Why AI that writes ERP records needs human approval

Version 1.0 — Last updated: October 29, 2026

Why does AI that writes records need human approval? Records drive stock, accounting and payment decisions, and a model can produce an answer even when it is unsure. In a sound design, AI prepares the record and shows its reasoning; an authorised person approves, corrects or rejects it, and every decision is logged.

AI no longer just answers questions; it can read a document and write a record into an ERP. A supplier transaction from a photo of an invoice, an order line from an email, a task from a meeting recording. At that point the question changes. It is no longer "does the model give the right answer?" but "when it gives the wrong one, who stops the record?"

My answer, as founder of Turkey-based Gramoni, is simple: in any AI application that writes records, a person must make the final call. It is also one of Gramoni's working principles: you approve.

Why records are different

A record in an ERP is not just a row of data. Stock quantities, accounting vouchers, payment orders and work orders are what later decisions rest on. A wrong chatbot answer is read and forgotten; a wrong record flows into reports, tax returns and payments.

Language models also have a known trait: they can produce a fluent answer even when they are unsure. So for an application that writes records, "the model is usually right" is not enough. There has to be a step that catches the case where it is wrong. That step is human approval.

One more distinction matters: AI proposing a record is not the same as AI finalising it. If a proposal is wrong, the person who sees it corrects it. If the record is finalised directly, the error usually surfaces only at month-end reconciliation, in a customer complaint or during an audit. Human approval moves the point where errors are caught to the very start of the process.

What regulators and standards bodies say

EU AI Act, Article 14. Regulation (EU) 2024/1689, the EU's Artificial Intelligence Act, requires high-risk AI systems to be designed, including with appropriate human-machine interface tools, so that natural persons can oversee them effectively while they are in use. It asks that the person assigned to oversight be able to:

• understand the system's capacities and limitations and detect anomalies;
• stay aware of the tendency to rely or over-rely on the system's output (automation bias);
• correctly interpret the output;
• decide in any situation not to use the system, or to disregard, override or reverse its output;
• interrupt the system through a "stop" button or a similar procedure that brings it to a safe halt.

The article is binding for high-risk systems, and whether a system falls into that class depends on its intended purpose. But the five capabilities it lists make a good design checklist for any application that writes into an ERP.

NIST AI Risk Management Framework. The AI RMF 1.0 from the US National Institute of Standards and Technology (NIST), intended for voluntary use, organises risk management into four functions: GOVERN, MAP, MEASURE and MANAGE. Subcategory MAP 3.5 asks that processes for human oversight be defined, assessed and documented. The framework notes that human-AI configurations range from fully autonomous to fully manual; some systems may not require human oversight, while others specifically do.

OECD AI Principles. Adopted in 2019 and updated in May 2024, the OECD principles ask AI actors to implement mechanisms and safeguards, such as capacity for human agency and oversight, appropriate to the context. The OECD's explanation lists "human determination", a "human in the loop", among these measures.

Turkey: KVKK Article 11. Article 11 of Turkey's Personal Data Protection Law (KVKK, Law No. 6698) gives a person the right to object to an outcome against them that arises from analysing processed data exclusively through automated systems. For any automation that touches personal data, having a person see the outcome matters for this reason too.

Businesses worry about the same things

In TÜİK's 2026 AI bulletin, among Turkish enterprises that had considered AI but did not use it, 66.4% cited unclear legal consequences, such as who is liable if AI causes harm, and 65.4% cited data protection and privacy concerns (Turkish Statistical Institute). Eurostat reports that in the EU in 2025, 52.52% of enterprises in the same group cited legal uncertainty and 48.83% data protection concerns.

Human approval answers both questions directly. It is clear who approved the record, so responsibility is tied to a person. And data is processed within the scope the approver can see.

What human-approved design looks like

In my view, an AI application that writes records should follow four rules:

1. AI prepares, a person decides. The application creates the record as a draft; it is not written to the ERP as a final record until it is approved.
2. The reasoning is visible. The source sits next to the draft: which document, which line, which rule. The approver can see what they are approving.
3. Uncertain cases are not guessed. The application does not fill in a record it cannot decide on; it lists it and leaves it to a person.
4. Every decision is logged. Who approved, corrected or rejected what, and when, is on record. Article 14's "stop" capability rests on this too: the log makes it possible to see what the application did and to halt it when needed.

These rules are not there to add approval work but to make approval fast and meaningful. The person does not redo the job; they check a prepared record.

Gramoni's approach

Gramoni's AI and automation service is built on exactly this principle: AI applications that run on your own data and processes, with every result going through human approval. What we build today includes agents that write records with human approval, records created from a photo of a document, and decision logs from meeting recordings. We do not train models on your data.

If you want to discuss which records in your processes could be prepared by AI and put to you for approval, book a call.