What is Human-in-the-Loop AI
Human-in-the-loop AI means a person must approve before the AI can finish the job — seeing the exact change, signing with their identity, and leaving a record.
Human-in-the-loop AI, in everyday language, means a person must approve before the AI can finish the job.
Not “a human might read the chat.” Not a footer that says this content was generated. A gate the software cannot skip.
In February 2024, a British Columbia tribunal held Air Canada responsible for a chatbot that invented a bereavement-fare policy. CBC reported that the airline’s argument — the chatbot is a separate legal entity — failed. The decision is Moffatt v. Air Canada. A customer relied on the invented fare. A human did not catch the fiction before it became a commitment.
That is the class of failure this article is about.
The phrase is older than ChatGPT. Safety engineering already distinguished a signer on every payload from a supervisor with a kill switch. Generative AI borrowed the label and diluted it. Vendors now say “human in the loop” for a thumbs-up on a chat, a weekly review of logs, or a prompt that says “ask the user first.” Only one of those is a gate.
Words you’ll hear
- In the loop. The process cannot proceed past a gate without a human act. At work, the CRM write does not execute until a named person signs the quoted fields.
- On the loop. The system runs; a human can stop it. Intervention is possible. It is not required per action. At work, this may be acceptable for read-only monitoring. It is not a write control.
- Theatre. A checkbox “I understand this is AI,” or a prompt that says “ask the user first,” while the model may still act.
- Effective oversight. EU AI law Article 14: for higher-risk systems, people must be able to interpret outputs, stay aware that automation can lull them, and interrupt the system.
- Rubber stamp. A gate that fires so often people auto-click. That is not oversight. It is fatigue.
- Named signer. Identity bound to the decision. Shared inboxes destroy this.
- Quote / payload. The exact change in the language of the live system — opportunity fields, journal lines, email body — not a wall of prompt text.
- Fail-closed. Missing approval means nothing happens. See What is write-back governance.
- Maker-checker. An older control: one person proposes, another authorises. HITL for AI is that instinct when the proposer is a model.
Mata v. Avianca is the cousin case on the legal side: fluent fiction entered a court record because no working check caught invented citations. The loop failed before filing, not after.
Why you should care
Enterprise buyers should demand a person at the gate for writes to live business systems and for customer-facing commitments. They may accept “on the loop” for read-only monitoring. They should reject theatre.
It affects you if AI can:
- change records or money
- send a customer a message that asserts a policy, price, or term
- affect employment, credit, or people’s rights
Place people where risk and reversibility change: before writes, before external messages, and at exception thresholds (amount, region, data class).
Do not put humans on every sentence. A gate that fires fifty times a day will be auto-clicked.
The person who already owns that class of change in the analogue process should sign it here. Inventing an “AI champion” who approves finance journals and legal emails is how you get a rubber stamp.
Show the change in the language of the live system. A person cannot oversee what they cannot parse.
What changes by role
Finance. Journals, forecast overrides, and material fields need the same owner who would sign in the analogue close. A champion who does not own the ledger will click through. Rejects are success: they prove the gate. A six-month zero reject rate is a finding.
Legal. Customer commitments and filings need a signer who can interpret the payload. Air Canada is customer-facing fiction. Mata v. Avianca is professional fiction entering a record. Legal should also refuse “Act compliant” claims that rest only on a button. Article 14 is a bundle of duties, not a widget.
Operations. Place gates at reversibility boundaries. Ops should measure time-to-approved-write and reject rate, and should treat human wait as a first-class workflow step, not a Slack nudge.
Go-to-market. Friction is real. The honest comparison is unreviewed mutation versus incident response, not versus a demo that writes instantly. GTM should not be asked to approve legal emails, and legal should not be asked to approve Amount.
Security. The gate must be unskippable by the model, including after prompt injection. A jailbreak can trick the model into requesting a bad write. It should not be able to execute without a quote and a signer. Identity binding matters: a generic “approve” in a shared inbox is not a control.
