Human in the loop means that a person reviews, adjusts or stops AI output before that output has consequences. The AI makes a proposal; the human decides. That keeps responsibility where it belongs: with the professional who uses the output, not with the model that generated it.
With generative AI, that review step sits between the draft and the moment a text, piece of advice or action leaves the organisation. Human on the loop is a lighter variant, in which the person supervises and only steps in when something deviates.
For high-risk AI, the EU AI Act requires human oversight, and the GDPR protects people against decisions made entirely by automated means. A check that exists on paper but lets everything through in practice does not count. With AI agents that carry out actions themselves, where the review step sits matters more than with a chatbot.
In a small office, human in the loop comes down to a defined review step for each task, with a name attached to it. What that step looks like differs from profession to profession.
What does human in the loop mean?
Human in the loop is a way of working in which a person is a fixed link in the process of an AI system. Without that person’s approval, the output goes no further.
In machine learning, the term long referred to people who assessed training data and corrected predictions, so that the model learned from those corrections. With generative AI such as ChatGPT, Claude and Copilot, the meaning shifts to the usage phase: the person checks what the model produces, not how the model is trained.
In April 2019, the EU’s High-Level Expert Group on AI named human agency and oversight as the first of seven requirements for trustworthy AI. Human in the loop is the strictest way of meeting that requirement, because the person is involved in every decision rather than afterwards.
How does human in the loop work with generative AI?
Human in the loop with generative AI works as a gate between draft and use. A language model produces a draft text, summary or analysis, and a person checks it against the source before anyone acts on it.
That check is needed because a language model generates text based on patterns, not on verified facts. A model produces a convincingly worded answer with a made-up legal provision just as fluently as a correct answer. You cannot tell the difference from the tone.
In practice, the review step consists of three actions: checking facts and sources, judging whether the output fits the client’s situation, and deciding whether the text is used unchanged, adjusted or not at all. Whoever makes that last decision carries the responsibility.
What is the difference between human in the loop and human on the loop?
Human on the loop differs from human in the loop in when the person steps in. With human in the loop, the person approves every outcome before it has consequences. With human on the loop, the system runs on its own and the person supervises, with the option of stepping in when something deviates.
A third variant is human in command: the person decides whether and for what an AI system is used, and stops its use when needed. Human in command sits above the other two and belongs with the management or owner of an office.
The choice between in and on the loop depends on what a mistake costs. An internal summary of a meeting can live with supervision after the fact. A letter to a client, a piece of advice or a deed cannot, because the mistake has already reached the recipient before anyone sees it.
When is human oversight a legal requirement?
Human oversight is a legal requirement for high-risk AI systems under the AI Act, and for decisions with legal effects under the GDPR. For most office use of language models, neither obligation applies directly, but professional rules and professional liability still apply in full.
What does the AI Act require?
Article 14 of the AI Act requires high-risk AI systems to be designed so that natural persons can oversee them effectively. Under Article 14(4), the system enables that person to understand its limitations and to interpret the output correctly. The same person must be free to disregard, override or reverse the output.
Article 26(2) places the obligation on the deployer: it assigns oversight to people with the necessary competence, training and authority. For high-risk systems under Annex III, this applies from 2 December 2027. A writing assistant for draft letters usually does not count as high risk. For EU AI Act compliance, the main provision that applies is then Article 4, the AI literacy provision that applies to every organisation.
What does the GDPR require?
Article 22 of the GDPR gives everyone the right, with a few exceptions, not to be subject to a decision without a human in the loop. Article 22 covers decisions based solely on automated processing that produce legal effects or similarly significantly affect someone. A credit refusal or an automated selection of job applicants are the familiar examples.
According to the guidelines of the European data protection authorities, a human signature on a decision that was in reality taken by a system does not take that decision outside Article 22. A valid review requires a reviewer with the authority and the information to reach a different decision. That brings the GDPR to the question the next section deals with: is the check real?
When is human review only for show?
Human review is only for show when the reviewer in practice never departs from the AI output, even when that is needed. Article 14(4) of the AI Act names the mechanism behind it: automation bias, the tendency to automatically rely on what a system produces.
Four signals point to review that is only for show:
- The reviewer lacks the expertise to recognise a mistake in the output.
- Review time is so tight that only layout and spelling get attention.
- Departing from the output means extra work or justification, while approving it takes no effort at all.
- Nobody records how often the reviewer changes or rejects something.
That last one is the easiest to measure. A reviewer who records zero corrections for months is probably not checking. Every language model produces mistakes, such as a wrong date or a made-up source.
How do you keep a human in the loop with AI agents?
To keep a human in the loop with AI agents, you place the review step before every action that cannot be undone. An agent carries out steps itself, such as sending an email, updating a file or deleting a document, and that changes the moment of review compared with a chatbot.
