Which AI outputs should staff always check before they use or send them?

20 October 2026

What needs a check every time?

Check every AI output before it reaches a customer, changes a business record, commits money, gives a legal or HR opinion, or tells someone what to do in a safety-sensitive situation. The level of review should match the consequence of a mistake. A quick internal brainstorm may need only a sense check. A customer quote, payment instruction or dismissal letter needs source-by-source verification and approval by the person authorised to make that decision.

Put work into three practical bands. Red means no sending or action without a named, qualified human reviewer: contracts, legal or tax advice, employment decisions, payments, medical or safety instructions, and promises to customers about price or delivery. Amber means a trained employee checks facts, names, dates, tone and policy before use: ordinary customer emails, CRM summaries, meeting notes and management reports. Green means low-risk internal ideas or formatting, where a quick read is enough. Do not let staff classify their own sensitive output as green simply because the task feels routine.

The UK Government’s AI Playbook says organisations need meaningful human control at the right stages and a way for users to report inaccurate results for human review. This is guidance for government, not a private-sector statute, but its risk-based logic is useful for a small business. The Crown Prosecution Service offers a named UK example: its AI approach explicitly includes human oversight, continuous evaluation and secure use. If a public body will not treat generated text as self-approving, neither should your team.

What should the reviewer actually check?

Start with the source, not the polish. Compare every material claim with the original email, contract, price list, account record or approved knowledge base. Check customer identity, product, quantity, amount, VAT treatment, deadline, delivery address and named owner. For a £4,800 quote, one wrong digit or an invented inclusion matters more than elegant wording. Ask the reviewer to mark where the number came from, not simply to say that it looks plausible.

Then check omissions and framing. An AI meeting summary may capture three decisions but omit the fourth, or turn a tentative idea into a commitment. Read the source notes and ask: what is missing, what is overstated and who was assigned the action? For external communications, read the message as the recipient. Does it disclose confidential details, imply that a complaint is resolved when it is not, or promise a refund the sender cannot approve?

Finally, check whether the tool was allowed to see the input at all. Output review cannot undo an unauthorised upload of client information. The ICO’s analysis of generative AI accuracy distinguishes factual accuracy about people from a model’s statistical accuracy. It gives the concrete example of a complaint summary, which needs to reflect the source documents accurately and contain correct information about the customer. The same principle applies to your CRM notes: verify the person’s details and context before storing the summary as a record.

Use a short checklist in the workflow: source matched, figures matched, personal data appropriate, decision authorised, tone suitable, reviewer named. Six ticks are more useful than a vague policy telling people to be careful.

Which outputs need specialist sign-off?

Put financial, legal, employment and regulated material in the red band. A finance lead should approve a payment or change to bank details. A qualified accountant or tax adviser should check advice about VAT, payroll or accounts treatment. A solicitor should review legal wording when its effect matters. The hiring manager and HR lead should make recruitment and disciplinary decisions, not an AI ranking. A technical owner should review code or formulas that can delete data, expose systems or change financial reports.

These are not necessarily tasks that AI can never help with. It can prepare a comparison, identify missing clauses or draft a plain-English explanation. But the person with responsibility must have the original evidence, understand the decision and be able to disagree. Adding a rubber-stamp approval button after the AI has already sent the email is not meaningful oversight.

Consider a small service firm using AI to draft an engineer’s work instruction. A typo in a casual internal note may cost minutes. An invented safety step could injure someone. The latter requires a competent person to compare the draft against current procedures before it goes to site. Likewise, an AI-drafted credit-control email could refer to the wrong invoice or claim a payment is overdue when it is not. Review invoice status and correspondence before sending.

A simple authorisation matrix helps: employee drafts; team lead checks customer commitments; finance checks money; HR checks people decisions; technical lead checks operational changes. If you have only five staff, one person may fill several roles, but the rule still needs an identified owner. No qualified reviewer available? Hold the output rather than sending it.

Can you make review proportionate without slowing everyone down?

