"Keep a human in the loop" is the most repeated line in AI governance. The loop breaks when the person rubber-stamps, has lost the skill, has no authority to stop, or has too much to check. Only one of those is fixed by training.
A regulator asks for a human in the loop. A vendor's slide says the product keeps one. Your own policy says every AI-assisted decision has one. All three mean the same picture: a system produces, a person checks, and the check is what makes the output safe. The picture is right about where the safety comes from. It is silent about whether the check happens, and the evidence says it fails in four different ways, which look alike from the outside and need four different fixes.
The first failure is the one most people mean by automation bias. In a 2023 study, 27 radiologists read mammograms with AI suggestions attached, some of them deliberately wrong. When the suggestion was wrong, the most experienced readers fell from 82 per cent correct to 45.5 per cent. The least experienced fell to under 20 per cent. The AI was a purported system whose suggestions were set by the researchers, and the sample was small. Within those limits, even the most experienced readers were right less than half the time when the suggestion was wrong.
The fix for rubber-stamping is friction, and people dislike it. A 2021 study found that cognitive forcing, for example making a person commit to their own answer before seeing the AI's, or delaying the AI's suggestion, reduced overreliance more than showing explanations did. Participants gave the least favourable ratings to the designs that reduced overreliance most. Deloitte's Tech Trends 2026 describes agent supervisors who step in at deliberately designed points, as strategic handoffs at critical decision points, not simply to check an agent's work. The idea is sound and the evidence behind forced commitment is older than generative AI. Neither is training. A rubber-stamper who attends a course on automation bias returns to the same workflow with the same answer already on the screen.
The second failure is quieter and takes months. A 2025 observational study compared colonoscopy quality at four Polish endoscopy centres in the three months before and the three months after AI-assisted polyp detection was introduced. On procedures without the AI, the adenoma detection rate fell from 28.4 per cent to 22.4 per cent. The study cannot prove the AI caused the fall. It is consistent with a skill that erodes when it is no longer exercised.
The learning version of the result is cleaner. In a field experiment with nearly a thousand secondary-school students, published in PNAS in 2025, access to an unguarded chatbot raised practice performance by 48 per cent. When access was removed, that group scored 17 per cent lower than students who had never had it. A version of the tutor built with safeguards raised practice performance more and largely removed the harm. Students are not managers and maths is not a budget paper. The design finding transfers: practice with a tool that supplies the answer can leave the person less able than before.
The fix for skill loss is designed practice, and here training is the right remedy. The tutor with safeguards points the way. A person keeps the skill by exercising it on cases where the answer is withheld, with a check afterwards. McKinsey's 2026 treatment of early-career development, as described in a published review of it, proposes an "answer-key model" on the same principle: the person attempts the work first, the AI grades it, and a manager discusses the gap. This is the one failure of the four where a course can be the fix, provided the course withholds the answer.
For trainers and facilitators: the difference between a demonstration and a practice session is whether the answer is on the screen. A session that shows what the tool can do builds familiarity. A session that asks the participant to commit first builds the skill the loop depends on.
The third failure is not about ability at all. In August 2025 a senior defence lawyer in Victoria, Australia, took full responsibility before a Supreme Court judge for submissions that contained fabricated quotations and citations to cases that do not exist. The lawyers said they had checked the initial citations and assumed the rest were accurate. The prosecutor had not checked either. The judge said the use of AI was not acceptable unless its product was independently and thoroughly verified. Nothing in the reporting suggests anyone in that chain lacked the ability to check a citation. On this reading, what was missing was a person whose job it was to stop the document until every one had been checked.
The fix is a written decision-rights list, not a better reviewer. AIRS-J/1 dimension E1, Decision Rights and Escalation, scores whether a person acts within their authority and does not delegate what cannot be delegated, to a person or to an AI system. At Level 2 the anchor asks the person to act within their authority, unprompted, and to escalate what needs another party's approval, naming who that party is. A reviewer who has no written authority to hold a document, and no named person to escalate to, has nothing for that behaviour to work on, however good their eye. The fix is organisational: name the person who may stop the work, and say in writing what they may stop it for. Training a reviewer who cannot stop the work produces a better-informed bystander.
