AI coding ROI is a throughput problem, and verification is how you solve it

Planning season is around the corner, and for many engineering leaders this year's budget conversation includes a line item that barely existed two years ago: AI coding tools and the tokens they consume. The adoption story is easy to tell, since most software developers now work with coding agents every week and code volume has grown accordingly. The harder question, and the one finance teams are increasingly asking, is what all of that code has actually delivered to the business.

Before we get into what to do about it, let's look at where the value of AI-generated code sits and where it tends to leak away.

What does business value look like in AI-assisted development?

AI coding agents are now part of everyday professional development. JetBrains' 2026 Developer Ecosystem Survey found that 90% of professional developers use AI coding agents at work at least weekly, and 68% use them daily. In BairesDev's Q3 2026 Dev Barometer, 42% of the software developers surveyed said AI writes at least half their code, up from 12% a year earlier. These figures measure adoption and activity, and they tell you very little about return.

Software development produces value only when working change reaches production and does what the business needs it to do. Until that happens, code carries cost in tokens, compute, review hours, and engineering attention without giving the business anything it can use.

That is where the picture gets uncomfortable, because activity and value are now moving apart. Telemetry from 22,000 developers in Faros's Q2 2026 AI Engineering Report shows teams with high AI adoption completing 66% more epics, while deployments per week fell by nearly 12% and incidents per pull request tripled. CloudBees' State of Code Abundance 2026 found that 67% of enterprise technology leaders report a significant increase in code volume, yet only 31% of AI spend can be attributed to specific business outcomes, and 81% have seen production issues from AI-generated code increase. Code is moving faster while the value it delivers lags behind.

Agentic development ROI therefore comes down to the ratio between verified changes that ship and stay shipped and the full cost of producing them. Raising the first and lowering the second is what makes AI pay for itself, whereas measuring generation volume alone tends to produce gains that never show up in the P&L.

Where does the value of AI-generated code leak away?

Value rarely disappears in one dramatic moment. It erodes through four distinct forces, each with its own cost profile, which is why it helps to look at them one at a time.

Production cycles stretched by retries. Agents rarely ship on the first attempt. When a generation fails a build or a review, the agent tries again, often regenerating far more than the defect required, and every loop consumes tokens and calendar time. As AI coding tools move from flat-rate licenses to usage-based billing, those loops become a cost finance can see, and code quality has a direct effect on the size of the bill: Sonar research found that agents working in cleaner codebases used 7.2% fewer input tokens and 8.5% fewer output tokens on the same tasks, with no meaningful change in completion rate.

Rework. AI-generated code has an awkward habit of looking right. 61% of developers say AI often produces code that looks correct but isn't reliable, and 38% say reviewing it takes more effort than reviewing a colleague's work. Defects that pass a quick review surface later, after integration or release, and the work has to be done twice, so the time saved in generation gets spent again in correction. Developers still lose roughly a quarter of their week to toil, regardless of how heavily they use AI.

Remediation. Issues that slip past review settle into the codebase as debt. Carnegie Mellon researchers studying 807 open-source repositories that adopted Cursor found a three-to-five-times increase in lines of code added in the first month that proved temporary, alongside a persistent 30% increase in static analysis warnings and a 41% increase in code complexity. The study covers open-source projects and a single tool, so it doesn't describe every enterprise team or coding agent, but it shows the risk clearly. Debt of this kind is costly in two ways: it slows down the engineers who maintain the code, and it raises the cost of every future agent run that has to work through it.

Incidents. Problems that get past the earlier stages eventually reach customers. DORA's 2024 research associated every 25% increase in AI adoption with an estimated 7.2% decrease in delivery stability, and its 2025 report found AI still associated with rising instability. Incidents are where engineering cost turns into business cost, through lost revenue, breached SLAs, regulatory exposure, and executive attention pulled away from growth.

How do AI coding costs compound?

AI coding costs compound because the four forces, while distinct, reinforce each other when nobody intervenes. Unverified code that leaves the agent loop can become rework at review, and rework that misses something can turn into remediation debt. That debt makes the codebase harder for both people and agents to change, which lengthens the next cycle and raises the next token bill, and the defects that escape all of it become incidents. The result is a cost that grows with every cycle that runs without verification, and a problem that would have taken minutes to fix inside the agent loop can end up as a postmortem.

Why is throughput the number that matters?

Generation speed is the easiest number to collect, which is probably why it ends up on so many dashboards, but it is also the number least connected to value.

