Does it make sense to have an AI review delivered software code before acceptance?

There's a major legal risk here. What do the confidentiality or IP clauses in your agency contract say? Uploading proprietary codebase files to a cloud-based AI system could unintentionally put you in breach of contract. If the data is used for training on third-party servers, you'll leave yourself wide open while trying to defend your rights.

From a technical standpoint, the biggest limitation is the context window. A 26.000 EUR warehouse system likely spans dozens of services, database schemas, and external integrations. Models look at files in isolation. Because it doesn't see the data validation handled by a function three files over, it might falsely raise an alarm crying 'security vulnerability here'.

Under German contract law, defects must be concretely documented before signing the acceptance protocol. Text output from an AI does not count as a valid defect notice. The defect must be reproducible in a running system, and you have to prove that it fails to meet the requirements set out in the technical specifications.

We tried this exact thing last year on an 18.000 EUR B2B portal. The model spat out a 47-item list. Before taking it to the agency, we paid a freelance senior dev 400 EUR to review it. Only 4 of those 47 items were actual defects; the rest were bogus. But one of those 4 bugs was severe enough to crash the system in production. Useful as a filter, totally inadequate as a final judge.

instead of pasting all the code and sying find the bugs, you'll get way cleaner results if you go module by module with focused prompts like list dependencies and security vulnerabilities, but definitely don't send raw model output to the agency they won't take you seriously.

Don't overcomplicate it. Run the acceptance process straight through user experience and functionality. Set up test scenarios: 1) What happens when an invalid barcode is scanned? 2) Does stock sync break if the internet drops and reconnects? 3) Does the system hang while issuing an invoice? Your job is to verify whether it does the actual work, not critique the prose of the code.

Did your contract include an automated testing clause or a test coverage threshold? Also, are there unit tests written by the agency in the delivered repository? If test suites exist, running them gives you a far clearer, indisputable acceptance metric than having an AI read the code.

One of our clients pulled something like this. They brought an eight-page list generated from a prompt to our meeting and claimed 'your software is garbage'. One item said 'database password is hardcoded', but it was literally just an example config template, the actual password was read from an environment variable. The whole room got incredibly tense and delivery was delayed by two months for nothing.

This is exactly what we experienced. Most time waste accumulates in tasks waiting for approval.

Hope this helps.

I've been dealing with this for a long time. Everything goes well for the first three months; problems arise in the fourth.

Hope this helps.

To get into the details: Everyone rushing into code review prompt gets stuck at the same point.

Here's how it went for us. The harder it is to reverse a decision the slower you should make it.

Correct me if I'm wrong.

I don't think this advice fits everyone. When making decisions, write down the worst-case scenario too, not just the best.

Of course, it varies if your situation is different.

There's a part I don't understand. If you don't write this down from the start, it leads to arguments later.

Most time waste accumulates in tasks waiting for approval. I'm also curious if anyone does it differently.

I'm writing this so you don't make the same mistake. If you don't write this down from the start it leads to arguments later.

If you post the result here, it will help others too.

How did you solve this? Every "we'll look at it later" in a meeting means unbilled work.

That's all, sorry if I went on too long.

Three different views emerged, they all complement each other. The harder it is to reverse a decision, the slower you should make it.

Hasty decisions become decisions you have to fix six months later.

youre righht but the biggest time-waster for us was not knowing who had the final say.

of course, it varies if your situation is different.