Authoring Is Cheap. Verification Is the Constraint.
AI in the software development lifecycle is an operating model change, not a tooling purchase. The licenses are the cheapest and least important part. What actually changed is where the constraint sits: authoring got cheap, and verification, integration, and merge capacity did not.
Every serious dataset since 2024 says the same thing. Individual output goes up. Organizational throughput does not follow unless somebody redesigns the part of the pipeline that now has to absorb the volume. Most organizations skip that step, bolt agents onto authoring, double their pull request volume, and drown.
This is the piece I point people to when they ask why their AI rollout produced a busier dashboard and a flat release calendar. The numbers are below, and they are not subtle.
Hire Me
The Productivity Paradox, With Numbers
This is the single most important finding in the field, and the one most often misquoted. Faros AI published it first in July 2025 from telemetry across more than 10,000 developers on 1,255 teams. Tasks completed per developer were up 21%. Pull requests merged per developer were up 98%. PR review time was up 91%. Average PR size was up 154%. Bugs per developer were up 9%. And at the company level - throughput, DORA metrics, quality KPIs - there was no significant correlation with AI adoption at all. Twice the PRs, and nothing moved.
Faros ran it again in May 2026 across 22,000 developers and 4,000 teams, and the picture got worse, not better. Tasks per developer up 33.7%. PR merge rate up 16.2%. PR size up 51%. Bugs per developer up 54%, from 9% a year earlier. Incidents per PR up 242.7%. Median PR review time five times longer. Code churn up 861%. Deployments per week down 11.7%. PRs merged with no human review at all up 31.3%, with a quarter of all PRs now reviewed by an AI agent instead of a person.
DORA has been tracking the same shape from the survey side. In 2024, a 25% increase in AI adoption was associated with a 1.5% drop in delivery throughput and a 7.2% drop in delivery stability. In 2025, throughput finally turned positive while stability stayed negative, and DORA settled on the word that explains both: AI is an amplifier. It magnifies whatever is already there. In 2026, DORA's ROI report named the two mechanisms - a J-curve where productivity dips before it rises, and a verification tax, the review and validation cost that cheap authoring shifts onto humans.
"Twice the pull requests, five times the review time, and fewer deployments per week is not a productivity gain. It is a queue with a dashboard."
Then there is METR, which did the thing nobody else did: a randomized controlled trial. In July 2025, 16 experienced open-source maintainers worked 246 tasks on their own repositories. With AI tools they were 19% slower. Before the study they had forecast being 24% faster. After the study, having just been measured at 19% slower, they believed they had been 20% faster. METR's February 2026 update with late-2025 tools found the original cohort still estimated at minus 18% (confidence interval minus 38% to plus 9%) and a fresh cohort at minus 4%, and METR itself called the result "very weak evidence" and is redesigning the study because developers now refuse to work without AI.
Take two things from METR and not a third. First, perceived speed and measured speed diverge, by about 40 points, in the same people, on the same work. Second, the effect on experienced developers in mature codebases is not settled. Do not take from it that AI makes engineers slower. Take from it that your engineers' own report of how much faster they are is not data, and if that is what your dashboard is built on, you do not have a dashboard.
Three Branches, One Gain
The mechanism is arithmetic, not mystery. Authoring cost drops, so you get more PRs and larger PRs. The review queue grows, which is the 91% to 5x review-time number above. At that point an organization does one of three things, and only one of them is a gain.
Review Depth Falls
The queue gets cleared by lowering the bar. Rubber stamps, no-comment merges, single-pass approvals on 800-line diffs. Throughput looks fine for a quarter.
This is the Faros 2026 branch: bugs per developer up 54%, incidents per PR roughly tripled, a third more PRs merged without a human ever reading them.
Review Depth Holds
The reviewers keep their standards and the queue backs up. Cycle time stays flat, deployments per week drift down, and engineers spend their new capacity waiting.
Safer than the first branch and just as useless to the business. Individual output doubled and nothing reached production faster.
Redesign Verification
Plan approval before code exists. Risk-tiered review so a copy change and an auth change do not get the same treatment. AI pre-review that clears the mechanical comments. A merge queue. Generated tests scored by mutation, not coverage.
Throughput rises with stability held. This is the only branch where the organization gets what it paid for.
