Keep people responsible for decisions

Name the roles before the flow runs

Process owner

Accountable for the outcome of the whole task, and for deciding to widen, pause or stop the automated step.

Reviewer

Checks flagged items and samples of routine ones. Holds the authority to reject output.

Approver

Releases anything that commits money or sends a message outside the business.

Access administrator

Grants, limits and revokes connections, such as OAuth permissions between services.

Adviser

An outside consultant who documents, tests and hands over. Does not own the process after handover.

In a small business one person may hold several roles. The point is that each role is written down, and that the reviewer is not the person whose work is being checked wherever that can be avoided.

Place review checkpoints where errors cost most

• Before money moves

  Payments, refunds and credit notes pass an approver, however routine they look.

• Before a message leaves the business

  Customer emails drafted by a rule or a language model are read by a person first.

• When the input is unusual

  Missing fields, unknown suppliers and amounts outside the normal range go to a reviewer.

• By regular sampling

  A reviewer inspects a sample of routine items to catch quiet drift that no single case reveals.

In a hypothetical invoice-review illustration, the flow might match invoices to purchase records automatically, while any invoice above an agreed limit, or with no matching record, waits for a named budget holder.

Keep logs that someone can read

A useful log records the date, a reference to the input, the rule applied, the result and who reviewed it. It is stored where the process owner can reach it without asking a supplier, and it avoids copying personal data into free-text fields.

A plain CSV log opens in any spreadsheet, so a manager can filter it without special tools. Logs turn a vague worry, such as “something seems off this month”, into a question that can be answered.

Know the rules that shape human review

GDPR Article 22

Gives people protection against decisions based solely on automated processing that have legal or similarly significant effects, with safeguards that include human intervention. Most back-office routing is far from this, but credit, hiring and similar decisions are not.

EU AI Act

Regulation (EU) 2024/1689 sets obligations for AI systems by risk category, including human oversight for high-risk uses. Which duties apply to a small business depends on the use and on the regulation’s own timetable.

NIST AI RMF

The AI Risk Management Framework 1.0, published by the US National Institute of Standards and Technology in 2023, is voluntary guidance organised around four functions: govern, map, measure and manage.

ISO/IEC 42001

An international standard for AI management systems, published in 2023, describing how an organisation can set up and review its own controls.

This is general information, not legal advice. For questions about whether a rule applies to your use, consult a qualified professional or the data protection or regulatory authority in your country.

Agree when to pause or stop

Stop conditions agreed in advance remove the awkwardness of calling a halt. Pause the flow when:

• Differences from the manual result appear that nobody can explain.
• A reviewer cannot say why the flow produced a particular result.
• The share of items sent to review rises noticeably.
• An input source changes its format or a connected service changes its permissions.
• Anyone raises a concern about fairness or privacy.