Human-in-the-loop vs expert approval

What human in the loop and expert approval mean

Vendors and buyers sometimes use these phrases interchangeably. They actually describe different parts of the work: how a person participates in a workflow versus who accepts a particular result.

A system can include a person without establishing that they reviewed or approved the work. Consider someone clicking through a queue of two hundred items. Their involvement makes the workflow human-in-the-loop, but it doesn’t tell us which items they examined or accepted. The quality team still needs to be able to identify who approved each item and when.

What an electronic signature needs to show

Electronic signature requirements have been in place for decades. Under 21 CFR 11.50, a signed electronic record must show the signer’s printed name, the date and time of signing, and the meaning of the signature, such as review, approval, responsibility, or authorship. That information is subject to the same controls as the electronic record and must appear in its human-readable forms, including displays and printouts.

For an AI-assisted record, the meaning needs to be clear. Did the person read the full output, resolve the flagged items, or accept responsibility for the conclusion? Those are different actions. If the system records them all in the same way, someone examining the record later may be unable to tell what the signature represents.

Giving reviewers what they need to check the work

Faster drafting can leave people with more material to review, without making that review any easier. In a June 16, 2026 PharmTech commentary, Brian Drapeau raises a concern shared by many: reviewers may accept automated output because it reads convincingly, especially when advances in software and AI create more output to review. His July 16, 2026 follow-up considers what happens when that output adds work to existing approval, training, and qualification queues.

Whether reviewers can check the work depends on their workload, training, responsibilities, and the information available to them. The interface is one part a supplier can improve and a buyer can examine before choosing a system. For someone checking an extracted value, it helps to see the source beside it, along with an explanation of uncertainties in the system. That gives the reviewer something specific to investigate and evidence to judge it against. Presenting every value in the same way can make it harder to see where closer attention is needed. Flags can help direct that attention, but teams need to test which errors they catch and which they miss before relying on them to guide review.

What regulators have said so far

AI-assisted manufacturing work is already subject to applicable CGMP and electronic record requirements. The documents below add proposals and principles specific to AI. As of November 2026, Annex 22 and the FDA AI guidance remain drafts.

• EU GMP Annex 22, draft. The European Commission opened consultation on July 7, 2025, alongside revised drafts of Annex 11 and Chapter 4. Consultation closed on October 7, 2025. That version of Annex 22 says generative AI and large language models should not be used in critical GMP applications. For non-critical applications, it places responsibility for ensuring suitable outputs with adequately qualified and trained personnel. EMA’s 2026 workshop report describes subsequent discussion of whether risk-based controls could support broader uses of these models. The report informs further drafting. As of November 2026, these three proposed texts have not entered into operation.
• FDA’s draft AI guidance. Published in January 2025, the guidance describes seven steps for assessing the credibility of AI used to produce information that supports a regulatory decision. It excludes uses aimed at improving operational efficiency when they do not affect patient safety, drug quality, or the reliability of study results. Teams should not assume that an agent supporting a quality decision falls within that exclusion.
• EMA and FDA guiding principles. Published on January 14, 2026, the Guiding Principles of Good AI Practice in Drug Development describe ten shared principles for AI across the medicine lifecycle, including manufacturing.

These documents emphasize expertise, oversight, and controls suited to the intended use. They do not prescribe a single approval interface or require a named person to sign every AI output. Each organization needs to establish which decisions require human review or approval, how that work will be recorded, and which electronic record and signature requirements apply.

What to record so an approval can be examined later

To understand an approval later, teams need more than a name and a timestamp. The following seven items are recommendations for designing that record. They bring together the signature information required by 21 CFR 11.50 and additional details that can help explain AI-assisted work. These are combined guiding principles, not a checklist prescribed by any one regulation.

1. What was reviewed. Identify the specific output so it can be distinguished from the session or group of items in which it was produced.
2. What produced it. Record the model, prompt, schema, and rule versions, along with the inputs and relevant configuration and source context. These details help explain how the output was produced. They may support reproduction, but do not guarantee an identical result from a probabilistic model.
3. What the system was uncertain about. Preserve the flagged items, the reasons they were flagged, and the source from which each value was read.
4. Who approved it. Identify the person and define the role and training needed for that review.
5. What they decided. Record whether the reviewer accepted, corrected, or rejected each flagged item. Keep any correction alongside the original reading.
6. Why they overrode the system. If the reviewer accepted a flagged item or rejected an unflagged one, record their explanation in their own words.
7. What the signature means. State the meaning required by 21 CFR 11.50 so someone examining the record can understand what the person signed.

Together, these details help a team explain the approval of a particular record. A name and timestamp alone cannot establish what the person reviewed, whether they were qualified to review it, or whether the review was adequate.

Where approval belongs in the workflow

The approval step needs to sit at the point where the person takes responsibility for the work. Three design choices follow:

• Make the scope of approval clear. One signature can cover multiple records when the applicable requirements allow it and the signature is linked to the records it covers. If a person signs for fifty records, the scope and required review need to be clear.
• Record review and approval separately when they are different actions. Resolving flagged values and accepting a finished record for use can involve different people and responsibilities. Each signature should show which action the person completed.
• Record when approval is bypassed. If someone can skip the step under pressure, that action needs to be recorded and available for reporting for the step to function as a control.

What to ask a supplier

When a supplier describes a system as “human-in-the-loop,” a lot of ambiguity remains; buyers still need to understand how review works. What does the reviewer see, when do they see it, and what evidence is available beside the output? What does the system record when the reviewer acts? Which versions are linked to the output? What happens if someone approves without examining the work? A demonstration can show how these controls work. Teams still need evidence that they support effective review in practice. The responsible position in regulated environments is that experts retain full responsibility for review and approval. The record left by each run helps teams examine how that responsibility was carried out.