When researchers studied 15 professionals at two German technology firms using generative AI in their daily work, they found people inventing detailed, phase-specific rules for deciding what they were willing to sign.
The professionals — consultants, data scientists, software architects, business managers — did not treat AI output as a finished thing to approve or reject. They spread their oversight across the whole workflow. While drafting, they sorted tasks by audience and risk, marking out what the study calls "no-delegate zones": legal disclaimers, KPI commentary, detailed architecture notes that would take longer to prompt correctly than to write from scratch. While refining, eleven of the fifteen ran source-credibility checks, swapping blog links for the original studies. Several imposed a deliberate pause before accepting anything high-risk. For the most consequential documents, some borrowed the code pull request: treat the draft as a proposed change, add inline comments, require approval from at least two colleagues before it goes out.
Their sense of authorship tracked how deeply they had revised. Heavily rewritten material felt like their own. Lightly edited passages felt only partly owned, and under deadline pressure some participants openly credited those to the tool. Neither firm's official guidance prescribed any of this. The formal policy said employees remained responsible for accuracy and quality, full stop. The workers built the practices themselves, because the policy assigned them responsibility without specifying how to exercise it.
A longitudinal study of a mid-sized software company points the other way. Over two years, as AI-authored contributions climbed toward 90% of the total, nearly 200,000 pull requests moved through the system. Raw volume tripled while the reviewer pool grew by half, roughly doubling the review burden per person. Human review coverage fell from 89% to 68%. The share of pull requests receiving a human-written comment dropped from about 39% to 21%. Silent approvals — a reviewer clicking "approve" and typing nothing — roughly doubled per person per month.
Merge and revert rates held steady, but they do not capture whether the code is maintainable, whether the reviewer understood what they approved, or whether the organization's capacity to catch subtle problems is eroding.
In an earlier piece for this publication I noted that no organization had yet documented discovering its own verification capacity had degraded. That is still true. What this study adds is a description of the conditions under which such a discovery would be slow in coming: volume rising faster than review capacity, and the surviving indicators pointing at everything except the thing that changed.
The Linux kernel's 2026 contribution policy settles the question by fiat. An AI agent may not add the legally significant Signed-off-by certification. The human submitter reviews the code, confirms licensing compliance, and takes full responsibility. AI involvement gets recorded separately, under an Assisted-by tag.
Across all three cases the same gap is opening: between what an organization can now generate and what its people can honestly claim to have considered. The German professionals closed it with effort they were never asked to spend. The software company managed it by letting attention thin as volume grew. The kernel maintainers refused to let the question stay ambiguous. Each is a bet about where human judgment remains necessary and how to keep it there under pressure. Two of the three depend on individual conscientiousness; only one changes what the institution will accept.