AI over-reliance is easy to imagine in its most obvious form: an employee asks an AI system a question, receives a confident but incorrect answer and uses it without checking.
Real over-reliance is usually less theatrical. The system works well on Monday, Tuesday and Wednesday. By Thursday, checking feels a little less necessary. A month later, the AI-generated first draft has quietly become the assumed starting point for the work, and “review” may now mean looking for something obviously wrong rather than independently deciding whether the reasoning is sound.
That progression matters because organizations do not want employees distrusting useful AI. If a system is consistently good at a low-consequence task, asking people to recreate the work merely to prove a human was involved defeats much of the point of using AI.
At Cybermaniacs, we are more interested in whether reliance is calibrated: whether the amount of trust, verification and human judgment applied to AI makes sense for the quality of the system, the nature of the work and the consequence of being wrong. That is a much harder thing to measure than AI adoption, but it is far more useful if the concern is actual risk rather than usage.
NIST describes one version of the problem as automation bias: excessive deference to automated systems, including situations where people assign AI-generated material more quality or authority than it deserves. NIST also points out why this becomes more difficult as AI improves. Reliable systems earn trust, which is useful until that trust begins carrying into situations where the system is less reliable or the consequence has changed. NIST's Generative AI Profile treats over-reliance as a human-AI interaction risk rather than merely a model-quality problem.
Microsoft researchers have found the same difficulty in experiments with AI-supported search and decision-making. People using LLM-based search were faster and often preferred the experience, but when the AI supplied incorrect information they were more likely to rely on the wrong answer. Other Microsoft research has found that explanations can increase reliance on both correct and incorrect AI responses, because a well-developed explanation makes the answer feel more credible. Microsoft Research's work on appropriate reliance is useful precisely because it avoids the simplistic conclusion that people merely need to “trust AI less.”
That is closer to what enterprises are likely to encounter. The employee who relies too heavily on AI may not look careless. They may look highly productive, and their confidence may have been reinforced by hundreds of successful interactions.
The more useful test appears when the easy pattern breaks. Does the employee recognize that this case requires more scrutiny? Can they switch from accepting to evaluating? Do they have enough independent knowledge to notice when an answer that sounds excellent is built on the wrong premise? Those are human-risk questions, not merely AI adoption questions.
One useful sign is a change in verification behavior. People stop checking sources they once checked. They begin reviewing the presentation of the answer more carefully than its substance. AI-generated recommendations become the reference point around which the rest of the analysis is organized, even when the task would benefit from an independent starting position.
Another sign is the disappearance of productive disagreement. A person does not need to reject AI frequently to demonstrate judgment, but if the system is consulted constantly and almost never challenged, it is reasonable to ask whether the absence of disagreement reflects extraordinary model performance or a changing human relationship with the technology.
Language can reveal some of this informally. “The AI says…” starts to carry the weight previously attached to “the data shows…” or “legal confirmed…”. Teams may begin passing AI output between themselves without anyone being quite sure who examined the underlying evidence.
There are behavioral signs too. Employees may struggle more when the tool is unavailable, become reluctant to begin a task without it or feel considerably less confident when asked to make the same decision independently. None of these signals proves over-reliance on its own, but together they can show that AI has moved from assisting the work to shaping how people think the work should be done.
This distinction is important because poorly designed AI governance can create the opposite problem: forcing people to spend time checking systems that have already demonstrated they are highly reliable for the task.
The goal should be appropriate reliance, not permanent suspicion. A useful low-risk assistant should earn a degree of trust. If an AI system summarizes a routine internal meeting accurately hundreds of times, requiring a senior employee to cross-check every sentence against the recording would be an impressively expensive way to preserve human agency.
The same level of reliance makes much less sense when an AI-supported recommendation influences hiring, patient care, financial approval, legal commitments, safety or production infrastructure. The underlying technology may be similar, but the context and consequence are not.
This is why Cybermaniacs treats reliance as part of a wider Human Risk Management problem rather than trying to define one acceptable amount of AI trust for the whole enterprise. The right relationship depends on consequence, reversibility, domain expertise, system performance and what the human is still expected to contribute.
