An AI-generated report lands in your inbox. It is organized, persuasive, and supported by citations. You correct a few sentences, check the formatting, and approve it. Later, someone discovers that a source does not support its central recommendation.
The problem was not a lack of proofreading. It was a lack of verification.
Human review should be a decision checkpoint, not a proofreading exercise. The reviewer’s job is to determine whether the output is supported, appropriate for its intended use, and safe to release or act on. That requires more than asking whether it sounds right.
For business leaders, managers, and employees, an effective review process comes down to three questions: What evidence supports this? What could happen if it is wrong? Who has the authority to approve or stop it?
What Human Review Must Accomplish
Generative AI can produce confident explanations without reliable supporting evidence. The NIST Generative AI Profile identifies confabulation—including false content and fabricated citations—as a risk. Professional presentation is not evidence of accuracy.
Human review also has limits. A reviewer can miss errors, misunderstand the subject, or accept a plausible answer too quickly. Adding a human approval step does not automatically make a workflow safe.
The checklist below is a recommended business practice, not an official government checklist or compliance certification. NIST’s AI Risk Management Framework is voluntary, and its Core explicitly states that its actions are not themselves a checklist. Its emphasis on context, reviewer proficiency, documentation, and oversight provides a useful foundation.
Before Reviewing: Define the Decision and the Reviewer
Start by establishing what you are approving. An internal brainstorming draft and a recommendation affecting someone’s employment should not follow the same review path.
- Define the intended use. Identify the audience, the decision the output will support, and the consequences of an error. Be specific: “Summarize supplier terms for procurement review” is more useful than “Analyze this contract.”
- Match scrutiny to consequences. Apply more demanding review to work affecting health, safety, money, employment, legal rights, or access to services. Consider who could be harmed and whether an error would be difficult to reverse.
- Name an accountable reviewer. Choose someone with relevant expertise, access to the underlying evidence, and authority to reject or escalate the work. If several specialties are involved, identify who owns the final decision.
Practical example: a contract summary
An employee might review an AI-generated summary for readability. But approving it as the basis for terminating a supplier relationship requires someone qualified to interpret the contract, examine exceptions, and assess the proposed action. The same text can require different oversight depending on its use.
If the reviewer lacks the expertise, evidence, or authority needed, the review is not ready to proceed.
Verify the Substance, Not Just the Presentation
Separate checking the writing from checking the reasoning. A polished paragraph can contain an unsupported conclusion, an outdated requirement, or a calculation built on the wrong denominator.
- Check consequential claims independently. Open the underlying sources and confirm that they actually support the claims. Check the relevant passage, not just the title or search snippet. Treat an AI-generated citation as a lead to investigate, not proof.
- Verify dates and calculations. Check publication dates, effective dates, units, denominators, formulas, and assumptions against original material. Recalculate important figures using an appropriate method rather than accepting the model’s explanation.
- Compare summaries with their inputs. Look for omitted exceptions, changed meanings, invented details, and uncertainty rewritten as certainty. Confirm that the summary distinguishes what the source states from what the model infers.
For example, an AI-generated sales analysis might describe revenue growth as evidence of stronger profitability. Those are different claims. A reviewer should examine the revenue data, cost information, reporting periods, and assumptions before approving the conclusion.
Similarly, a policy summary that leaves out an eligibility exception may be misleading even if every included sentence is technically accurate. Review what is missing as well as what is present.
Another AI system can help identify questions or locate potential sources, but agreement between two models is not independent verification. The underlying evidence still needs to be checked.
Check Privacy, Fairness, and Potential Harm
Accuracy is necessary, but it is not sufficient. An accurate output can still disclose confidential information, make inappropriate judgments about people, or be used outside an approved workflow.
- Review inputs as well as outputs. Confirm that the tool and workflow are approved for the data involved. Check for personal information, confidential business material, and unnecessary disclosures. A clean final document does not undo an inappropriate disclosure in the prompt.
- Look for unfair assumptions. Ask whether the output stereotypes people, overlooks relevant groups, or draws unsupported conclusions about individuals. Challenge recommendations based on characteristics that are irrelevant to the decision.
- Escalate unresolved concerns. Send privacy, security, legal, or specialist questions to the appropriate owner. Do not approve consequential work with a vague “please double-check” warning attached.
Consider an AI-assisted candidate assessment. Before approving it, a reviewer should ask whether its conclusions are supported by job-related evidence or inferred from writing style, background, or other unreliable signals. A convincing explanation does not make an inference appropriate.
The Centers for Medicare & Medicaid Services’ internal AI guidance provides a concrete example of reviewing for inaccuracies, bias, information leaks, and safety risks, with use limited or suspended until problems are resolved. Those are CMS-specific requirements, not universal business rules, but the operational lesson is useful: unresolved concerns need an owner and a response.
Before AI Takes Action: Separate Approval from Execution
Reviewing text is different from authorizing a system to send it, publish it, change a record, or initiate a transaction. Connected AI tools make that distinction especially important.
- Separate draft approval from execution approval. Establish explicit approval points before consequential external actions. Approving the wording of a customer email should not automatically authorize an AI system to select recipients, attach files, and send it.
- Limit access and permissions. Give the system only the access needed for its task. Define who monitors activity, who can intervene, and how execution can be stopped when something goes wrong.
For example, an AI tool preparing supplier-payment recommendations may need read access to invoices. That does not mean it should also have unrestricted authority to change payment details or release funds.
A CISA and partner announcement on AI agents recommends limiting autonomy, avoiding unrestricted access, and implementing robust oversight and continuous monitoring. These controls support human review; they do not replace it. The reviewer must still understand the action being authorized.
Close the Review with a Clear Decision
A review is incomplete until someone records what happens next. “Reviewed” is not a sufficiently clear outcome.
- Choose an explicit outcome. Approve, revise, escalate, or reject. Specify the approved use so that an internal draft is not later treated as cleared for public release.
- Keep a proportionate record. Record the reviewer, date, intended use, evidence checked, corrections, and unresolved limitations. Protect the review record according to organizational data policies; do not create an unnecessary duplicate store of sensitive information.
- Define when review must happen again. Reassess when the intended use, underlying evidence, system, or relevant circumstances change. Approval applies to a particular context, not every future use.
A lightweight sign-off can make accountability visible without creating unnecessary bureaucracy:
Reviewer: ___ | Intended use: ___ | Evidence checked: ___
Limitations or corrections: ___ | Decision: ___ | Date: ___
For higher-consequence work, add specialist approvals, execution permissions, and a re-review trigger. NIST’s framework treats risk management as continuous; a saved approval should not become permanent permission.
Make Human Review a Real Control
Managers should give reviewers enough time, access, and authority to challenge AI output. A mandatory approval box adds little value if employees cannot inspect sources or feel pressured to approve regardless of their concerns.
Stop and escalate when you cannot verify a consequential claim, cannot assess the potential harm, or lack authority to approve the action.
Start with one AI-assisted workflow your team already uses. Name its reviewer, identify the evidence that must be checked, and establish the point where execution requires explicit approval. Then use this checklist to make the decision visible and repeatable.
The goal is not to make every AI-assisted task cumbersome. It is to ensure that speed does not outrun evidence, judgment, and accountability.