AI-Assisted Software Development: How Our Team Uses It From Requirements to Code Review

AI-Assisted Software Development is changing how businesses build and deliver software. But how can teams use AI to improve development efficiency without compromising code quality and accountability? This article explores how Arestós uses OpenAI Codex across the software development lifecycle, from requirements analysis to code review and documentation.

What is AI-assisted software development?

AI-assisted software development is the use of AI coding tools to help developers analyse requirements, write and refactor code, generate tests, review pull requests, and document systems, while human developers remain responsible for design decisions, validation, and final approval.

Rather than replacing developers, AI supports existing software development workflows by automating repetitive tasks, accelerating implementation, and helping engineers identify potential issues.

AI-Assisted vs Fully AI-Generated Software

The main difference is the level of human involvement and control throughout development.

Where OpenAI Codex Fits

OpenAI Codex is an AI coding agent that helps developers understand codebases, implement changes, fix bugs, run tests, and review code.

It can operate on a developer’s computer, from a phone, or in the cloud, supporting different stages of the software development workflow.

Developers can use Codex to analyse existing systems, generate code from technical specifications, create tests, investigate bugs, and prepare technical documentation. However, all generated changes must be reviewed and validated before approval or production deployment. Codex supports developers; it does not replace their technical judgment or accountability.

Why Hong Kong Enterprises Are Rethinking Software Delivery With AI

AI adoption is growing in Hong Kong, but scaling it remains challenging due to legacy systems, skills gaps and governance requirements.

• Adoption remains shallow: 69% of surveyed organisations are experimenting with AI or running limited pilots, while only 23% report measurable financial impact. (Deloitte–HKU AI Adoption Index 2026)
• Large enterprises are moving faster: Nearly 40% plan to adopt agentic AI, roughly twice the SME share (19%). (HKT)
• Financial services is leading: 75% of 55 surveyed financial institutions have implemented or are exploring generative AI use cases. Adoption reaches 83% among large institutions, compared with 63% among smaller ones. (HKMA; SCMP)

For software teams, AI-assisted development offers a practical way to apply AI to coding, testing and code review while keeping technical decisions and quality control with developers.

Our Toolset: How We Use OpenAI Codex and Its Guardrails

We use OpenAI Codex to support coding, testing, debugging and code review through the CLI, IDE and cloud-based tasks. Its use is governed by project-specific instructions and human approval.

• Where we use it: CLI and IDE for coding and debugging, cloud tasks for delegated work, and GitHub for pull request reviews. GitHub reviews require the repository to be connected to Codex and the feature enabled. (OpenAI documentation)
• Project instructions: Codex reads AGENTS.md files before working, following global and project-specific rules for coding, testing and review. (OpenAI documentation)
• Security guardrails: We use sandboxing and approval settings, exclude secrets and client personal data from prompts, and follow client consent and data-handling requirements.
• Human oversight: Developers validate AI-generated code, run tests and approve changes before deployment.

We apply the same AI governance principles to client-facing solutions such as Generative BI.

How Our Team Uses OpenAI Codex Throughout the Software Development Lifecycle

Running Example: Multi-Store Retail Integration Project

Consider a Hong Kong retail group operating three WooCommerce storefronts for retail, B2B wholesale and corporate gifting, integrated with Odoo Community Edition (CE) and managing approximately 25,000 SKUs.

The project faces manual data synchronisation, inventory overselling and an undocumented legacy sync plugin. The scope includes two-way synchronisation using webhooks and a job queue, SKU migration, wholesale pricing tiers, end-to-end testing and handover.

The following estimates illustrate how AI-assisted development could affect delivery time across each stage:

Stage 1: Requirements Analysis and Planning

We use OpenAI Codex to accelerate requirement analysis and technical planning, while business analysts and tech leads retain control over validation and technical decisions.

From Business Requirements to Technical Specifications

Codex analyses the BRD and anonymised workshop notes to draft:

• Functional specifications for the WooCommerce–Odoo integration.
• Given/When/Then acceptance criteria.
• Assumptions and unanswered questions requiring client confirmation.