For HR and L&D: the Victoria case is the one to put in front of people who think the loop is a skills problem. The reporting shows a check that stopped early, not a skill that was missing, and no one else in the chain picked it up.
The fourth failure is arithmetic. In a survey of 3,200 employees and business leaders commissioned by Workday, fielded in November 2025 and published in January 2026, 85 per cent said AI saved them between one and seven hours a week. Workday reported that nearly 40 per cent of the time saved was lost to rework of AI output, nearly four hours lost for every ten gained. Seventy-seven per cent of daily users said they reviewed AI work as carefully as human work or more. The survey is vendor-sponsored and self-reported, so the precise figures carry no weight. The shape does. If the volume of output rises faster than the time to check it, the check gets shorter, and a check that gets short enough becomes the first failure.
The fix is a load limit, which nobody likes to set. A person can verify a certain number of load-bearing claims in a day with the attention each needs. Above that number the loop is nominal. AIRS-J/1's T1 anchor at Level 3 asks for verification effort proportionate to consequence: heavy where the decision is irreversible or high-consequence, light where it is neither. That is a rationing rule. It says a reviewer under load should spend the attention where the consequence is, and say in the work product which claims got it. An organisation that wants every output checked equally at a volume that makes equal checking impossible has designed the fourth failure into the workflow.
The four failures look identical from outside: a person signed something they should not have. The fixes have nothing in common.
Friction, practice, a decision-rights list and a load limit address four causes. None of them tells you whether the person in the loop can do the job. A workflow can have forced commitment, designed practice, written authority and a sane load, and still have a reviewer at Level 1 who expresses doubt about a claim and acts on it unchanged. The four fixes make the behaviour possible. They do not show that it happened.
That is an assessment question, and self-report cannot answer it. AIRS-J/1 says so in one clause: self-assessment, survey response, declared experience, training attendance and manager endorsement generate no observations. The 77 per cent of daily AI users in the Workday survey who say they check AI work as carefully as human work or more are reporting a feeling about themselves. The radiology and Victoria results show how far that feeling can sit from the behaviour. What answers the question is an observed decision with a retained trace, scored against a public anchor, with at least three observations for each dimension from distinct decision points.
The Standard separates two modes, and they fix different things. Practice is for building the behaviour: scenarios with feedback, where scaffolding is allowed and nothing is awarded. Certification is for showing it: a separate assessment on the official instrument, against the public rubric, with a retained trace, and with any prompting recorded and capped at Level 1. Practice addresses the second failure. Certification answers the question every list of fixes leaves out. Practice never awards a certifying result, and that separation is what lets the result mean something.
The loop is the right picture. Whether there is a person in it who can do the job is a question the picture does not answer, and the Standard does.
Diagnose the failure, then read the Standard
AIRS-J/1 assesses how a person decides, not what they know. A result is not a measure of intelligence, personality, AI technical skill or domain expertise, and it is not a substitute for supervision, professional licensing or regulatory authorisation. The four failures are a reading of four public results from different fields; none of those studies was designed to test the taxonomy and none scored anyone against the Standard. The Workday figures are vendor-sponsored self-report and are cited for shape, not precision. The Victoria case is described from press reporting, and the judgment was not read. The McKinsey article is described from a published review, because the McKinsey page could not be opened. Practice and Certification are described as the Standard defines them; no sitting date and no holder is implied.
AIR APAC publishes these articles in the institution's voice. Every figure carries its source and its limit. All articles.
When a decision involves AI, many managers choose the most cautious option and call it prudence. The Standard scores that at Level 1. Maximal caution where the cost is low is as much a failure as minimal care where the harm is severe.
A tribunal held an airline to what its chatbot said. A consultancy's revised report disclosed its AI use, after errors were found in the first. The question in both was the same: who was entitled to know, and when.
Judgment was always built on the job, by doing junior work badly and being corrected. AI now does the junior work. Organisations are removing the apprenticeship and keeping the expectation.