The “AI plus QR codesA 2D matrix barcode that encodes data in a square grid of black and white modulesA single black or white square in the QR grid. The number of modules per side scales with the QR versionThe size of a QR code, numbered 1 (21×21 modules) through 40 (177×177). Higher versions store more data but require more printed space. Read more →, from 21×21 modules for version 1 up to 177×177 for version 40. Read more →. Read more →” headline is everywhere in 2026. Most of it is either wishful thinking, a rebrand of features that already worked without AI, or a niche cosmetic trick presented as a paradigm shift. Some of it is real, useful, and quietly reshaping how dynamic codes get deployed at scale. This post separates the two.
I’m writing this from the perspective of someone who builds QR code tooling for a living and has watched a year’s worth of “AI-powered QR” pitches arrive in my inbox. The sorting hat below reflects what’s actually in production at scale, what’s experimental but plausible, and what’s marketing copy.
What’s actually working: smart routing
The most concrete shift is that dynamic QR platforms have started routing scans through ML-driven decision layers rather than static redirect rules. The encoded URL is still a redirect — the boring part hasn’t changed — but the redirect destination is now picked at scan time based on signals like:
- Device type and OS (iOS vs Android, mobile vs tablet, app deep-link vs web).
- Approximate geolocation (country, city tier, sometimes neighbourhood).
- Time of day and day of week (lunch menu vs dinner menu, weekday vs weekend offer).
- Referring placement (was this code on a poster, a packaging insert, a magazine ad?).
- Historical scan behaviour for that specific code.
None of this is fundamentally new — rule-based routing existed long before “AI” became the marketing word for it. What changed is the cost of orchestrating dozens of rules without manual upkeep. A model that watches scan outcomes and adjusts routing weights is genuinely cheaper to operate than a hand-tuned rule tree, and it surfaces patterns operators wouldn’t have written rules for.
The practical implication for anyone running QR campaigns: if you have enough scan volume to be measuring conversion seriously (low thousands of scans per code per month), routing intelligence is now the highest-leverage place to spend dynamic-platform budget. Not “AI design,” not “AI analytics dashboards,” just routing.
What’s actually working: anomaly detection on scan traffic
The second area where AI is doing real work is on the analytics side, post-scan. Scan traffic is bursty and noisy — a campaign launches, scans spike, weather changes, a placement is replaced, a viral mention happens. Distinguishing “interesting signal” from “normal noise” used to require an analyst with patience.
Modern dynamic QR platforms now ship anomaly detection by default: automatic flags for codes whose scan rate dropped suddenly (often the first sign of physical damage or a destination outage), codes with unusual geographic spread (often the first sign of a print run leaking into an unexpected channel), and codes whose user-agent distribution shifted (often the first sign of a bot or a scanner-app update breaking compatibility).
This is the kind of work AI is well-suited to: noticing patterns in continuous data and flagging the unusual. It’s already changing what an “operations dashboard” looks like for high-volume campaigns. The same shift is showing up in the broader QR analytics tooling space.
What’s plausible but immature: AI-generated destination pages
Generative AI can produce a landing page from a prompt in seconds. Two questions: does it actually convert, and is it safe to ship without review?
Where it works: A/B test variants where the marginal cost of generating ten variations versus one is dramatic. Micro-segmented destinations where the per-segment investment couldn’t justify a human writer (a code on a regional flyer, a code on a niche product variant). Bootstrapping copy that a human will then edit.
Where it fails: shipping unedited generative copy as a primary brand surface. AI prose still has a recognisable “blandness” — generic structure, hedge words everywhere, no opinions, no surprising specifics. Conversion rates on un-edited AI landing copy consistently underperform human-written equivalents in the tests I’ve seen. Use AI to draft, not to publish.
There’s a related angle worth flagging: AI-generated images on the destination page are rapidly becoming acceptable. A generative hero image is no longer obviously AI-generated to most users, and the quality threshold has crossed the line where it stops hurting trust. Generative copy hasn’t quite crossed that line yet, in 2026.
What’s mostly cosmetic: AI-generated artistic QR codes
You’ve seen them: a QR code that’s also a portrait, a landscape, a product photo. The technique uses a diffusion model to generate an image whose dark/light pattern matches a scannable QR matrix. They’re visually impressive and they do scan, mostly.
