“Human-in-the-loop” gets used as if it named a single setting, a box a system either ticks or does not. It names a range. The same phrase covers a system that stops and waits for your sign-off before it sends anything, and a system that sends on its own while you watch a dashboard and can pull the handbrake. Those are different amounts of control, and the difference is the whole point.
What the loop is
Every automated system runs a cycle: it takes in a situation, decides what to do, and acts, then reads the result and goes again. That cycle is the loop. Human-in-the-loop describes a person placed somewhere inside it, a checkpoint that reviews, approves, corrects, or overrides what the system produces before or after it takes effect.
The looser the coupling between the person and the cycle, the faster the system runs and the less any single action is guaranteed a human’s eyes. Tightening it does the reverse. That trade sits under every design choice below.
The three positions
The label collapses three arrangements that behave very differently.
In the loop. The system proposes and then stops. Nothing happens until a person approves. The human is a required step in the cycle, so no action reaches the outside world without a sign-off. This gives the most control and the slowest throughput, and it is the arrangement people usually picture when they hear the phrase.
On the loop. The system acts on its own, and a person supervises in real time, able to pause or override. The human watches the cycle rather than gating each pass through it. Control is kept as a right to intervene, not as a checkpoint every action must clear. (You will also see this called human over the loop.)
Out of the loop. The system runs autonomously with no human checkpoint while it operates. Any human role comes before it runs, in design, or after, in audit, never during. This is the far end of the same continuum, and it is where automation without a runtime human sits.
Why the position is the design decision
Here is the part most explanations skip. Asking whether a system has a human in the loop is close to meaningless, because almost any system can claim one somewhere. The question that carries information is narrower: at which specific decisions does a person’s approval block the action, and at which does the system act first and let a person catch it afterward?
That mapping is made decision by decision, not system-wide. A tool can require sign-off before it spends money or sends an external message, and act unsupervised when it drafts and tags. The same system is then “in the loop” for one class of action and “on the loop” for another. Reduce that to a single label for the whole system and you throw away the information that matters.
There is a second, less obvious catch. A human placed in the loop is not automatically an effective one. When a system is right most of the time, the reviewer drifts toward approving whatever it proposes, a failure mode known as automation bias. A checkpoint that gets rubber-stamped is a checkpoint on paper only, which is why oversight is a question of design and attention, not position alone.
The idea is older than modern AI
The spectrum is not a recent coinage. In 1978, Sheridan and Verplank set out a scale of automation running from fully manual to fully autonomous, ten levels describing how much of a decision a machine makes versus a person (Sheridan and Verplank, 1978). In 2000, Parasuraman, Sheridan and Wickens generalised it: automation is not one dial but applies separately across the stages of a task, gathering information, analysing it, deciding, and acting, each on its own low-to-high scale (Parasuraman et al., 2000).
That second point matters for anyone designing a system today. A system can be highly automated at gathering and analysing information while deliberately kept manual at the deciding and acting stages. In, on, and out of the loop are not three boxes but named points on a continuum the human-factors literature has modelled for decades.
What regulation now requires
Oversight has moved from good practice to legal obligation for some systems. The EU AI Act (Regulation (EU) 2024/1689) requires that high-risk AI systems be designed so they can be effectively overseen by people while in use (Article 14). It does not mandate a uniform gate. Oversight measures must be commensurate with the risk, level of autonomy, and context of use (Article 14(3)), which is the “which decision gets which gate” principle written into law. The overseer must be able to decide, in any given situation, not to use the system or to override or reverse its output (Article 14(4)(d)), and must be kept aware of automation bias (Article 14(4)(b)). For certain biometric identification systems the Act goes further, requiring that no action follow from a match unless two separate people have confirmed it (Article 14(5)), a hard in-the-loop gate written into statute. The high-risk obligations apply from 2 August 2026.
The direction is echoed on the voluntary side. The US NIST AI Risk Management Framework treats human oversight as a governance function to be established across a system’s lifecycle rather than a feature bolted on at the end (NIST AI 100-1, 2023).
The question worth asking
So the reassurance in “there is a human in the loop” is thinner than it sounds. It tells you a person exists somewhere in the system. It does not tell you where, at which decisions, or with what real power to say no. The useful version of the question names the decision: before this system spends, sends, deletes, or commits, does a person’s approval block it, or does the system act and leave a person to catch it? Answer that decision by decision and you have described the actual design. This is the same axis that separates an autonomous agent from a fixed automation, so it helps to be clear on what an agent is before deciding where to place the human.
Sources
- Sheridan, T. B. and Verplank, W. L. Human and Computer Control of Undersea Teleoperators. MIT Man-Machine Systems Laboratory, 15 July 1978. DTIC ADA057655.
- Parasuraman, R., Sheridan, T. B. and Wickens, C. D. A model for types and levels of human interaction with automation. IEEE Transactions on Systems, Man, and Cybernetics Part A, 30(3):286-297, May 2000. DOI 10.1109/3468.844354.
- European Union. Regulation (EU) 2024/1689 (Artificial Intelligence Act), Article 14. Official Journal, 12 July 2024.
- National Institute of Standards and Technology. AI Risk Management Framework (AI RMF 1.0), NIST AI 100-1. 26 January 2023.
Questions, answered
What is human-in-the-loop AI?
A design pattern where a person stays inside an automated system's decision cycle, reviewing, approving, correcting, or overriding what it does rather than letting it act unchecked. The person is a checkpoint inside the system's sense, decide, act loop.
What is the difference between human in, on, and out of the loop?
In the loop: the system waits for a person's approval before each action. On the loop: the system acts on its own while a person monitors and can intervene. Out of the loop: it runs autonomously, with any human role before or after operation, not during.
Is human oversight of AI legally required?
For some systems, yes. The EU AI Act requires that high-risk AI systems be designed so people can effectively oversee them while in use (Article 14), with oversight measures commensurate with the risk. The high-risk obligations apply from 2 August 2026.
Does human-in-the-loop slow AI systems down?
A tighter coupling does. Requiring approval before every action gives the most control and the slowest throughput. Monitoring an autonomous system instead is faster but does not guarantee that any single action gets a person's review. The trade is chosen per decision, not once for the whole system.
Brief is a team of AI associates you direct in plain language. Opening to a small group at a time.
Request access