Rubber stamp.

"Don't worry, a human signs it off."

As of 23 October, in Italy, that sentence has to be true.

A new Italian law now says, in effect, an AI system can help you decide whether to hire, discipline or dismiss someone, but it can't make the decision. A person has to, and that person has to have real authority to decide differently. If they don't, a dismissal made that way is void. Not fined. Void, as if it never happened.

Most UK businesses will never employ anyone in Italy. I'd still read it, because it puts a hard edge on a question most of us have been answering far too comfortably.

What Italy actually did

The bit that matters isn't the ban on fully automated decisions. Data protection law has said something like that for years. The bit that matters is the test for the human. A name on the approval screen isn't enough. The person has to be able to say no, and mean it.

The UK has already drawn the same line

It's tempting to file this under "Brussels again". Don't.

Since February, UK data protection law has said a decision counts as solely automated "if there is no meaningful human involvement" in taking it. That's the wording the Data (Use and Access) Act 2025 put into the UK GDPR. The UK goes less far than Italy: in most cases it lets you make significant decisions automatically. But if you do, you owe people safeguards: tell them, let them make their case, let them get a human to look again, and let them challenge the result.

And the ICO has already been out to see what "meaningful" looks like in practice. Its Recruitment rewired report is based on more than 30 employers who talked to it voluntarily between March 2025 and January 2026. Its central finding is worth reading slowly:

We found that most employers thought their use of automated recruitment tools constituted decision support rather than decision-making. They mainly based this on their view that meaningful human involvement was present. However, the evidence we saw indicated that, in practice, employers were using the tools to make solely automated decisions.

Read it twice. These weren't reckless firms. They believed they had a human in the loop. The ICO looked at the evidence and found they didn't.

The pattern it describes is painfully ordinary. The tool scores the applicants. The hiring manager, busy, looks properly at the top of the pile. For the lower-scoring candidates, managers were, in the ICO's words, 'rubber-stamping' the score or, in some cases, not intervening at all. The human was in the loop for the people the machine liked.

Why the approval click is worse than nothing

Here's the position I'll defend.

A human who never overrules the machine isn't a safeguard. It's a disguise.

It's worse than being honest that the thing is automated, because it removes the reason to build the safeguards you'd otherwise have built. If you know a system decides on its own, you add a way for people to appeal, you check its results for bias, you watch it. If you've convinced yourself there's a human in the loop, you do none of that, because the human is supposed to be the check.

Think of the smoke alarm with the battery taken out. It's still on the ceiling. Everyone still feels safer walking past it. It's worse than no alarm, because nobody's going to buy a new one.

The ICO's test for the human is short. They must be able to "exercise real influence over decision before it is applied" and have "the authority, discretion and competence to alter it". Authority means they're allowed to say no. Discretion means they're expected to use judgement. Competence means they understand what the tool did well enough to disagree with it. And the ICO adds that human involvement "must be applied to every candidate, not just those who score highly."

This isn't only about hiring. The same shape turns up anywhere an AI produces a recommendation and a person clicks approve: which customer complaints get escalated, which invoices get queried, which suppliers get flagged, which pupils get extra support. I've written before about how AI is eager to please, and about agents that hold sensitive actions for a human to approve. That approval gate is only worth what the person behind it actually does.

The fair objection

The best argument against me is the obvious one, and the ICO makes it itself. These tools exist to save time. In its words, they "necessarily and logically involve decreasing human involvement, since they are explicitly designed to reduce human labour." If your hiring manager properly reviews every one of 400 applications, where's the saving?

That's a fair point, and I don't think the answer is to make everyone read everything.

The answer is to be honest about which job the human is doing. You've got two clean options, and the ICO spells out both. Either put real human judgement into every decision, which is expensive and sometimes worth it. Or accept that the decision is automated and build the safeguards the law asks for: tell people, give them a route to a human, let them challenge it. What you can't do is take the cheap version of the first and skip the second.

Italy has decided that, for decisions about people's jobs, only the first option exists. You can argue that goes too far. I think it's a fair signal of where things are heading.

A test you can run on Monday

Pick one place in your business where an AI makes a recommendation and a person approves it. Then ask three things.

1. How often does the person say no? If the answer is "never", or nobody knows, you have your answer. A reviewer who agrees with the machine every single time is either looking at a perfect machine or not really looking.
2. What does the person see? Do they get the reasoning and the underlying information, or just a score and an approve button? You can't overrule something you can't see into.
3. Who's allowed to say no, and what happens when they do? If overruling the tool means a form, a conversation with a manager and a delay, people will learn not to.

This applies to what we build too. An approval step in an automation is only worth putting there if the person behind it has the time, the information and the standing to use it. Otherwise it's a box we've ticked on someone's behalf.

Close

Italy has made it law that the human in the loop has to be real. The ICO has already said the same about UK hiring, and found that most of the employers it spoke to thought they were fine and weren't.

If your human never says no, you don't have a human in the loop. You have a rubber stamp with a salary.