Reporting Doesn’t Stop Incidents. Verification Does.

Inside a lot of engineering organizations right now, leadership has asked for visibility into AI-generated code as it moves through the pipeline. And they got it. The assumption that follows almost automatically: Now someone’s watching, so the risk is being managed. 

But that assumption doesn’t hold up. At least not cleanly. 

In our recent report, The Enterprise AI Code Verification Crisis, we found that 93% of organizations with AI-generated production code say leadership receives some form of reporting on it. Yet 80% of those same orgs have already traced a production incident back to that code anyway. 

Reporting and understanding turned out to be two different things wearing the same badge. Only 38% of leaders get a regular view of what’s shipping, while the rest work from occasional updates. And a small but significant 7% have no visibility at all. Engineering leaders are more in touch with daily tasks than executives, so they tend to say their organization gives regular updates more often (41% compared to 34%). This means the people setting the strategy are usually relying on older information. 

A report tells you what already happened. Whether it tells you anything useful about what’s about to happen is a separate question, and most organizations haven’t answered it yet. 

None of this would matter much if AI-generated code were still a pilot program. It isn’t. 

Eighty-three percent of organizations now deploy production code that is more than 10% AI-generated, and more than a quarter report that AI accounts for over a quarter of what ships. A year ago, the question we asked was whether teams were experimenting with agentic AI in testing at all: Two-thirds of those who were called themselves “piloting.” This year, the question assumed AI-generated code as a baseline and asked how much. The pilot became the pipeline, and it happened faster than most testing infrastructure could follow. 

Independent research backs up what the timeline suggests. A 2026 NBER paper tracking more than 100,000 GitHub developers found that AI coding tools drove a 741% increase in code output but only a 20% increase in actual software releases, a gap the researchers attribute to human review and testing as the bottleneck. 

Code got cheap to produce. It did not get cheap to verify. 

And the organizations pushing hardest on the first half of that sentence are, disproportionately, the ones absorbing the cost of the second: Orgs above the 10% AI-code threshold ship with known testing issues at a rate of 91%, compared to 73% for orgs still under it. 

That correlation — more AI-generated code, more knowingly shipped defects — has a name. 

Call it the confidence gap, or call it what it actually is: an AI code verification crisis, with financial, operational, reputational, and legal problems arising from how much an organization is shipping and the confidence it can actually stand behind it. That gap between speed and quality shows up as reporting that doesn’t prevent incidents or as budget that keeps climbing while safeguard confidence keeps falling, with 92% of leaders in our survey expressing some level of concern that their current safeguards won’t catch AI-generated quality issues before they reach production — and 41% putting that concern at "very" or "extremely."

Worse yet, the problem shows up in a less obvious place: in how ROI is measured. With 89% of organizations reporting positive returns from their AI testing tools, that sounds like a technology winning cleanly on its merits … until you notice that the organizations reporting the strongest ROI are, in large numbers, the same organizations tracing incidents to AI code, shipping with known defects, and worrying openly about their own safeguards. It's less a contradiction than a tell. Speed is easy to measure and shows up fast. Quality debt is quiet and shows up later, usually on someone else's sprint. 

None of that cost shows up on a slide about velocity. The challenges show up on the release calendar instead. Sixty-six percent of organizations admit teams have compromised on quality or testing standards to hit a release deadline in the past year, as 21% say they know it happened, and 45% say it probably did. An eye-popping 53% have shipped to production with known, unresolved issues at least some of the time. 

But these aren't separate problems. It’s the same pressure, described from two different vantage points. 

The workforce data adds a wrinkle that the "AI replaces testers" narrative doesn't account for. QA headcount grew at 64% of organizations over the past year, and the growth concentrates exactly where the incident data would predict it should: in orgs that have traced a production issue to AI code increased QA headcount at 67%, compared to 51% of those that haven't. Instead of shrinking the need for verification, AI generates enough additional volume and risk that organizations are hiring to keep up with it. 

At the same time, 84% of organizations have eliminated or significantly reduced at least one role because of AI adoption, and more than half of those cuts hit junior developers and manual QA testers specifically. Senior QA headcount is growing while the pipeline that has historically produced senior QA people is narrowing. An organization can be adding capacity and eroding its own future capability in the same fiscal year. 

None of what's just been described — the compromises, the headcount shuffle — shows up on a green build. 

Test-pass rate and shipped-feature count were the metrics of the last era, but the data argues for a different scoreboard now.

Incident-to-AI-code attribution. How often a production incident traces back to AI-generated code specifically, tracked with the same rigor as a security metric, not absorbed into a general defect count where it quietly disappears.

Disclosure consistency. Sixty-two percent of organizations currently disclose AI-generated code to customers only "in certain situations." In the EU AI Act era, that judgment call creates compliance concerns, yes, but also legal liabilities and broken customer trust. 

Calibrated safeguard confidence. A whopping 92% of leaders are concerned that their safeguards won't catch AI-generated issues before production, yet 89% report positive ROI from AI testing tools. In the era of the AI code verification crisis, confidence and evidence have quietly come apart. The fix involves measuring one against the other rather than reporting them separately. 

Production error-free rate, tied to what shipped. The share of real user sessions running without an error, connected back to the build and test run that produced them — the number that actually closes the loop between "the tests passed" and "the release held up in the real world."

ROI, redefined. Today, ROI is measured by speed and output (shipping faster, more code) rather than by quality outcomes (fewer incidents, lower defect costs). Until those sit on the same dashboard, ROI will keep reading as good news regardless of what's happening downstream. 

Each of these needs a vantage point outside the code itself, which is a different way of describing what verification has always been for. Who actually holds that vantage point depends on where you sit, and the data points to three different answers. 

If you're running engineering, the near-even 53/47 split in this survey — deploying AI too fast versus falling behind — is a decision your organization has probably been making implicitly rather than on purpose. It's worth making deliberately, because right now the answer is being decided deadline by deadline by whoever's closest to the release button that week.

If you're on a QA or testing team, the headcount data is the argument for the work you're already doing, not a threat to it. The organizations under the most pressure are those investing in more verification, not less. The way we see it: Verification is getting harder to do well as opposed to becoming less necessary. 

If you're on the board or own risk, disclosure and governance are converging into a single conversation. Only 27% of organizations disclose consistently, and 34% have already faced a regulatory inquiry or fine tied to a software defect. The organizations building a clear, auditable record now — what was known about AI-generated code, when it was known, what was done about it — are building the evidence they'll need before a regulator asks for it. 

None of this is an argument for slowing down. The old model — testing built around manual effort and human-scale output — didn't fail, but AI undoubtedly outgrew it. 

Fortunately, that's a solvable mismatch, and the Sauce Labs AURA platform resolves the tension. AURA verifies every release against business intent, authoring, running, and analyzing tests across the full lifecycle, in an autonomous learning loop with humans in control, not a dashboard reporting on what already shipped. Even better, that loop now runs into production: a real-time error-free rate on every release, tied back to the build and tests that produced it, instead of a crash report arriving after the fact. 

Organizations using AI-unified release assurance report 90% fewer production incidents, 47% faster release cycles, and 38% of engineering capacity reclaimed from test maintenance. The gap between watching the code and standing behind it requires intentional effort to bridge. That's what release assurance is for. 

Is your next release actually ready to ship? Book a demo to see how AURA verifies releases against business intent, rather than relying on reporting alone.