Only the third branch produces an organizational gain. The other two produce a dashboard.
Individual Speed Is Not Organizational Velocity
Organizational performance is not the sum of individual output. It is how well code integrates, how reliably review catches defects, and whether the architecture stays coherent while forty people and a fleet of agents push at it. Speed is the most visible signal in that system and the most misleading one. When PRs per developer are up and deployments per week are flat or down, you do not have a gain. You have a queue, and the queue is where the money went.
The dangerous failure mode is not one incident. It is quiet accumulation: an inconsistent quality bar across teams, ungoverned data flows, shadow tooling leadership cannot see, and a widening gap between how productive everyone feels and how healthy the system actually is. None of it shows up on a velocity chart. The bill arrives later, as a production break, a security audit finding, or the morning a routine change turns out to need a rewrite.
GitClear's January 2026 data, from 623 million code changes indexed to 2023, is what that tipping point looks like in aggregate. Code-block duplication up 81%. Error-masking constructs - empty catches, broad excepts - up 47%. Cross-file function calls down 35%, which means generated code stopped reusing what already existed. Refactoring's share of all changes fell from 21% in 2022 to 3.8% in 2026. GitClear's own framing is the right one: the headline is not that AI writes bad code. It is deferred structural maintenance, at scale, with nobody assigned to it.
The Paradox Test
Run this quarterly. It takes ten minutes with source control and CI data you already have. If PRs per developer are up and any two of the following are also true, you have a queue and a risk, not a gain, and the next rollout phase should wait until you have fixed it.
- Deployments per week are flat or down. The one number that cannot be faked by generating more code, and the one the Faros 2026 cohort saw fall 11.7% while everything upstream of it climbed.
- Median review time is up by more than PR count is up. Review got slower per PR, not just busier. That is the verification tax showing up as latency instead of as a line item.
- Change failure rate or incidents per deploy are up. The review that used to catch it is not catching it, whatever the approval counts say.
- No-comment merges are up. Human oversight is quietly leaving the system, one uncontested approval at a time, and nobody decided that it should.
Report Outcomes, Not Activity
A number without a pre-AI baseline is a story, not evidence. Capture the baseline while the team is still working without AI, or at least before the next expansion, because a retroactive baseline is storytelling with a spreadsheet attached. The list is short: cycle time from ticket start to production deploy at p50 and p85; PR review turnaround, and review time relative to PR size; change failure rate; bug escape rate to production per release; test coverage by module plus mutation score on the critical ones; deployment frequency; and a developer survey on perceived productivity, so that in six months you can measure the perception gap METR measured instead of arguing about it.
If a clean pre-AI baseline does not exist, say so explicitly in every report rather than back-filling one. An honest "we did not measure before" ages far better than a number somebody reconstructed from memory.
Report These
- Cycle time, ticket to production, p50 and p85. The outcome.
- Review latency and review time per line. The constraint.
- Change failure rate. Held flat is the honest claim; anything else was bought with a lower bar.
- Escaped defects by review tier, so you know whether auto-merge is scoped correctly.
- Incidents per deploy. The Faros 2026 tripling, watched for locally.
- PRs merged with no human comment, by tier. Oversight erosion, made visible.
- Rework rate after review. Whether review is catching anything.
- Mutation score on critical modules. Test quality, which coverage cannot tell you.
- Duplication and cross-file reuse trend. GitClear's deferred maintenance, caught before the tipping point.
- Agent spend per merged PR, per workflow. Unit economics, and the early warning for a runaway loop.
Do Not Report These as Success
- AI adoption percentage.
- AI-authored lines or PRs as a share of the total.
- Suggestions accepted.
- Tasks completed per developer, on its own.
Every one of these goes up while quality goes down, which is exactly what the Faros data shows happening, and every one of them hands leadership the wrong dashboard. They are the numbers a vendor would pick.
Track adoption for coverage and cost planning. It tells you who has a seat and what the seats cost. It is not an outcome, and the day it appears on a board slide as one is the day the board stops being able to tell whether the program is working.