The catch: they require error-correction levelOne of four settings that controls how much damage a QR code can tolerate: L (about 7%), M (15%), Q (25%), or H (30%). Read more → H by default, the generation pipeline is finicky, scan reliabilityHow consistently a QR code scans across different devices, lighting conditions, distances, and orientations. Read more → is consistently lower than a conventional QR, and the style constraints often conflict with brand identity. They work best as one-off marketing artefacts (a magazine cover, a launch poster) where the novelty is the point and a small percentage of failed scans is acceptable cost.
I would not put one on production packaging. I would not put one on a payment-link QR. I would not use one as the primary scan path for any campaign where conversion economics matter. The fundamentals about QR design and scan reliability still apply, and artistic codes operate uncomfortably close to the edge of what’s reliable.
What’s overhyped: “AI personalisation” pitched as transformative
A lot of vendor pitches in the past year have presented “AI-personalised QR codes” as a category-defining shift. The reality, as far as I can tell:
- The “personalisation” is almost always device + location routing, which existed before AI and didn’t require it.
- The “AI” layer is mostly an A/B test orchestrator running on top of dynamic redirects.
- The “transformative” part is marketing language; the actual lift in conversion rates is in the single digits in most cases I’ve seen.
Useful, sometimes worth paying for, not a category shift. If a vendor’s AI pitch can be summarised as “we route scans to different pages based on signals,” they’re describing what dynamic QR platforms have always done with a glossier wrapper.
The security angle: AI lowers the cost of QR phishing
The one place AI is making things measurably worse is on the attacker side. AI lowers the cost of producing convincing phishing destinations — fake login pages that closely mimic specific brands, branded landing pages with believable copy, dynamic content that adapts to the user’s geography and language. A QR code remains a generic delivery mechanism, but the thing it delivers to is cheaper and more convincing than it was two years ago.
Defences haven’t fundamentally changed: domain reputation services, HTTPS, link-preview features in modern phone camera apps that show the URL before opening it. What has changed is volume — QR phishing email reports are climbing. The recent data is summarised in the QR statistics post under the security section.
For users: the practical defence is still to look at the URL preview before tapping through, and to be more suspicious of QR codes in unsolicited emails, mailers, and unusual physical locations (a fresh sticker on top of an existing code is a classic pattern).
For operators: the most important AI-era hygiene is never running a QR campaign through a redirect domain that an attacker could realistically clone. Use your own brand domain for dynamic redirects whenever possible — brand.com/r/spring is harder to spoof than bit.ly/AbcDef.
What I’d actually invest in if I had a 2026 QR budget
In rough order of bang-for-buck:
- Routing intelligence on dynamic codes — device, geo, time-based destination selection. Pays back in conversion lift across nearly any campaign with enough scan volume to measure.
- Anomaly detection on scan traffic — saves operations time and catches outages early.
- AI-drafted A/B variants for landing copy and hero images, with a human reviewing before each variant goes live.
- Branded redirect domain for all dynamic codes — security hygiene that compounds over time.
- (Distant fifth) Artistic QR codes for one-off launch moments where novelty is the point.
What I’d skip: vendor pitches that lead with “AI” and don’t have a concrete story for one of the above; “AI dashboards” that are just renamed analytics charts; any product that proposes generative content for primary scan destinations without a human-edit step.
For the longer-term forecast on where the QR space is going, see QR code trends worth watching in 2026. The trend post is forward-looking; this post is grounded in what’s actually shipping right now. And if you’re tightening up the codes you’ve already deployed, the 12 most common QR code mistakes and why some QR codes don’t scan cover the field-level fundamentals that AI can’t paper over. For one specific high-value use case — using QR on professional networking surfaces — see the LinkedIn QR codes post.
Sources
- FBI Internet Crime Complaint Center — Authoritative tracking of QR phishing (quishing) report volume in the US, the data source underpinning the rising-attack-volume claim in the security section.
- Wikipedia — QR code — Background on the QR code’s redirect/encoding mechanics that smart routing layers sit above, and the security section that frames the AI-lowers-phishing-cost argument.
- Denso Wave — QR Code applications — Reference for the conventional QR code structure that artistic / generative codes deviate from, relevant to the “What’s mostly cosmetic” section on AI-generated artistic QR codes.