Sample prompt: Using docs/brief.md, draft functional specs for the WooCommerce–Odoo sync. Write acceptance criteria in Given/When/Then. List all assumptions and questions requiring client confirmation.

The BA reviews the output and confirms outstanding requirements with the client before development begins.

Impact Analysis on Existing Codebases

Codex traces existing models, hooks, cron jobs, custom fields and API endpoints to identify dependencies and potential regression risks.

In our simulated project: Codex identifies that the legacy sync plugin writes stock values directly to the database, bypassing Odoo’s stock movements. This reveals a hidden cause of inventory discrepancies and overselling.

Task Breakdown

Once the specifications are validated, Codex converts them into:

• Epics and user stories.
• Technical tasks with dependencies.
• A draft backlog ready for Jira.

The tech lead reviews and reorders tasks, prioritising high-risk integration work first.

Effort Estimation and Risk Assessment

Codex can draft effort estimates and a risk register covering:

• Duplicate webhook events.
• Inventory race conditions.
• Bundle SKU mapping.
• HKD pricing and rounding discrepancies.

The tech lead calibrates estimates against historical project data and validates the identified risks.

Architecture remains a human decision. For this project, the team chooses a job queue instead of direct webhook synchronisation to manage asynchronous updates more reliably.

Estimated effort: 80 hours → 50 hours.

OpenAI reports that Simplex reduced screen-design time by 40% using Codex. This is a vendor-published result, not a guaranteed productivity benchmark. (OpenAI case study)

The same discovery process can support larger enterprise software implementation projects.

Stage 2. Coding and development

During development, Codex assists with implementation, code maintenance, debugging, integration and migration. It operates under repository-specific AGENTS.md instructions and sandbox restrictions. A named developer remains responsible for reviewing and approving every change.

Generating Code from Functional Specifications

Codex converts approved acceptance criteria into individual development tasks, generating the necessary models, services, webhook controllers and unit tests.

Example prompt: Implement AC-07 (order sync on payment complete) following AGENTS.md. Use the existing queue job pattern in sync/jobs.py. Add unit tests. Do not modify the pricing module.

Developers validate the implementation against the approved specifications before merging. This workflow also supports the storefront components of our WooCommerce development projects.

Refactoring Legacy Code

Refactoring follows a test-first approach:

1. Establish baseline: Write characterisation tests to capture existing system behaviour.
2. Refactor: Ask Codex to improve the code in small, controlled changes.
3. Validate: Rerun tests to detect unintended changes to existing business logic.

Investigating and Fixing Bugs

Codex helps trace errors and develop reproducible fixes.

Debugging workflow: Stack trace → failing test → proposed fix → developer verification.

The developer must confirm that the root cause is resolved and that the fix does not introduce regressions.

Writing Database Queries, APIs and Integration Code

For the WooCommerce–Odoo integration, Codex can generate:

• PostgreSQL queries for inventory reconciliation.
• REST API clients with retries and exponential backoff.
• Idempotency checks to prevent duplicate processing.

Technical review: Developers inspect query execution plans, database performance, API rate limits and duplicate-processing safeguards before deployment. These controls are particularly important when integrating storefront operations with an Odoo ERP implementation.

Understanding Unfamiliar Codebases

Codex can help developers navigate existing repositories by identifying where business rules are implemented, tracing function calls and explaining module dependencies.

However, AI-generated explanations may miss architectural context or undocumented system behaviour. METR’s study found that experienced developers took 19% longer on average when using AI tools on large repositories they were familiar with (METR). Developers should therefore verify findings against the actual code and project documentation.

Preparing System Migration Scripts

Codex can draft data transformation and migration scripts. Before execution, each migration should include three safeguards:

Project example: The simulated project involves approximately 25,000 SKUs. The migration is rehearsed three times, with reconciliation checks performed before go-live.

Where Codex got it wrong: It mapped wholesale prices to the wrong Odoo pricelist. Characterisation tests exposed the issue before the change was approved.

