AI is a good first-pass code reviewer and a poor final one. The split is clear: it catches obvious issues (unused variables, shadowed names, off-by-ones, missing error handling) quickly and consistently, but it does not understand what the change is for at the system level. Set up the loop around that split and you ship better PRs faster.
The diff, not the file
Always feed the model the diff first, not the whole file. Reviewers — human or AI — read diffs. Asking for a review of a full file produces generic observations about the file's existing code, most of which isn't what the PR is changing.
Tip
Paste the unified diff with three lines of context. Ask the model to only comment on the changed lines. This one constraint filters out the majority of "here's how I would rewrite this other part of the file" noise.
Give it the goal of the PR
A one-sentence description of what the PR is trying to achieve changes the quality of the review more than any prompt engineering. "This PR adds retry logic to the webhook handler" lets the model check for retry-specific concerns — idempotency, exponential backoff, dead-letter behaviour — that a goal-less review will miss.
Ask for categories, not prose
Structure the output. A freeform review drifts; a structured one stays honest:
- Bugs — behaviour that is wrong as written.
- Risks — behaviour that could go wrong under load or unexpected input.
- Style — conventions the codebase already enforces elsewhere.
- Questions — things the reviewer would ask the author before approving.
Categorised output makes it trivial to triage which items to act on.
What humans still do
- Judge whether the change belongs. AI will happily accept a well-written implementation of the wrong feature.
- Weigh tradeoffs. "Is this the right abstraction?" is a design call, not a review comment.
- Vouch for merges. An AI comment is a suggestion; a human approval is accountability.
Where this breaks
Security-sensitive review. Models will miss subtle auth bugs and timing attacks with alarming confidence. For those paths, AI is a complement to a human security reviewer, not a substitute.