the repository pattern and the team's test style produces consistent code and cuts rework. It stays documented and changes when the pattern changes.
4. Measure the effect
Track feature cycle time before and after, bugs per sprint and average code review time. Speed unchanged with quality down points at the team's practice, and the tool leaves the decision process.
Security in generated code
A language model learned from public code, insecure code included, and returns a pattern that works with a known failure. SQL injection, XSS and sensitive data exposure show up in the output of popular tools.
OWASP listed these risks in Top 10 for LLM Applications (2023), with prompt injection and data leakage among them. The DORA State of DevOps report for 2024 showed high adoption across respondents and a contradictory effect: more individual productivity alongside drops in delivery throughput and stability.
Keep the existing layers running: code review, security tests and SAST. Train the team to recognize the most common risk pattern in generated code.
Who runs the adoption
Technical leadership picks the approved tool for the company context, publishes a guide for the common uses, fixes the review criteria and opens space for the team to share practice. A team with that structure extracts more value from the tool and produces less rework. A team without it argues about the tool every week.
