How much human oversight does an AI decision actually need?

Organisations tend to answer this question twice, both times wrongly: either a human reviews everything, which collapses within a fortnight, or nobody reviews anything, which holds until the first complaint.

Four levels of oversight

1. Level 1 — assistive. Drafting, summarising, formatting. A person reads the output before use; spot-check quality monthly.
2. Level 2 — advisory. The assistant proposes an answer that shapes a person's work. A named human accepts or rejects each one, and the reasoning is visible.
3. Level 3 — consequential. The output affects someone's education, employment, money, health, safety or legal rights. A named decision-maker records the decision and the basis, and can override with a reason.
4. Level 4 — prohibited. Decisions we do not automate at all, including safeguarding conclusions and anything where a wrong answer cannot be undone.

Where UK GDPR draws its line

UK GDPR places extra restrictions on solely automated decisions producing legal or similarly significant effects: people have the right to be informed, to obtain human intervention, to express their view and to contest the decision. The word 'solely' does a lot of work — nominal human involvement does not remove the obligation.

Designing oversight that survives contact with reality

• Set the level per decision type, not per tool. One assistant may operate at three levels across different tasks.
• Show the reviewer the reasoning and the uncertainty, not just the answer.
• Make overriding easy and record why — the reasons are your best improvement data.
• Cap volume. If review throughput exceeds what a person can genuinely consider, the level is wrong or the process is.
• Review the levels quarterly. Tasks drift upward in consequence without anyone deciding that they should.