Rolling out AI coding in a team: rules that help

What the research says

Do not automatically expect a big leap. In a 2025 randomised study by METR, experienced open-source developers took about 19% longer with AI on tasks in familiar projects, yet rated themselves faster. The sample was small, the tools evolve quickly, and METR itself now assumes the picture has changed.

The lesson for your team is not “AI achieves nothing”. It is that feeling faster is no proof. Measure it.

Rule 1: Settle the data first

Which tools are allowed, and under what contract?
Is code used for training? Check the setting on your plan, not the marketing page.
What must never go in a prompt: customer data, credentials, third-party code under confidentiality?
If you process personal data in the EU, data processing has to be settled too.

If there are no permitted tools, people use some anyway, just without you knowing.

Rule 2: The author stays responsible

Whoever opens the pull request has understood it and can explain it. “The AI wrote that” is not a reason. This one rule prevents many problems.

Rule 3: Small changes

AI makes it easy to generate a thousand lines, and reviewers then tend to approve because they cannot read it all. Limit the size of changes. Review becomes the bottleneck, and that is where quality is decided.

Rule 4: Tests and CI first

Agents do well when they can check their results: tests, linters, type checks, security scans. Without these guardrails, you just manage faster mistakes. Also require a failing test for a bug before the fix. Otherwise models happily change the test until it passes.

Rule 5: Write the project rules down for the model

Keep a file in the repository with conventions, build commands, architecture decisions and things not to do. Most tools read this automatically. It saves corrections and puts everyone on the same instructions.

Where AI usually helps and where less

Usually good	Riskier
Understanding unfamiliar code	Authentication and permissions
Tests, migrations, boilerplate	Payments and cryptography
Throwaway prototypes	Large rebuilds with no tests
Debugging with clear logs	Unknown libraries without checks

Agents with care

Agents that run commands need limits: no access to production data, no long-lived credentials, and changes go through the normal review process. Content from the web or tickets can contain hidden instructions. Treat it as untrusted input.

How to measure the benefit

Lines of code are not a measure. Better ones are:

Lead time from task to production
Failure rate and rollbacks after deployment
Duration and size of reviews
The team’s view of maintainability after a few months

Measure before rollout so that you have a baseline. Start with one team over a clearly limited period, not everyone at once.

Do not forget junior developers

People who let AI solve every task do not learn the checking they will need later. Plan tasks someone solves alone first, and have juniors justify AI suggestions in review.

For apps already built, the pre-launch checklist helps. If you want support with the rollout: AI coding with tob-apps.

Rolling out AI coding in a team