Yes. Do not make a director approve every spelling correction. For low-risk internal formatting, an ordinary read is enough. For a repeatable customer reply, use a pre-approved template with AI filling only bounded fields, and have an employee check the customer-specific details. For higher-risk decisions, require a second person or specialist. The control should follow the risk of the action, not the mere presence of AI.

Build review into the normal hand-off. In a CRM, label the generated text as draft and require a named employee to press send. In a spreadsheet, write AI suggestions to a separate review column rather than overwriting source data. For invoices, let the system flag potential mismatches but keep payment approval outside the AI workflow. Record the reviewer and the source version for red-band work. This makes a later correction possible without turning every task into a formal audit.

Test the arrangement on 20 real examples before scaling it. Count material errors, omissions, rework minutes and review time. If a workflow saves ten minutes of drafting but creates fifteen minutes of checking, it has not earned its place. If errors cluster around a particular task, narrow the AI’s role or remove it. This is a practical test target, not a national benchmark or a promise of return.

Write a one-page rule staff can remember: green, read before use; amber, compare to source before use; red, source-check plus authorised sign-off before any action. Put examples from your own business beneath each colour and give staff an easy route to ask when unsure. Review the examples after the first month, because the real boundary cases will emerge from daily work.

What if a mistake has already been sent?

Stop the workflow and work out what reached whom. Do not immediately ask the same AI tool to write a confident explanation. Preserve the original input, output, source document and send or action log. Identify the affected customer, amount, deadline or record. A named owner should correct the facts, contact the recipient where appropriate and decide whether money, safety, contractual or personal-data issues require escalation.

If personal information was involved, assess the incident under your data-protection process and seek advice where needed. A wrong generated statement about a person can become more serious when copied into a permanent record or used to decide how they are treated. The ICO says the required accuracy depends on purpose, and the closer an output comes to a decision about someone, the more central accuracy becomes. That is a stronger reason to fix the source record as well as the outgoing message.

Use the incident to improve the control. Was the source missing? Did the reviewer have too little time? Was the approval step bypassed? Change the workflow, run a small test set and tell staff what is different. A blame-free near-miss route matters: if people fear punishment for flagging an AI error, you will discover problems from customers instead. Track the count and severity of errors each month rather than congratulating yourself on the number of AI-generated drafts produced.

Is This Right For You?

This approach suits a business where staff already use AI for emails, summaries, quotes or operational work and need a clear boundary before output becomes action. Start with the tasks that touch customers, money or personal data. If you only use AI to brainstorm internal ideas, a lightweight read is enough and a complex approval system is not worth the cost.

It is not a substitute for qualified legal, financial, HR or safety advice. If nobody in your team can review a specialist output, do not send or act on it until you have the right person. A one-page rule, named owners and a test of 20 examples are a sensible first step.

Frequently Asked Questions

Do staff need to check every AI-generated sentence?

They need to read everything they use, but source-by-source checking should concentrate on claims, figures, personal details, commitments and high-risk advice. Low-risk internal ideas need a lighter review.

Can a manager approve AI output without reading the original material?

Not for a consequential decision. The reviewer needs the source records or a reliable way to verify the claims. A signature without evidence is only a rubber stamp.

Should AI-generated customer emails always be reviewed?

Yes, before sending. Check the recipient, facts, tone and any price or delivery promise. Standard low-risk replies can have a fast check; complaints, refunds and disputes need the right manager.

Can AI check its own work?

It can flag possible errors or compare a draft with a supplied source, but that is a supporting control, not independent sign-off. A person must check material claims and authorise consequential actions.

What about AI summaries of meetings and calls?

Compare decisions, dates, owners and commitments with the recording or notes before sharing or saving them as an official record. Tell participants when recording or transcription is used under your policy.

Who is responsible if an AI-generated figure is wrong?

The business and its authorised staff remain responsible for using and sending it. Assign a named reviewer, correct the figure promptly and investigate why the control missed it.

How much does this review process cost a small business?

You can begin with a one-page rule and existing team leads, with no new software fee. Measure minutes spent checking 20 real examples, then compare that time with drafting time saved and errors avoided. Specialist review has its normal professional cost.