Human oversight of AI: what the regulations require

Forms of human oversight

Human oversight exists on a spectrum. Human-in-the-loop means a person approves every decision before it takes effect. Human-on-the-loop means the system acts but a person monitors and can intervene. Human-in-command means a person can override the system and stop its operation entirely.

The right level depends on the risk. A content recommendation may need only monitoring. A credit decision affecting an individual may need approval. The EU AI Act requires that the level of oversight be proportionate to the risk the system poses.

What auditors look for

Auditors want to see that oversight is designed in, not an afterthought. They look for documented roles (who monitors, who intervenes), escalation paths, training records for the people in oversight roles, and logs showing that interventions actually happen when the system produces unexpected outputs.

• Documented roles and responsibilities for oversight
• Escalation procedures for unexpected outputs
• Training records for people in oversight roles
• Intervention logs showing the system can be overridden
• Review of oversight effectiveness at planned intervals

Tracking it in your programme

In Certifyi, human oversight is a control linked to each AI system that requires it. The evidence — role assignments, training records, intervention logs — sits on the control. The control maps to the EU AI Act, ISO 42001 and the NIST AI RMF at the same time.

• AI compliance: all three AI frameworks in one workspace.
• AI transparency: disclose how oversight works.
• AI risk management: classify systems by risk to set the right oversight level.

Related terms

AI transparency

The practice of making an AI system's purpose, training data, decision logic and limitations visible to affected people, regulators and auditors. The EU AI Act requires varying degrees of transparency by risk category.

Algorithmic bias

A systematic and unfair difference in outcomes produced by an AI system, caused by training data, feature selection, or design choices that disadvantage one group over another.

AI impact assessment

An assessment, for each AI system, of who is affected, what could go wrong, how likely and how severe it is, and what is done about it. ISO 42001 requires one, and the EU AI Act requires its own forms for high-risk systems.