With a chatbot, the review comes at the end, because only text comes out. AI agents work in chains of steps, and a mistake in step two carries through to step five before a person sees anything. The workable solution is an approval point for each type of action: reading and drafting can happen independently, while sending, paying and deleting only happen after approval.
Also set out which permissions an agent gets. An agent that only puts draft emails in a folder limits the damage a mistake can do. An agent with write access to the client file does not.
How do you set up a review step in a small office?
To set up a human in the loop review step in a small office, you link three things for each AI task: the risk level of the task, the person who checks it and exactly what that person checks. An office of ten employees does not need a compliance department for that.
At the bank, I worked in the fraud department, among other places, where everything went through the four-eyes principle. I apply the same check in all my AI workflows, with a review intensity that rises with the risk: an internal note gets a lighter check than a published article or client advice.
Three measures make the review step tangible. Test a new way of working on a small sample first, before the whole team uses it. Log prompts and output, so that you can later trace where a mistake came from.
Third, be honest about the weakest point. In my own way of working, that is fact-checking sources and figures, a pitfall many professionals share. That is the core of responsible AI use in an organisation: no ban on tools, but agreements about what happens after the output.
What does the review step look like in different professions?
Human in the loop looks different in each profession, because each profession weighs different mistakes most heavily. Below, you will find for each sector where the review step is needed first.
What does it look like at a notary’s office?
In the Netherlands, the review step at a notary’s office lies with the civil-law notary or junior notary who executes the deed: that person is the human in the loop and carries the responsibility under the Dutch Notaries Act (Wet op het notarisambt, Wna). The AI-weegschaal published by the Royal Dutch Association of Civil-law Notaries (KNB) in November 2025 is the starting point for deciding how much human assessment each application needs.
In practice, AI drafts of client summaries and correspondence are checked against the facts in the file, and no AI draft of a deed clause goes to a client without a legal review. If you set up AI governance for a notarial practice, you define that review for each type of deed, together with which data the duty of confidentiality in Article 22 of the Wna keeps out of the model.
What does it look like at an accounting firm?
At an accounting firm, the review step lies with the accountant responsible for the file: that person is the human in the loop, and the step should be recorded as a control measure in the quality management system. In the Netherlands, firms with assurance or compilation engagements must work under the NVKM quality management standard by 1 January 2027 at the latest, and a fixed review step on AI output fits within it.
The heaviest check belongs with figures: an AI summary of annual accounts or a calculation is checked against the source, not against your own impression. Texts such as a cover letter or an internal note can take a lighter check.
What does it look like at a marketing agency?
At a marketing agency, the review step lies with the account manager or editor who publishes the content on the client’s behalf, as the human in the loop between AI draft and publication. That person checks factual claims about the product, the client’s brand voice and statements the client cannot back up legally.
For SEO content, that check has carried more weight since Google’s December 2025 core update. In my own SEO work, I have since seen generic AI content without human editing lose traffic, while content with a recognisable perspective and its own examples held steady.
How do you set out human review in an AI policy?
You set out human review by describing in an AI policy, for each task, who checks the output, what that person checks for and when output is not used. That way, human in the loop is part of the team’s daily way of working, not just a policy document.
A usable AI policy sets out for each task the risk level, the responsible reviewer, the review points and the data that must not go into an AI tool. If you are starting with AI in your team, begin with one or two processes with a clear review step, rather than with an organisation-wide policy. In the AI Literacy Course, you set up that review step with assignments based on your own work. The human stays responsible, and a well-designed loop makes that responsibility workable.
Frequently asked questions about human in the loop
Human in the loop also raises the question of who or what exactly counts as the reviewer.
Does a second AI model count as human in the loop?
No, a second AI model that checks the output does not count as human in the loop, because the review is then still automated. Article 14(1) of the AI Act requires natural persons to oversee high-risk AI effectively. A checking model can help find mistakes, but the decision on whether to use the output stays with a person.
Does the law require a four-eyes principle for AI anywhere?
Yes, the AI Act requires a four-eyes principle for remote biometric identification systems listed in Annex III. Under Article 14(5), the deployer may take no action on the basis of such an identification unless at least two competent natural persons have verified and confirmed it separately. That requirement applies from 2 December 2027. For other AI applications, the regulation does not mention a second reviewer, although professional rules or your own way of working may call for one.
Is RLHF a form of human in the loop?
RLHF, reinforcement learning from human feedback, is a form of human in the loop during the training of a model, not during its use. For InstructGPT, reviewers wrote example answers and ranked the model’s answers, after which the model was further adjusted using those rankings. That feedback changes the model in general, but it does not check a single draft you send to a client today.
