Human review is a job, not a checkbox: who signs off AI-assisted work?
A practical guide for Hong Kong workers and managers on how to assign human review based on output impact, covering reviewer competence, evidence checks, escalation paths, and accountability using NIST, OECD, and HKSAR frameworks.
When a manager asks you to “just check the AI’s work before it goes out,” the instruction is dangerously vague. Without a clear standard for what that check involves, who performs it, and what happens when something is wrong, human review becomes a box-ticking exercise rather than a genuine safeguard. For workers in Hong Kong—where the government’s Ethical AI Framework and Generative AI Guideline stress accountability and risk management—the gap between a checkbox and a real review can mean the difference between a trusted output and a costly error.
This article maps out a practical system for assigning reviewer competence, verifying evidence, setting escalation triggers, and fixing accountability for low-, medium-, and high-impact AI-assisted outputs. The framework draws on the NIST AI Risk Management Framework, the OECD AI Principles, and Hong Kong’s own guidance, but the protocol itself is something you and your team can implement today.
Map output impact before assigning a reviewer
The first step is to classify every AI-assisted output by its potential harm if undetected errors slip through. The OECD AI Principles emphasise that risk and accountability vary with context; Hong Kong’s Ethical AI Framework similarly calls for proportionate measures. Use a simple three-tier system:
- Low impact: Internal drafts, brainstorming notes, routine data summaries with no external or financial consequence.
- Medium impact: Client-facing reports, internal policy memos, hiring shortlists, or any output that could influence a decision but is not final or legally binding.
- High impact: Regulatory filings, medical or safety advice, credit or loan decisions, legal documents, public communications, or any output that directly affects an individual’s rights, health, or finances.
Document the tier for each output type in a simple matrix. Without this upfront classification, you cannot know what level of reviewer competence or evidence checking is needed.
Match reviewer competence to the impact tier
Not every reviewer needs to be a subject-matter expert, but the reviewer’s competence must match the tier. For low-impact outputs, a general awareness of common AI errors—such as hallucination, outdated data, or biased phrasing—is sufficient. For medium-impact outputs, the reviewer should have domain knowledge (e.g., a marketing specialist reviewing a campaign brief) and familiarity with the specific AI tool’s known failure modes. For high-impact outputs, the reviewer must be a qualified professional in the relevant field—such as a licensed accountant, lawyer, or engineer—who can independently verify the output against authoritative sources.
Hong Kong’s Generative AI Guideline notes that users should understand the limitations of AI systems. A practical step is to maintain a register of approved reviewers for each impact tier, along with their qualifications and training records. If no qualified reviewer is available for a high-impact task, the output should not be released until one is.
Require evidence checks, not just a glance
Human review must include verifiable evidence that the output is accurate and appropriate. For low-impact outputs, a quick scan for obvious errors and a check that the AI’s source material is correctly cited may suffice. For medium-impact outputs, the reviewer should cross-check key facts, figures, and claims against at least two independent sources, and confirm that any data used is current and relevant. For high-impact outputs, the evidence check must be exhaustive: every factual claim should be traced back to a primary source, calculations should be re-performed manually or with a separate tool, and any legal or regulatory assertions should be verified against the latest official texts.
The NIST AI Risk Management Framework recommends documenting the evidence used in review. A simple checklist for each tier can make this routine. For example, a high-impact checklist might include: “Source of each data point recorded,” “Calculations independently verified,” and “Regulatory references checked against current legislation.”
Define escalation triggers and paths
Even the best reviewer will encounter outputs they cannot confidently approve. Escalation should be triggered when: the reviewer lacks the expertise to verify a claim, the output contains a contradiction that cannot be resolved, the AI’s confidence score is below a predetermined threshold, or the output could have unintended consequences beyond the reviewer’s authority. For low-impact outputs, escalation might go to a team lead. For medium-impact, it should go to a department head or a designated risk officer. For high-impact, escalation must go to a senior decision-maker or a cross-functional review panel, and the output should not be released until the issue is resolved.
Hong Kong’s Ethical AI Framework encourages organisations to define clear roles and responsibilities. Document the escalation path for each tier and ensure every reviewer knows whom to contact and how. Without a defined path, reviewers may either approve uncertain outputs or delay unnecessarily.
Fix accountability with a sign-off chain
Accountability means that a specific person is responsible for the final decision to release an AI-assisted output. For low-impact outputs, the reviewer who performed the check can sign off. For medium-impact outputs, the reviewer and their supervisor should both sign off, with the supervisor taking ultimate responsibility. For high-impact outputs, a formal sign-off chain is needed: the reviewer, the domain expert, and a senior manager or director must each confirm the review in writing. The sign-off should include the date, the impact tier, the evidence checked, and any limitations noted.
The OECD AI Principles state that AI actors should be accountable for the proper functioning of AI systems. In practice, this means that if an error slips through, the organisation can trace exactly who reviewed it, what they checked, and where the process failed. This is not about blame—it is about learning and improving the review system.
Limitations and the need for ongoing review
This framework is based on publicly available guidance from NIST, OECD, and Hong Kong’s Digital Policy Office. It has not been tested in a live operational environment, and organisations should adapt it to their specific context, industry regulations, and risk appetite. The effectiveness of any human review system depends on the reviewer’s training, the clarity of the checklists, and the organisation’s culture of safety. Regular audits of the review process itself—looking at missed errors, escalation outcomes, and reviewer feedback—are essential to keep the system robust.
Practical checklist for implementing human review
- Classify every AI-assisted output as low, medium, or high impact.
- Assign reviewers with documented competence for each tier.
- Create evidence-check checklists for each tier.
- Define escalation triggers and a clear path for each tier.
- Establish a sign-off chain that records who approved what and when.
- Review and update the system at least quarterly, incorporating lessons from any incidents.
Human review is a job, not a checkbox. With a structured approach grounded in established frameworks, Hong Kong’s workers and managers can turn review into a reliable safeguard that protects both the organisation and the people it serves.
Sources and further reading
Guidance and regulations can change; check the current primary sources before applying them to a consequential workplace decision.