Throughput is the rate at which verified, working change reaches production, and it holds up when speed and stability improve together. DORA's data illustrates the risk when the two diverge: in 2024, a 25% increase in AI adoption was associated with an estimated 1.5% decrease in delivery throughput, alongside the drop in stability. By 2025 the throughput association had turned positive, while the association with instability persisted. DORA describes AI as an amplifier that magnifies the strengths of strong delivery systems and the weaknesses of weak ones.

Anyone who has queued at a supermarket with a single open checkout already knows the principle behind this: the line moves only as fast as its slowest point. Agents moved that slowest point from writing code to verifying it. Every change that loops back for another attempt consumes the capacity of that stage a second time, so reducing those loops is one of the most direct ways to raise throughput where it is constrained.

This is the business case for verification. Done well, it protects AI speed by giving it a chance to survive into delivery, and a verification program that works shows up as rising throughput and a falling cost per accepted change. The number of findings it produces says much less about whether it is working.

How can teams reduce rework in agentic development?

There is no single switch that fixes this, but five practices make a measurable difference when they are applied together.

1. Guide agents before they write. Many retries start with an agent that lacks context about your architecture and standards. Supplying that context up front raises first-pass quality and removes the codebase discovery work that inflates token costs.

2. Verify inside the agent loop. Check code as it is generated, so problems surface while the agent is still working on the change. An agent that sees a security flaw or logic error while writing can correct it before the change reaches a reviewer, whereas the same flaw found at review costs a full cycle, and found in production it costs an incident.

3. Hold every change to one independent standard before merge. Teams reduce rework most reliably when they apply a single, deterministic quality and security standard to human and AI code alike, run by a system separate from the one that generated the code, because a model grading its own output cannot provide independent verification. DORA's research also points to small batch sizes and strong testing as fundamentals that shape whether AI improves delivery, so it pays to keep changes small enough to review properly.

4. Fix what verification finds, automatically. Findings that wait in a backlog become debt, so resolve them at the pull request when a quality gate fails and work down the existing backlog continuously, re-verifying every fix before a developer sees it.

5. Report metrics that tie AI spend to shipped value. Replace activity metrics with software delivery metrics a CFO can audit, such as cost per accepted change, first-pass acceptance rate, time from first draft to merge, rework rate, change failure rate, and the trend in the remediation backlog. CI loop effectiveness, meaning the share of problems caught before merge, is the leading indicator behind all of them.

But does verification actually pay off?

It's a fair question, especially when verification sounds like one more step between an agent and a merged pull request. Organizations that verify systematically report better results. In the 2026 State of Code Developer Survey, SonarQube users were 44% less likely to report production outages caused by AI-generated code. They were also more likely than non-users to say AI had a positive impact on rework and patch costs (47% versus 40%) and defect rates (44% versus 37%), with a similar gap on vulnerability rates (39% versus 31%).

Costs move with quality as well. As we saw earlier, Sonar research found that agents working in healthier codebases used 7.2% fewer input tokens and 8.5% fewer output tokens on the same tasks, which makes code quality an AI cost lever in its own right. Context has a separate effect on top of that: when Sonar Vortex gives agents precise, governed context instead of leaving them to search the codebase file by file, Sonar research shows up to 36% lower token consumption on refactoring tasks.

How does Sonar help turn AI speed into shipped software?

Sonar provides independent AI code verification across the full agentic development cycle, from the agent's first draft to the main branch, with each capability aimed at a specific force:

• Sonar Vortex gives agents your project's standards and codebase context before they write, then verifies their output while they work, which reduces retries and the token costs that come with them.
• SonarQube applies deterministic analysis across more than 40 languages with a 3.2% false-positive rate, and its quality gates enforce one standard on every pull request, whether a person or an agent wrote the code, which reduces rework and the incidents that follow from it.
• Gitar reviews every pull request and diagnoses CI failures, then iterates on fixes until the build passes, shortening the time from first draft to merge.
• SonarQube Remediation Agent generates fixes when a quality gate fails and works down the existing backlog in the background, re-verifying every fix before it opens a pull request, so the backlog shrinks over time instead of compounding.

Together, these capabilities give the time AI saves in generation a much better chance of reaching production as working software, delivered faster and at a lower cost per change.

Where to start

AI-generated code becomes business value only when it ships and holds up in production. Retries, rework, remediation, and incidents are where that value leaks, and they compound when left unchecked, so the earlier you catch them, the more of your AI investment you keep.

If you're preparing next year's AI budget, start by measuring what share of your AI-generated changes ship and stay shipped, and what each of those changes cost to get there. That baseline will tell you more about your AI coding ROI than any count of lines generated, and it gives you something concrete to show finance once verification starts moving the number.

Start reducing AI coding waste with Sonar.