Section 1
Three questions that place a decision
Reversibility: can this be undone quietly and quickly. A wrong article recommendation can. Cancelling an account, rejecting an application, or paying an invoice cannot, or not without cost. Consequence: what does the error do to the person receiving it. A misrouted ticket costs a few minutes. A wrongly declined loan changes their month. Contestability: will they know a decision was made, and can they challenge it. Many automated decisions are invisible to their subject, which removes the correction mechanism entirely. High on all three means automate freely. Low on any one means a human belongs in the loop. Founders new to this should start with the simpler cases, as [AI Automation for Non-Technical Founders: Where to Start](/blog/ai-automation-for-non-technical-founders-where-to-start) lays out.
Section 2
Four tiers, not two
The debate is usually framed as automated or manual. Four settings work better. Full automation: the system decides and acts, with logging. For reversible, low-consequence, high-volume decisions: routing, tagging, prioritising a queue. Automation with notification: the system acts and a human is told, so they can intervene afterwards. Where speed matters and reversal is possible. Recommendation: the system prepares the decision and a person approves it. Most consequential business decisions belong here, and it captures most of the time saving. Human only: the system may inform but takes no position. Reserved for employment, credit, safety, and anything that ends a relationship. Write down which tier each decision sits in, and revisit when volume or error rates change.
Section 3
The categories to keep out of reach
Some decisions stay with people regardless of system performance, because the harm is not proportional to the error rate. Employment outcomes: hiring rejections, performance conclusions, terminations. Screening assistance is defensible; a decision is not. Access to money, credit, and insurance, where an error compounds for years. Safety-critical judgements, where the failure mode is physical. Anything that ends a customer relationship, since the business then loses the chance to discover it was wrong. And anything involving a vulnerable person, which is where an efficient system performs worst, because vulnerability presents as an edge case. They are hard not because the technology is weak but because the cost of a rare error is carried entirely by one person, and the company will not hear about most of them.
Section 4
Governance you can actually run
NIST's AI Risk Management Framework organizes this work around four functions, govern, map, measure, and manage, with trustworthiness as the goal. Translated for a growing company, it means four things. Govern: one named owner per automated decision, and a written statement of its tier. Map: a list of the decisions your systems make, which most companies have never produced and find sobering. Measure: sampled review of outcomes at a fixed cadence, with error rates recorded rather than remembered. Manage: a process for handling a challenge, correcting a wrong decision, and changing the rule behind it. None of this needs a committee. It needs a list, an owner per line, and a recurring calendar entry.
Section 5
Watch the override rate in both directions
Where humans review automated decisions, the override rate tells you more than accuracy, and it fails in two directions. An override rate near zero usually means rubber stamping. The reviewer has learned the system is mostly right and now approves without reading, giving you the cost of a human and the risk profile of full automation. A very high rate means the automation is not helping and is adding a step. Both are fixable once visible. Sample approvals and check whether the reviewer would catch a seeded error. Give reviewers the time the task takes. And measure how long a review lasts: four seconds on a decision requiring judgement is not a review, it is a signature.
Section 6
Where to start, and whether you are ready
Make the list first. Every decision your software makes without a person, including those inherited from default settings. Most companies find decisions nobody chose to automate: an email filter that hides complaints, a scoring rule that deprioritises a segment, a threshold set by a vendor. Then place each on the four tiers, assign an owner, and set a review cadence, the same sequencing discipline as [AI Automation in Product Development: From Idea to Launch](/blog/ai-automation-in-product-development-from-idea-to-launch). Fix the mismatches, usually one or two decisions running with more autonomy than anyone would authorise. You are ready to expand automated decision-making if you have that list, an owner per decision, a working appeals path, and measured error rates. You are not ready if nobody has checked what your systems already decide on their own. Explaining the resulting policy to non-technical colleagues is its own task, addressed in [Storytelling in Tech: Making Complex Concepts Relatable](/blog/storytelling-in-tech-making-complex-concepts-relatable).