Human-in-the-Loop
What is Human-in-the-Loop?
An AI system design pattern where human oversight is integrated into the decision-making process. Human-in-the-loop ensures that critical decisions receive human review and is required for high-risk AI systems under the EU AI Act.
Terms that appear alongside human-in-the-loop
Each of these is named in at least one of the same controls as human-in-the-loop. The number is how many controls name both.
- nist 3 shared controls
- eu ai act 3 shared controls
- impact assessment 2 shared controls
- audit 2 shared controls
- gdpr 2 shared controls
- risk assessment 2 shared controls
- incident response 2 shared controls
- remediation 2 shared controls
Frameworks that govern human-in-the-loop
What the standards actually require on human-in-the-loop
Requirements naming human-in-the-loop across 6 standards, quoted from the control text.
Control points where a human reviews, approves or can intervene in the system's operation or decisions, placed according to the risk and impact of the decisions.
iso-iec-tr-24028-2020::9.4.2 · Human-in-the-loop control points →Based on the risk assessment, determine the category of human involvement, human-in-the-loop, human-over-the-loop, or human-out-of-the-loop, commensurate with the assessed risk.
AIGE-HI-3 · Determine the level of human involvement →Apply MANAGE function including: content provenance implementation per NIST AI 600-1 MGT-1 (cryptographic watermarking + C2PA Content Credentials + media authentication) + human oversight integration per MGT-2 (human-in-the-loop + human-on-the-loop + human-out...
NISTAI600-5 · Manage - Content Provenance, Human Oversight, and Incident Response →Operate human oversight + redress + contestation per OECD AI Principles. Human oversight must (a) implement appropriate human-in-the-loop + human-on-the-loop + human-out-of-the-loop based on risk + impact + context + with documented decision per AI system, (b)...
OECDAI-6 · Human Oversight, Redress, and Contestation Mechanisms →Understand the enterprise's role in the AI lifecycle and keep an up-to-date registry of linked AI systems; understand potential adverse impacts from internal sources (incident monitoring, oversight bodies) and external sources (human rights institutions, AI ob...
oecd-due-diligence-guidance-for-responsible-ai-2026::2.1.G2 · 2.1.G2 Initial scoping of risks: enterprises in the AI system lifecycle →Address OWASP LLM06:2025 Excessive Agency + LLM10:2025 Unbounded Consumption. Excessive Agency occurs when an LLM is granted too much functionality (excessive functions + permissions + autonomy) such that compromise causes outsized impact including unauthorise...
OWASPLLM-6 · Excessive Agency and Unbounded Consumption (LLM06 + LLM10) →Questions people ask about human-in-the-loop
What is Human-in-the-Loop?
Why is Human-in-the-Loop important for compliance?
Which compliance frameworks address Human-in-the-Loop?
Where can I learn more about Human-in-the-Loop?
See how Human-in-the-Loop applies across compliance frameworks
Our platform maps 1,016 frameworks with 316K cross-framework control mappings. Explore how this concept is addressed across standards.