Available
What does human-in-the-loop mean?
AI prepares, a person decides: how to place that checkpoint without slowing the whole team down.
Human-in-the-loop is a way of designing an automated system or AI agent so that a person authorizes, corrects or rejects an action before it is carried out. It matters most for sensitive actions: writing to a customer, spending money, changing an official record or making a decision about someone.
In short
- Oversight means being able to authorize, validate, correct, suspend or refuse.
- Actions with significant impact are validated before they run.
- Rubber-stamp oversight, without the information to judge, does not count.
- In Quebec, a fully automated decision about a person must be disclosed to them.
What does overseeing an AI involve in practice?
Quebec's 2026 guide on responsible agentic AI, written for public bodies, defines human oversight as an intervention that lets someone authorize, validate, correct, suspend or refuse an action that an agent proposed or carried out. One of its guiding principles is that sensitive actions must remain subject to prior human validation [1].
The guide spells out when oversight is mandatory: when the agent changes official data, triggers an action in a system, makes a recommendation affecting a person, uses personal or confidential information, communicates with a third party, commits spending or handles an ambiguous case [1].
It also warns against token oversight. The person in charge must have the information needed to understand the proposed action and then accept, modify, refuse or escalate it [1].
Before, during or after: which kind of oversight fits?
| Moment | When to use it | Example in a service SME |
|---|---|---|
| Validation before execution | Actions with significant impact | Confirming a price or an appointment to a customer |
| Monitoring during execution | Running tasks that can be interrupted | Watching tomorrow's schedule being built |
| Review after the fact | Internal, reversible, low-impact actions | Reading through the day's request sorting |
The guide limits after-the-fact review to internal, reversible, low-impact actions [1].
What do Canadian and Quebec rules say?
The federal Directive on Automated Decision-Making sorts systems by impact level. At levels I and II, a system may make decisions without direct involvement from staff. At levels III and IV, the final decision must be made by a human [2]. The directive applies to federal institutions, but its scale is a useful benchmark for any business.
For private businesses in Quebec, section 12.1 of the Act respecting the protection of personal information in the private sector, as amended by Law 25, applies when a decision is based exclusively on automated processing of personal information. The business must tell the person no later than when it informs them of the decision and, on request, explain the information used and the main factors. The person must also be able to submit observations to a staff member who can review the decision [3].
Does an approval queue slow the team down?
Which mistakes make approval pointless?
- Bulk-approving without reading: you are back to full automation without admitting it.
- Showing the approver a summary too thin to judge, without the underlying data.
- Placing the checkpoint after the customer has been contacted instead of before.
- Letting the agent change its own rules: Quebec's guide says an agent must never be able to bypass the planned human validations [1].
- Requiring approval for everything, even risk-free internal tasks, until people click without looking. Keep it for sensitive actions and let a simple automated process handle the rest.
How does Pilotiko apply human approval?
It is a design rule in Pilotiko: AI agents read the business's real data and prepare the work, but any action touching a customer, money or a send waits for a person's go-ahead. A possible AI hallucination therefore stays a draft. Drafted content follows the same rule: nothing is published without your approval.
Email and text appointment reminders are being commissioned: the code is ready, but nothing is sent yet. The AI receptionist is planned and not available yet.
Frequently asked questions
Is human-in-the-loop the same as human oversight?
They overlap. Human-in-the-loop usually means a person must act before the system proceeds, while oversight also covers monitoring during a task and reviewing afterwards. Quebec's guide uses oversight as the umbrella term and asks for prior validation on sensitive actions.
Do I need to approve every action an AI agent takes?
No. Quebec's guide recommends oversight in proportion to risk: validation before execution for significant actions, after-the-fact review for internal, reversible, low-impact ones. The key is sorting actions correctly.
Does the law require a small business to keep a human in the loop?
In Quebec, a business that makes a decision based exclusively on automated processing of personal information must tell the person and let them submit observations to a staff member who can review it. For how this applies to you, check with a legal professional.
Who is responsible if an approved action was wrong?
The business remains responsible for what it sends or decides, whether the action came from an employee or an agent. Quebec's guide also states that the organization stays accountable for actions associated with its agent. That is why the approver needs all the relevant information.
How do I keep approvals from becoming a bottleneck?
Group approvals in a single queue at set times and sort them by urgency. Reserve prior validation for sensitive actions. Measure real approval time for a few weeks before adjusting.
Sources
- Ministère de la Cybersécurité et du Numérique (Gouvernement du Québec), Guide sur l'utilisation responsable de l'intelligence artificielle agentique (accessed on October 15, 2026).
- Treasury Board of Canada Secretariat, Directive on Automated Decision-Making (accessed on October 15, 2026).
- LégisQuébec, Act respecting the protection of personal information in the private sector (CQLR, c. P-39.1) (accessed on October 15, 2026).
Read next
What is an AI agent?
An AI agent pursues a goal by chaining steps and tools on its own. Definition, the agent loop, a worked example for a Quebec SME and the guardrails it needs.
AI hallucination: why does AI make things up?
An AI hallucination is false content stated as fact. Why it happens, real examples, a risk calculation for a Quebec SME and practical ways to keep it in check.
Quebec Law 25: what changed for small businesses?
Quebec's Law 25 explained for small service businesses: the person in charge, consent, incidents, automated decisions, penalties and a costed starter checklist.
Process automation: RPA, workflows or AI agents?
Process automation explained: robotic process automation (RPA) versus rule-based workflows and AI agents, with a Quebec SME calculation and the pitfalls.