Human in the loop automation means that software does the routine work but a named person approves the steps that matter before they happen. In practice, the steps that still need approval are decisions that affect a person’s legal rights or livelihood, and actions that move money, cancel something or change a live system. Everything else is a judgement call, based on how much harm a wrong result could do and how easily you could undo it.
This article sets out four groups of automation that sit on the approval side of that line. It explains the UK legal position, which changed in 2026, and describes what approval looks like when it is real rather than a rubber stamp. It is general information, not legal advice, and it does not replace a review of your own processes.
What human in the loop automation actually means
The phrase describes a design choice. An automated process runs until it reaches a step where a mistake would be costly, then it stops and waits for a person to say yes or no. Only after that decision does it carry on.
Current tools build this in as a standard feature. OpenAI’s guide to its Agents SDK describes human-in-the-loop approvals as a way to pause a run before side effects such as cancellations, edits, shell commands or sensitive actions through connected tools. Its worked example is cancelling a customer order. The run pauses, returns a pending item, and resumes once your application approves or rejects it. Microsoft’s documentation for its Agent Framework says that each function tool can be marked as needing human approval before it runs.
Those are developer tools, but the idea applies equally to a small business using a no-code workflow. The question is the same: which steps should the system be allowed to take alone, and which should wait for a person?
It helps to separate two things that are easy to confuse:
- Approval before an action. The system proposes, a person decides, and nothing happens until they do.
- Review after an action. The system acts, and a person checks results later and can reverse or challenge them.
Both have a place. The rest of this article is mostly about when the first kind is needed.
A working rule of thumb: four groups that still need a person
The sources reviewed for this article point to four groups of automation where human approval remains the sensible default, and in the first group is also a matter of law.
- Decisions about people that have a legal or similarly significant effect, such as hiring, credit and access to services.
- Actions that cancel, edit or spend, or that act on live systems.
- Sign-offs the business must own, such as expenses and documents.
- Ad spend and campaign changes, where automatic changes are optional and budget stays under human control.
Work that sits outside all four, such as drafting an internal summary or sorting incoming enquiries into folders, is where full automation is easiest to defend. Even there, that is a judgement for you to make rather than a rule from any of the sources, so it is worth writing down why you made it.
Group 1: decisions about people
This is the group where the law has the most to say, and where the position changed in 2026.
What the law says now
The Data (Use and Access) Act 2025, section 80, rewrites the UK GDPR rules on automated decision-making. Two ideas in the wording matter most.
The first is what counts as a decision made without a human. On legislation.gov.uk, a decision is based solely on automated processing if there is no meaningful human involvement in the taking of the decision. The word that carries the weight is