Human in the loop means a person reviews or approves an AI system's work at set moments before it takes effect. It's how you get the speed of automation without handing over decisions that matter. It only works if that person has the time, information and authority to actually say no.
What are the different forms of oversight?
Not every check has to come before the action. Three forms are worth separating, because they cost different amounts of attention.
| Form | What the person does | Fits |
|---|---|---|
| Approve first | Says yes or no before anything happens | Actions you can't take back |
| Review afterwards | Samples finished work and corrects it | Reversible, high-volume work |
| Handle exceptions | Only sees what the system flags | Narrow tasks that have proven themselves |
Where should you put a person?
Use two questions: can it be undone, and who feels it if it's wrong? That gives you a simple rule.
| Easy to undo | Hard to undo | |
|---|---|---|
| Stays internal | Let it run, sample the results | Approve first |
| Reaches customers or money | Approve first, relax it later | Always approve |
Tagging a mail sits top left. Sending a payment sits bottom right. Most agents have actions in all four boxes, so decide per action. Anthropic's guidance on agents also suggests that they pause for human feedback at checkpoints or when they hit a blocker, and that they have stopping conditions such as a maximum number of iterations.
How do you avoid rubber-stamping?
A check that always ends in yes is not a check. The warning sign is an approval queue nobody reads properly any more. Spain's data protection authority sets out the factors that make human intervention real, and they're useful well beyond law:
- Competence. The person can actually change the outcome.
- Training. They understand what the system can and can't do.
- Independence. Nobody pressures them not to overrule it.
- Means. They have the information, tools and time to judge.
So show the reviewer the source next to the draft, keep the queue small and track how often they change something. Almost no changes for a long time may mean you can relax the check, or that nobody's really looking. Find out which.
What does the law say?
Two texts come up most, and neither says that every AI action needs a person. This is a summary, not legal advice.
- GDPR Article 22. People have the right not to be subject to a decision based solely on automated processing that has legal or similarly significant effects, with exceptions. Under some of those exceptions they keep at least the right to human intervention, to give their view and to contest the decision. The AEPD quotes earlier EU guidance that oversight must be meaningful, "rather than just a token gesture".
- EU AI Act Article 14. Human oversight is required for high-risk AI systems. The Commission says those rules apply from 2 December 2027 for areas such as employment and education, and from 2 August 2028 for AI built into products.
When can you remove a check?
When you've measured it, not when it feels fine. Log what the system proposed and what the person did with it. Relax one action at a time, starting with the easy-to-undo ones, and keep sampling. A model or prompt change resets the trust, so check again after one.
Approval moments are part of our Business Agent. If you're still choosing what to build, begin with which process to automate first.
