Every legal team rolling out AI tools eventually reaches for the same reassurance: "Don't worry, there's a human in the loop." It shows up in vendor pitches, internal policies, and board presentations as the default answer to the obvious question of what happens when the AI gets it wrong?
But at a recent legal AI symposium, a fireside conversation between in-house legal leaders pushed back on how loosely that phrase gets used. The panel, moderated by Shashank Bijapur, CEO of SpotDraft, with David Tudor (Group GC, Nasper) and Annabelle Thomas (Legal Director and Company Secretary, Heineken), spent a good part of the session on a sharper question: what does "human in the loop" actually mean once a lawyer is clicking approve on an AI-generated draft, memo, or agent output dozens of times a day?
Annabelle named the problem directly: clicking "approve" on a tool is often just theater. It satisfies a governance checkbox without requiring any real engagement with what the AI produced or how it got there. A lawyer can approve an output in seconds without reading it closely, without checking its sources, and without asking whether it actually answers the question that was posed.
That distinction matters more as AI moves deeper into legal workflows. It's worth pushing the point further than the panel did: an approval button creates a record that someone clicked "yes," but a record isn't the same thing as oversight. If the goal of human-in-the-loop design is to catch errors, hallucinations, or misapplied judgment before they become the basis for a decision, a rubber-stamp approval arguably does the bare minimum of creating the appearance that someone checked.
So what's the alternative? According to the panel, stricter approval workflows aren’t the solution. Real human-in-the-loop practice means seeing beyond the output, which is to stay curious and engage with the process that produces the output. That includes:
The panel was clear that this kind of oversight doesn't get built through policy documents alone. It gets built through culture, which, according to the panelists, starts at the top. If leadership treats AI output as something to accept rather than interrogate, that behavior cascades. If leadership visibly questions, tests, and pushes back on AI-generated work, that curiosity becomes the norm rather than the exception.
This has practical implications for how legal teams might design their own AI governance frameworks, even beyond what the panel specifically addressed. An approval workflow is necessary, but on its own it likely isn't sufficient. Teams that want genuine oversight could consider building in more deliberate moments for interrogation: peer review of AI-assisted work product, documented reasoning for why an output was accepted or rejected, and training that moves beyond "how to prompt" toward "how to evaluate what comes back."
As legal teams scale their use of AI for contract review, research memos, or fully agentic workflows, the temptation will be to measure "human in the loop" by counting approval clicks. That's a metric that's easy to report and easy to game. The harder, more valuable version of oversight is for the lawyers to stay curious about the process, know what a good answer looks like before they see one, and treat AI output as something to be tested rather than trusted by default.
That's a much harder thing to build than an approval button. But as AI takes on more of the legal workflow, that difference between compliance theater and actual risk management is only going to matter more.
Curious what AI-assisted contract review looks like when it's built for real human oversight, not just compliance theater?
