# What does human-in-the-loop mean?

> Human-in-the-loop puts a person before an AI's sensitive actions. Forms of oversight, Quebec and Canadian rules, a worked SME example and the mistakes to avoid.

Updated on October 15, 2026 · https://app.pilotiko.com/en/glossary/human-in-the-loop

Human-in-the-loop is a way of designing an automated system or AI agent so that a person authorizes, corrects or rejects an action before it is carried out. It matters most for sensitive actions: writing to a customer, spending money, changing an official record or making a decision about someone.

## In short
- Oversight means being able to authorize, validate, correct, suspend or refuse.
- Actions with significant impact are validated before they run.
- Rubber-stamp oversight, without the information to judge, does not count.
- In Quebec, a fully automated decision about a person must be disclosed to them.

## What does overseeing an AI involve in practice?

Quebec's 2026 guide on responsible agentic AI, written for public bodies, defines human oversight as an intervention that lets someone authorize, validate, correct, suspend or refuse an action that an agent proposed or carried out. One of its guiding principles is that sensitive actions must remain subject to **prior human validation** [1].

The guide spells out when oversight is mandatory: when the agent changes official data, triggers an action in a system, makes a recommendation affecting a person, uses personal or confidential information, communicates with a third party, commits spending or handles an ambiguous case [1].

It also warns against token oversight. The person in charge must have the information needed to understand the proposed action and then accept, modify, refuse or escalate it [1].

## Before, during or after: which kind of oversight fits?

| Moment | When to use it | Example in a service SME |
|---|---|---|
| Validation before execution | Actions with significant impact | Confirming a price or an appointment to a customer |
| Monitoring during execution | Running tasks that can be interrupted | Watching tomorrow's schedule being built |
| Review after the fact | Internal, reversible, low-impact actions | Reading through the day's request sorting |

The guide limits after-the-fact review to internal, reversible, low-impact actions [1].

## What do Canadian and Quebec rules say?

The federal Directive on Automated Decision-Making sorts systems by impact level. At levels I and II, a system may make decisions without direct involvement from staff. At levels III and IV, the final decision must be made by a human [2]. The directive applies to federal institutions, but its scale is a useful benchmark for any business.

For private businesses in Quebec, section 12.1 of the Act respecting the protection of personal information in the private sector, as amended by [Law 25](https://app.pilotiko.com/en/glossary/quebec-law-25), applies when a decision is based exclusively on automated processing of personal information. The business must tell the person no later than when it informs them of the decision and, on request, explain the information used and the main factors. The person must also be able to submit observations to a staff member who can review the decision [3].

## Does an approval queue slow the team down?

**Example: a 12-person residential cleaning company in Laval**

Assumption: an AI agent drafts confirmations, schedule changes and replies to enquiries. The coordinator approves them in a single queue twice a day.

- Messages drafted per week : 80
- Time to approve a correct message : 20 s
- Messages needing a fix (assumption: 10%) : 8
- Time to fix each one : 3 min
- Weekly total (80 × 20 s + 8 × 3 min) : about 51 min
- **= Under an hour a week so that none of the 80 messages goes out without a person seeing it.**

## Which mistakes make approval pointless?

- Bulk-approving without reading: you are back to full automation without admitting it.
- Showing the approver a summary too thin to judge, without the underlying data.
- Placing the checkpoint after the customer has been contacted instead of before.
- Letting the agent change its own rules: Quebec's guide says an agent must never be able to bypass the planned human validations [1].
- Requiring approval for everything, even risk-free internal tasks, until people click without looking. Keep it for sensitive actions and let a simple [automated process](https://app.pilotiko.com/en/glossary/process-automation) handle the rest.

## How does Pilotiko apply human approval?

It is a design rule in Pilotiko: [AI agents](https://app.pilotiko.com/en/glossary/ai-agent) read the business's real data and prepare the work, but any action touching a customer, money or a send waits for a person's go-ahead. A possible [AI hallucination](https://app.pilotiko.com/en/glossary/ai-hallucination) therefore stays a draft. Drafted content follows the same rule: nothing is published without your approval.

Email and text appointment reminders are being commissioned: the code is ready, but nothing is sent yet. The [AI receptionist](https://app.pilotiko.com/en/glossary/ai-receptionist) is planned and not available yet.

## Frequently asked questions

### Is human-in-the-loop the same as human oversight?

They overlap. Human-in-the-loop usually means a person must act before the system proceeds, while oversight also covers monitoring during a task and reviewing afterwards. Quebec's guide uses oversight as the umbrella term and asks for prior validation on sensitive actions.

### Do I need to approve every action an AI agent takes?

No. Quebec's guide recommends oversight in proportion to risk: validation before execution for significant actions, after-the-fact review for internal, reversible, low-impact ones. The key is sorting actions correctly.

### Does the law require a small business to keep a human in the loop?

In Quebec, a business that makes a decision based exclusively on automated processing of personal information must tell the person and let them submit observations to a staff member who can review it. For how this applies to you, check with a legal professional.

### Who is responsible if an approved action was wrong?

The business remains responsible for what it sends or decides, whether the action came from an employee or an agent. Quebec's guide also states that the organization stays accountable for actions associated with its agent. That is why the approver needs all the relevant information.

### How do I keep approvals from becoming a bottleneck?

Group approvals in a single queue at set times and sort them by urgency. Reserve prior validation for sensitive actions. Measure real approval time for a few weeks before adjusting.

## Sources

1. Ministère de la Cybersécurité et du Numérique (Gouvernement du Québec), « Guide sur l'utilisation responsable de l'intelligence artificielle agentique », https://cdn-contenu.quebec.ca/cdn-contenu/adm/min/cybersecurite_numerique/Intelligence_artificielle/GU_IA_Agentique.pdf (accessed on 2026-10-15)
2. Treasury Board of Canada Secretariat, « Directive on Automated Decision-Making », https://www.tbs-sct.canada.ca/pol/doc-eng.aspx?id=32592 (accessed on 2026-10-15)
3. LégisQuébec, « Act respecting the protection of personal information in the private sector (CQLR, c. P-39.1) », https://www.legisquebec.gouv.qc.ca/en/document/cs/P-39.1 (accessed on 2026-10-15)