AI Flags It, You Confirm: Why Human Oversight Is Becoming Law

“Human in the loop” used to be a slide. It is becoming a statutory test. Teams that already designed for a person to confirm the call will have less to retrofit when the filing starts.

The EU AI Act, the GDPR, and the UK's rewritten automated-decision rules are converging on one demand: a natural person must be able to see the material, refuse the output, and take responsibility for what happens next. Vista was built as “AI flags it, you confirm” so that human oversight sits in the product, rather than arriving later as a governance patch.

Three regimes, same demand

EU AI Act, Article 14. High-risk systems must be designed so they can be effectively overseen while in use. The overseer has to understand the system's limits, resist automation bias, interpret the output, decide not to use it, and stop it. For remote biometric identification listed in Annex III point 1(a), two competent people must separately verify the identification before the deployer acts on it, with a narrow law-enforcement exception. Article 14 sits in Chapter III, Section 2. After Regulation (EU) 2026/1744, those high-risk duties apply from 2 December 2027 for Annex III systems and 2 August 2028 for Annex I product-safety systems. The article is deferred with the rest of the high-risk chapter. It is not cancelled, and it is not optional.

GDPR, Article 22. In the EU, a person still has the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects or similarly significantly affects them. The exceptions (contract, authorised by Union or Member State law, explicit consent) come with a right to obtain human intervention, to express a view, and to contest the decision. “Solely automated” is the tripwire. A rubber-stamp is still solely automated.

UK: Data (Use and Access) Act 2025, section 80. The old UK GDPR Article 22 prohibition was replaced by Articles 22A to 22D. Section 80 came into force on 5 February 2026 (SI 2026/82). The new default, for significant decisions that do not rest on special-category data, is permission subject to safeguards: tell the person, give them a route to human review, let them contest it. Special-category significant decisions stay tighter. Article 22A treats a decision as solely automated where there is no genuine or meaningful human involvement. The ICO's draft ADM guidance, consulted on from 31 March to 29 May 2026, is the working read of what “meaningful” will mean in enforcement. The statutory AI and ADM code itself is still being prepared under SI 2026/425. The Act is already live. The code is not yet the thing you can quote.

You do not need all three to apply. One is enough. A UK operator with no EU customers still has Articles 22A to 22D. An EU high-risk system still has Article 14 on the 2027/2028 clock, and Article 22 now.

What “confirm” has to mean

Oversight that nobody can perform at 4pm on a Tuesday is not oversight. The test we use is short:

• A named person, not a mailbox.
• They can see the input that mattered, not only the draft.
• Saying no is a normal path, not an incident.
• The queue is sized so they have time to look.
• The decision is recorded: who confirmed, what changed, when.

If the only human step is “click approve”, you have automated the signature. That fails Article 22's “solely automated” test, it will fail the ICO's meaningful-involvement read, and it will fail Article 14's requirement that a person can disregard or reverse the output.

The worked example

Vista keeps a hotel's information right in one place and feeds every other channel from it. The AI flags what is out of date and suggests the fix. A person always confirms before anything changes. That is the whole product idea. It is also the pattern: the model does intake and drafting; judgement stays with the person who will own the result.

We built it that way because auto-publish, hope, apologise is how a property ends up telling the world a rate or a fact that is wrong. It is also how you fail a human-oversight test with a straight face. The same shape holds for a recruitment shortlist, a complaint draft, a credit flag. The system proposes. A person with authority disposes.

I am not saying Vista is a high-risk system under Annex III. I am talking about design. If you wait for the 2027 date to add a confirm step, you have spent two years shipping the opposite habit.

This does not apply if…

If no decision about a person is being taken (no legal effect, no similarly significant effect, no Annex III use), Article 22 and Article 14 are not your first problem. You may still want a confirm step because the operation is safer with one. That is judgement, not a statutory duty.

If a competent person actually reviews the file before the outcome lands, and can change it, you are not in “solely automated” territory. Do not invent extra steps to look busy. Do the review.

If you are running a prohibited practice under Article 5, oversight will not save you. The ban is the ban.

The practical patterns (queues, evidence, refuse-paths, records) are in Human Oversight by Design. The legal hooks sit beside it: Annex III classification, GDPR Article 22, and the UK ADM regime. This post is the case that the law and the product instinct now ask for the same thing. The library page is how you build it.

If a system in your operation flags and nobody confirms, talk to us.