Our Guide to AI Literacy vs AI Judgment is useful here because literacy alone does not solve this problem. An employee can know perfectly well that AI sometimes produces false information and still make the wrong decision about whether this answer needs independent scrutiny. Judgment is what converts general understanding into a decision about the work in front of you.
Bad AI is comparatively easy to supervise because obvious errors keep people alert. When outputs are unreliable, employees check more often, correct more actively and maintain more of their own independent process because the technology has not earned enough trust to replace it.
Good AI changes the relationship. As the system becomes more accurate, checking every result becomes economically irrational, so employees reasonably begin investing less effort in verification. The organization may encourage this because those productivity gains are exactly what justified the investment in the first place.
Eventually, the workforce can arrive at a slightly awkward place: the AI is good enough that people rarely need to catch it, while the organization still depends on people being capable of catching it when the unusual failure occurs.
Microsoft researchers studying early-stage academic work recently observed a version of this problem. Researchers using AI had to make judgments about credible evidence and research direction, but confident AI outputs could disguise uncertainty and make it more difficult to know which material deserved closer scrutiny. The researchers developed their own compensating strategies to preserve judgment. Microsoft Research's 2026 study is a useful reminder that over-reliance is partly an information-design problem and partly a human-capability problem.
For enterprises, this means improving AI can actually increase the importance of knowing where the remaining human judgment matters most. The task shifts away from checking everything and toward recognizing the situations that deserve independent scrutiny, which is a much more sophisticated capability than simple verification.
Potentially, particularly where AI takes over the work through which people previously developed or maintained expertise.
The concern is not novel. Government guidance in the UK has explicitly warned that over-reliance on AI tools can weaken operators' ability to analyze information and maintain subject-matter expertise. More recent workforce research suggests employees are beginning to notice the issue themselves.
IBM's 2026 global workforce study found that 60% of employees were concerned that AI was eroding their skills, with critical thinking cited most often among the capabilities perceived to be declining. At the same time, 71% of CHROs identified the ability to supervise, validate and override AI outputs as an essential future workforce capability. IBM's study captures the tension rather neatly: organizations increasingly need people to evaluate AI while AI may be reducing some of the practice through which evaluation skill was traditionally built.
Our Guide to Agentic Skill Atrophy looks at that problem in more depth.
The answer is not to preserve manual work for sentimental reasons. Some tasks should disappear. The more useful exercise is identifying which underlying capabilities the organization will still depend on humans to exercise after automation and then making sure those capabilities have another route to remain practiced and observable.
If the person is the fallback control when AI gets something important wrong, discovering at the moment of failure that they have not independently performed the task for eighteen months is not an especially robust resilience strategy.
Human oversight assumes that the person retains enough independence from the system to evaluate it, and that assumption deserves examination.
Suppose an employee reviews an AI-generated recommendation. The interface presents a polished conclusion, supporting reasoning and apparently relevant evidence. The employee's task is to approve or reject it. Technically, this is human-in-the-loop, but psychologically the AI has already framed the problem, selected the evidence and proposed the answer. The person may be reviewing from inside the AI's reasoning rather than bringing an independent perspective to it.
Research suggests this framing can matter. Microsoft has found that explanations may increase reliance even when an AI response is wrong, while sources and visible inconsistencies can help users detect errors. That should make control designers cautious about assuming that more explanation automatically creates stronger oversight.
Our Guide to Human Oversight in AI defines meaningful oversight in terms of whether people can monitor, question, influence, interrupt or take responsibility for AI-supported decisions and actions. Over-reliance weakens that control when the human stops functioning as a genuinely discriminating part of the system.
This is also why Cybermaniacs uses human control effectiveness as a separate question from whether a human checkpoint exists. The organization needs evidence that the person can perform the risk-reducing function assigned to them, not simply evidence that an approval button was clicked.
A direct survey question—“Do you rely too much on AI?”—is unlikely to produce tremendous insight.
People are not especially well positioned to diagnose their own over-reliance, partly because appropriate reliance depends on context and partly because the behavior develops gradually.