What the Evidence Says
- Individual output doubled and the company did not move. Faros AI's telemetry across 10,000+ developers and 1,255 teams found PRs merged per developer up 98%, PR review time up 91%, PR size up 154%, and bugs per developer up 9%, with no significant correlation between AI adoption and company-level throughput, DORA metrics, or quality KPIs. Faros AI, The AI Productivity Paradox (source dated 2025-07; verified 2026-09)
- A year later the review queue broke. Across 22,000 developers and 4,000 teams, Faros measured bugs per developer up 54%, incidents per PR up 242.7%, median review time 5x, code churn up 861%, deployments per week down 11.7%, and PRs merged with no human review up 31.3%, with 25% of PRs now reviewed by an AI agent. Faros AI, The Acceleration Whiplash (source dated 2026-05; verified 2026-09)
- Stability went first. DORA's 2024 report found a 25% increase in AI adoption was associated with a 1.5% decrease in delivery throughput and a 7.2% decrease in delivery stability, from roughly 3,000 respondents. DORA 2024 (source dated 2024-10; verified 2026-09)
- Throughput recovered, stability did not. DORA's 2025 report, from nearly 5,000 respondents, found "AI adoption now improves software delivery throughput" while it "still increases delivery instability," with 90% using AI at work and a median of two hours a day. DORA's frame: AI is an amplifier of whatever an organization already is. DORA 2025 (source dated 2025-09; verified 2026-09)
- The cost has a name now. DORA's 2026 ROI research introduces the J-curve, where productivity dips before it rises, and the verification tax, the review and validation cost that AI shifts onto humans. Budget for both or the first quarter will read as failure. DORA, ROI of AI-assisted Software Development (source dated 2026; verified 2026-09)
- Perceived speed and measured speed diverge. In METR's randomized controlled trial, 16 experienced open-source maintainers working 246 tasks on their own repositories were 19% slower with AI tools. They had forecast being 24% faster and, afterward, believed they had been 20% faster. METR developer productivity RCT (source dated 2025-07; verified 2026-09)
- And it is still not settled. METR's update with late-2025 tools (57 developers, 800+ tasks) put the original cohort at minus 18% with a confidence interval of minus 38% to plus 9%, and a new cohort at minus 4%. METR called it "very weak evidence" and is redesigning the study because developers now refuse to work without AI. Quote the uncertainty, not the headline. METR uplift study update (source dated 2026-02; verified 2026-09)
- The structural bill is already visible. GitClear's analysis of 623 million code changes found code-block duplication up 81%, error-masking constructs up 47%, cross-file function calls down 35%, and refactoring's share of changes down from 21% in 2022 to 3.8% in 2026. GitClear's framing: not "AI writes bad code," but deferred structural maintenance. GitClear, The Maintainability Gap (source dated 2026-01; verified 2026-09)
- Verification is being skipped by the people who say they do not trust the output. Sonar's survey of 1,100+ developers found 42% of committed code is now AI-generated or assisted, 96% do not fully trust it, and only 48% always verify AI code before committing. Those three numbers do not belong in the same organization, and they are. Sonar, State of Code 2026 (source dated 2026-01; verified 2026-09)
What I Do About It
Baseline first, before the next expansion, and I say out loud when one does not exist. Then I design the verification stage before I scale the authoring stage, because the data above says that order is the whole difference between a gain and a dashboard.
Concretely: I approve the plan, not the diff, so senior judgment lands before there are 1,500 lines to argue about. Review is tiered by risk - docs and flag-off scaffolding auto-merge on green with a weekly audit sample, standard feature work gets one human after AI pre-review has cleared the mechanical comments, and auth, money, PII, migrations, and rule engines get two humans and an architect with no AI auto-approve. PR size is capped in the pipeline, a soft warning at 400 lines and a hard split request at 800, because a 154% jump in PR size is how review time went up 91%. A merge queue batches verification and keeps main green. And on the modules that matter, the gate is mutation score, not coverage, because generated tests that assert nothing pass a coverage gate every time.
On my own teams the AI-native pipeline - Claude Code, OpenAI Codex, GitHub Copilot, and AWS Kiro as first-class CI/CD stages - delivered 5x deploy frequency and a 23% PR throughput gain with SonarQube enforcing the quality bar as a hard gate in CI/CD. The throughput number only means something because the gate held while it was climbing.
The honest claim in every report I send up is the same one: change failure rate held flat while throughput rose. If I cannot say that, I do not have a result yet. I have a queue.
Hire Me →