Reviewed: October 12, 2026 · Format: governance checklist
“A person is in the loop” only helps when that person has the information, time, authority, and skill to question the output. A fast approval click after an AI recommendation is not a reliable review process.
Use risk to set the review level
| Workflow | Possible starting control |
|---|---|
| Internal brainstorming or formatting | Spot-check a sample and keep a clear owner. |
| Customer-facing draft or summary | Review every output before sending; verify names, dates, promises, and source facts. |
| Classification that routes work | Review low-confidence and high-impact cases; monitor missed or misrouted items. |
| Money, employment, rights, safety, or eligibility decisions | Do not let an unreviewed AI output make the final decision. Use qualified human decision-makers and applicable safeguards. |
A reviewer’s checklist
- Can I see the source information the output is based on?
- Which claims, names, dates, amounts, or citations must I verify?
- What information is missing, uncertain, or inferred?
- Does the output follow current business policy and the person’s preferences?
- Do I have authority to reject, correct, or escalate it?
- Is there a record of the decision and a route to report errors?
Make review meaningful
Give reviewers a short rubric and representative examples. Measure how often they change or reject outputs, not just how quickly they approve them. If reviewers routinely accept suggestions without checking, reduce automation or change the interface and training. The UK Information Commissioner’s guidance discusses meaningful human review in the context of data protection; organizations should also check rules in their own jurisdiction.
For a customer email, for example, show the original message and the source policy next to the draft. Require the reviewer to confirm the customer’s request, the proposed answer, and any promise before sending. A model should flag missing details and route exceptions instead of inventing an answer.
Review requirements depend on the task, the potential impact, and the law that applies. This guide is an operational starting point, not a legal assessment.