Using AI in development is not the problem. The problem is when nobody reviewed what the AI wrote. As the client, check four things: whether you have access to the code and the accounts, the quality of the code, whether security was checked, and whether another team could take the product over.
You cannot see this from the outside. An app a team built with care and an app AI wrote without review look the same at handover. The difference shows three months later. This article gives you six signs that let you spot it sooner, and eight questions to ask your contractor.
Why this is no longer the exception
According to the 2025 Stack Overflow survey, 84% of developers use AI tools or plan to. At the same time, 46% of developers do not trust the accuracy of what AI writes.
So your contractor almost certainly uses AI. That is not bad in itself: a good team gets more done in less time with it. The question is how they use it.
There are two ways. In the first, AI is a tool: the developer uses it, then reads the code, corrects it and answers for it. In the second, AI is a substitute: the code goes into the product because it works, without anyone having read it. The first way saves you money. The second saves it today and takes it back later.
Developers themselves do not trust AI code without review. You should not pay for a product where the review was skipped either.
Six signs that nobody reviewed the code
1. The first version came fast, but every fix takes longer
AI writes something new very quickly. Changing existing code that nobody understands is slow. If the first demo came after two weeks and a small change now takes a week, that is the most reliable sign.
2. Fixing one thing breaks another
When the same logic is written in five places, a fix in one place does not fix the other four. Bugs you already reported, and that were fixed, come back.
3. The contractor cannot explain how something works
Ask where passwords are stored, or what happens when a payment fails. Someone who wrote the code, or at least read it, answers straight away. "We'll check" in response to basic questions means they do not know the code.
4. No tests and no documentation
Automated tests are evidence that someone thought about what can break. If there are none, or they exist only so that there are some, every change means checking the whole app by hand.
5. You have no access to the code
The code is with the contractor and you only have a link to the running app. As long as that is the case, you cannot check anything in this article, and you cannot change contractors.
6. You do not know who pays for the AI services and hosting
The app uses an AI model, a database and a server. If all the accounts are in the contractor's name, the product is theirs in practice, whatever the contract says.
Eight questions for your contractor
Ask them in a regular meeting, without accusation. A good contractor answers on the spot.
Which AI tools do you use on our project, and for what?
Who reviews the code AI writes before it goes into the product?
Where is the code repository, and who has access to it?
Are there automated tests, and what do they cover?
Have you entered our data, or our customers' data, into AI tools, and under what terms?
In whose name are the accounts for hosting, the database, the domain and the AI services?
What would another team need to take the project over, and how long would it take?
How did you check security, and what did you find?
When you listen to the answers, the point is not whether the contractor uses AI, but whether they know what they did with it. "We use AI for the first draft, and another developer reviews every change" is a good answer. "Everything works, don't worry" is not an answer.
What to check on security is covered in Is AI-written code secure?.
What to put in the contract
If you are only now commissioning the project, settle this up front. Later, each of these points becomes a negotiation.
Repository access from day one. Not at handover, but while the work is under way.
Accounts in your name. Hosting, database, domain and AI services are yours; the contractor has access.
Disclosure of AI tools, and a ban on entering confidential data into them without agreement.
Code review as a condition of acceptance. Every change is read before release by a person who did not write it.
Tests as part of the product, not an extra that drops off when time runs out.
A security review before launch, with a record of what was checked.
Handover documentation: how to run the app, release it, and restore it from a backup.
What to do if you have already accepted the product
First, secure access. Ask for the repository and for the accounts to be moved into your name before you raise anything else. Without that you have nothing to check with.
Then ask the questions from this article. The aim is not to find someone to blame. The answers tell you whether the contractor knows the state of the product and can fix it, or does not know it.
If there are no answers, or they do not convince you, commission an independent review. That is what our AI project rescue review is for. In two weeks we review the code, security and user experience, and tell you in writing what to keep, what to fix and what to rewrite. The report is written so that your existing contractor can carry out the fixes, and you can invite them to the presentation of the findings. See the AI Project Rescue package for what it covers and what it costs.
Only then decide whether to change contractors. Often it is not necessary.
Frequently asked questions
Is it wrong for a contractor to use AI in development?
No. What is wrong is when nobody reads the AI-written code before release. A contractor who uses AI with care gets your work done faster and for less.
Does my contractor have to tell me they use AI?
Not necessarily by default, so put it in the contract. Require disclosure of the tools and a rule that confidential data does not go into them without your consent.
Should I change contractors because of poor code?
Not straight away. First find out what state the product is in and whether the contractor can fix it. Changing without a review means the new team starts from the same unknown state, at a higher price.
How do I know the price was fair if AI wrote most of it?
The price does not pay for typing. It pays for a product that works, is secure and can be maintained. If the contractor got there faster with AI, the price is fair. If you received code with no review, no tests and no documentation, you did not get what you paid for, whoever wrote it.
We write about it. We also build it.
Let's talk about your project
A 30-minute call to understand what you're building and whether we're the right fit. Come as you are - no brief required.
Prefer email?
[email protected]