Measuring Development Productivity

Reported productivity gains vary considerably by project and developer experience:

• Simplex: OpenAI reported 70% fewer development hours per screen using Codex (OpenAI case study).
• METR: Experienced developers took 19% longer on average with AI tools in its study. Participants accepted fewer than 44% of AI suggestions and spent 9% of their time reviewing or cleaning up AI output (METR).

These findings show why AI adoption should be evaluated by task type and net delivery effort, including review, correction and testing.

Development controls

• Break broad prompts into tasks with clearly defined acceptance criteria.
• Require developers to understand and explain every code diff before merging.

Deliverables: Reviewed source code, automated tests, migration scripts and reconciliation reports.

Estimated effort in the running example: 420 hours → 290 hours.

Stage 3: Automated Testing

Codex helps generate tests from acceptance criteria, automate browser-based workflows, identify edge cases, build regression tests and analyse test failures. QA engineers define test coverage and verify that each test reflects the intended business behaviour.

Generating Unit Tests from Requirements

Tests should be derived from approved requirements rather than existing implementation. Otherwise, they may simply reproduce current code behaviour, including existing defects.

Example prompt: Write pytest tests for AC-01 to AC-12 in specs/sync.md. Create at least one test per criterion. Do not read the implementation.

QA engineers review the test assertions to ensure they validate the expected business outcomes.

Automating End-to-End Browser Tests

With Playwright MCP, AI agents can explore browser-based applications and help generate automated tests from natural-language instructions.

For the WooCommerce–Odoo project, the E2E test covers the complete transaction:

Checkout → Payment confirmation → Webhook → Odoo order creation → Inventory update across three storefronts

This verifies that connected systems work together correctly, rather than testing individual components in isolation.

Identifying Edge Cases and Building Regression Tests

Codex can suggest less common scenarios that may be overlooked during test planning. QA engineers then prioritise them according to business risk.

For regression testing, every confirmed bug becomes a test case before its fix is implemented. This ensures the issue can be reproduced and prevents it from recurring in later releases.

Running example: Regression testing effort decreases from approximately three days of manual work to four hours of automated execution per release.

Analysing Test Failures

Codex can review CI logs, group failures by likely cause and help distinguish flaky tests from genuine defects.

QA engineers verify the diagnosis and determine whether the issue requires a code fix, a test adjustment or further investigation.

Two controls are particularly important:

• Test assertions: Verify that each test checks the correct business behaviour.
• Browser selectors: Use stable test IDs instead of selectors dependent on changing page text or layout.

Measuring Testing Productivity

Simplex reported 17% fewer hours spent on integration testing after adopting Codex. This is a smaller reduction than some reported gains in development, suggesting that AI’s impact varies across software delivery activities.

The objective is therefore not to maximise the number of generated tests, but to improve meaningful test coverage while reducing manual effort without compromising quality.

Deliverables: Unit and E2E test suites, test coverage report and edge-case register.

Estimated effort in the running example: 200 hours → 150 hours.

Our QA testing and automation services help businesses strengthen software quality through structured testing and validation.

Stage 4: Code Review and Quality Control

Every pull request goes through multiple quality checks. Codex reviews code for potential bugs, security vulnerabilities, performance issues and duplicated logic. Automated security scans provide an additional layer of validation, while a senior developer makes the final approval decision. AI is never the final approver.

Why AI-Generated Code Requires Stricter Review

Code that compiles and passes functional tests is not necessarily secure. Veracode’s 2026 GenAI Code Security Report found an average security pass rate of only 56% across the models tested.

Coding-specialised models performed similarly to general-purpose models, averaging 51% and 52%, respectively. Results also varied by language, with Python at approximately 63% and Java at 30% (Veracode).

These findings reinforce the need to treat AI-generated code as untrusted until it has passed appropriate review and security checks.

