Working out what your role actually owes

Proportionate to role is the phrase that decides how much of this applies to you. It is not a way of getting out of the duty; it is a way of aiming it. This lesson is about working out where you sit.

Three questions that place you

Does an AI output reach a person through you? If a model produces something that affects a customer, an applicant, a patient or a colleague, and your decision is the last one before it takes effect, you are in the oversight position whether or not anyone has told you so. Everything in Article 14(4) is aimed at you: understanding the system's limits, resisting automation bias, reading the output correctly, and being willing to override it.

Do you choose, buy or configure AI? Then you are where the intended purpose gets fixed, and where a deployer can quietly become a provider under Article 25 by rebranding a system, substantially modifying it, or pointing it at a new purpose that makes it high-risk. Your obligation is to know what the vendor states the system is for, and to notice when your organisation starts using it for something else.

Do you build or change models? Then the documentation duties are near you: what data was used, what the system was tested against, what its limits are, and what has to be recorded so that someone else could make sense of it later.

Most people answer yes to one of these. A significant number answer yes to none and still use AI daily in drafting, summarising and searching. That group still owes the first duty from the previous lesson, which is telling someone what they are using.

What depth looks like at each level

Everyone. What an AI system is, in the sense of a system that infers rather than applies a written rule. What must not go into a tool. Where the register is. Where to escalate and how fast. That is a short list and it is genuinely enough for someone whose AI use is a summarisation feature.

People in the oversight position. Everything above, plus the failure modes of the specific system they oversee, how to read its output including what any confidence figure is calibrated against, what their override right is and how to exercise it, and what the stop procedure is. Generic AI awareness does not reach this. Article 26(2) training is training on a system, not on a subject.

People who buy or build. Everything above, plus classification, the Article 13(3) content that a high-risk system's instructions for use must contain, and the Article 25 routes by which provider obligations arrive.

The proportionality trap

Proportionality is usually applied to the wrong variable. Organisations scale training by seniority, so executives get the deep version and the claims handler gets the video. The Act scales by consequence to affected people. The claims handler is the one exercising oversight over decisions about individuals, and is therefore the one whose training depth is legally load-bearing.

A related error is scaling by system risk classification alone. Article 4 applies to all AI systems. A low-risk tool used carelessly with personal data creates real exposure under data protection law even where the AI Act asks little.

How to ask for what your role needs

If your training has not matched your role, the productive request is specific rather than general. Asking for more AI training produces another generic module. Asking these four questions produces something usable:

• What is this system documented as being for, and where is that document?
• What is it known to be bad at, and how would I recognise that in an output?
• What exactly am I allowed to do when I disagree, and who needs to know?
• Who do I tell, and how fast, when something looks wrong?

If nobody can answer the second question, that is a finding in itself, and it belongs with whoever holds the register. A system whose failure modes nobody can describe cannot be overseen in the way Article 14 requires, and that is true before anything goes wrong.

As of 24 September 2026.