Why human control over AI fails

How to make the human review of AI effective

Colleagues of Cyber
“A human reviewed it.” A reassuring sentence in a conversation about the risks of AI. However, the human reviewer is often the weakest link in the chain, not the safety net many assume.

Many AI policies rely on the same safety measure: AI prepares the output and a person checks it. Think about how you review a young colleague’s draft. You expect to find mistakes, so you read critically, challenge the reasoning and check the numbers. With AI output, your critical approach can gradually fade.

The better AI performs, the more responsibility we give it, but the less critically we tend to review its output. This creates a dangerous gap: the system’s impact grows while the control designed to catch its mistakes becomes weaker. 

A human in the loop sounds reassuring. But a review of roughly 60 academic studies shows a recurring problem: humans tend to accept convincing yet incorrect AI recommendations instead of challenging them. A human in the loop is only effective if that person is still attentive enough to catch errors.

The pitfalls of human review

  • Trust grows faster than accuracy. 

The better the model you use, the rarer and subtler its errors become, and the less closely you look. It’s much harder to spot a wrong conclusion presented convincingly than an obvious typo.

  • Time pressure affects review quality. 

AI is inherently used to save time, so you are implicitly expected to sign off faster on a review. Should it take as long as doing the work yourself, it would feel like a failed business case.

  • Approving output becomes a habit. 

When you approve nearly every output without changing anything or raising questions, the value of that review becomes questionable.

  • Human review can create false confidence. 

Management assumes that AI combined with a human review is at least as good as, or better than, human work alone. But the quality of the result still depends on how critically that review was done. So in the end, the quality might even be worse.

Regulators recognise these risks. The EU AI Act explicitly requires people overseeing high-risk AI systems to remain aware of the tendency to over-rely on the system’s output. However, awareness alone does not fix the problem.

A practical example of the risks of human review

Imagine a team using AI to draft first versions of their supplier risk assessments. Every draft is reviewed before it is finalised. In the first weeks, reviewers read the output carefully and regularly correct it. Over time, the drafts look consistently good and the review just becomes a quick read of the conclusion.

Then one of the assessments states convincingly that a key supplier holds a valid security certification, but in reality it doesn’t. The draft gets approved, the supplier is rated low risk and nobody notices until an incident occurs. On paper, the control worked perfectly: 100% of outputs were reviewed, but that figure says nothing about the quality of those reviews.

In this case, management should have asked themselves: How often does this tool make mistakes? How often do reviewers change anything to the drafts? And would we even notice if they stopped reviewing the output?

Three practical steps for reliable human review

3 practical steps - reliable human review

AI output with a human review is not automatically of higher quality than work prepared by a person. Treat that review as a control measure that has to prove its worth, just like any other control.

Measure how often your tools get things wrong for each type of task. Routine, well-defined tasks with a proven low error rate can pass without systematic review, supported by periodic sampling to confirm the error rate stays low. Complex output that requires judgement or interpretation gets a focused review by someone with the right expertise and enough time.

An interesting tactic is to use error seeding – deliberately inserting known errors into a sample of AI output to track how many are caught. Combine this with simple indicators, such as how often reviewers change or reject output. Remember: an approval rate close to 100% should be a warning sign, not a signal of success. 

Report the results to management or your AI governance committee, so decisions about oversight are based on evidence. Make sure every test error is removed before the output is used, and position the exercise as a test of the control, not of the individual.

Conclusion: from human-in-the-loop to human-in-control

A human check remains essential, but the mere presence of it proves nothing. Effective oversight requires more than placing a human in the loop. You have to determine where review genuinely adds value, equip reviewers with the right expertise and time, and test whether they catch the errors they are expected to detect. Human review should be treated like any other control: proportionate to the risk, measurable and regularly tested.

In short: it’s time to go beyond check-the-box human review and move towards targeted oversight where human judgement adds real value.

Questions about AI oversight or AI governance?

Let’s make your human oversight on AI proportionate, measurable and effective. For more information, contact Thomas Cornelis or Andreas De Clercq from our Risk Advisory team.

Thomas Cornelis

Thomas Cornelis

Senior Manager Risk Advisory
View bio
Andreas De Clercq

Andreas De Clercq

Senior Consultant
View bio