What people get wrong
On the loop as in the loop. A kill switch is not a per-action signer.
Theatre. Footers, checkboxes, and “shall I proceed?” in unbound chat.
Too many gates. Fatigue produces rubber stamps. Fewer gates, better quotes.
Wrong human. Whoever is online, or an AI champion spanning domains.
Chat as the quote. Prompt text is not field-level change.
HITL as sufficient for the EU AI Act. Oversight is necessary, not sufficient, for higher-risk systems.
Good looks like: read-only analysis without a click per sentence; quoted writes; named roles; fail-closed execution; rejects stored on the lifecycle graph; metrics on reject rates. Failure looks like a prompt, a footer, and a customer who relied on the bot.
The person should sit at release, not at every internal hand-off between agent teams. Internal critics can reduce garbage. They are not the signer.
Adjacent ideas are easy to mix. Write-back governance is the fail-closed property of the write. HITL is the human act that satisfies it. A lifecycle graph is how you prove the act later. A workstream is whose job the gate belongs to. None of those is a footer on a chatbot.
Fatigue is the operational enemy. If every sentence needs a click, people will click. If only irreversible steps need a click, people can still read. Design the quote so a finance owner can say yes or no in the language of the journal, and a legal owner can say yes or no in the language of the email body. Mixed payloads produce mixed, tired humans.
How this shows up in Nimbus
Read-only connectors mean the loop can analyse without a human per sentence.
When a write is proposed, governance quotes it and stops. Named roles must sign. Agent teams can draft. They cannot waive the gate. Missing approval is fail-closed.
The Lifecycle Graph stores the human act: who signed, what they saw, what happened next — including rejects. Perception can list rejected items.
See Governance. Companion: What is write-back governance.
Questions people actually ask
Isn’t this just slower AI?
It is slower than ungoverned writes and faster than incident response. Invented policy is cheaper to catch in a quote than in a tribunal.
Who should be the human?
The owner of the live-system change or the customer commitment, not “whoever is online.” Shared inboxes destroy accountability.
Does a person-at-the-gate satisfy EU AI law by itself?
No. Higher-risk systems have a bundle of duties. Oversight is necessary, not sufficient. Do not claim “Act compliant” because you have a button.
How do we stop rubber-stamping?
Fewer gates, better quotes, metrics on reject rates. A six-month zero reject rate on CRM writes is a finding: either you are perfect, or nobody is reading.
Is a chat saying “shall I proceed?” enough?
Only if it is bound to identity, shows the payload, and cannot be skipped.
What is the difference between in the loop and on the loop?
In the loop: the job cannot finish the risky step without a human act. On the loop: a human may intervene. Vendors blur them because the second is cheaper to ship.
Can agent teams approve each other’s work?
They can criticise drafts. Release still needs a named human. Multi-agent review is not a signer. See What is multi-agent AI.
Do read-only jobs need a person every time?
Usually not. That is the point of connectors defaulting to read-only. Put people where reversibility changes.
How does this relate to Air Canada?
A customer-facing chatbot made a commitment with no working human catch. The tribunal did not treat the bot as a separate legal person. If your loop can send or display a policy, price, or term, you need a gate or you own the fiction.
What about Mata v. Avianca?
Lawyers filed invented case law from ChatGPT. The failure was the missing check before the record changed. The same pattern waits in CRM and ERP.
Can we batch-approve 200 records?
Not as one click with no visible set. Bulk without inspection is a rubber stamp with worse radius. Show the set.
Does logging approvals in Slack count?
Only if identity, payload, and outcome are bound and retained as a control record. A thumbs-up emoji is theatre.
Related reading
What is AI governance and What is multi-agent AI — the person should sit at release, not at every internal hand-off.
Sources
See what governed AI looks like on your stack.
Connect your tools, run a workstream, and keep every decision on your ledger - free for 7 days.