Our Code Review Pipeline

The review process combines AI assistance with automated controls and human approval:

1. Developer self-review: The developer asks Codex to inspect the changes before submitting a pull request.
2. Codex PR review: Codex reviews connected GitHub pull requests and flags high-priority P0 and P1 issues (OpenAI documentation).
3. Automated security scanning: Static Application Security Testing (SAST) and Software Composition Analysis (SCA) run in the CI pipeline.
4. Senior developer approval: A senior developer reviews the findings and approves the changes before merging. Branch protection can enforce this approval requirement.

What the Review Checks

Turning AI Findings into Better Human Reviews

Codex findings help reviewers identify areas requiring attention, but developers must assess each comment rather than accept every suggestion automatically.

Human reviewers prioritise architectural decisions, business logic, maintainability and the potential impact of changes across connected systems. This is particularly important when considering how to structure a QA team with AI-assisted development in the workflow.

Common review risks

• Alert fatigue: Tune review rules to focus on actionable, high-impact findings.
• Rubber-stamping: Require reviewers to document their reasoning for high-risk changes and verify that critical findings have been addressed.

Deliverables: Pull request review records, security scan reports and an approval audit trail.

Estimated effort in the running example: 80 hours → 60 hours, with 100% of pull requests scanned.

Stage 5: Documentation and Knowledge Sharing

Codex helps turn codebase knowledge into practical documentation, explain legacy business logic and answer new developers’ questions. This makes technical knowledge easier to access and reduces reliance on individual team members. Developers review and approve all documentation.

Generating Technical and API Documentation

Codex can draft and update:

• API references: Endpoint descriptions, parameters, response schemas and error codes (e.g. OpenAPI).
• README and setup guides: Project structure, dependencies and environment configuration.
• Operational runbooks: Steps to investigate and rerun a failed sync.

Keep documentation in the repository and update it in the same PR as related code changes.

Explaining Legacy Business Logic

Codex can trace business rules across the codebase and translate them into plain-language explanations.

• Running example: Codex converted wholesale pricing tiers into a rule table. During review, the client identified an outdated pricing rule.
• Human checkpoint: The business owner confirms that the documented rules reflect current business requirements.

Accelerating Developer Onboarding

Codex can generate a codebase tour covering:

1. Core modules and their responsibilities.
2. Key data flows and system integrations.
3. Important configuration files and development commands.

New developers can also ask Codex repository-specific questions instead of relying entirely on senior team members. In the running example, time to the first meaningful PR decreased from approximately two weeks to four days.

Reducing Dependency on Individual Developers

Teams document architecture decisions in Architecture Decision Records (ADRs), while Codex helps draft summaries and update supporting documentation.

This is particularly valuable when working with offshore software developers, where accessible documentation supports knowledge transfer across distributed teams.

Common pitfall: AI-generated documentation may sound correct but describe outdated or incorrect behaviour. Review it alongside the code.

Deliverables: API documentation, runbooks, business rules glossary and onboarding guide.

Running example result: Estimated effort decreased from 100 hours to 70 hours.

Limitations and Risks of AI-Assisted Development

AI-generated code can be incorrect, insecure or based on invented assumptions. It requires rigorous review before deployment. Key risks include:

• Hallucinations and incorrect suggestions: AI may produce plausible but inaccurate code or explanations. Hong Kong’s GenAI Technical and Application Guideline highlights hallucinations and bias as model limitations. Mitigation: Verify outputs against project requirements and actual system behaviour.
• Security vulnerabilities: Veracode’s 2026 report found an average security pass rate of just 56% across tested AI models. Mitigation: Apply code reviews, SAST/SCA scans and security testing.
• Uncertain productivity gains: A METR study found experienced developers were 19% slower with AI tools, despite expecting productivity gains. Mitigation: Measure actual delivery time and rework.
• Data privacy and confidentiality: Uploading source code or customer data to cloud-based AI tools may expose confidential information. Mitigation: Classify data and use approved tools with appropriate security controls.
• Intellectual property and licensing: AI-generated code may raise ownership and open-source licensing issues. Mitigation: Define code ownership in contracts and review licence compliance. Hong Kong’s proposed text and data mining copyright exception has not become law.
• Code quality and over-reliance: Accepting code without understanding it can increase technical debt and weaken developer skills. Mitigation: Require code-reading reviews and developer accountability.

