AI-generated code in critical infrastructure - audit requirements?

AI-generated code is entering critical infrastructure, often without clear provenance. What audit requirements should apply - full human review, targeted testing, or model-level certification of the generator?

Cost-wise, this looks good on paper, but double-check the production numbers before committing.