AI Code Review: Pre-Screening Before Human Review
AI-assisted code review: an AI tool analyzes a pull request before a human reviewer looks at it. The AI: scans the diff for potential bugs (logic errors, off-by-one, null references), convention violations (naming, error handling, testing patterns — checked against the project's AI rules), security issues (unsanitized inputs, missing authentication, hardcoded secrets), and code quality concerns (overly complex functions, duplicated code, missing error handling). The AI's analysis: presented as comments on the PR, similar to a human reviewer's comments.
The AI review is NOT a replacement for human review: it is a pre-screening step. The AI catches: mechanical issues (convention violations, common bug patterns, security checklist items) so the human reviewer can focus on: logical correctness (does the code do what the PR description says?), architectural decisions (is this the right abstraction? Does this belong here?), edge cases (what happens with unexpected input?), and business logic (does this match the requirements?). The AI: handles the 30% of review that is mechanical. The human: handles the 70% that requires judgment.
The impact: code reviews with AI pre-screening are: faster (the human reviewer does not need to check conventions — the AI already did), more consistent (the AI checks the same things on every PR — humans may miss conventions on some reviews), and more focused (the human reviewer spends time on high-value feedback instead of nit-picks). Teams report: 20-30% faster reviews when AI pre-screening catches the mechanical issues before the human sees the PR.
How AI Code Review Works
The workflow: developer opens a PR → the AI review bot automatically analyzes the diff → the AI posts comments on the PR (specific, line-level feedback like a human reviewer) → the developer addresses the AI's comments → the human reviewer reviews the PR (with AI comments already resolved). The human reviewer: sees a PR where conventions are already correct, common bugs are already caught, and the remaining review work is about logic and architecture.
AI review tools: GitHub Copilot Code Review (built into GitHub — reviews PRs automatically), CodeRabbit (AI code review bot that posts PR comments), Codeium Windsurf (reviews as part of the IDE workflow), and custom solutions (using the Anthropic API or OpenAI API to analyze diffs programmatically). Each tool: analyzes the diff, applies rules (if configured), and generates review comments. The comments: indistinguishable from human comments in format, but labeled as AI-generated.
What the AI checks: convention compliance (naming, formatting, error handling — especially effective when the project has AI rules that define the conventions), common bug patterns (null checks, array bounds, async/await misuse, resource cleanup), security patterns (input validation, authentication, data exposure), and test coverage (does the PR include tests? Do the tests cover the changed code?). What the AI does NOT check well: business logic correctness (the AI does not know the business requirements), architectural appropriateness (the AI does not know the long-term technical vision), and subtle race conditions (complex concurrent behavior that requires deep understanding).
Without rules: the AI review comments 'Consider adding error handling.' With rules: 'This service function does not use the Result pattern (see CLAUDE.md line 12).' The specificity: transforms the AI from a generic linter into a project-aware reviewer. With AI rules: every convention is checked on every PR, every time. No convention is missed because the reviewer was rushed. No convention is forgotten because it is buried in a style guide nobody reads.
How AI Rules Make AI Review More Accurate
Without rules: the AI review checks against generic best practices. It flags: generic security patterns, generic naming suggestions, and generic code quality concerns. The feedback: sometimes relevant, sometimes not (the AI does not know which conventions the team follows). With rules: the AI review checks against the project's specific conventions. It flags: violations of the team's error handling pattern, deviations from the team's naming convention, and missing validation using the team's specific validation library. The feedback: always relevant because it references the team's actual conventions.
The specificity improvement: without rules, the AI might comment: 'Consider adding error handling to this function.' (Vague — what kind of error handling?) With rules ('Error handling: use Result<T, E> pattern for service functions'), the AI comments: 'This service function does not use the Result pattern for error handling. Expected: return Result.err() on failure instead of throwing.' (Specific — references the team's exact pattern.) The developer: knows exactly what to fix.
Convention enforcement: the most impactful use of AI review + AI rules. The AI: automatically enforces every convention in the rules file on every PR. No human reviewer: needs to check conventions (the AI handles it). No convention: is missed because the reviewer was in a hurry. Every PR: checked against every rule, every time. The consistency: impossible to achieve with human-only review (humans: inconsistent, rushed, biased by familiarity). AI review + rules: consistent, thorough, and tireless. AI rule: 'AI review + AI rules: the combination that eliminates convention violations from code reviews entirely. The human reviewer: freed to focus on logic, architecture, and business correctness.'
Before AI review: the human reviewer checks 100 things. 30 are mechanical (naming, formatting, conventions). 70 require judgment (logic, architecture, edge cases). The 30 mechanical checks: tedious, inconsistent (the reviewer misses some on busy days), and low-value (the developer could have caught them with a linter). After AI review: the AI handles the 30 mechanical checks. The human: reviews only the 70 that require judgment. Every review: more valuable. Every reviewer: more satisfied (they do interesting work, not nit-picking).
Getting Started with AI-Assisted Code Review
Step 1 — Enable an AI review tool: GitHub Copilot Code Review (available with Copilot Business/Enterprise — enable in repo settings), CodeRabbit (install from GitHub Marketplace — free for open source), or custom (build a GitHub Action that sends the PR diff to the Claude API and posts review comments). The tool: runs automatically on every PR. No developer action needed.
Step 2 — Configure with your AI rules: point the AI review tool to your CLAUDE.md or rules file. The tool: uses the rules as the convention reference for its review. Without rules: generic feedback. With rules: project-specific feedback. The configuration: tool-specific (CodeRabbit reads a configuration file, Copilot reads copilot-instructions.md, custom solutions read CLAUDE.md programmatically).
Step 3 — Calibrate over 2 weeks: the AI review will produce some false positives (flagging correct code as a violation) and may miss some issues (false negatives). Over 2 weeks: track the accuracy. False positives: caused by vague rules (the AI misinterprets) — fix the rules. False negatives: caused by missing rules (the AI does not know the convention) — add the rules. After 2 weeks: the AI review is calibrated to your codebase and produces accurate, relevant feedback. AI rule: 'The first 2 weeks: calibration. Expect some false positives. Fix them by improving rules. After calibration: the AI review is a reliable first-pass reviewer.'
Week 1: the AI review flags 15 issues. 10 are real violations. 5 are false positives (the AI misinterpreted a vague rule). The developer: frustrated by the false positives. Fix: improve the 2-3 rules that caused the false positives (make them more specific). Week 2: the AI flags 12 issues. 11 are real. 1 is a false positive. The developer: trusts the AI review. Week 3+: the AI's accuracy is calibrated. Almost every flag is a real issue. The calibration: a one-time investment that produces ongoing accuracy.
AI Code Review Quick Reference
Quick reference for AI-assisted code review.
- What: AI pre-screens PRs for bugs, convention violations, and security issues before human review
- Not a replacement: AI handles the 30% that is mechanical. Humans handle the 70% that requires judgment
- Impact: 20-30% faster reviews. More consistent convention checking. More focused human feedback
- Tools: GitHub Copilot Code Review, CodeRabbit, custom API solutions. Run automatically on every PR
- With rules: project-specific feedback. 'Missing Result pattern in this service function' not just 'Add error handling'
- Convention enforcement: AI checks every rule on every PR. No convention missed. No reviewer fatigue
- Calibration: 2-week period. Fix false positives by improving rules. Add missing rules for false negatives
- Human reviewer freed: to focus on logic, architecture, business correctness, and edge cases