Human in the loop is becoming the new cookie banner
An approve button proves someone was present. It says nothing about judgment. Human review is heading the way of cookie banners unless product and legal teams design the decision point itself.
David Rosenthal, a partner at VISCHER, asked on LinkedIn whether "human in the loop" is the new cookie banner: a safeguard that started with good intentions and turned into a tick-box.
In a lot of companies it already is, and the cause is design. AI policies commonly say some version of "a person reviews before anything goes out." Product teams do the reasonable thing and build an approve button. The policy is satisfied. The button gets clicked. Nobody can say what the reviewer looked at, how long they had, or whether they could have said no.
An approval click proves a person was present. Whether that person exercised judgment is a separate question, and most review steps are built in a way that can't answer it.
Privacy lawyers have seen this before
Consent banners failed because the decision sat at a point where the user had no information and no real choice, and the record captured only the click. A log full of "accept" says nothing about whether anyone understood what they agreed to. Human review is heading down the same path for the same reason.
Rosenthal points at the human side of the problem: people tend to trust outputs that look right. Two other posts from the same week show the structural side.
When the maker checks its own work
Definely relaunched its brand around the principle that the maker cannot be the checker. Contracts can be drafted faster than ever, the company said, and the responsibility for what gets signed hasn't changed. That's separation of duties, an old idea from audit and finance, applied to AI drafting. If the same system drafts the clause and flags the risk in it, you have one perspective presented as two.
Stefan Eder shared research showing that AI agents that collaborate can learn to deceive together. Collaboration is supposed to add mutual scrutiny. When the agents share an objective, cooperation can reinforce misconduct. So the obvious fix for weak human review, adding a second agent to check the first, breaks down for the same reason a second signer from the same team does. The checker has to want something different from the maker.
Read together, the posts describe how oversight collapses. A reviewer approves without the information or time to judge. A maker and a checker turn out to be the same system. A row of checkers all share the maker's goal. Each of these produces a clean approval record, which is why none of them shows up in an audit.
Design the decision point
The fix sits at the moment of decision, and it starts with what the reviewer sees. If it's the output alone, they're grading prose. They need the inputs, the sources the system relied on, and the instructions it was given.
A reviewer also needs real power to reject, and the team needs to know what happens when they use it. A review step that never rejects anything is telling you something about itself.
The record matters as much as the screen. A click and a timestamp prove presence. A record of what was shown, what was changed and why the reviewer approved is evidence of judgment. That's the record a regulator, an auditor or a court will want when an AI output goes wrong, and it has to be captured at the moment of review. Nobody can rebuild it afterward.
The cost objection
The strongest objection is cost. The point of AI is speed, and a review step that shows sources, permits rejection and records reasons slows everything down. Part of that is right. Most outputs don't need this treatment. Choose decision points by consequence: where an output becomes binding, leaves the company, or moves money. Everywhere else a lighter check is fine, as long as the policy says so plainly. The failure is a policy that promises human review everywhere and a product that delivers a button.
Being specific about where review happens also builds trust. A customer or regulator who asks how your AI is supervised gets a concrete answer: these decisions get full review, these get spot checks, and here is the record for each. That answer holds up. "A human reviews everything" falls apart the first time someone asks to see the screen.
A Monday task
For product counsel this is a Monday task. Pull your AI policy, find every sentence that says a human reviews, and ask the team to show you the screen where that happens. If the screen has an approve button and nothing else, you have a cookie banner.
Then sit down with the product team and sort those reviews by consequence. The ones that matter get a real decision point. The rest get rewritten in the policy as what they are.