Reviewers should always be able to override the AI, and the override should be easy to do and recorded with a reason. The AI might miss context the reviewer has, like a vendor relationship, a known exception or an industry practice, and the reviewer is the one accountable for the decision.
Recording the reason matters for two reasons, since it creates an audit trail for the decision and it shows where the AI’s assessments are consistently wrong. If reviewers keep overriding the same type of finding, that is a signal the criteria or the AI need adjusting.