Click. Approve. Miss.The AI control nobody tests.

“A human reviews the output” appears in nearly every AI policy, model approval and vendor assessment. It is the most relied-on AI control most firms have, and almost the only one nobody tests. Two studies published this autumn show why that matters and how to fix it.

Auditors ask two questions of any control: is it designed to catch what it is meant to catch, and does it actually operate that way? A reconciliation gets sampled. An access review gets re-performed. Human review of AI output usually gets neither. The policy says a person looks at it, the workflow has an approve button and the control is recorded as in place.

Anthropic reports that developers using its coding tool accept 93% of the permission prompts it shows them. In a controlled study with 1,053 paid testers, it swapped one routine prompt for a clearly dangerous command. People stopped it 13.6% of the time. An automated check stopped 89%. And the longer people had been at it, the worse they got.

A working paper from Harvard Business School, Harvard Medical School and GSK is the first randomized test of the obvious remedy: plant known errors in the AI output so reviewers stay alert. Seventeen pharmacy doctoral students spent 12 weeks checking AI-written drug-safety summaries against source reports, 10,088 reviews in all, rotating through four doses of planted errors.

Only the highest dose helped, and it came with reviews about 18% slower and lower trust in the AI. False alarms did not rise at any dose. Even at the best dose, reviewers caught about one real error in three.

Airport security solved a version of this more than 25 years ago. Real threats in X-ray images are too rare to keep screeners sharp or to measure them. So software projects stored images of guns and knives into live bag scans, logs whether the screener spots them and tells them straight away. Regulators in many countries now require it. The same design works for AI review.

1. Build test errors from your own failures.

   Use mistakes your AI has actually made, edited into otherwise correct outputs. A test error that looks planted measures nothing.

2. Choose the dose deliberately.

   Too few and reviewers learn that errors are rare. Pick a rate for each queue, write down why and revisit it.

3. Tell the reviewer at once.

   Airport screeners learn immediately when they have caught a projected threat. Immediate feedback turns a measurement into training.

4. Track by person, queue and time of day.

   Attention decays inside a session. The fiftieth review of the day is the one to watch.

A medRxiv preprint from early October adds the complication. Test errors are only as hard to spot as whoever planted them made them. The AI’s own errors are the ones that read well, and those are the ones reviewers miss. Worse, a missed error is not recorded as a disagreement. It is recorded as approved, so the approved pile looks cleaner than it is.

The fix is cheaper than it sounds. Have a second, independent reviewer re-check a sample of the first reviewer’s approveditems. For a careful reviewer who misses 3% of errors, the authors estimate about 500 re-checked cases are needed, against nearly 150,000 for a fresh sample. That produces the number that matters: the escape rate, or how often a real error passes review.

Planted errors test whether the control operates. Re-checks test whether it works. Neither is enough alone.

• Catch rate on test errorsIs the reviewer paying attention?
• Escape rate on approved workHow often do real errors get through?
• Approval rateNear 100% is a question, not a result.
• Time per itemWatch the fast tail, not the median.
• Override rateA slow decline over months is automation bias showing up in data.

Once the numbers exist, the design choices follow from them. Put people where their catch rate times the cost of a miss exceeds the cost of their time, and send the rest to automated checks or sampling. Limit how many items a reviewer handles in a sitting. For the highest-stakes decisions, ask the reviewer to reach a view before showing them the AI’s answer; research going back to 2021 shows this reduces blind agreement, though reviewers like it less.

1. Days 1 to 30: find the controls.

   List every process where a policy, model approval or vendor assessment says a person reviews the AI output. Record who reviews, how many items a day and what they are expected to catch. Most firms have never assembled this list.

2. Days 31 to 60: measure one queue.

   Pick the highest-consequence queue. Start planting test errors at a chosen dose and start re-checking approved items. Baseline the five numbers before changing anything else.

3. Days 61 to 90: act on the numbers.

   Where review is not catching enough, cut the load, change the review step or route the work to an automated check. Report the results like any other control test, including the failures.

Human review is one responsible-AI commitment that can now be tested. Most of the others have never been tested at all.

Sources. Kacey Fang, Greg Powell, Jeffery Painter, Andrew Bate and Michael Lingzhi Li, The Right Amount of Wrong: Error Injection for AI Oversight, SSRN working paper (2026), with the Harvard Business School AI Institute summary (15 October 2026); Krishna Chaitanya Kotabhattara et al., Planted Errors Cannot Measure What a Clinician Misses, medRxiv preprint (October 2026); Anthropic, Claude Code auto mode (25 March 2026) and Auto mode is now the default in Claude Code (7 August 2026); FHNW School of Applied Psychology, Examining Threat Image Projection Artifacts and Related Issues: A Rating Study; Route Fifty on FAA threat image projection (2000); Zana Buçinca, Maja Malaya and Krzysztof Gajos, To Trust or to Think (CSCW 2021). All pages accessed 22 October 2026.

Provided for general information; not legal advice. AI Risk Consulting is not a law firm. The two principal studies are a working paper and a preprint and had not been peer reviewed at the time of writing.