Every conversation about using AI responsibly ends on the same sentence: the decision stays with a person. It is true, and it is also the easiest sentence to make fake, because a person pressing “confirm” on a screen is formally a person deciding.
Three conditions that make a review real
The first is that there is something to look at. A review of a result that does not show where it came from is not a review: it is trust with a click in the middle. A tool that says “I found 47 items of personal data” and replaces 47 allows no verification; one that shows the value, the type and the point in the document where it sits does.
The second is that the default direction is the cautious one. If the program substitutes and then asks for confirmation, inattention produces a safe and slightly unreadable text; if it proposes and waits, inattention produces a document with the names still in it. The two interfaces look alike and fail in opposite directions.
The third is that checking costs less than redoing it by hand. If the review means rereading everything, it will not happen, and the checkbox becomes the thing you click while looking somewhere else.
The kind of error a machine makes, and a person does not expect
A personal data detector fails in a way that does not resemble human error. It catches forty-seven occurrences of a name and leaves one, the one written differently, in a footnote, on page thirty-one. A person rereading tends to relax exactly where the machine is weak, because the machine is flawless all around it.
That is why the useful review is the one the interface guides: a list of detections with their context, and a way to add what is missing, rather than a free reread of the finished document.
This has a name
The tendency to accept what an automated system proposes, and to stop looking for contrary evidence, is called automation bias. It has been studied for decades in aviation and in medicine, and it comes in two forms worth telling apart, because they are corrected differently.
The first is the commission error: the system proposes something wrong and the person follows it, because contradicting it costs attention and it is usually right. The second is the omission error, and that is the one that bears on anonymisation: the person does not notice the problem because the system did not flag it, and the absence of a warning gets read as the absence of a problem.
The consequence is counter-intuitive and worth stating in full: the more accurate a tool is, the worse the human check on it becomes. Trust calibrates on average experience, and the average experience of a tool that is wrong once in a hundred times is that it is always right. People stop looking in exact proportion to how rarely looking is needed, and that one time in a hundred arrives anyway.
From which follows a practical conclusion common sense does not produce: human review is not defended by asking people for more attention, because attention is the resource the system itself is consuming. It is defended by changing what they are looking at: a list of detections instead of a finished document, the value in its context instead of a count, a default direction that forgives inattention.
What the law asks, where it asks anything
Italian Law 132/2025opens in a new tab requires, for the intellectual professions, that the professional’s own intellectual work remain predominant and that AI be used for supporting activities. It is a formula describing a relationship rather than a procedure: it does not say how many minutes, it says who is in charge.
The Court of Florence, in an order of 14 March 2025, applied it to a concrete case: a filing citing judgments that did not exist, generated by ChatGPT. The court ruled out aggravated liability for an isolated, good faith error, but wrote that using these tools does not replace the professional’s duty to check and verify the information. What was missing in that case is not better technology, it is one more step taken by somebody.
The word the AI Act adds: authority
The European regulation comes at the same question from another side, and for high-risk systems it calls it human oversight. For a professional firm those obligations do not bite (an assistant that summarises documents is not a high-risk system), but the definition the regulation uses works as a description of the job well outside its own perimeter.
When the AI Actopens in a new tab lists the duties of whoever uses a high-risk system, it asks that oversight be assigned to people with the competence, the training and, the surprising word, the authority to exercise it. That is the piece missing from almost every written procedure: whoever checks has to be able to say no. A trainee who rereads a filing but has no way of stopping it being filed is not exercising oversight, they are completing a step.
For a firm the translation is short, and needs no new document: whoever does the checking has to be somebody who, on finding something, can stop the thing. If they cannot, the check moves to somebody who can, or moves earlier, to where stopping costs little.
The review you can show
There is a difference between saying “I checked it” and being able to show what you checked. The second requires the tool to keep a trace of what it proposed and what you decided, and for that trace to stay where you are.
In Omissia the review is the middle of the program rather than a final step: values are shown one at a time at the point in the document where they sit, confirmed or discarded, and you can add by hand what the detector did not see. Values with a check character, tax codes, VAT numbers and IBANs, are verifications rather than proposals, and that is a difference worth knowing. How it works, step by step, is in How it works.