Does the law require human oversight of AI?

For systems classified as high-risk, the EU AI Act (Article 14) requires demonstrable human oversight, and frameworks like NIST's AI RMF treat human-AI teaming as a key control. Whether a given marketing use is legally high-risk depends on the case.

Doesn't approval slow everything down?

Done well, no — automate low-risk hygiene fully and reserve approval gates for high-stakes decisions, so velocity stays high where risk is low.

Guide

Human-in-the-loop AI for advertising: why approval gates matter

TL;DR

Human-in-the-loop (HITL) means people review, correct or approve an AI's actions at defined decision points rather than letting it act unattended. When AI controls ad spend, the core building blocks are approval gates, spend caps and audit logs. Put the human at high-stakes points (big budgets, launches) and automate low-risk hygiene to keep velocity.

What human-in-the-loop means

In a HITL design, the AI proposes actions — bid changes, new campaigns, budget shifts — but a person reviews and approves them before they take effect. It's the difference between "the AI did something" and "the AI suggested something and you said yes."

Why it matters when AI controls ad spend

AI mistakes with a live budget cost real money. Effective HITL focuses on when and how to involve people: confirm high-risk actions, correct borderline outputs, approve policy exceptions, and keep the system aligned with intent.

The building blocks

Approval gates — a control point where a proposed action pauses for human sign-off before it executes.
Spend caps — hard limits so automation can't overspend.
Audit logs — a record of who/what/why/impact for every change.
Scoped permissions — limited write access by account and action.

Example: Agent Planners pauses every write for approval (in-app or email magic-link) and logs each action.

Governance and regulation

Governance frameworks reinforce HITL. The NIST AI Risk Management Framework organizes around Govern, Map, Measure and Manage. The EU AI Act requires demonstrable human oversight (Article 14) for systems it classifies as high-risk — so phrase obligations carefully; not all marketing AI is legally "high-risk," but human oversight is a widely recommended control regardless.

HITL without killing velocity

Done well, approval doesn't slow you down: automate low-risk hygiene fully and reserve gates for high-stakes decisions. You keep speed where risk is low and control where it's high.

Frequently asked questions

What does human-in-the-loop mean for AI advertising?: The AI proposes actions (bid changes, new campaigns, budget shifts), but a person reviews and approves them before they take effect — often combined with spend caps and audit logs.
Does the law require human oversight of AI?: For systems classified as high-risk, the EU AI Act (Article 14) requires demonstrable human oversight, and frameworks like NIST's AI RMF treat human-AI teaming as a key control. Whether a given marketing use is legally high-risk depends on the case.
Doesn't approval slow everything down?: Done well, no — automate low-risk hygiene fully and reserve approval gates for high-stakes decisions, so velocity stays high where risk is low.