How to Keep a Human in the Loop Where Regulators Expect One

Key Takeaways

The binding texts reviewed do not define "human in the loop"; they set narrower duties tied to specific decisions, firms and dates.
GDPR Article 22 gives a right not to be subject to solely automated decisions with legal or similarly significant effects, and, under EDPB-endorsed guidelines, token human review does not avoid it.
The AI Act's oversight duties for Annex III credit and insurance systems apply from December 2, 2027 (earlier systems only after significant design changes); its two-person rule covers remote biometric identification only.
Under GDPR Article 22's contract and consent exceptions, people must at least be able to obtain human intervention, express their view and contest the decision.
Meaningful review needs authority, information, training and freedom from defaulting to the output; measure reviewer behavior to show it (interpretation).

Current as of October 30, 2026. This guide draws on the EU AI Act (Regulation (EU) 2024/1689) as amended by Regulation (EU) 2026/1744, Article 22 of the General Data Protection Regulation, the Court of Justice's SCHUFA judgment (Case C-634/21), the Article 29 Working Party's guidelines on automated decision-making as endorsed by the European Data Protection Board, Colorado Senate Bill 26-189, NYDFS Insurance Circular Letter No. 7 (2024), FINRA guidance and a NASAA staff publication, as published on that date. How they apply depends on the firm and the system; it is not legal advice.

"Human in the loop" is not a defined term in any of the binding texts reviewed for this guide. What they contain instead are narrower duties: a right to a human, a design capability, an assignment of competent people, or a review that must not be a formality. Each attaches to a particular kind of decision, firm and date.

Unless a step quotes a rule or a regulator, it is our recommendation, labeled (interpretation).

What is settled, and what is not

Settled: GDPR Article 22(1) gives a person "the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her." It has applied since May 25, 2018.
Settled: under the EU AI Act, providers must design high-risk systems so they "can be effectively overseen by natural persons during the period in which they are in use" (Article 14(1)), and deployers must assign oversight to people with the competence, training, authority and support to do it (Article 26(2)). Under Regulation (EU) 2026/1744, both apply to Annex III systems, which include credit scoring of individuals and life and health insurance risk assessment and pricing, from December 2, 2027, and to systems already on the market before then only if their design changes significantly (Article 111(2)).
Colorado: SB26-189, a state statute, takes effect January 1, 2027 and provides for meaningful human review of certain consequential decisions; as of October 30, 2026 its implementing rules were pending and a federal court had paused enforcement.
Not settled: how much review turns a decision from "solely" automated into a human one. The texts reviewed set criteria, not thresholds.

On scope: the AI Act and the GDPR are regulations, binding and directly applicable in every Member State; the AI Act duties below apply to high-risk systems only. The SCHUFA judgment is a preliminary ruling interpreting Article 22. The Working Party guidelines are guidance on the GDPR, not part of it. Circular Letter No. 7 states the New York Department of Financial Services' expectations of insurers authorized in New York and certain other entities, for underwriting and pricing. FINRA's notice, report and blog address its member firms and each says it creates no new requirements. The NASAA piece addresses investment advisers and carries its own disclaimer, quoted in Step 7.

Step 1: Map each AI-assisted decision to the human-review rule that applies

Inventory decisions, not models: which system contributes, what it outputs, who acts on it and whom it affects (interpretation). Then tag each against the texts attaching a human duty: GDPR Article 22 for decisions about individuals in scope of the GDPR; AI Act Articles 14 and 26 for Annex III high-risk systems; supervisory rules for broker-dealers; and governance expectations for New York insurers (interpretation).

A decision can carry several tags; the strictest sets the design (interpretation).

Article 22(2) lifts the prohibition where the decision is necessary for a contract with the person, is permitted by Union or Member State law that lays down suitable safeguards, or rests on explicit consent. For the contract and consent cases, Article 22(3) requires the controller to implement suitable safeguards, "at least the right to obtain human intervention on the part of the controller, to express his or her point of view and to contest the decision." Recital 71 gives as examples "automatic refusal of an online credit application or e-recruiting practices without any human intervention".

A score produced elsewhere can count. In SCHUFA (December 7, 2023), the Court ruled that a credit information agency's automated establishment of a probability value is itself automated individual decision-making "where a third party, to which that probability value is transmitted, draws strongly on that probability value to establish, implement or terminate a contractual relationship with that person." A lender relying heavily on a bureau score should include it in its Article 22 analysis (interpretation).

The Working Party guidelines say a controller "cannot avoid the Article 22 provisions by fabricating human involvement", and that oversight must be "meaningful, rather than just a token gesture."

Step 3: Specify the oversight capabilities the AI Act requires providers to build

Article 14(3) lets providers meet the duty with measures built into the system, measures for the deployer to implement, or both, scaled to "the risks, level of autonomy and context of use". Article 14(4) requires that the people assigned to oversight be enabled, as appropriate and proportionate, to understand the system's capacities and limitations and monitor it; to remain aware of "the possible tendency of automatically relying or over-relying on the output produced by a high-risk AI system (automation bias)"; to interpret its output correctly; to decide not to use it or to "disregard, override or reverse the output"; and to intervene or halt it through a stop button or similar procedure.

Article 14(5), which requires separate verification by at least two people, applies to remote biometric identification systems under Annex III point 1(a), not to credit scoring or insurance pricing.

Article 13(3)(d) puts these measures in the instructions for use; obtain them before signing and test the override and stop functions (interpretation).

Step 4: Assign deployer oversight to named, competent staff with authority

Article 26(2): "Deployers shall assign human oversight to natural persons who have the necessary competence, training and authority, as well as the necessary support." Article 26(5) deems a financial institution's monitoring duty met through internal governance rules under Union financial services law, but that covers monitoring, not the oversight assignment.