Business Benefits and Limitations of AI-Assisted Development

AI-assisted development can improve software delivery efficiency, particularly in routine development tasks, testing and code reviews. However, its effectiveness depends on the task, the quality of human oversight and the complexity of the system.

Benefits of AI-Assisted Development

• Faster routine development: Codex accelerates repetitive coding, documentation and test generation, allowing developers to focus on more complex engineering work.
• More consistent testing: AI generates tests from acceptance criteria, identifies edge cases and helps expand test coverage.
• More efficient code reviews: AI scans pull requests for potential bugs, security issues and coding inconsistencies before human approval.

Research shows that productivity gains vary by task and working environment. OpenAI’s Simplex case study reported reduced effort in design and integration testing.

However, METR’s study found that experienced developers took 19% longer on certain familiar coding tasks when using AI. Enterprises should therefore measure actual productivity rather than assume AI always accelerates development.

Limitations of AI-Assisted Development

• Developer review remains essential: AI-generated code may contain bugs, security vulnerabilities or incorrect assumptions. Developers must understand, test and validate every change before approval.
• Architecture requires human judgment: System design, technology selection and technical trade-offs depend on broader business and engineering considerations that AI cannot reliably decide on its own.
• Complex business logic needs domain expertise: AI can help interpret requirements and existing workflows, but developers and business stakeholders must verify that the implementation reflects actual business rules.

What This Means for Arestós Clients

For Arestós clients, AI-assisted development can shorten delivery timelines and reduce costs on routine development work without compromising engineering accountability. Our developers use AI to support tasks such as coding, testing and documentation, while a designated engineer remains responsible for reviewing changes, validating functionality and overseeing each release.

This approach supports different project needs across Arestós services:

• E-commerce web development: Apply AI-assisted workflows to online store development, platform customisation and third-party integrations. Explore E-commerce Development.
• Corporate website development: Support the development and maintenance of corporate websites, brand platforms and content-driven sites. Explore Corporate Website Development.
• Offshore IT staffing services: Extend your development capacity with offshore engineers who work alongside your in-house team, supported by AI-assisted workflows where appropriate. Explore Offshore IT Staffing Services.

The objective is not simply to generate code faster, but to help clients deliver software more efficiently while maintaining clear ownership, quality standards and human oversight.

Frequently Asked Questions

1. Is AI-generated code safe for production?

Only after it passes the same tests, security scans and senior approval as any other code. AI-generated code averages a 56% security pass rate across more than 100 models (Veracode), so we treat it as unverified until it has been checked.

2. Who reviews and approves AI-generated code?

A named senior developer or tech lead approves every PR. Codex does the first review pass and CI runs security scans, but AI is never the final approver.

3. Does AI-assisted software development reduce development costs?

It reduces effort on routine work, but results vary. Simplex reported 70% less development time per screen, while METR found experienced developers were 19% slower. We report net savings for each project.

4. Can AI replace software developers?

No. AI speeds up specific tasks, but judgment about requirements, architecture, business logic, security and accountability stays with people.

5. How does OpenAI Codex support the software development process?

It drafts specs and impact analyses, generates and refactors code, writes tests, reviews every PR and drafts documentation, following the repository’s AGENTS.md rules.

6. How should regulated Hong Kong companies approach AI-assisted development?

Align with PCPD and DPO guidance (GovHK). Financial institutions should also follow HKMA and SFC expectations.

7. How do we measure whether it’s working?

Track net time saved, rework rate, defect escape rate and PR cycle time, rather than how fast the team feels. In METR’s study, developers still believed they were 20% faster even though they had been slowed down.

Conclusion

AI-Assisted Software Development enables Arestós to streamline routine development tasks while keeping engineering expertise and human oversight at the centre of every project. By combining OpenAI Codex with experienced developers, we help businesses improve delivery efficiency without compromising software quality or accountability.

Looking to apply AI to your next web or software project? Book a free consultation on AI-assisted web and software development with Arestós to explore the right approach for your business.