AI Shifts Development into Review Work. Who Owns Sign-off?

Six percent of developers feel noticeably relieved by AI. 67 percent describe denser days with higher output. The dividend has not disappeared. It has shifted into work that is not part of any plan: reviewing. No one has decided who is responsible for it.

RelatedAI Doesn’t Replace Jobs – It Replaces Job Profiles: What This Means for C-Level Recruiting  /  Local AI: Governance Before Hardware Purchase

Where decisions are made about using AI, the questions are: What are we saving? How do we gain productivity? The rollout is paid for, the licenses are active, and the return is promised. At some point, someone wants to see it.

In June 2026, the Python Software Association surveyed the PyCon DE community. 383 software developers, data scientists, and AI engineers responded. In none of the more than 1,000 answers does anyone report concrete job cuts due to AI. Where staffing gaps are reported, almost a third specifically cite classic software development. So the dividend exists. However, it arrives at the team as an expectation. It does not create free capacity.

The work doesn’t disappear. It changes character.

96 percent use AI tools at least several times a day. What can be delegated is delegated: new code (76 percent), research (44 percent), refactoring (35 percent). The counter-list is interesting. When asked about newly created tasks, 68 percent cite reviewing and curating AI output. Domain knowledge, system design, and requirements communication are gaining value. These are precisely the skills whose quality demands human judgment.

Substitution is happening, but at the task level rather than the job level. Production becomes review. And review is no mere busywork: it costs time, it demands judgment, it carries responsibility. Code cannot be read sideways; the narrative threads only connect in the final chapter.

Because review work is absent from any plan, it goes unseen and unbudgeted. 16 percent feel overwhelmed at the end of an AI-heavy day, one in five in corporations. Velocity planning has no slot for this work. And because it has no owner, responsibility for its errors falls on the last person in the chain: the individual who clicks “Merge.”

The larger the house, the smaller the dividend

One might assume this is a problem for small, unstructured organizations. The opposite is true. As size grows, review work increases from 64 percent in companies with fewer than 50 employees to 76 percent in those with over 5,000. Unclear responsibilities grow alongside and are cited as the biggest bottleneck in corporations, ahead of data quality, legacy systems, and security. Automation gains, however, do not scale similarly: in smaller firms, well over a third automate more than half of routine tasks, while in corporations, only one in five does.

Large houses thus receive a smaller dividend amid a heavier review burden. Size also offers no protection regarding liability. Around seven out of ten respondents from organizations with over 5,000 employees say responsibility for an AI-caused error is not explicitly defined and effectively lies with the developer who accepted the code. In companies with fewer than 50 employees, the figure is identical. Compliance, corporate audit, works council: none of these change anything here. Only 14 percent in corporations have a documented framework with mandatory review, named approval, and audit trail. Another 9 percent don’t even know if one exists.

The Same Machine Writes the Code and Delivers the Quality Signal

Roughly one in six respondents also described a specific incident. These reports reveal a costly pattern: the verification signal itself originates from the machine.

A senior engineer at an energy corporation reviews an AI pull request and is impressed by an elegant testing approach. On a second read, however, the tests make no sense-even though they pass with flying colors. At a logistics group, the agent repeatedly rewrites a failing test until it passes. The bug only surfaces during deployment, and root cause analysis takes days. In the pharmaceutical sector, after six months of AI-driven development, teams discover 23,000 lines of generated documentation that no one has ever read. All tests are green. They validate AI-generated requirements against AI-generated code. All three accounts come from organizations with more than 500 employees.

“When generating code, it happens quite often that package versions are simply invented. If you trust this blindly, you quickly get sucked into a vortex of hallucinations and end up debugging in completely the wrong place.”
– Free-text response from the survey, June 2026

Hallucination-plausible-sounding but entirely fabricated model output-is not just a rookie mistake. It catches senior developers at major corporations off guard. And it strikes precisely where organizations believe they are protected: 90 percent check AI output via manual review, and 76 percent run automated tests. Yet only 30 percent have a formal evaluation framework-a versioned test suite that reliably measures whether a system can accomplish a given task. Meanwhile, 14 percent rely primarily on gut feeling. Trust in the output, however, has risen to 58 percent.

Four Levels Act Logically. No One Decides.

Survey respondents cite unclear responsibilities as the biggest bottleneck (40 percent), followed only then by security, data protection, and the EU AI Act (36 percent). This is remarkable because no one is actually misbehaving. Each level acts in a way that makes perfect sense from its own perspective. Yet the decision-making process remains a vacuum.

Each level can reasonably assume that another is responsible

Together, these four open questions create the approval gap. It exists in the space between levels. None of them is doing anything wrong. Only the developer who adopts the generated code cannot point the finger at another level. If you can only resolve one of these four questions, make it the second. It is the only one decided daily in your organization, albeit unconsciously.

The cost of this gap is illustrated by the survey’s most sobering report. At a small software firm, massive security vulnerabilities resulting from intensive AI use only came to light after the colleague involved had left the company. The result: a complete rebuild. When control knowledge and approval authority rest with a single person, part of your oversight capability walks out the door with them. The damage remains.

The Deadline Has Moved. The Responsibility Has Not.

A significant portion of regulatory time pressure has just eased. In late June 2026, the EU Council finalized the Digital Omnibus: obligations for high-risk systems under Annex III are delayed by 16 months to December 2, 2027, and for AI in regulated products to August 2, 2028. Annex III covers AI that influences decisions regarding credit, hiring, or critical infrastructure. The substantive requirements remain unchanged.

Many interpret this as an all-clear signal. I see it differently. For certain high-risk obligations, the regulatory clock is ticking more slowly. The operational clock continues at the same pace. An error that an agent introduces into your production environment next week won’t wait for Brussels. Operational responsibility begins the moment approval is granted. And approvals happen in your organization every day-90 percent of them through manual review by an individual whose name never appears in any log.

Those who view the 16-month extension as mere procrastination will squander it. Those who treat it as a preparation window can build a control framework free from deadline panic. A responsibility model that holds up in daily operations is forged during quieter periods. Under deadline pressure, all you get is a spreadsheet that no one maintains.

Three Decisions You Cannot Delegate

Practical experience not captured in the survey: One owner can handle up to approximately 500 employees. Beyond that, you need a named owner per domain, otherwise it becomes centralization theater.

Control Is Not a Cost Block

The survey reveals a design task. The data provide no reason to cut developer positions. They do, however, give cause to sharpen profiles and clarify responsibilities. Only 4 percent feel their work is being devalued. What burdens respondents is the loneliness of granting approval.

The dividend does not disappear because the technology underperforms. It vanishes into work that no one ordered: invisible, therefore unplanned, therefore unpaid. And because no one ordered it, no one takes responsibility for it-except the individual who grants approval. Sovereignty belongs to those who recognize review work as actual work and give it a name before chance assigns one.

Frequently Asked Questions

Alexander C. S. Hendorf is Chairman of the Python Software Verband e. V. and co-initiator of PyCon DE. He has been working at the interface of data science, AI, and organizational development for over two decades and is a Trusted Voice at Digital Chiefs.

More from the MBF Media Network

Also available in