Name the role, not just the team; give it written authority to override or suspend; train it on the specific system's limits; and staff it for the decision volume (interpretation).

Step 5: Design review so it is meaningful: authority, information, time and automation bias

The Working Party guidelines expect review by "someone who has the authority and competence to change the decision", who considers all the relevant data, and say the controller should record in its data protection impact assessment the degree of human involvement and the stage at which it takes place. AI Act Article 14(4) adds understanding of the system's capacities and limitations, correct interpretation of its output and awareness of automation bias. Colorado's SB26-189 defines meaningful human review to include a reviewer who "does not default to the system output".

None of these texts sets a time allowance. Volume targets that leave a reviewer seconds per case, screens that show the score before the evidence, and reviewers who never disagree are signs the review may be a formality (interpretation). Track override and escalation rates by reviewer, sample agreed cases for second review, and record reasons (interpretation).

Step 6: Give affected people a route to a human, an explanation and a challenge

For the contract and consent exceptions, GDPR Article 22(3) requires at least the right to obtain human intervention, to express a point of view and to contest the decision. Recital 71 says the safeguards should also include the right "to obtain an explanation of the decision reached after such assessment and to challenge the decision." Articles 13 to 15 require controllers to tell people about automated decision-making referred to in Article 22(1) and (4) and give "meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject."

Article 22(4) adds: "Decisions referred to in paragraph 2 shall not be based on special categories of personal data referred to in Article 9(1), unless point (a) or (g) of Article 9(2) applies and suitable measures to safeguard the data subject's rights and freedoms and legitimate interests are in place." Health data used in life and health underwriting is the obvious case to check (interpretation).

For decisions based on Annex III high-risk systems that have legal or similarly significant effects a person considers adverse to their health, safety or fundamental rights, AI Act Article 86 gives that person a right to an explanation from the deployer of the system's role, unless Union or national law provides an exception and only where Union law does not already provide it; it is covered in our guide to explaining AI decisions. Send contests to reviewers who meet Step 5, give them the full case file, and record outcomes (interpretation).

Step 7: Set human checkpoints for agents and generated output at broker-dealers and advisers

FINRA's 2026 oversight report lists among the risks of AI agents "AI agents acting autonomously without human validation and approval", and among supervisory considerations "where to have 'human in the loop' agent oversight protocols or practices". The report says it "does not create any new legal or regulatory requirements or new interpretations of existing requirements". Regulatory Notice 24-09 reminds members that under Rule 3110 "a member firm must have a reasonably designed supervisory system tailored to its business."

NASAA's piece, which "reflects the views of NASAA's Investment Adviser Section Resources and Publications Project Group" and states "It does not necessarily represent the views of NASAA, and it is not intended as legal advice", says AI-driven output such as client communications and investment recommendations "should be reviewed by a compliance officer for accuracy before being disseminated".

For New York insurers, Circular Letter No. 7 does not use the phrase. It expects senior management to carry out day-to-day implementation, including "assigning competent staff, overseeing model risk management, ensuring effective challenge and independent risk assessment".

Give each agent a written scope, a list of actions that need human approval before execution, logs of what it did, and a named supervisor (interpretation).

Checklist

Items restate the recommendations above (interpretation).

Each AI-assisted decision is tagged with the human-review rules that apply to it
Solely automated decisions under GDPR Article 22 have an exception and safeguards on file
Bureau and vendor scores relied on heavily are included in the Article 22 analysis
High-risk systems come with documented oversight measures, tested override and stop functions
Oversight roles are named, trained, authorized to override and staffed for volume
Reviewer behavior is measured: overrides, escalations and second-review samples
Affected people can obtain human intervention, an explanation and a way to contest
Agents have written scopes, approval checkpoints, logs and a named supervisor

How we sourced this guide: every factual statement in it is drawn from published rules, regulatory guidance and other public documents, and we keep a full set of sources and citations for it. If you would like them, or want to question a point, get in touch through our contact page and we will share them.

Frequently Asked Questions

Does the EU AI Act require a human to approve every AI credit decision?

No. Article 14 requires providers to design high-risk systems so people can oversee them, including understanding, interpreting, overriding and stopping them, and Article 26(2) requires deployers to assign that oversight to competent people with authority. Neither requires sign-off on each output. The two-person verification in Article 14(5) applies to remote biometric identification, not credit or insurance. These duties apply to Annex III systems from December 2, 2027; systems placed on the market or put into service before that date are covered only if their design changes significantly from then on (Article 111(2)).

Does having a person review an automated decision take it outside GDPR Article 22?

Only if the review is real. The Article 29 Working Party guidelines, endorsed by the European Data Protection Board, say human involvement cannot be fabricated and must be meaningful rather than a token gesture, carried out by someone with authority and competence to change the decision. Whether a given review meets that is a judgment the firm should document (interpretation).

Does New York's Circular Letter No. 7 require a human in the loop for insurers?

It does not use the phrase. The circular letter states the Department of Financial Services' expectations of insurers authorized in New York and certain other entities, for AI and external data in underwriting and pricing. It looks to governance: board oversight, and senior management responsible for day-to-day implementation, including assigning competent staff and ensuring effective challenge and independent risk assessment. Insurers also remain responsible for vendor tools they use.

Do FINRA rules require a human in the loop for AI agents?

No rule reviewed for this guide uses that phrase. FINRA's 2026 oversight report lists where to have human-in-the-loop agent oversight as a consideration for member firms and says it creates no new requirements. Rule 3110 still requires a reasonably designed supervisory system tailored to the firm's business, which applies when the firm uses AI.