Human in the loop
HITLAlso called human-in-the-loop, human oversight
Human in the loop is a design in which a person reviews, approves or can override an AI system's output before it takes effect. In compliance it means an analyst confirms an alert, a match or a decision rather than the system acting alone. Data protection and AI laws require meaningful human involvement for certain decisions.
How it works
At a regulated firm, an AI model might rank alerts, draft a suspicious activity narrative or recommend an onboarding decision. A trained analyst then reviews the evidence and makes the final call. Firms set thresholds for which outputs need review, record who approved what, and sample automated closures. Related designs include human on the loop, where people monitor and can intervene, and human in command.
The control matters because rubber-stamp review does not count as meaningful oversight under data protection law. Reviewers need authority, time and information to disagree with the system. Article 14 of the EU AI Act requires high-risk AI to allow people to monitor, interpret, override and stop it. For Annex III systems this applies from 2 December 2027.
The rules
Requires high-risk AI to be designed so people can understand, monitor, override or stop it. The date reflects the July 2026 omnibus amendment.
Providers and deployers of Annex III high-risk AI systemsGives individuals the right not to be subject to solely automated decisions with legal or similarly significant effects, subject to safeguards including human intervention.
Controllers processing personal data of people in the EUAllows solely automated significant decisions on wider lawful bases, with safeguards: information, a way to contest, and human intervention.
Controllers processing personal data in the UKCommon questions
What is the difference between human in the loop and human on the loop?
Human in the loop means a person approves each output before it takes effect. Human on the loop means the system acts on its own while a person monitors it and can step in when needed.
Does a human review make a decision not automated under GDPR?
Only if the involvement is meaningful. The reviewer must have the authority and competence to change the decision and must consider all relevant information. A token check of the system's output does not remove a decision from Article 22.
Is human in the loop required for AML alert handling?
AML rules do not prescribe it in those terms. Firms remain responsible for decisions to report suspicion, and supervisors expect them to understand and evidence how automated tools reach outcomes, which is why most keep analysts in the decision.
Our coverage
News and analysis on AI and model risk from RegTech Post.
Read the coverage →RegTech PostAI Without Oversight: The New Fault Line in Corporate GovernanceRead the article →RegTech PostNorm AI Bets on a Future Where Compliance Is AutonomousRead the article →
