AI agents still need a human in the loop because companies are deploying them faster than they can watch them. In Gravitee's April 2026 survey, the enterprise agent estate had doubled in four months, while 48% of agents in production ran unsecured.
Short answer: human in the loop means a trained person reviews or approves an agent's consequential actions before they take effect. It matters because most organizations can't yet verify what their agents do on their own.
How human in the loop works for AI agents
A human checkpoint works by pausing the agent at a defined decision point, showing a person the context, and letting them approve, change or stop the action. How much of that you need depends on how far up the autonomy ladder an agent sits.
| Stage | What the agent does | Where the human sits |
|---|---|---|
| Task execution | Carries out one task with tool access | Approves the output or the action |
| Plan, execute, adapt | Runs a multi-step workflow | Signs off at defined decision points |
| Multi-agent coordination | Several agents hand work to each other | Watches the handoffs and the exceptions |
| Fully agent-driven operations | Runs a whole function | Sets limits and audits after the fact |
The risk is a mismatch. A team that believes it runs at stage two, while its controls were built for stage one, has oversight on paper only. If you build multi-step flows, our guide to human approval gates shows where to place the pauses.
Agent fleets doubled, but oversight didn't
Fleets grew faster than the controls around them. Gravitee's 2026 report surveyed 750 senior technology leaders across the UK and US in two waves, and found the enterprise agent estate doubled in four months.
- Fleet size: about 37 agents per organization on average in the December wave, by April the overall estate had doubled.
- Coverage: mean monitoring coverage was 52%, so 48% of production agents ran unsecured.
- Incidents: 54% of organizations had experienced or suspected an agent security or data privacy incident in the past 12 months.
- By sector: telecoms led at 67.3%, followed by financial services at 54.7%.
One number looks like good news and isn't. Confirmed incidents fell from 59.3% to 34.9% while the fleet doubled. Gravitee, a vendor in this space, reads that drop as underreporting and detection failure, not better security.
Confidence is rising faster than verification
A VB Pulse survey of 157 enterprises, from June 2026, shows the same gap from the testing side. Only 5% said they fully trust automated evaluation.
Yet 66% already permit, or are engineering toward, fully automated deployment with no human in the loop within 12 months. 34% already allow it for low-risk agents. Half had an agent pass internal evaluations and then fail with customers, and a quarter had it happen more than once.
Later VB Pulse waves used different samples and report different figures, so treat these as a June snapshot. For a view of what agents complete without intervention in coding, see our Devin and Replit comparison.
What real oversight needs beyond a named reviewer
Real oversight needs a reviewer who has been trained for the job, not just assigned to it. Strata, an identity vendor, notes that most organizations put someone in the loop without training them on what to approve, when to escalate, or how to recognize automation complacency.
Strata's proposed model comes from aviation: Crew Resource Management and simulator training. In practice, that means rehearsed escalation, not a name on a chart.
Structure is the other gap, because few companies have the operating model to give reviewers clear authority. McKinsey's work on the agentic organization finds 89% of organizations in general still run industrial-age models. Only 9% use agile or product and platform models, and 1% act as a decentralized network.
The EU delayed high-risk duties to Dec 2, 2027
The EU did not make high-risk oversight enforceable on August 2, 2026, as originally scheduled. Regulation (EU) 2026/1744, the Digital Omnibus on AI, was published on July 24, 2026 and entered into force on July 27.
- Annex III high-risk systems: compliance moved from August 2, 2026 to December 2, 2027.
- Annex I systems (AI embedded in regulated products): moved to August 2, 2028.
- What it covers: the high-risk obligations, including human oversight.
The delay buys time, not an exemption. Use it to make your review steps real before the deadline arrives.
Try it yourself: tier your agent actions by risk
You can sort your own agent actions into review tiers with one list. Write down what each agent can do, then apply the rule below to every action.
- Can it move money, delete data or change access? Require human approval before it runs, plus a rollback path.
- Does it reach customers or ship code? Require approval, or a sampled review with a fast stop switch.
- Is it internal and reversible, like a draft or a tag? Let it run, log it, and spot-check samples.
- Can nobody explain what it touched? Pause it until monitoring covers it.
Keep the approval queue short so reviewers stay alert, which is the main defense against approval fatigue. Tools in our agent orchestration tools category, and monitors such as AgentOps, help log what each agent did.
Human in the loop vs on the loop vs out of the loop: what's the difference
The difference is when the person acts: before the action, during it, or not at all.
| Term | What it is | How it differs | When you meet it |
|---|---|---|---|
| Human in the loop | A person approves before the action runs | Blocks the agent until someone decides | Payments, deletions, access changes |
| Human on the loop | A person monitors and can stop the agent | The agent acts first; the human intervenes | Customer replies, code deploys with rollback |
| Human out of the loop | No person reviews individual actions | Only logs and audits remain | Low-risk internal tasks |
