Put a human review wherever an AI output can cause harm that is hard to undo: anything customers see, anything that makes a claim, anything involving money, personal information or a decision about a person. Low-risk internal drafts can be spot-checked instead. The point is to decide review levels in advance, by risk, rather than hoping someone notices.
Start from risk, not from the tool
Frameworks such as NIST’s AI Risk Management Framework are voluntary and organise AI risk work under four functions: Govern, Map, Measure and Manage (NIST). NIST’s companion playbook is explicit that it is not a checklist: organisations choose the suggestions that fit their use case (NIST AI RMF Playbook). A small business does not need the full framework, but the logic transfers: know where AI is used, judge the risk, and assign someone accountable.
A three-level review model
| Risk level | Typical tasks | Human role |
|---|---|---|
| Low | Internal brainstorming, meeting summaries, rough outlines | Spot-check a sample; owner reads before reuse |
| Medium | Published marketing copy, customer email replies, product descriptions | Review every item before it goes out |
| High | Pricing, contracts, health or financial statements, decisions about hiring or credit, anything involving sensitive personal information | Named expert approves; AI only assists; keep a record |
Adjust the table to your business. The principle is that review effort rises with the cost of being wrong.
Where to place the checkpoints
- Before input. Decide what data may be pasted into an AI tool. Personal or confidential information needs a policy and approved tools. In Australia, the Privacy Act can apply to personal information, so seek advice where unsure.
- After generation. Check facts, figures, names and claims against a source.
- Before publication or sending. A different person than the author where possible.
- After release. Sample live outputs and watch complaints, errors and corrections.
Why claims need a human
The ACCC says claims about products and services must be accurate, rest on reasonable grounds and be capable of being backed by evidence, and that the overall impression counts, not just the wording (ACCC). An AI tool can write a confident sentence with no evidence behind it. The business, not the tool, is responsible for what it publishes. For an overview of how automation fits operations, see AI automation for business operations.
What makes a review meaningful
A human checkbox is not oversight if the reviewer lacks time, knowledge or authority. Make it real:
- Time. Allow enough per item; do not set quotas that encourage rubber-stamping.
- Knowledge. The reviewer must know the subject well enough to spot errors.
- Authority. They can reject, edit or escalate without penalty.
- Evidence. The reviewer sees the source material, not just the AI output.
- Record. Note who approved what and when for higher-risk items.
Common failure patterns
- Reviewing only the first few outputs, then trusting the rest.
- Treating polished writing as proof of accuracy.
- Letting automation send directly to customers with no gate.
- No named owner when something goes wrong.
Start small
If you are new to this, the AI video brand safety checklist is a worked example of a review pass, and disclosing AI in advertising covers a related risk. Begin with one workflow, set its risk level, write the review rule on one page, run it for a month and adjust.
Limits
Human review costs time, and it will not catch every error. Some tasks are not suitable for AI at all, and regulators may expect more in certain sectors. This is general information, not legal advice.
Where Radiance Impact fits
Radiance Impact’s Technology division designs workflow automation, and approval steps can be built into those workflows. For a wider look at how it works across disciplines, see About, or contact us to discuss a process.
Sources
- AI Risk Management Framework, NIST
- NIST AI RMF Playbook, NIST
- Misleading or deceptive conduct, ACCC
