~ / blog / which-automations-need-approval
Which automated actions should need a person's approval?
Updated October 10, 2026
Decide it before you switch the automation on, write it down, and name who approves. NIST's AI Risk Management Framework doesn't give a list of actions. It says oversight should be a deliberate, documented choice: "Processes for human oversight are defined, assessed, and documented in accordance with organizational policies from the GOVERN function."
Not everything needs a person
NIST says oversight depends on the system: "Some AI systems may not require human oversight, such as models used to improve video compression. Other systems may specifically require human oversight." It describes a range: "Human-AI configurations can span from fully autonomous to fully manual."
So the question isn't whether a person should approve everything. It's where each action sits on that range.
A simple way to sort your automations
Here's a practical way for a small business to sort them, based on what each action commits you to:
- Let it run: internal steps that are easy to undo, like tagging a record, moving a card, or drafting a reply that nobody sees yet.
- Queue it for a one-tap OK: anything a customer will see for the first time, like a new message template or a reply outside the usual pattern.
- A person decides: anything that agrees to something, like a price, a refund, a date, contract terms, or a message sent on someone's behalf that they haven't approved.
Once a person has approved a template, sending that same template can often run on its own. Anything with a new price, date or promise goes back to a person.
Name who approves
NIST frames this as roles: "The AI RMF provides opportunities to clearly define and differentiate the various human roles and responsibilities when using, interacting with, or managing AI systems." For each action that needs approval, write down who approves it and who covers when they're out. An approval step with no named owner becomes a queue nobody clears.
The framework is voluntary
NIST says: "The Framework is intended to be voluntary, rights-preserving, non-sector-specific, and use-case agnostic, providing flexibility to organizations of all sizes and in all sectors and throughout society to implement the approaches in the Framework." Treat it as a way to think the question through, not a rule you have to follow. Some industries have their own rules about automated decisions, and those come first.
What this page does not decide
This guide doesn't tell you whether a specific automation is lawful, and it doesn't cover industry rules on automated decisions, consumer notices or consent. It isn't a NIST compliance checklist.
Frequently asked questions
Does NIST require human approval for AI actions?
No. The AI RMF "is intended to be voluntary". It says "Processes for human oversight are defined, assessed, and documented", and that some systems "may not require human oversight" while others "may specifically require human oversight."
What's a good rule of thumb for approvals?
If the action agrees to something on your behalf, like a price, a date or terms, a person should decide. Internal, reversible steps can usually run on their own.
Sources
This page is run by FloHub.