How do you measure human vs AI-generated code?

What the number means — and what it does not

Audience: an engineering manager, CTO, or founder sizing AI adoption and review capacity. This page is not legal advice. It does not rank individual developers.

Organisations want a human versus AI authorship share to plan review load, licence spend, and risk exposure. The metric is useful only when the denominator is explicit and provenance is honest. It does not measure code quality, security, productivity, or individual performance. Using it as a performance KPI invites gaming — Goodhart's law: when a measure becomes a target, it ceases to be a good measure.

SPACE (Forsgren et al., ACM Queue) emphasises multidimensional developer experience and warns against single-metric surveillance. DORA metrics are team and system level. Keep authorship share at portfolio or team level for exposure sizing, not individual scorecards. Last verified 10 September 2026. Not legal advice.

• Legal requirement versus guidance versus best practice versus SRM recommendation: GitHub metadata conventions are platform best practice. SPACE and DORA are research-backed frameworks — guidance, not law. ShipReady AI-authored-code floor and per-committer metering are telemetry recommendations — not HR analytics.
• The detect-ai-generated-code guide on this site explains provenance versus classifiers. The measure-ai-generated-code-risk guide on this site links share to risk signals. The how-shipreadymetrics-measures-ai-roi-engineering-health guide on this site connects share to ROI views.

Pick the denominator — lines, commits, or pull requests

Each denominator answers a different question. Mixing them without labelling produces nonsense comparisons.

Attribution rules — co-authorship and edits

AI-generated code edited by a human is still partly AI-sourced. YOUR policy should state whether lightly edited AI blocks count as AI-attributed (common for risk) or human (common only if rewrite threshold is defined).

Co-authored commits should use platform markers — see detect-ai-generated-code guide. Agent bots should use dedicated identities.

Do not use probabilistic classifiers as the sole attribution source. Pair markers with spot audits.

Per-committer metering counts distinct committers for licence alignment — a different question from AI share.

Illustrative example — not a study

Illustrative example only, with invented numbers for teaching. Not empirical data from ShipReady Metrics or any published study.

Suppose a team chooses pull requests merged as the denominator for Q3. They tag PRs with primary authorship: AI-assisted, human-only, or mixed. In the illustrative quarter, 40 PRs merged: 10 AI-assisted, 25 human-only, 5 mixed. AI-primary share by PR count = 10 ÷ 40 = 25 percent. Mixed PRs are excluded from the numerator unless YOUR policy splits them — if YOU assign mixed to 50 percent AI weighting, adjusted AI exposure = 10 + 2.5 = 12.5 of 40 = 31.25 percent.

If the same team instead measures lines added on main from git markers, illustrative totals might be 12,000 human-attributed lines and 8,000 AI-attributed lines in the quarter. Line share = 8,000 ÷ 20,000 = 40 percent — a different story than 25 percent by PR. Report both only if YOU label denominators clearly. Never compare teams on different denominators without adjustment.

Do not use authorship share as a performance metric

High AI share does not mean high output quality or low output quality. Low AI share does not mean excellence. Incentivising lower or higher AI usage distorts behaviour — merge size manipulation, marker avoidance, or rejecting helpful assistance.

Use authorship share to size security and review investment: if 40 percent of lines are AI-attributed on a service, allocate proportionate SAST coverage and senior review to that service.

Pair with outcome metrics from the measure-ai-generated-code-risk guide — finding rates and change failure — not a leaderboard for individual velocity.

What you need to do now

Operational steps. Not legal advice.

• Document one primary denominator and a mixed-PR rule in YOUR AI governance policy.
• Mandate provenance markers on approved tools — detect-ai-generated-code guide.
• Publish a monthly team-level dashboard; exclude individual rankings.
• Reconcile PR-level and line-level views before presenting to executives — label both.
• Connect share trends to review capacity and security finding cohorts.
• Read the how-shipreadymetrics-measures-ai-roi-engineering-health guide for product-specific views.

Checklist

Measurement hygiene. Not a certification.

• Denominator documented in writing?
• Mixed and edited-AI rules defined?
• Provenance markers enforced on protected branches?
• Authorship share reported at team or repo level only?
• Outcome metrics paired with share (findings, change failure)?
• Executives briefed that share is exposure sizing, not productivity?

Where this shows up in ShipReady Metrics

AI-authored-code floor in signed-in AI Code Readiness reporting shows git-marked or attributed AI commit counts — a provenance-based input to share calculations YOU may combine with line stats from YOUR VCS.

Per-committer metering in signed-in admin Committer Seats reports distinct committers in a 90-day window for licence alignment — not AI percentage per person.

AI ROI scoring may incorporate throughput and cost estimates alongside authorship signals; figures are estimates, not audited financials.

This product does not rank individual developers by AI usage and does not certify that YOUR share calculation is complete if markers are omitted.

Primary sources (last verified 10 September 2026)

DORA research and metric guidance at dora.dev. GitHub commit and co-author documentation. SPACE framework, Forsgren et al., ACM Queue. Goodhart, Problems of Monetary Management, 1975. Not legal advice.

Frequently asked questions