Human-in-the-loop (HITL)

The literature distinguishes three configurations. Human-in-the-loop means the system cannot complete a gated step without an affirmative human decision; human-on-the-loop means the system acts autonomously while a person monitors and can intervene or halt it; human-out-of-the-loop means no real-time oversight at all. The labels apply to individual steps rather than whole systems: a single agent may run read-only tools autonomously, log medium-risk actions for later review, and block on approval for irreversible ones.

In EU law the anchor is Article 14 of the AI Act (Regulation (EU) 2024/1689). High-risk systems must be designed so natural persons can oversee them effectively; Art. 14(4) lists what overseers must be enabled to do: understand the system's capacities and limitations and monitor it, remain aware of automation bias, correctly interpret output, decide not to use or to disregard, override or reverse output, and intervene or interrupt via a stop procedure. Art. 14(5) adds a two-person rule for remote biometric identification listed in Annex III point 1(a). Deployers must assign oversight to people with the necessary competence, training and authority (Art. 26(2)). After the AI Omnibus amendment entered into force on 27 July 2026, these obligations apply to Annex III high-risk systems from 2 December 2027 and to Annex I product-embedded systems from 2 August 2028. Separately, GDPR Art. 22 restricts decisions based solely on automated processing with legal or similarly significant effects, and Art. 22(3) gives a right to obtain human intervention; the Article 29 Working Party guidelines (WP251rev.01) treat token human involvement as insufficient to take a decision outside Art. 22, and the CJEU held in SCHUFA (C-634/21, 2023) that an automated score can itself be such a decision when a third party draws strongly on it.

The central failure mode is rubber-stamping. Automation bias and approval fatigue mean reviewers who approve hundreds of routine requests stop reading them, so the approval rate trends to 100% and the control becomes theatre. Effective designs gate by risk rather than by default, show the concrete proposed action (the exact email, SQL statement, diff or payment with its parameters and the sources that led to it) instead of a summary written by the same model, make rejection and editing as easy as approval, default to deny on timeout, and log who approved what for audit.

For agents, implementation requires pausing mid-trajectory: the orchestrator persists state at the gated tool call, surfaces it in an approval queue, and resumes with the human's decision injected as the tool result. Note the limits. HITL does not prevent prompt injection; it gives a human a chance to notice its effects, which only works if the malicious action is visible in what is shown. It also adds latency and cost, so it complements sandboxing and least privilege rather than replacing them.