Comparison

Human in the loop vs human on the loop

Written with AI from the sources below and checked against our facts sheet. Last checked 7 Nov 2026. How this site is made · Spot an error?

Part of: AIGP certification and exam

The one-line rule

Human in the loop: a person approves each decision before it takes effect. Human on the loop: the system acts on its own while a person monitors and can intervene or stop it.

Side by side

	Human in the loop (HITL)	Human on the loop (HOTL)
How it works	A person reviews or approves each output before it takes effect	The system acts on its own; a person monitors and can step in, override or halt it
When the human acts	Before every decision lands	During operation, by supervising and intervening when needed
Speed and scale	Limited by reviewer capacity	Scales to high volumes
Fits when	Stakes are high and decisions are individual: a benefit cut, a diagnosis, a loan denial	Volume is high and individual errors are recoverable: fraud alerts, content ranking, robot fleets
Main failure mode	Automation bias: reviewers rubber-stamp whatever the AI suggests	Missed problems: the monitor does not notice, or cannot act in time
Design controls	Reviewer's own judgment recorded before the AI answer, reasons and confidence shown, override rates tracked	Alerts and thresholds, live dashboards, a stop function, fallback to a manual process
GDPR Art. 22	Meaningful review of each case can take the decision outside "solely automated"	Each decision is likely still "solely automated"

When each applies

Neither model is right everywhere. Match the oversight to the severity, reversibility and volume of possible harm. The more severe and irreversible the harm, the closer the human should be.

Widely cited definitions come from the EU High-Level Expert Group's Ethics Guidelines for Trustworthy AI (2019). Human in the loop is the ability to intervene in every decision cycle, which the experts note is often neither possible nor desirable. Human on the loop is the ability to intervene during the design cycle and to monitor the system's operation. Above both sits human in command: overseeing the system's overall activity and deciding when, how and whether to use it. Our lesson III.A.4 adds human out of the loop: full automation, suited to low-stakes, reversible tasks like spam filtering.

The EU AI Act does not pick a model. Art. 14 requires high-risk systems to support oversight "commensurate with the risks, level of autonomy and context of use." Overseers must be able to:

understand the system's limits and spot anomalies;
stay aware of automation bias;
interpret outputs correctly;
decide not to use, override or reverse an output;
stop the system with a "stop" button or similar procedure.

Providers build these tools in, and deployers assign competent people with authority to use them (Art. 26(2)). One rule works per decision. For remote biometric identification, two competent people must separately verify a match before anyone acts on it (Art. 14(5)). Law enforcement, migration, border control and asylum uses can be exempted where the law deems this disproportionate.

The NIST AI RMF makes the same point in Appendix C. Human-AI configurations span from fully autonomous to fully manual, and roles must be clearly defined. MAP 3.5 asks for documented human-oversight processes. See also our page on human oversight.

Worked example

Orrin Bank, a fictional EU lender, uses AI in two places.

Loan decisions. A model recommends approving or declining personal loans. Credit scoring is high-risk under Annex III point 5(b). Orrin chooses human in the loop: a credit officer reviews every recommendation before a decision goes out. To counter automation bias, officers read the file and record a view before the score appears. The bank tracks how often officers disagree.

Card fraud. A model blocks suspicious card payments in milliseconds, across millions of transactions a day. A wrongly blocked payment can be released within minutes. Orrin chooses human on the loop: analysts watch a live dashboard, release false positives and can pause a rule set if block rates spike. Annex III point 5(b) expressly excludes fraud detection from the credit-scoring entry.

Above both, Orrin's AI committee acts as human in command. It decided which processes use AI at all, approved the thresholds and can switch either system off.

The exam trap

The classic confusion is assuming "human oversight" always means a person approves every output. Art. 14 requires effective oversight proportionate to the risk, not sign-off on each decision. A second trap treats any human in the loop as a safeguard that lowers the risk tier. A reviewer who rubber-stamps is not oversight, and a human reviewer does not remove high-risk status.

The tell is to ask what happens before a person acts:

Nothing takes effect until a person approves: in the loop.
The system acts and a person watches, ready to intervene: on the loop.
No person is involved in real time: out of the loop.
People decide whether the system runs at all: human in command.

Near-zero override rates in a human-in-the-loop design are a warning sign of automation bias, not proof of a good model.

Frequently asked questions

What is the difference between human in the loop and human on the loop?

Human in the loop means a person must review or approve each AI output before it takes effect. Human on the loop means the AI acts on its own while a person monitors it and can intervene, override or stop it. In the loop gives control over every case at the cost of speed. On the loop gives scale at the cost of case-by-case control.

Does the EU AI Act require a human in the loop?

Not as a general rule. Art. 14 requires high-risk systems to be designed for effective human oversight, proportionate to the risks, level of autonomy and context. Overseers must be able to understand, interpret, override and stop the system. The one built-in per-decision check covers remote biometric identification. There, two competent people must separately verify a match before anyone acts on it, with narrow exceptions.

What is human in command?

Human in command is the governance layer above the loop models. People decide whether, when and how an AI system is used and set its scope. They keep the power to overrule it or switch it off. The EU High-Level Expert Group on AI described it in its 2019 Ethics Guidelines for Trustworthy AI, alongside the two loop models.

Is human on the loop enough under GDPR Article 22?

Often not, for decisions with legal or similarly significant effects. Article 22 covers decisions based solely on automated processing. If a system decides each case itself and a person only monitors overall, each decision is likely still solely automated. Such decisions are then allowed only under an exception: contract necessity, authorization by law or explicit consent. Safeguards such as the right to human intervention then apply.

Sources

Spot an error? Tell us