Oversight is a statutory job, not a job title

Human oversight sounds like a reassurance. In the EU AI Act it is a specification. Article 14 sets out what the person in front of a high-risk system must be able to do, and the list is concrete enough that you can test whether a real person in a real job can do it.

The point of writing it down is that "a human reviews the output" is the easiest sentence in governance to say and the hardest to make true. Every organisation says it. The Act exists in part because saying it stopped meaning anything.

The five capabilities in Article 14(4)

The person assigned oversight must be enabled to do all of the following.

• Understand the capacities and limitations of the system, and monitor its operation. Not the interface. The system: what it is good at, what it is bad at, and what its failures look like when they happen.
• Remain aware of automation bias: the tendency to over-rely on output produced by an automated system, particularly where the system is used to make or inform a decision about a person. The Act names this in the text because it is the default human response, not an unusual one.
• Correctly interpret the output. A score of 0.87 means nothing without knowing the scale, the base rate and the error profile. Interpretation is a skill that has to be taught, not a capacity people are assumed to have.
• Decide not to use the system in a particular case, or to disregard, override or reverse its output. This is a decision right, and it is only real if exercising it is not career-limiting.
• Intervene or interrupt through a stop button or comparable procedure, so that the system halts in a safe state.

Read the list as a whole. The first three are about comprehension, the last two about authority. An organisation typically fails on one side or the other: reviewers who understand the system but cannot overrule it, or reviewers with formal authority who have never been told what the model's error modes are.

What Article 26(2) adds

Article 14 describes what oversight must achieve. Article 26 puts the duty on the deployer, and it is the deployer, not the vendor, who has to make it real. The deployer must assign human oversight to natural persons who have the necessary competence, training and authority, and the necessary support.

Three words, three separate tests, and organisations routinely satisfy one and claim all three.

Competence is about the person: do they know the domain well enough to recognise a wrong answer? A reviewer who cannot form an independent view of the case cannot detect that the model has formed a wrong one.

Training is about the system: have they been taught how this specific system fails? Generic AI awareness is not training for oversight of a particular model.

Authority is organisational: can they say no and have it stick? If overriding the model requires a manager's sign-off and the manager's incentive is throughput, the authority is nominal.

Why the stop function is in the list

The stop function looks like an engineering detail among four human-factors requirements. It is there because the other four are worthless without it. A reviewer who understands the system, resists automation bias, reads the output correctly and decides to intervene, and then finds there is no mechanism to halt the process, has exercised judgement and not oversight.

Note the wording: the system halts in a safe state. Stopping is not enough if stopping leaves half-processed cases in limbo, or silently falls through to approving whatever is queued. When you are told a system has a stop function, the follow-up question is what happens to the work in flight.

The separate track for biometrics

Article 14(5) requires that for certain remote biometric identification uses, action is not taken unless the identification has been separately verified and confirmed by at least two competent natural persons. One reviewer is treated as insufficient. That is the Act's own assessment of how reliable single-human review is under pressure.

As of 24 September 2026.