Useful measurement needs several perspectives. Organizations can examine whether people understand AI limitations and recognize situations requiring independent verification, but they also need to look at behavior: whether employees verify, challenge, escalate or intervene differently as consequence changes.
Confidence and perceived control add another layer. Growing familiarity may reflect stronger capability, or it may simply make people more certain. Workload, interface design, leadership expectations and time pressure can shape the same behavior from outside the individual.
Operational evidence can help as well. Override patterns, escalation behavior, exception handling, corrections and near misses may reveal places where human behavior is becoming either unusually passive or excessively cautious.
At Cybermaniacs, this is part of what we mean by Human-AI Risk Intelligence. Our Guide to What Is Human-AI Risk Intelligence? explains why AI workforce risk cannot be inferred from one measure alone.
The proprietary part is how those signals are assessed, related and interpreted across populations and use cases. The useful public principle is that organizations should measure what reliance does to decisions, not just ask how much employees say they trust AI.
The answer depends on why it is happening.
If people lack basic understanding of AI limitations, education is appropriate. If they understand those limitations but cannot recognize errors within their own domain, the issue may be capability or practice. If the interface encourages passive acceptance, the product or workflow may need to change.
Microsoft researchers have experimented with what they call cognitive forcing functions—design interventions that require users to engage more actively with AI-generated plans or assumptions. Some approaches reduced over-reliance without simply imposing more cognitive burden on the user. Microsoft Research's 2026 work on cognitive forcing functions offers an interesting glimpse of how control design can shape human behavior.
Elsewhere the problem may be workload. Asking someone to conduct thoughtful review on hundreds of AI-generated items each day is likely to produce shallow review, however good the training was.
For agentic systems, technical controls become increasingly important as well. The UK's National Cyber Security Centre recommends matching human oversight to the autonomy and consequence of the agent, while retaining monitoring and the ability to intervene where unexpected behavior could have significant impact. NCSC's guidance on managing agentic AI risk explicitly recommends combining human oversight with technically enforced controls for higher-risk environments.
That framing is more useful than treating the employee as the universal safety net. In practice, strong control design uses human judgment where it adds meaningful risk reduction and lets technical safeguards carry the parts of the burden they are better suited to handle.
This is another AI problem that becomes awkward when everyone waits for someone else's function to claim it.
AI governance owns part of it because reliance affects the adequacy of controls. Security and risk teams care because weak verification can increase operational and cyber risk. Learning functions influence capability. Product and technology teams shape the interfaces and workflows that encourage or discourage independent judgment.
Business leaders matter because they create the performance environment around the technology. If teams are rewarded entirely for speed and AI adoption, employees will make rational decisions about what receives their attention. Telling them in a training module to slow down and verify everything does not change the incentives operating on Monday morning.
Human Risk Management provides a useful connective layer because the problem spans competency, behavior, psychology, culture and organizational conditions.
Cybermaniacs' Human Risk Assessment & Assurance work helps organizations examine those conditions with more depth. AI Enablement & Change (AIECM) addresses workforce readiness, capability, confidence, behavior and adoption, while Agentic Readiness & Change (ARC) extends the problem into environments where people supervise autonomous agents rather than individual AI outputs.
Over-reliance rarely belongs entirely to the employee because the surrounding system teaches people how much attention, skepticism and independent judgment the work actually rewards.
Enterprises should want people to rely on AI. A system that nobody trusts enough to use is not creating much value.
The more interesting objective is helping people develop a relationship with AI that changes appropriately with the task. Routine work can become highly automated, while consequential work attracts more scrutiny. Familiar systems can earn trust without receiving unconditional trust.
That requires more than telling employees that AI makes mistakes. People need enough domain capability and AI judgment to recognize when the normal pattern no longer applies. The workflow needs to provide signals that make thoughtful review possible, and the organization needs to preserve enough independent human capability that somebody can still tell the difference.
Over-reliance becomes dangerous when the employee is still officially responsible for judgment after the work has quietly taught them not to exercise very much of it.
The question for organizations is therefore not simply whether employees trust AI too much. It is whether they still know when the AI has earned that trust—and when it hasn't.